Ziggo Horizonbox support

[robgeerts]

Nice, now my Horizon pauses when my doorbell rings

[Martijn85]

Realy nice work!

I have tried this with my Horizon but this is not working (anymore?)

When i send some of the remote commands i get this message:

Code: Select all

PHP Warning:  fsockopen(): unable to connect to 192.168.10.119:5900 (Connection refused) in /home/pi/domoticz/scripts/turn_off_horizon.php on line 60

Also to check if the Horizon is online is not working for me, the file DeviceDescription.xml seems not to exist (anymore)?

I seem to have the SMTG7401XEN (Samsung).

[robgeerts]

If it doesnt exists you have the wrong IP, horizon uses multiple IP's, try 192.168.10.120 or find additional ips with. Advanced IP Scanner

[Martijn85]

If it doesnt exists you have the wrong IP, horizon uses multiple IP's, try 192.168.10.120 or find additional ips with. Advanced IP Scanner

Thanks! It seems to be indeed: 192.168.10.120

[Grove]

I can switch the box box on and off
But can't get the status of the box.

Also portscanning the mediabox on that ip doesn't report 62137 as an open port.

Any suggestions to get the status of the horizonbox?

[Jeff]

For those who want to discover what ports the horizon mediabox is using consider using nMap. This network scan tool comes both command version and a standard installer.

In a normal situation where the box is connected to your home network the built-in DHCP of the mediabox reserves a block of 20 ip's. For those of you who want to scan for open ports we need to observe the following: If the default gateway address of the box is for example 192.168.1.25 then the scan address is usual gateway address +1 ip higher.

Running the following command gives all the info needed:

Code: Select all

nmap -p 1-65535 -sV -sS -T4 IPADDRESSOFMEDIABOX

Output:

Code: Select all

Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-28 11:56 W. Europe Daylight Time
Nmap scan report for 192.168.1.26
Host is up (0.011s latency).
Not shown: 65526 filtered ports
PORT      STATE  SERVICE    VERSION
1234/tcp  open   http       lighttpd 1.4.28
1235/tcp  open   http       lighttpd 1.4.28
5900/tcp  open   vnc        VNC (protocol 3.8)
7547/tcp  open   http       lighttpd 1.4.28
8080/tcp  open   http-proxy
9080/tcp  closed glrpc
29153/tcp open   upnp       Samsung UPC Horizon TV upnpd (Linux 2.6.35; UPnP 1.0
; DLNADOC 1.50)
62137/tcp open   upnp       XBMC UPnP (Platinum 0.5.3.0; DLNADOC 1.50; UPnP 1.0)

62138/tcp open   upnp       XBMC UPnP (Platinum 0.5.3.0; DLNADOC 1.50; UPnP 1.0)

Nmap done: 1 IP address (1 host up) scanned in 218.58 seconds

Getting the current status of the mediabox is done by creating a new virtual sensor and define it as text.
To update the default (Hello World) text we need to use the 2nd script (check_upc.php) and modify the device idx to match the virtual text sensor.

Capture hzn.PNG (122.45 KiB) Viewed 7585 times

[LanWolf]

I tried to find the port/ip with the nmap command, my gw 192.168.1.254, but 255 cannot be the address to scan i suppose ?
an other used address by the horizon is 192.168.1.100 but also i get no reaction on that address nor 101.

[noppes123]

Quick question: how do I find out which port number to use? Is it always 62137? (I get no response)

EDIT: when running the switch_upc.php script I get the following error:

Code: Select all

PHP Parse error:  syntax error, unexpected 'function' (T_FUNCTION) in /home/pi/domoticz/scripts/switch_ziggo.php on line 49

A code snippet:

Code: Select all

...
KEY_DVR                 = Ef 29
KEY_TV = Ef 2a;
*/
 
function makeBuffer($data)
{
    $data = str_replace(" ", "", $data);
    return hex2bin($data);
}
 
 
$localip = "192.168.192.200"; // IP of mediabox
$localport = 5900; // Controlport of mediabox
$key = "E0 00"; // Power toggle
...

[Jeff]

I tried to find the port/ip with the nmap command, my gw 192.168.1.254, but 255 cannot be the address to scan i suppose ?
an other used address by the horizon is 192.168.1.100 but also i get no reaction on that address nor 101.

If the default gateway of your horizon is 192.168.1.254 i assume that you mean the default gateway of your Cable Modem?

The horizon needs to be visible in the dhcp table of the modem (usual the name starts with UPCGW****) For this to work is necessary to enter the ip of the Horizon Box, If in your situation the box is also being used as a modem use the 192.168.192.1 ip.
It might also help to look under Basic -> Local Area Network -> DHCP Pool list.

