Access hidden service menus / modes

From Openlgtv
Jump to: navigation, search

This page describes methods to access the Hidden service modes / menus of an LG tv. Any IR (InfraRed) transmitting device that can send NEC 1 device 4 codes on the fly can do this. Attention: Not for all IR devices listed here it is currently known how to send ALL of the possible service IR codes.

Contents

Service mode password

Some of the service modes such as EZ_ADJUST or IN_START are secured with a password that must be entered with the standard remote control . Currently there are two known passwords: '0000' and '0413'. You have to try which one works with your firmware version. You should enter that password combination with the DEFAULT LG remote and NOT with the IR device used to send service codes.

One for All/Radio Shack universal remotes (thanks to Vicky2003 from the hifi-remote.com)

Introduction

Attention: Not all models have this function, confirmed to work: URC-3920, URC-3940, URC-7720, URC-7781, URC-7940, URC-7950, URC-8820.

First set a device with the LG TV code. Example: On a URC-7781, the code is 0178. You can test if the power button, volume and channels work on your TV. After that, proceed to the next steps. For the URC-7781 the procedure to set the keys uses the 5 digit EFCs and you should follow the instructions manual of the remote control.

Codes: For older remotes which uses 3 digit Extended Functional Codes (EFCs)

  1. EZ-Adjust = 018
  2. IN-Start = 019
  3. POWER-ONLY = 014
  4. IN-Stop = 015 (factory reset)

For Newer remotes which uses 5 digit EFCs

  1. EZ-Adjust = 00018
  2. IN-Start = 00019
  3. POWER-ONLY = 00014
  4. IN-Stop = 00015

Some remotes uses 2 digit EFC codes, so the numbers might exclude zero at the beginning: 18, 19, 14 or 15. Take a look at comparision chart to check which remote supports which codes.

Procedure

  1. Press the device key (TV, VCR, SAT, CD, AUD or DVD).
  2. Press and hold the MAGIC key until the device keys blinks twice (the device key will blink once then twice).
  3. Press 9 9 4. The device key will blink twice.
  4. Press the MAGIC key once.
  5. Enter the 3-digit (or 5-digit) EFC code (see above)
  6. Press the key to which the function will be assigned. The device key will blink twice.


"Magic" button can be named as "P", "S", "Setup" or on some remotes there's need to simultaneously press and hold "REW" and "FFWD" buttons as "Magic" button.

Links

Some general info about programming (mainly OneForAll) universal remotes

You can find more codes for LG on this thread on the hifi-remote.com forums. More supported remotes thread.

Here's the chart with JP1 remotes comparision

RCA remotes

This is for the following models: RCR3273N, RCR3283N, RCR412SN, RCR412BN, RCR4383N, RCR4258N, RCR4358N, RCR4373N, RCR4383N, RCR461, RCR612N, RCR473N, RCR812N, RCR815N and will probably enable ez_adjust menu only.

Procedure

  1. enter setup code 11265,
  2. hit the GUIDE button


Logitech Harmony remote (from http://harmonylghack.wikispaces.com/)

I've got two LG LCD's, a LG 26LD350 in the bedroom and a LG 42LD450 in the living room. I did a little research and found out via http://lgusb.wikispaces.com/ that you can hack most of the LG LCD-TV's to activate support for playback of DivX / MKV files via the USB port. I use a Logitech Harmony 520 remote to control all my equipment and thought that it really shouldn't be that hard to program it to access the LG Service (EZ Adjust) Menu, so I started reading the wiki and the discussions but couldn't find anything about accessing the EZ Adjust Menu using a Logitech Harmony 520 remote, everybody was using cheap one-for-all remotes to access the hidden service menu.

I googled and found that you actually can use a Logitech Harmony remote to access the Service Menu, I tried it and it worked so I desided to write down a quick tutorial:

Prerequisites

  • A LG LCD TV with an USB port that can be used to show pictures and play music.
  • A Logitech Harmony Remote, from what I understand any model will work.
  • An account to HarmonyRemote (http://members.harmonyremote.com).
  • The Logitech Harmony Remote Software installed on your PC.

