Saturday, June 18, 2011

Programmatically Controlling Pioneer Receivers and BluRay Players

I recently got a new Pioneer Elite SC-35 receiver (  This receiver has an ethernet plug on the rear and is supported by the iPhone/iPOD app called iControlAV. 
While the receiver has a web interface called "Pioneer Web Control System" I wanted a way to control this receiver via script. The web interface has support for
  • Powering the receiver on/off
  • Changing the Volume including mute
  • Changing the Input (Zones 1-3)
  • Changing the "Listening Mode"
The iControlAV app for iPhone supports the same plus a few more options.
The iControlAV uses SSDP query to find the receiver. Which runs NU-OS 1.13.  You can Browse to http://<Receiver IP>/BasicDevice.xml to get the info on your device. 
My receiver has port 23 (telnet) open along with 80 and 8102 (referenced in BasicDevice.xml)
Basic process:
  • Send command as ASCII on telnet (23) or TCP/8102 (see your BasicDevice.xml)
  • Commands that check status or query the device begin with a ?
  • Commands that perform a command sometimes have parameters (input number) at begining, some at end
  • You can monitor the telnet window to see the "response" for each command sent.  This includes commands sent through IR remote or from the device its self.
Basic Commands (more commands to come in another post):
Is Device powered ON?
PWR0 Device is ON
PWR1 Device is OFF
PF Power Device OFF
PO Power Device ON
?M  Is Zone MAIN muted
MUT1 Zone is NOT Muted
MUT0 Zone is Muted
MO  Mute MAIN zone
MF  unMute MAIN zone
?V Get Current Volume level
VOLxxx Current volume level, xxx is 000-200
VOL121 -20.0db
VOL081 -40.0db
XXXVL Set Volume Level to XXX (000 - 200)
001VL Set Volume Level to -80.0db
081VL Set Volume Level to -40.0db
?RGC Get inputs on device (i think)
RGC111001002 *Unknown*
?RGBxx Get inputs Name (related to above command), available inputs will change based on model
?F Get current input (use ?RGB to get name)
FN19 Input 19
FN15 Input 15
XXFN Set current input (XX = Input number)
XX Input number
19FN Set to input 19
15FN Set to input 15
Turn on device, set input to HDMI1 (19 in my case), and volume to -40db




(Update: 7/17/2011)
I was able to find a doc that has all the commands (better than what I was able to determine).


  1. Hey Mike,

    Cool stuff. What does the conversation look like between the iControlAV app and the AVR? (wireshark capture) I'm trying to emulate this for an old pioneer receiver, and haven't managed to get the response correct to the M-SEARCH.


  2. It is very chatty. Do you want/need a wireshark capture of it?

    You can also check out

  3. Hi

    Your discoverings is very interesting! Is it possible to catch the return values from the reciver in the telnet conection? I'm dreaming about making a volumecontrol for the receiver, and place it along with the volumecontrol in the systembar in windows. Do you have any clue if this is possible?

  4. Yes you could. You would have to leave the Telnet session open to parse incoming text.

    From what I have seen the device only allowed a single telnet session to be open. So if you had other IP controls you would not be able to use them at the same time.

    If you want help writting some c# code on this let me know. mike a t

  5. I quickly created a small ugly application to turn volume up and down and mute, but it is very easy to keep adding more commands if you want to...

  6. Any Idee about command to move from preset1 to preset 2 in netradio (38fn)

  7. This comment has been removed by the author.


  9. Any Idee about command to move from preset1 to preset 2 in netradio (38fn)

  10. Is there a wireshark capture I can look at? On my vsx 1023, with telnet on port 8023, I can change inputs with the xxFN command, and can probe current input with ?FN, but I cat control the listening modes. ?S and ?L give nothing. I could use wget or curl to talk Http instead. I know the AVR supports it because the iPhone app can control listening modes. A wireshark capture of iPhone to Pioneer AVR would be helpful.

  11. Well, I ran wireshark myself, connecting between the Pioneer AVR and my iPhone by inserting an ethernet hub between the Apple Airport and the ethernet switch that leads to the Pioneer. From the hub, I am connecting to the Mac. The Mac is running Wireshark. The mac can now see all the traffic from the Wireless to the Wired.

    So, wireshark packets are kind of tough to follow along, but what I found is the Pioneer iPhone app uses both HTTP on port 8080 and Telnet on port 8102. Seems to have an alternate version of the XML file at startup, compared to the one posted in the 1st commet, but from then on it's using the Telnet port. Pressing the Listening Modes i the App shows that it is sending Telnet commands like 0010SR and 0100SR actually get through. I tried from my own Telnet instance in a Term window, and sure enough I can change the listening modes! Now I need to work out the 4 digit codes from the iPhone app and compare to the Pioneer PDF file. The code 0010SR is in the PDF, but not the 0100SR. So, Progress.

    THanks for the clue to use Wireshark on the Pioneer App. That is the clue I needed.

  12. This comment has been removed by the author.

  13. This comment has been removed by the author.

  14. This comment has been removed by the author.


  15. This is an awesome post.Really very informative and creative contents. These concept is a good way to enhance the knowledge.I like it and help me to article very well.Thank you for this brief explanation and very nice information.Well, got a good knowledge.

  16. I'm so glad there's other nuts out there like me who simply have to hack their devices... Usually just because we can :) I have the same receiver and only recently cared enough to connect it to the network. (I was forced to run a lan cable out to that part of the house for a video surveillance system, so I plugged in the receiver while I was at it.) And now here I was a few days later going through the network tab in my Chrome debugging tools figuring out how to make each call. The I decided to google just in case someone had already figured this stuff out -- and sure enough, YOU had! So, thanks for posting it! If you're still monitoring comments and happen to see this one, I have a question/request. The link to the document you mentioned which contains the full list of commands is no longer working. Did you happen to save a copy of it? (Or maybe know where it is currently located?) If so, and if it's no trouble, I'd love it if you can share it with me.

    So thanks again for posting this information -- you just never know who might come along nearly a decade later looking for it :)


Enumerating TFS Permissions for items within the TPC for audit and logging

Below is a powershell cmdlet that I threw together to enumerate data out of our TFS instance.  This is used to keep track of permissions in ...