Script no longer working on firmware V0000.09.01l.P0604

[BastyJuice]

❌ Script no longer working on firmware V0000.09.01l.P0604

After updating my Hisense TV to firmware version V0000.09.01l.P0604, the script stopped working.

---

🐛 Problem

When attempting to authenticate via MQTT, the following error is shown:

Bad connection. Returned code: 5
Failed to connect to MQTT broker. Exiting...

yaml
Kopieren
Bearbeiten

---

🔍 Root Cause

MQTT return code 5 means:

Connection Refused – Not Authorized

This indicates that the TV is blocking the connection attempt, most likely due to changes introduced in the latest firmware:

• MQTT connections from third-party clients may now be restricted or blocked.
• The pairing/authentication flow using vidaa_cert.cer and vidaa_cert.pkcs8 may have been changed or disabled.
• The TV might now require a different pairing method or completely block external pairing attempts.

As a result, the script fails to complete authentication and cannot create the required credentials.json.

---

✅ Recommendation

Unless a workaround is found, this script is not compatible with firmware version V0000.09.01l.P0604 or newer.

If you're on an older firmware version, the script should still function as expected.

---

ℹ️ Environment

• TV Model: Hisense 100E77NQ PRO
• Firmware: V0000.09.01l.P0604

---

Please let me know if there’s a known workaround or if support for the new firmware is planned.

[nikagersonlohman]

Hi @BastyJuice,

As I do not have that TV and only developed this script based on information and documentation created by others I will not be able to help. If you have found how to fix this let me know and I can update the script on github (or clone it to yours off course 🙂)

Regards,

Nika

[jamesmule]

@BastyJuice Can you access your TV at http://IP:38400/MediaServer/rendererdevicedesc.xml by any chance and see a transport_protocol (e.g. transport_protocol=3280) in root/device/modelDescription? I believe that number defines the authentication protocol.

[floriangbh]

Hello,
I think I have the same issue :

Waiting for message... (press and hold escape to cancel waiting)
2025-09-11 19:04:19,434 - ERROR - Bad connection. Returned code: 5
Waiting...

Calling http://ip:38400/MediaServer/rendererdevicedesc.xml return <modelDescription>#CAP# mac=903c1d61ebfa macWifi=4c24ceb352b1 macEthernet=903c1d61ebfa ip=192.168.0.141 region=4 transport_protocol=3280 platform=1 voice=2 brand=his vidaa_support=1 </modelDescription>

I use certificates from https://github.com/d3nd3/Hisense-mqtt-keyfiles, maybe that's the issue ?

[SodaSurfer]

hi im using version v0002.09.02x.p0823 and got the same result 5 issue. did someone managed to solve this?

[PeterBurner]

Same problem here on Hisense 65U8KQ running V0000.09.09O.P0930
Calling http://ip:18400/MediaServer/rendererdevicedesc.xml gave me region=0 transport_protocol=3290 platform=1 voice=2 brand=his vidaa_support=1.
I can provide additional information if needed.

[PeterBurner]

I did some digging and found the following log statements using ADB LogCat:

Logs

12-01 12:31:23.069 12779 12779 E wdf_jni : [wifi_wfd]ConnectUtils getConnectUser: uuid: dd:0d:49:eb:a2:8a, brand: his, operation: vidaacommon, time: 1764588683, flag: 1
12-01 12:31:23.070 12779 12779 E wdf_jni : [wifi_wfd]pattern: 38D65DC30F45109A369A86FCE866A85B
12-01 12:31:23.070 12779 12779 E wdf_jni : [wifi_wfd]race: 38D65DC30F45109A369A86FCE866A85B$dd:0d:49:eb:a2:8a, race_md5: 8F34B2
12-01 12:31:23.070 12779 12779 E wdf_jni : [wifi_wfd]client id: dd:0d:49:eb:a2:8a$his$8F34B2_vidaacommon_001
12-01 12:31:23.070 12779 12779 E wdf_jni : [wifi_wfd]username: his$6239759786165851619
12-01 12:31:23.070 12779 12779 E wdf_jni : [wifi_wfd]time_sum: 6, remainder: 6
12-01 12:31:23.070 12779 12779 E wdf_jni : [wifi_wfd]value: his6h!i@s#$v%i^d&a*a, value_md5: 5CBB55
12-01 12:31:23.070 12779 12779 E wdf_jni : [wifi_wfd]password before md5: 1764588683$5CBB55, password: FCCB0A5D9B0C927C6D7561986CB8DADD

...

