core: Roku Media player does not stream to "Play On Roku"

@attain-squiggly-zeppelin nice I’ll see about adapting the node code over the upcoming holiday breaks

It appears that Roku disabled Play On Roku. Read about if from a Roku employee here

@ctalkington

I did a capture of the android app talking to my Roku Ultra.

It uses a protocol it says ecp-2. It seems similar to regular ecp but over web sockets.

However, upon connecting the roku device sends a challenge with a nonce, and the app responds with a sha1 of the concatenation of the nonce and a hard coded uuid.

The hard coded uuid is F3A278B8-1C6F-44A9-9D89-F1979CA4C6F1.

Example exchange:

GET http://192.168.1.176:8060/ecp-session HTTP/1.1
Sec-WebSocket-Origin: Android
Sec-WebSocket-Protocol: ecp-2
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: jU9KP0hjtBw7zbNQUH+SFw==
Sec-WebSocket-Version: 13
Sec-WebSocket-Extensions: permessage-deflate
Host: 192.168.1.176:8060
Accept-Encoding: gzip
User-Agent: okhttp/4.9.0-roku1


2023-11-11 18:45:13.491
{
    "notify": "authenticate",
    "param-challenge": "x4F6nRyCvRjhe1a+L2QZBw==",
    "timestamp": "233317.714"
}
2023-11-11 18:45:13.537
{
    "param-response": "XzpAJnctaMSVBr1DjvWWLUU2Vaw=",
    "request": "authenticate",
    "request-id": "0"
}
2023-11-11 18:45:13.561
{
    "response": "authenticate",
    "response-id": "0",
    "status": "200",
    "status-msg": "OK"
}

Turning on my tv via roku:

{"request":"key-press","request-id":"6","param-key":"Power"}
{"response":"key-press","response-id":"6","status":"200","status-msg":"OK"}

Streaming a video from my phone:

{"request":"input","request-id":"8","param-params":"{\"a\":\"sta\",\"t\":\"v\",\"u\":\"http:\\\/\\\/192.168.1.160:5150\\\/VIDEO%2Fm_0.m3u8\",\"framerate\":\"30\",\"h\":\"192.168.1.160:5150\",\"videoname\":\"20231104_111237\",\"k\":\"http:\\\/\\\/192.168.1.160:5150\\\/%2FVIDEO_THUMB%2F17870\",\"videoformat\":\"hls\",\"videoresolution\":\"1080\"}","param-channel-id":"15985"}

Proof of concept nodejs code: (Sorry, it would have taken me longer to write it in Python. It should be simple enough to convert to Python for someone who uses it every day.)

index.mjs:

import WebSocket from 'ws';
import crypto from 'crypto';

const key = 'F3A278B8-1C6F-44A9-9D89-F1979CA4C6F1';

const host = process.argv[2];
console.log('connecting to ', host);

const ws = new WebSocket(`ws://${host}:8060/ecp-session`, 'ecp-2');

ws.on('error', console.error);

ws.on('open', function open() {
  console.log('opened!');
});

ws.on('close', function () {
  console.log('closed!');
});

const dummy_video = {"a":"sta","t":"v","u":"http://192.168.1.160:5150/VIDEO%2Fm_0.m3u8","framerate":"30","h":"192.168.1.160:5150","videoname":"20231104_111237","k":"http://192.168.1.160:5150/%2FVIDEO_THUMB%2F17870","videoformat":"hls","videoresolution":"1080"};


let request_counter = 0;

ws.on('message', function message(data) {
  console.log('received: %s', data);
  const msg = JSON.parse(data);
  if (msg.notify === 'authenticate') {
    const hasher = crypto.createHash('sha1');
    hasher.update(msg['param-challenge'] + key);
    const response = {
      "param-response": hasher.digest('base64'),
      "request": "authenticate",
      'request-id': (request_counter++).toString()
    };
    console.log(JSON.stringify(response));
    ws.send(JSON.stringify(response));
  }

  if (msg.response === 'authenticate') {
    if (msg.status !== '200') throw new Error('failed to authenticate!');
    ws.send(JSON.stringify({
      "request": "input",
      "request-id": (request_counter++).toString(),
      "param-params": JSON.stringify(dummy_video),
      "param-channel-id":"15985"
    }));
  }
});

The package.json:

{
  "name": "roku-play-stream",
  "version": "1.0.0",
  "main": "index.mjs",
  "license": "MIT",
  "dependencies": {
    "ws": "^8.14.2"
  }
}

Usage: yarn install node ./index.mjs 192.168.1.100 assuming your Roku is on that one dot one hundred address.

Hope this helps!

so the issue with HA or community registered app is the process to get such approved by Roku. They are unlikely to allow something that’s only purpose is to bypass a security change they made so the app would need to provide some other functionality and implement deep linking of media as a feature.

I had started a discussion about such a community venture of getting https://github.com/lvcabral/ha-roku-cast-app as an official app but it would take a large effort so sideloading and supporting custom app id for deep linking in HA integration would likely be easier to achieve. but this was during the holidays and my personal availability has been low since. I’ll try to get to the rokuecp and HA updates in the next few weeks.