IP Control of LG TVs

[benanderson_475]

First, you need to encrypt password using PBKDF2. Go to https://8gwifi.org/pbkdf.jsp and input the following data:

Code:

Master Password: your pairing code (BK2AT22Y)
Salt: Y2G4DpvcpmONByDyzFaPuQ==
Iteration: 16384
dkLen: 128
PBE Ciphers: PBKDF2WithHmacSHA256

Use aes.lua from this post: https://forum.logicmachine.net/showthrea...7#pid12807
Save it as a user library named aes

Example, change key to the one that you've generated. Change ip and cmd as needed. \r is added to command automatically.

Code:

ip = '192.168.1.100'
key = 'm7mRFt3BM+CwW3bYunE6sA=='
cmd = 'POWER off'

function encrypt(key, data)
  -- padding
  local rem = #data % 16
  if rem ~= 0 then
    rem = 16 - rem
    local ch = string.char(rem)
    data = data .. string.rep(ch, rem)
  end

  -- generate iv
  local iv = ''
  local ts, tu = os.microtime()
  math.randomseed(ts - tu)
  for i = 1, 16 do
    local ch = math.random(0, 255)
    iv = iv .. string.char(ch)
  end

  local aes = require('user.aes')

  -- encrypt iv
  local aes_128_ecb, err = aes:new(key, nil, aes.cipher(128, 'ecb'), { iv = string.rep('\0', 16) }, nil, 0)
  local ivenc = aes_128_ecb:encrypt(iv)

  -- encypt data
  local aes_128_cbc, err = aes:new(key, nil, aes.cipher(128, 'cbc'), { iv = iv }, nil, 0)
  local dataenc = aes_128_cbc:encrypt(data)

  return ivenc .. dataenc
end

function send(ip, key, cmd)
  local sock = require('socket').tcp()
  sock:settimeout(3)
  local res, err = sock:connect(ip, 9761)

  if res then
    key = require('encdec').base64dec(key)
    cmd = cmd .. '\r'

    local data = encrypt(key, cmd)
    res, err = sock:send(data)
    if res then
      reply = sock:receive(16)
    end
  end

  sock:close()
  return res, err
end

res, err = send(ip, key, cmd)
log(res, err)

Hi
i have the above all working, Many Thanks, how can i decrypt the response from the command sent, i added log (reply) and this is the result 
string %9��
��i���%r4

do i need to use 

Code:

local aes_128_cbcc, err = aes:new(key, nil, aes.cipher(128, 'cbc'), { iv = iv }, nil, 0)
local datadec = aes_128_cbcc:decrypt(reply)

where do i get the iv from, the doc say to use received iv as below?

5)
Receiver applies decryption with received IV, and encrypted message. For “VOLUME_MUTE on” command, the response from the server is: ce 53 7c e4 b8 82 98 c6 a4 3e 21 89 af 5f 20 2f and after decryption: 4f 4b 0a 00 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d. O K ‘\n’ } } } } } } } } } } } } For now, just ignore characters after ‘\n’