12-01 12:31:44.363 12779 12779 E wdf_jni : [wifi_wfd]ConnectUtils getConnectUser: uuid: dd:0d:49:eb:a2:8a, brand: his, operation: vidaacommon, time: 1764588704, flag: 1
12-01 12:31:44.363 12779 12779 E wdf_jni : [wifi_wfd]pattern: 38D65DC30F45109A369A86FCE866A85B
12-01 12:31:44.363 12779 12779 E wdf_jni : [wifi_wfd]race: 38D65DC30F45109A369A86FCE866A85B$dd:0d:49:eb:a2:8a, race_md5: 8F34B2
12-01 12:31:44.363 12779 12779 E wdf_jni : [wifi_wfd]client id: dd:0d:49:eb:a2:8a$his$8F34B2_vidaacommon_001
12-01 12:31:44.363 12779 12779 E wdf_jni : [wifi_wfd]username: his$6239759786165851592
12-01 12:31:44.363 12779 12779 E wdf_jni : [wifi_wfd]time_sum: 0, remainder: 0
12-01 12:31:44.363 12779 12779 E wdf_jni : [wifi_wfd]value: his0h!i@s#$v%i^d&a*a, value_md5: D2AB6F
12-01 12:31:44.364 12779 12779 E wdf_jni : [wifi_wfd]password before md5: 1764588704$D2AB6F, password: 83754D6E1CBB35BF506288810B7ABD68

...

12-01 12:32:05.162 12779 12811 E wdf_jni : [wifi_wfd]ConnectUtils getConnectUser: uuid: dd:0d:49:eb:a2:8a, brand: his, operation: vidaacommon, time: 1764588725, flag: 1
12-01 12:32:05.162 12779 12811 E wdf_jni : [wifi_wfd]pattern: 38D65DC30F45109A369A86FCE866A85B
12-01 12:32:05.162 12779 12811 E wdf_jni : [wifi_wfd]race: 38D65DC30F45109A369A86FCE866A85B$dd:0d:49:eb:a2:8a, race_md5: 8F34B2
12-01 12:32:05.162 12779 12811 E wdf_jni : [wifi_wfd]client id: dd:0d:49:eb:a2:8a$his$8F34B2_vidaacommon_001
12-01 12:32:05.162 12779 12811 E wdf_jni : [wifi_wfd]username: his$6239759786165851613
12-01 12:32:05.162 12779 12811 E wdf_jni : [wifi_wfd]time_sum: 3, remainder: 3
12-01 12:32:05.162 12779 12811 E wdf_jni : [wifi_wfd]value: his3h!i@s#$v%i^d&a*a, value_md5: C9C4D3
12-01 12:32:05.162 12779 12811 E wdf_jni : [wifi_wfd]password before md5: 1764588725$C9C4D3, password: F552BF38B24FB9D8BBCACC0FFDBF0F8D

...

