Problem
A friend of mine had an old Panasonic Viera TV which had certain features restricted with a pin number which he couldn’t remember at all, which looked pretty much like the one on the image below.
The pin number consisted of 4 digits, and wouldn’t be any of the default ones. So after a long while trying different combinations, my friend felt completely lost. Because it basically meant that he would need to try 10.000 different numbers — from 0000 to 9999, in order to find out what the selected one was.
At this point he called me out asking for help.
Reconnaissance
After playing around with the TV system settings, trying out different pins, I realized that the TV had no rate limiting in place, which basically means that I could try every number one after another and the TV wouldn’t stop me.
That was great news, however there was also a downside to it: since the TV was a bit dated, it was not able to process IR commands fast. So if I wanted to write a script to automate the process, I would need to write it in such a way that it went at human speed, otherwise the TV would not be able to process every command sent by the remote control.
At this point I started to think how could I put an automation process in place that would do the heavy lifting for me. Ideally it would be a script that would run by itself during the night, that is when the TV was not used.
After some research I found a remote control android app that would suppor the TV model that I was dealing with. And I had an android phone with an IR blaster, which was necessary in order for this plan to work.
The only downside to this is that a remote control is able to emit signals, not to receive them, which translates that the potential script would keep on iterating after finding the right pin. To solve this issue I thought that rather than finding the right pin, I would only need to reset the TV to it’s factory settings, which meant that once I send the right pin to the TV it would reset, which was totally acceptable.
Solution: automate a remote control
Requirements:
1. A phone with an IR blaster.
For this purpose I had and old Samsung Galaxy S6. But any other phone with an IR Blaster would do. There are even IR Blasters that you can buy separately and plug them in to your phone’s audio jack and it would work the same way. Allowing you to convert your phone into a remote control.
2. Install Python@3.9, Appium-Python-Client 1.0.2, and Appium desktop
Appium is an automation test framework for mobile devices. It would be similar to selenium in some way, but rather than testing web apps it allows you to test mobile apps, and thus automate taps on any given mobile app.
I chose to write my script in Python since that’s the language I tend to use for this sort of things, but you can use any other language supported by Appium.
3. Select a remote control app
I tried several remote control apps on my android device — I’m not sure there’s one of iOS. The one that I ended up using is AnyMote Universal Remote since it supported the TV that I was dealing with — Panasonic Viera.
4. Find elements to tap via appium desktop
Appium desktop allows you to inspect any given app and find elements’ ids and xpaths which are needed on the script in order to automate taps. Appium suggests you not to use xpaths as identifiers, but the truth is that since we are using a third party app we have no option but to use what the app has. So in some cases I went by ids, but in many other cases I just went by xpath, since that’s always available.
5. Write an automation script
This was the best part of the process, it was just fun. I wrote a little script that would launch the remote control app on the mobile phone. Then it would access the TV via IR commands and access it’s settings and end up on the factory reset section, in order to iterate pins until it found the selected one.
Writing the script was fairly straight forward. The only issue I had was that in order for appium to navigate through the app, I needed it to access first to the apps main activity by it’s class name. And since I didn’t develop the app, even decompiling it wouldn’t give me this class name easily.
So I basically went through adb and issued the following command, which would give me the data that I needed.
adb shell dumpsys window windows | find “mCurrentFocus”
After that I was ready to go. It took me about 20 minutes to get a script up and running, and other 20 minutes to tide it up. For more details you can find the script and the instructions on how to run it on the following link. https://github.com/y152132341/pin-reset
Conclusion
With this script I’ve been able to find the right pin and reset the TV to its factory default settings. Since the TV required me to issue command in a slow pace, it took a couple of hours until then. But it was certainly worth the try.
I must also say that I’m amazed with Appium on how easy to use it was, specially with the good docs that it has, featuring full examples for different available languages.
But above all I’m really proud that now a days a simple script allows us to save an old device that otherwise would have been wasted.
If you liked this post, please give a thumbs up.