And as a last resort try this nifty utility UPNP Scanner

[noppes123]

The Horizon is giving me a hard time. It is connected in the local network and the remote control via the Ziggo App worked for a while. Now the app doesn't connect to the Horizon Mediabox XL (as they call them nowadays) anymore, for no apparent reason.
I can still access the admin panel via 192.168.1.200 and a port scan comes up with:

Code: Select all

Starting Nmap 6.47 ( http://nmap.org ) at 2017-04-30 08:44 CEST
Initiating Ping Scan at 08:44
Scanning 192.168.1.200 [2 ports]
Completed Ping Scan at 08:44, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:44
Completed Parallel DNS resolution of 1 host. at 08:44, 0.02s elapsed
Initiating Connect Scan at 08:44
Scanning 192.168.1.200 [1000 ports]
Discovered open port 80/tcp on 192.168.1.200
Discovered open port 49152/tcp on 192.168.1.200
Completed Connect Scan at 08:44, 1.55s elapsed (1000 total ports)
Nmap scan report for 192.168.1.200
Host is up (0.048s latency).
Not shown: 997 closed ports
PORT      STATE    SERVICE
23/tcp    filtered telnet
80/tcp    open     http
49152/tcp open     unknown

So, I tried to get a status via http://192.168.1.200:49152/DeviceDescription.xml but that replies with a 404.

A UPnP scan shows 3 devices, one of which has an IP address:

Code: Select all

Device 6:
  Unique Device Name: uuid:14c75eb4-3803-3e68-8f99-1da5210ac4c2
  Friendly Name: UPC Horizon: (192.168.1.201)
  Type: urn:schemas-upnp-org:device:MediaServer:1
  Presentation URL: http://192.168.1.201:0/
  Manufacturer Name: Team XBMC
  Manufacturer URL: http://www.xbmc.org/
  Model Name: UPC Horizon
  Model Number: 1.0
  Description: UPC Hzn SuperCDS
  Model URL: http://www.xbmc.org/
  UPC: 
  Serial Number: 
  Service 1:
    Service Type Identifier: urn:microsoft.com:service:X_MS_MediaReceiverRegistrar:1
    Identifier: urn:microsoft.com:serviceId:X_MS_MediaReceiverRegistrar
    Last Transport Status: 0
  Service 2:
    Service Type Identifier: urn:schemas-upnp-org:service:ContentDirectory:1
    Identifier: urn:upnp-org:serviceId:ContentDirectory
    Last Transport Status: 0
  Service 3:
    Service Type Identifier: urn:schemas-upnp-org:service:ConnectionManager:1
    Identifier: urn:upnp-org:serviceId:ConnectionManager
    Last Transport Status: 0

Device 7:
  Unique Device Name: uuid:444D5376-3247-4655-5349-54fa3e292da1
  Friendly Name: 1798725539
  Type: urn:schemas-upnp-org:device:FUSION:2
  Presentation URL: 
  Manufacturer Name: Samsung electronics
  Manufacturer URL: 
  Model Name: SMT-G7401:P01B
  Model Number: 1-341-163.17.7
  Description: UPC Hzn Gateway
  Model URL: 
  UPC: 
  Serial Number: 
  Service 1:
    Service Type Identifier: urn:schemas-upnp-org:service:ConnectionManager:2
    Identifier: urn:upnp-org:serviceId:ConnectionManager
    Last Transport Status: 0
  Service 2:
    Service Type Identifier: urn:schemas-upnp-org:service:AVTransport:2
    Identifier: urn:upnp-org:serviceId:AVTransport
    Last Transport Status: 0
  Service 3:
    Service Type Identifier: urn:schemas-upnp-org:service:BasicManagement:1
    Identifier: urn:upnp-org:serviceId:BasicManagement
    Last Transport Status: 0
  Service 4:
    Service Type Identifier: urn:schemas-upnp-org:service:ScheduledRecording:2
    Identifier: urn:upnp-org:serviceId:ScheduledRecording
    Last Transport Status: 0
  Service 5:
    Service Type Identifier: urn:schemas-upnp-org:service:ContentDirectory:2
    Identifier: urn:upnp-org:serviceId:ContentDirectory
    Last Transport Status: 0

Device 8:
  Unique Device Name: uuid:52554976-3247-5265-6D6F-54fa3e292da1
  Friendly Name: 1798725539
  Type: urn:schemas-upnp-org:device:RemoteUIServer:2
  Presentation URL: 
  Manufacturer Name: Samsung electronics
  Manufacturer URL: 
  Model Name: SMT-G7401:P01B
  Model Number: 1-341-163.17.7
  Description: UPC Hzn Gateway
  Model URL: 
  UPC: 
  Serial Number: 
  Service 1:
    Service Type Identifier: urn:schemas-upnp-org:service:RemoteUIServer:1
    Identifier: urn:upnp-org:serviceId:RemoteUIServer
    Last Transport Status: 0

I wanted to use Wireshark to see whats being communicated via the Ziggo App, but now it doesn't connect anymore. So I can use a little help. Any suggestions?

[commentator]

Same problem here. The mention port isn't available when the box is on.
Tried both ip's the box is using.

Any suggestions?

[Cletus]

Hello Gentlepeople,

I am also the "proud" owner of a Horizon box but i am a PROUD owner of Domoticz and everything.

What bothers me the most about the Horizon box is that it's triggered with an Power Toggle instead of a Power On / Power Off

I read / searched / crawled high and low on the internet to find a solution for not finding the DeviceDescription.xml because i had the same issue that it could not be found.