12-01 12:32:05.194 12779 12811 E wdf_jni : [wifi_wfd]ConnectUtils getConnectUser: uuid: dd:0d:49:eb:a2:8a, brand: his, operation: vidaavoice, time: 1764588725, flag: 1
12-01 12:32:05.194 12779 12811 E wdf_jni : [wifi_wfd]pattern: 38D65DC30F45109A369A86FCE866A85B
12-01 12:32:05.195 12779 12811 E wdf_jni : [wifi_wfd]race: 38D65DC30F45109A369A86FCE866A85B$dd:0d:49:eb:a2:8a, race_md5: 8F34B2
12-01 12:32:05.195 12779 12811 E wdf_jni : [wifi_wfd]client id: dd:0d:49:eb:a2:8a$his$8F34B2_vidaavoice_001
12-01 12:32:05.195 12779 12811 E wdf_jni : [wifi_wfd]username: his$6239759786165851613
12-01 12:32:05.195 12779 12811 E wdf_jni : [wifi_wfd]time_sum: 3, remainder: 3
12-01 12:32:05.195 12779 12811 E wdf_jni : [wifi_wfd]value: his3h!i@s#$v%i^d&a*a, value_md5: C9C4D3
12-01 12:32:05.195 12779 12811 E wdf_jni : [wifi_wfd]password before md5: 1764588725$C9C4D3, password: F552BF38B24FB9D8BBCACC0FFDBF0F8D

...

12-01 12:40:42.146 12779 12779 E wdf_jni : [wifi_wfd]ConnectUtils getConnectUser: uuid: dd:0d:49:eb:a2:8a, brand: his, operation: vidaacommon, time: 1764589242, flag: 1
12-01 12:40:42.147 12779 12779 E wdf_jni : [wifi_wfd]pattern: 38D65DC30F45109A369A86FCE866A85B
12-01 12:40:42.147 12779 12779 E wdf_jni : [wifi_wfd]race: 38D65DC30F45109A369A86FCE866A85B$dd:0d:49:eb:a2:8a, race_md5: 8F34B2
12-01 12:40:42.147 12779 12779 E wdf_jni : [wifi_wfd]client id: dd:0d:49:eb:a2:8a$his$8F34B2_vidaacommon_001
12-01 12:40:42.147 12779 12779 E wdf_jni : [wifi_wfd]username: his$6239759786165852114
12-01 12:40:42.147 12779 12779 E wdf_jni : [wifi_wfd]time_sum: 8, remainder: 8
12-01 12:40:42.147 12779 12779 E wdf_jni : [wifi_wfd]value: his8h!i@s#$v%i^d&a*a, value_md5: EA9591
12-01 12:40:42.147 12779 12779 E wdf_jni : [wifi_wfd]password before md5: 1764589242$EA9591, password: 893CAED3F608936769DCAB69384B47CD

...

12-01 12:40:42.241 12779 12779 E wdf_jni : [wifi_wfd]ConnectUtils getConnectUser: uuid: dd:0d:49:eb:a2:8a, brand: his, operation: vidaavoice, time: 1764589242, flag: 1
12-01 12:40:42.241 12779 12779 E wdf_jni : [wifi_wfd]pattern: 38D65DC30F45109A369A86FCE866A85B
12-01 12:40:42.241 12779 12779 E wdf_jni : [wifi_wfd]race: 38D65DC30F45109A369A86FCE866A85B$dd:0d:49:eb:a2:8a, race_md5: 8F34B2
12-01 12:40:42.241 12779 12779 E wdf_jni : [wifi_wfd]client id: dd:0d:49:eb:a2:8a$his$8F34B2_vidaavoice_001
12-01 12:40:42.241 12779 12779 E wdf_jni : [wifi_wfd]username: his$6239759786165852114
12-01 12:40:42.241 12779 12779 E wdf_jni : [wifi_wfd]time_sum: 8, remainder: 8
12-01 12:40:42.241 12779 12779 E wdf_jni : [wifi_wfd]value: his8h!i@s#$v%i^d&a*a, value_md5: EA9591
12-01 12:40:42.241 12779 12779 E wdf_jni : [wifi_wfd]password before md5: 1764589242$EA9591, password: 893CAED3F608936769DCAB69384B47CD

...

