Automating an HDanywhere 4x8 (TTHA428MC)
Background
I was looking for an HDMI matrix on eBay to route various HDMI inputs and outputs around, and to spoof EDID data to a Windows PC. I came across the HDanywhere 4x8 which has what appears to be a model number on the front of TTHA428MC.
This device appears to be pretty much non-existant on the internet. I had an awful time finding any trace of it, even HDanywhere themselves don't have anything about it in the legacy section of their website.
It's a really neat device, it allows 4 HDMI inputs to be routed to any of the 8 HDMI/HDMI-over-ethernet outputs (along with some IR extenders). It also allows you to set the EDIDs for each of the inputs so the device plugged in thinks it has a specific screen, even when no screens are routed to it. However the best part is, it has a LAN port for network control.
Poking Around
Running an nmap scan on it reveals it has ports 80 and 23 open, HTTP and Telnet. It was indeed running a web server for a web control panel, password protected and I didn't know the password.
I messaged the seller but it was from another clearance and they had no idea, nor a manual either. I tried a top 1000 password dictionary against it as the login form used GET requests - yes it puts the password as a GET parameter in the clear...
/get_data?type=login&passwd=<your password here!>
Having given up with that for the time being I did some more poking. I decided to poke at different values for the type parameter and found that the URL /get_data?type=reset gave a readout of the current input/output mapping - rather handy. Later on I found out that this is actually part of something else.
Having got bored of poking around for other endpoints with no luck I moved my focus to Telnet. It required no auth and would print out s followed by two hex characters wheneve the input was changed, but sadly I couldn't get it to respond to anything I sent.
Getting Somewhere
After lots (and I really mean lots) of digging through Google, it appears to be a rebranded unit from another manufacturer called Intelix from what I can make out and they also make a 4x4 model which has a PDF manual available online - hurrah!
From the manual I learned lots of stuff, firstly, the default password for the web control panel (turned out to be '0000000000' - who would have thought). That meant I could see what was on offer.
Turns out thats what the I/O mappings I found earlier were for and pressing the buttons on the right changed the input perfectly as expected, and almost instantly too.
The firmware update link seemed to put the device into some mode where it wouldn't respond to anything anymore until after a power-cycle and given I haven't got any firmware to try, or instructions on how to flash it, I didn't bother investigating further.
Telnet
Moving back to Telnet, the manual for the 4x4 linked above also included the Telnet commands and what they do! Sending Br should return a followed by the device type.
Br
aMX0408aMX0404
Seems my device type is MX0408 and also MX0404 which explains why the manual for the 4x4 works perfectly for my 4x8.
Next is device status, which according to the manual is retrieved using Bc.
Bc
s00s00s01s23
This is where the manual doesn't match up. Apparently the output should be in the form s1Ys2Ys3Ys4Y where Y is the input source according to some backwards table. Instead, on my 4x8, I get sABsCDsEFsGH where ABCDEFGH are the outputs 1-8, A = 1, B = 2, etc, and the value at that position is the number of the input routed to in, so in the example above, outputs 1, 2, 3, 4 and 5 are routed to input 0 (which is labelled input 1 on the back of the device). Output 6 is routed to input 1 (actually input 2), and so on.
Next up is changing the input. According to the manual you send a followed by two hex digits which correspond to the input you want to route and the output you want it routed to. Sadly though there appears to be literally no correlation between them (a friend ran some stastitical anaylsis on them and came back rather suprised saying, yup, no match at all). Also to my disapointment, the manual only has the codes for the first 4 outputs of my 4x8 matrix.
After a fair amount of trial and error, I've worked it out to be the table below!
Inputs: 1 2 3 4
Output 1: a09, a1D, a1F, a0D
Output 2: a19, a1B, a11, a15
Output 3: a17, a12, a59, a08
Output 4: a50, a55, a48, a4A
Output 5: a5E, a06, a05, a03
Output 6: a47, a07, a40, a02
Output 7: a18, a44, a0F, a51
Output 8: a0A, a1E, a0E, a1A
When you send an input code, it sends back confirmation of what is routed to what, in the form sXY where X is the output number (minus 1) and Y is the input number (also minus 1). Why on earth I can't send the same value but a instead of s to set the routing I have no idea.
Yay, Python
Given Telnet is so simple, you can do all of this in Python really easily. Take the example below - it sets output 1 to input 1
import socket
# Setup socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# Connect to matrix
s.connect(('<ip of matrix>', 23))
# Send routing command
s.send('a09')
# Close socket connection
s.close()
Et voila! This now opens up the door to many more automation possiblities, which should be hitting this blog soon.
I am planning to write a Python API for the matrix so you can sepecify input and output numbers and it'll look them up in the bizarre table. Will update this post once complete.
Update 25/1/18: I've written a (relatively simple but fully featured) Python API for it now which is available over here on GitHub.