In the end i solved this with i think the following:

Scanning my pfsense router, doing nmaps on linux, in the end i downloaded the opensource firmware from Samsung itself from: http://opensource.samsung.com/reception ... et-top_box

I unpacked all the source files and did a massive search with Notepad++ to DeviceDescription.xml

I found out that this file is generated by some MediaServer application.

I enabled the MediaServer and scanned my network with Universal Media Server and saw that the box was available for streaming.

I even installed wireshark but luckily that wasnt needed. Please take a look below for the steps that i took for getting to the DeviceDescripton.xml

Setup the home network on your Horizon and make sure that you share the media library (Which turns on the MediaServer). Then in most cases the DeviceDescription.xml is generated on the http://<IP-OF-GATEWAY+1>:62137/DeviceDescription.xml

Please note what i meant is that if your gwlogin or gateway IP is: 192.168.1.2 you should be taking 192.168.1.3.

And voila, i could access the DeviceDescription.xml but only when the box is powered on. If it is in standby i could not access it.

I hope this information is to any use of anybody and i'm hoping to contribute to this wonderful community!

Regards, Paul

[noppes123]

Hi Paul,

You really went to great lengths!
I will give it a try and report back on my findings.

Indeed one of the big issues with the Horizon box is how it handles everything related to power, toggle on/off, standby, eco mode, etc.
I suspect we might be able to also get the DeviceDescription.xml when setting the standby mode to 'high' (don't recall the exact wording in the menus), meaning it consumes a lot of power in standby and keeps its fans running most of the time - very annoying on both accounts! Will check that as well.

In the long run, we still may need to use wireshark for detecting what the remote function in the Smartphone App is doing, if we can figure it out at all. But that App also 'works' very flaky.

Again, thanks for all your effort.

/Ron

[Grove]

Hi Paul,

if this works that will be a great improvement!!
Thanks already for the effort.

I will try this asap.

[Cletus]

Would be good if you guys indeed can report back!

I have to say though that i have my box in the High Energy mode because i have a mini streamer in my bedroom.

Luckily no fan noise and the devicedescription is not available when on "standby"

[Cletus]

So a small update.

I've created a very simple script that checks if the DeviceDescription.xml is available and do an echo based on that.

I will elaborate more on this when i have the time to make it into a command for power on / power off

Code: Select all

#!/bin/bash

horizonip="192.168.2.113"
horizonport="62137"

 if [[ $(wget http://$horizonip:$horizonport/DeviceDescription.xml -O-) ]] 2>/dev/null
  then echo "This page exists."
  else echo "This page does not exist."
 fi

Very simple and this works for me, when the box is powered on i get the echo : This page exists. when it's powered off i get This page does not exist.

w00t w00t!

[noppes123]

Would be good if you guys indeed can report back!

I have to say though that i have my box in the High Energy mode because i have a mini streamer in my bedroom.

Luckily no fan noise and the devicedescription is not available when on "standby"

So, even in 'high energy' mode the box does not respond?

I have the 7401 model, and I surely hear fans running (not very loud). What model do you have?

[Cletus]

I have the 7401, and when i mean i don't hear the fans, i don't hear the fans i don't know if they are running but i don't hear them atleast

And indeed, when the box in high energy mode is off the XML file is not available.

[Grove]

Here it's working!

Thx for your effort!

You need to configure your home network again. Halfway you will get a question like adding media. You must configure this also. That will make your xml appear on the horizonbox

[Cletus]

Thanks for testing!

Even Ziggo could not answer my question

Next phase is also implemented. I had to change the scripts because i ran into troubles with the output to null where Domoticz would give unexpected behaviour.

Please note that i also have a Harmony Hub and controlling that via commandline with the program HarmonyHubControl https://www.domoticz.com/wiki/Harmony_Hub_Control

I have the following two scripts on my domo now:

scripts://horizon/horizon_on.sh

Code: Select all

#!/bin/bash
HORIZON=$(curl -I  --stderr /dev/null http://<GATEWAYIP+1>:<PORT>/DeviceDescription.xml | head -1 | cut -d' ' -f2)

cd /home/pi/domoticz/scripts/horizon
if [ "$HORIZON" = "$null" ]
    then
        HarmonyHubControl <username> <password> <ip_of_harmony_hub> issue_device_command <device_id> <command>
fi
exit 0

scripts://horizon/horizon_off.sh

Code: Select all

#!/bin/bash
HORIZON=$(curl -I  --stderr /dev/null http://<GATEWAYIP+1>:<PORT>/DeviceDescription.xml | head -1 | cut -d' ' -f2)

cd /home/pi/domoticz/scripts/horizon
if [ "$HORIZON" = "200" ]
    then
        HarmonyHubControl <username> <password> <ip_of_harmony_hub> issue_device_command <device_id> <command>
fi
exit 0

please note that i have to CD into the scripts directory to make it work as the HarmonyHubControl uses an tokenfile to operate correctly. I could place that in the root or something but i'd like to keep that clean

After that i've created a dummy switch


and it goes like a charm!

next step, implement this script into an activity using the Harmony Remote via the HA-Bridge Philips Hue bridge emulator

Greetz, Paul