Procedure

  1. Access http://members.harmonyremote.com and log on with your credentials.
  2. Once logged on, go to this specific adress: http://members.harmonyremote.com/EasyZapper/Infrared/ShowInfrared.asp.
  3. On that page, click "Select an active device" and choose your LG TV.
  4. After you have choosen you will be redirected back and given two choises, "Detect>" or "Manual>". Choose "Manual>".
  5. Under Enter Infrared Codes, check to see that Data Type is set to "Pronto", in Data Value enter the following string:
    0000 006d 0022 0002 0157 00ac 0015 0016 0015 0016 0015 0041 0015 0016 0015 0016 0015 0016 0015 0016 0015 0016 0015 0041 0015 0041 0015 0016 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0016 0015 0016 0015 0016 0015 0016 0015 0016 0015 0016 0015 0016 0015 0016 0015 0689 0157 0056 0015 0e94
    Note: Copy/Paste the entire string as one row of text!
  6. Leave the rest of the fields blank and press "Proceed".
  7. "Converted from Pronto format successfully!" should be visible. Press "Next >".
  8. Choose your LG TV if not already choosen.
  9. In the name field write a name for the button. "Service Menu" or something like that.
  10. Click on "Add >".
  11. If you check your Logitech Harmony Remote Software you will see that you have the newly created button called "Service Menu".
  12. Send the updates to your remote via the software.
  13. The new button will show up in the LCD screen on your remote.
  14. Press it and your (almost) done.

Other 'PRONTO' codes that may work

In-Start

0000 006D 0022 0002 0155 00AA 0015 0015 0015 0015 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0040 0015 0040 0015 0015 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0015 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0015 0015 0015 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 05ED 0155 0055 0015 0E47

Ez-Adjust

0000 006D 0022 0002 0155 00AA 0015 0015 0015 0015 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0040 0015 0040 0015 0015 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 05ED 0155 0055 0015 0E47

Power-Only

0000 006d 0022 0002 0157 00ac 0015 0016 0015 0016 0015 0041 0015 0016 0015 0016 0015 0016 0015 0016 0015 0016 0015 0041 0015 0041 0015 0016 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0016 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0041 0015 0016 0015 0016 0015 0016 0015 0016 0015 0016 0015 0016 0015 0016 0015 0689 0157 0056 0015 0e94

In-Stop (be careful - makes factory reset)

0000 006D 0022 0002 0155 00AA 0015 0015 0015 0015 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0040 0015 0040 0015 0015 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0015 0015 0040 0015 0015 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0015 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 05ED 0155 0055 0015 0E47

Logitech Harmony 300i

This is a easy way I found to access the LG service menus on Logitech 300i (In-Start, In-Stop, EZ-ADJ and power only). This tutorial assumes you have a account on http://myharmony.com

Follow this procedure for In-Start, In-Stop and EZ-ADJ

  1. Go to http://myharmony.com/ and log in to your account
  2. Click on "DEVICES" tab and click on "Add a device"
  3. In manufacturer field enter "LG" and in model number add 47LE5300-UC and then click on Add. Your device should now be added.
  4. Click on "Buttons" and select LG 47LE5300-UC in the select box and click on "Go"
  5. On the right hand side of the screen you should see all the commands for this device, just drag the commands you want to a unused button on the remote.
  6. Once you are done click on "Save"
  7. Remember to sync your remote

For power only mode:

  1. Go to http://myharmony.com/ and log in to your account
  2. Click on "DEVICES" tab and click on "Add a device"
  3. In manufacturer field enter "Haier" and in model number add "HLC-15R" and then click on Add. Your device should now be added.
  4. Click on "Buttons" and select "Haier HLC-15R" in the select box and click on "Go"
  5. On the right hand side of the screen you should see all the commands for this device, EJECT is the button you want for power only mode, just drag the "EJECT" command to a unused button on the remote.
  6. Once you are done click on "Save"
  7. Remember to sync your remote

