I have an Onkyo Audio Receiver (AR), and there is an Android app that I can use to control it, change the volume, the channel etc. As a little project at home, I'm working on an app that can control certain functions on my computer.

I'd like to add the same functionality with my receiver into my app, purely as a technical challenge to myself. I know what IP the AR is assigned to (, but I don't know how the app controls it.

Are there any beginning tips on what I can do to figure out how this app works?

The receiver model is TX-NR515, and the app is called OnkyoRemote.

1 Answer 1


I would start by tracing all the traffic coming in and out of your application. A good summary of ways to do that are well documented in this stack overflow answer ().

Once you capture the traffic, examine it, what type of protocol does it use? Chances are, it's something wireshark will recognize, like http.

The next step I'd try is to examine what traffic is generated per each component in your app, for example, start the capture, press only the up command, than examine the traffic to identify the exact command on the wire

  • Thanks for that link, I'll give a few of those suggestions a go. I've also managed to decompile the apk file, so hopefully with capturing traffic, and the source I should be able to figure this out.
    – TMH
    Commented May 11, 2015 at 9:31
  • 2
    It will be interesting to hear what you dig out and how you did it. Every reverse engineer has a quirk on how to examine things and it will benefit further readers to learn about a different approach. Anyhow, good luck! Commented May 11, 2015 at 9:57
  • 1
    Well if I manage to get any headway with this I'll update here to show what method I ended up using.
    – TMH
    Commented May 11, 2015 at 10:00
  • Very interested in this, as well! Please post any developments or progress. Commented May 12, 2015 at 8:19
  • I had to do some digging myself as this was interesting. I did not trace the traffic, but after decompiling the apk, it is obvious the whole thing relies on upnp. If you have a working setup, try capturing the upnp data that is transmitted from the device using the approach from my answer (I can only test the outgoing requests as I use a Denon receiver (;) Commented May 12, 2015 at 8:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.