I was struggling to download control Mac, and then watching data on my network realised that the control 15 and others have a hidden API and webserver, I hav just pulled ALL FIRMWARE and APPS for all its hidden @port 9080
218
ControlMac
ControlOne
ControlPC
Ensemble
ID40
ID41
MS200
MS600
SourceFive
Store
TouchPC
TwinStore

Also rewriting control Mac does not appear difficult as its just simple REST-like HTTP filesystem API and im just testing a python script to upload files into my control15, im not good with coding however it uploaded and need to see what happens may need a couple of better coders than me to create an app or better script here is mine (ran from my linux nas)

Been doing some fairly mad reverse engineering work on Meridian Sooloos import functionality after Meridian effectively abandoned the platform in favour of Roon.

Current goal:
Create an external/open importer so music can be batch-imported into Meridian systems without relying on the old ControlPC/ControlMac workflow.

What we’ve found so far:

* Decompiled Meridian DLLs with `monodis`
* Identified internal import message classes:

* `Sooloos.Msg.Import.CreateLooseFilesMusicProjectRequest`
* `ImportProjectSubscribeRequest`
* `ImportProjectsAddedResponse`
* `AutoImportRequest`
* `AutoImportFileInfo`
* Confirmed Meridian uses HTTP POST messaging via:

* `/message/session/sendrequests`
* `/message/session/getresponses`
* Captured live ControlPC import traffic with Wireshark/tshark
* Extracted active `Message-Session` token from live traffic
* Confirmed imports are driven by JSON-like message payloads
* Confirmed upload flow uses:

* `/Music/incoming/<guid>/trackXX.FLAC`
* `nasproxy`
* Confirmed project creation responses from server:

* `ImportProjectsAddedResponse`
* `ProjectType: LooseMusicFiles`
* Extracted working `ImportDeviceId:sooid`
* Built first Python proof-of-concept script which:

* scans album folders
* extracts FLAC metadata
* builds Meridian-compatible payloads
* POSTs to Meridian endpoints

Current blocker:
Server still rejects manual requests with:

* `Invalid Session Id`
or
* HTTP 400 on malformed/incomplete requests.

So we are extremely close, but likely missing one of:

* session bootstrap/handshake
* precursor auth request
* exact request ordering
* one or two required JSON fields
* correct requestid sequencing

Important discovery:
The protocol is MUCH simpler than expected. It is basically:

* HTTP
* session token
* JSON-ish messaging
* separate upload stage for FLAC files

This no longer looks impossible.

What would help massively from anyone with coding/protocol knowledge:

* understanding Meridian session creation/bootstrap
* reproducing ControlPC login/session establishment
* deeper decoding of sendrequests/getresponses traffic
* identifying required fields for `CreateLooseFilesMusicProjectRequest`
* confirming upload sequencing after project creation
* building a clean Python client

Would love other Sooloos users/devs to take a look before this platform disappears entirely.

Last edited by ChrisSwain; 2026-05-08 15:49.
Various Technical goodies