LIRC compatible device

If you have a lirc or (winlirc) infrared transmitter you can use these codes to enter the service menu:

  begin remote

  name   LG_SERVICE_MENU
  flags RAW_CODES
  eps            55
  aeps          100

  ptrail        534
  repeat  9145  2222
  gap    40702


      begin raw_codes

          name SERVICE_MENU
             9056    4673     545     591     536     598
              531    1678     551     608     476     638
              557     552     581     612     517     608
              582    1693     543    1706     532     589
              539    1709     480    1732     586    1638
              642    1702     567    1667     495    1741
              516    1686     551    1707     508    1755
              505    1708     574    1638     573    1644
              595    1670     568     655     595     547
              585     513     644     530     587     525
              535     626     573     568     625     507
              612

          name IN_START
             9000    4600     550     600     550     600
              550    1700     550     600     550     600
              550     600     550     600     550     600
              550    1700     550    1700     550     600
              550    1700     550    1700     550    1700
              550    1700     550    1700     550    1700
              550    1700     550     600     550    1700
              550    1700     550    1700     550    1700
              550    1700     550     600     550     600
              550    1700     550     600     550     600
              550     600     550     600     550     600
              550


          name EZ_ADJUST
             9000    4600     550     600     550     600
              550    1700     550     600     550     600
              550     600     550     600     550     600
              550    1700     550    1700     550     600
              550    1700     550    1700     550    1700
              550    1700     550    1700     550    1700
              550    1700     550    1700     550    1700
              550    1700     550    1700     550    1700
              550    1700     550     600     550     600
              550     600     550     600     550     600
              550     600     550     600     550     600
              550
          
          name POWER_ONLY
              9019   4523     552     579     552     579
              552    1709     552     579     552     579
              552     579     552     579     552     579
              552    1709     552    1709     552     579
              552    1709     552    1709     552    1709
              552    1709     552    1709     552     579
              552    1709     552    1709     552    1709
              552    1709     552    1709     552    1709
              552    1709     552    1709     552     579
              552     579     552     579     552     579
              552     579     552     579     552     579
              552   43993    9019    2261     552


      end raw_codes

 end remote


This should also work:

 begin remote

      name LG
      bits 16
      flags SPACE_ENC|CONST_LENGTH
      eps 30
      aeps 100

      header 9061 4473
      one 591 1660
      zero 591 521
      ptrail 590
      pre_data_bits 16
      pre_data 0x20DF
      gap 108029
#      toggle_bit_mask 0x0

      begin codes
            lg_ez_adj 0x00ff
            lg_in_start 0x04fb
            lg_in_stop 0x05fa
            lg_power 0x10EF
            lg_input 0xD02F
            lg_tv/radio 0x0FF0
            lg_q.menu 0xA25D
            lg_menu 0xC23D
            lg_guide 0xD52A
            lg_up 0x02FD
            lg_left 0xE01F
            lg_right 0x609F
            lg_down 0x827D
            lg_ok 0x22DD
            lg_return/exit 0x14EB
            lg_info 0x55AA
            lg_av_mode 0x0CF3
            lg_vol_up 0x40BF
            lg_vol_down 0xC03F
            lg_mark/fav 0x7887
            lg_mute 0x906F
            lg_page_up 0x00FF
            lg_page_down 0x807F
            lg_1 0x8877
            lg_2 0x48B7
            lg_3 0xC837
            lg_4 0x28D7
            lg_5 0xA857
            lg_6 0x6897
            lg_7 0xE817
            lg_8 0x18E7
            lg_9 0x9867
            lg_0 0x08F7
            lg_list 0xCA35
            lg_q.view 0x58A7
            lg_red 0x4EB1
            lg_green/stop 0x8E71
            lg_yellow/play 0xC639
            lg_blue/pause 0x8679
            lg_text 0x04FB
            lg_t.opt/rev 0x847B
            lg_subtitle/ffw 0x9C63
            lg_rec 0xBD42
            lg_simplink 0x7E81
      end codes
 end remote

