The best way to do any UPnP crap is obviously CyberLink
My code uses CyberLink for C++.

The best way to perform upnp search and discovery is to create a UPnP control point to search for "urn:schemas-upnp-org:device:MediaRenderer:1". I basically know jack shit about UPnP. Anyway, in your control point's callback for notify received, if it's not a discover or byebye, then you probably have a response to your search. As I said, I know very little about UPnP. Just enough to make it work in a small (non-robust) setting.

(Warning... while writing this I don't have any packet dumps handy, so a lot of this is from reading code I have written trying to remember the protocol)

Once you get a response back with nt "urn:schemas-microsoft-com:nhed:presence:1", you'll want to save the location and port. When the device actually responds to your search (later on) you'll need this. Not sure why I didn't just send the query after receiving the presence response. Anyway, after receiving the search response you send a query to either port + 1 or port + 2 (where port is the port you saved from the presence response). I'm not certain why it's one or the other... but it seems like the Xbox 360 responds on port+1 after it's client key info is gone, but port+2 when the client key info still exists. I always just tried with both and set a timeout on the socket.

Sending the query is part of Key Exchange.