IP Control of LG TVs

[benanderson_475]

First, you need to encrypt password using PBKDF2. Go to https://8gwifi.org/pbkdf.jsp and input the following data:

Code:

Master Password: your pairing code (BK2AT22Y) Salt: Y2G4DpvcpmONByDyzFaPuQ== Iteration: 16384 dkLen: 128 PBE Ciphers: PBKDF2WithHmacSHA256

Use aes.lua from this post: https://forum.logicmachine.net/showthrea...7#pid12807
Save it as a user library named aes

Example, change key to the one that you've generated. Change ip and cmd as needed. \r is added to command automatically.

Code:

ip = '192.168.1.100' key = 'm7mRFt3BM+CwW3bYunE6sA==' cmd = 'POWER off' function encrypt(key, data)   -- padding   local rem = #data % 16   if rem ~= 0 then     rem = 16 - rem     local ch = string.char(rem)     data = data .. string.rep(ch, rem)   end   -- generate iv   local iv = ''   local ts, tu = os.microtime()   math.randomseed(ts - tu)   for i = 1, 16 do     local ch = math.random(0, 255)     iv = iv .. string.char(ch)   end   local aes = require('user.aes')   -- encrypt iv   local aes_128_ecb, err = aes:new(key, nil, aes.cipher(128, 'ecb'), { iv = string.rep('\0', 16) }, nil, 0)   local ivenc = aes_128_ecb:encrypt(iv)   -- encypt data   local aes_128_cbc, err = aes:new(key, nil, aes.cipher(128, 'cbc'), { iv = iv }, nil, 0)   local dataenc = aes_128_cbc:encrypt(data)   return ivenc .. dataenc end function send(ip, key, cmd)   local sock = require('socket').tcp()   sock:settimeout(3)   local res, err = sock:connect(ip, 9761)   if res then     key = require('encdec').base64dec(key)     cmd = cmd .. '\r'     local data = encrypt(key, cmd)     res, err = sock:send(data)     if res then       reply = sock:receive(16)     end   end   sock:close()   return res, err end res, err = send(ip, key, cmd) log(res, err)

Hi
i have the above all working, Many Thanks, how can i decrypt the response from the command sent, i added log (reply) and this is the result 
string %9��
��i���%r4

do i need to use 

Code:

local aes_128_cbcc, err = aes:new(key, nil, aes.cipher(128, 'cbc'), { iv = iv }, nil, 0) local datadec = aes_128_cbcc:decrypt(reply)

where do i get the iv from, the doc say to use received iv as below?

5)
Receiver applies decryption with received IV, and encrypted message. For “VOLUME_MUTE on” command, the response from the server is: ce 53 7c e4 b8 82 98 c6 a4 3e 21 89 af 5f 20 2f and after decryption: 4f 4b 0a 00 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d. O K ‘\n’ } } } } } } } } } } } } For now, just ignore characters after ‘\n’