Mobile phone with Symbian S60v2

You can use Novii Remote for Symbian S60v2 (eg: Nokia 6600) with this codebase

Mobile phone with Symbian S60v3

  1. download a trial version or irRemote buy IRremote by Psiloc from Psiloc website
  2. install IRremote on your S60v3 device Image:71335591.th.jpg
  3. Download the IN-Start menu profile for LG TV's from here and transfer the file on your phone. The IRremote should automatically launch the profile you just donwloaded for LG. (You may try the modified file with InStart, EzAdjust and PowerON IR codes from here: File:IrRemote LG IN-START EZAdjust PowerON.ir.zip but this one is not tested yet.)
  4. launch IRremote on your S60v3 device Image:51805265.th.jpg
  5. select menu, add device Image:48520619.th.jpg
  6. select TV Image:94803844.th.jpg
  7. select LG Image:49209931.th.jpg
  8. refresh the list Image:54604693.th.jpg
  9. type START and select the IN-START Service Menu profile Image:41637214.th.jpg
  10. refresh the list and select mon Image:48088075.th.jpg
  11. select the profile just downloaded Image:40070178.th.jpg
  12. press 2 and keep it pressed until the password form comes up on your tv (remember to press ctrl if you're using a qwerty phone) Image:22849293.th.jpg
  13. To access to power_only mode use LG_PO profile in the same section (TV/LG)
  14. refresh the list and select mon

Mobile phone with Windows Mobile 5/6

You can do the trick using Novii Remote Deluxe for PPC and this codebase, thanks to jpan.

PlayStation Portable, model PSP-1000 (1st Generation of PSPs)

You can use it to reproduce the IR hack if your PSP-1000 has been enabled to execute homebrew software. There is a homebrew application called Universal Remote v1.2 that can reproduce LIRC codes.



#
# this config file was automatically generated
# using WinLIRC 0.6.5 (LIRC 0.6.1pre3) on Tue Mar 16 12:12:30 2010
#
# contributed by Pitsensas
#
# brand:             LG_SERVICE_MENU
# model:            
# supported devices:
#
 
begin remote
 
  name  LG_SERVICE_MENU
  bits           16
  flags SPACE_ENC
  eps            55
  aeps          100
 
  header       9000  4600
  one           550   600
  zero          550  1700
  ptrail        550
  repeat       9145  2222
  pre_data_bits   16
  pre_data       0xDF20
  gap          40702
  toggle_bit      0
 
 
      begin codes
          IN_START                 0x00000000000020DF
          EZ_ADJUST                0x00000000000000FF
          IN_STOP                  0x000000000000A05F
      end codes
 
end remote

Confirmed to work on original PSP (fat version with IR transmitter) on 15/3/2012 and Australian version LW9500 Source code: http://pastebin.com/qbg00diQ

Simple improvised home brew IR transmitter

It sounds a bit crazy but it is possible to send the required service codes with a simple improvised IR transmitter by playing a special wav file through the LED from an old TV remote. The LED is connected to the output of any MP3 player. LED is brought to the TV. Starts playing the File:LG-service.zip. Empirically set the desired volume. You should see the menu. ATTENTION: POWER ONLY wav file is currently untested. Needs confirmation! Here are another files containing LG service IR codes in .WAV format: File:LG SERVICE IR WAV.zip and File:Service IR.zip

Using a "Smart" (Data enabled) Remote

Reading the codes from the original LG remote controller gives as "System" the 6121 Chipset (NEC transmission format) and some codes:

  • Power button: 04 FB 08;
  • Menu button: 04 FB 43;
  • Mute button: 04 FB 09;
  • Numeric 1: 04 FB 10;
  • Numeric 2: 04 FB 11; etc.

These codes are confirmed by those found in the sources (I got them form here).

Using a Data enabled remote controller, program it to send the following codes using the NEC format, and assign them to buttons of your choice:

  • IN_START: 04 FB FB
  • EZ_ADJUST: 04 FB FF
  • POWERONLY: 04 FB FE

Sony Tablet S (EZ_ADJUST using integrated IR remote control)

A further very easy way to get into the EZ_ADJUST menu is using the integrated IR remote control of Sony's Tablet S (tested with model SGPT114DE/S).

  1. start the built-in Sony remote control application (version 1.0.0)
  2. start the registration of a new device
  3. choose the recommended simple registration method
  4. select the device category TV and the manufacturer Vizio
  5. finish the device registration process

That's it! Just select the newly created device within the remote control application and press the button labeled with Enter. Afterwards you should see the password dialog.

Use your PC

You can use just a PC with network connection to access hidden menus and modes. Use the Python script "lgcommander.py" and instructions given here: https://github.com/ubaransel/lgcommander