12-01 12:40:44.252 12779 12779 E wdf_jni : [wifi_wfd]ConnectUtils getConnectUser: uuid: dd:0d:49:eb:a2:8a, brand: his, operation: vidaacommon, time: 1764589244, flag: 1
12-01 12:40:44.253 12779 12779 E wdf_jni : [wifi_wfd]pattern: 38D65DC30F45109A369A86FCE866A85B
12-01 12:40:44.253 12779 12779 E wdf_jni : [wifi_wfd]race: 38D65DC30F45109A369A86FCE866A85B$dd:0d:49:eb:a2:8a, race_md5: 8F34B2
12-01 12:40:44.253 12779 12779 E wdf_jni : [wifi_wfd]client id: dd:0d:49:eb:a2:8a$his$8F34B2_vidaacommon_001
12-01 12:40:44.253 12779 12779 E wdf_jni : [wifi_wfd]username: his$6239759786165852116
12-01 12:40:44.253 12779 12779 E wdf_jni : [wifi_wfd]time_sum: 0, remainder: 0
12-01 12:40:44.254 12779 12779 E wdf_jni : [wifi_wfd]value: his0h!i@s#$v%i^d&a*a, value_md5: D2AB6F
12-01 12:40:44.254 12779 12779 E wdf_jni : [wifi_wfd]password before md5: 1764589244$D2AB6F, password: E5AE6E6511A86CE7CA6B87B4AAB5323E

...

12-01 12:40:44.311 12779 12779 E wdf_jni : [wifi_wfd]ConnectUtils getConnectUser: uuid: dd:0d:49:eb:a2:8a, brand: his, operation: vidaavoice, time: 1764589244, flag: 1
12-01 12:40:44.311 12779 12779 E wdf_jni : [wifi_wfd]pattern: 38D65DC30F45109A369A86FCE866A85B
12-01 12:40:44.311 12779 12779 E wdf_jni : [wifi_wfd]race: 38D65DC30F45109A369A86FCE866A85B$dd:0d:49:eb:a2:8a, race_md5: 8F34B2
12-01 12:40:44.311 12779 12779 E wdf_jni : [wifi_wfd]client id: dd:0d:49:eb:a2:8a$his$8F34B2_vidaavoice_001
12-01 12:40:44.311 12779 12779 E wdf_jni : [wifi_wfd]username: his$6239759786165852116
12-01 12:40:44.311 12779 12779 E wdf_jni : [wifi_wfd]time_sum: 0, remainder: 0
12-01 12:40:44.311 12779 12779 E wdf_jni : [wifi_wfd]value: his0h!i@s#$v%i^d&a*a, value_md5: D2AB6F
12-01 12:40:44.311 12779 12779 E wdf_jni : [wifi_wfd]password before md5: 1764589244$D2AB6F, password: E5AE6E6511A86CE7CA6B87B4AAB5323E

I can confirm that manually connecting via MQTTX to mqtts://ip:36669 using the logged credentials and the client certificate found here is possible.

Note that the logged uuid isn't the MAC address of either my smartphone WiFi interface, Bluetooth interface nor my TVs WiFi interface. Not idea where it comes from. Maybe a random one generated by Android for privacy.

Also note that the client ID suffix switches between _vidaacommon_001 and _vidaavoice_001.

[PeterBurner]

I got the script working after changing the password salt in line 288

hisense/hisense.py

Line 288 in baef412

third_hash = self.string_to_hash(f"his{last_digit_of_cross_sum}h*i&s%e!r^v0i1c9")

to

        third_hash = self.string_to_hash(f"his{last_digit_of_cross_sum}h!i@s#$v%i^d&a*a")

[PeterBurner]

@nikagersonlohman would it be possible to add a transport protocol detection to your script? Please note that some TVs use port 18400 instead of 38400 to provide the device description XML.

Or maybe add an integer transport_protocol argument instead of the new_auth boolean.

[nikagl]

@PeterBurner sorry, I do not use/develop this anymore... I initially created based on the other provided scripts but as HASS and Hisense have HomeKit support (for the basic operations only) it is sufficient for me

[Sablic]

@PeterBurner I have played around with what @nikagl done and AI. Created the HA integration for hisense_tv. That is the pet project but I'm open to suggestions and contributoins. https://github.com/Sablic/hisense_tv