Technical details, CP6 and TR2, Hacking.

! THIS IS NO DISCUSSION POST ! 

ONLY POST TECHNICAL DETAILS.....

 

Sorry for the shouting above, We need to keep technical details as clean as possible. Discussions need to find a place elsewhere. If you're not sure if you should post something then please consult me.


Background info:

NEEO Brain => CP6
NEEO Remote => TR2

Reply
5replies Oldest first
  • Oldest first
  • Newest first
  • Active threads
  • Popular
  • Firmwares CP6

    Get CP6 in recovery mode by holding the CP6 pair button and plug in the power.

    CP6 recovery:
    UI:        http://<BRAIN_IP>/checkforfirmware?server=https%3A%2F%2Fneeo-cp6-recovery.s3.amazonaws.com
    CP6:    https://neeo-cp6-recovery.s3.amazonaws.com/firmware_info.txt
    UI:        http://<BRAIN_IP>/downloadfirmware?server=https%3A%2F%2Fneeo-cp6-recovery.s3.amazonaws.com
    CP6:    https://neeo-cp6-recovery.s3.amazonaws.com/neeo_firmware_0.50.6-20180424-481315c-0523-151625_emmc.img
    

    It is possible to tel the brain to fetch the firmware from another location.
    Image is encrypted.

     

    root@kali:~/CP6# binwalk neeo_firmware_0.50.6-20180424-481315c-0523-151625_emmc.img
    
    DECIMAL       HEXADECIMAL     DESCRIPTION
    --------------------------------------------------------------------------------
    0             0x0             OpenSSL encryption, salted, salt: 0x-518658326412886F
    11246143      0xAB9A3F        MySQL MISAM compressed data file Version 6
    207273445     0xC5ABDE5       MySQL ISAM index file Version 7
    
    Reply Like
  • Firmware TR2

    TR2 images are stored locally on the brain and can be downloaded using:

    Firmware images:
    http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/neeo.xml
    http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/neeo_release.bin
    http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/recovery_release.bin
    http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/bootloader_release.bin
    

    Firmware seems not encrypted. ;-)

    root@kali:~/TR2_0.53.8# binwalk bootloader_release.bin
    
    DECIMAL       HEXADECIMAL     DESCRIPTION
    --------------------------------------------------------------------------------
    200252        0x30E3C         D-Link ROMFS filesystem, version 1.0, little endian, size: <= 21024
    222604        0x3658C         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/fs-ecos.c"
    222642        0x365B2         eCos RTOS string reference: "ecos.c"
    227412        0x37854         CRC32 polynomial table, little endian
    230440        0x38428         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/scan.c"
    230680        0x38518         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodelist.c"
    230988        0x3864C         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/debug.h"
    231368        0x387C8         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodemgmt.c"
    232248        0x38B38         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/readinode.c"
    236668        0x39C7C         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/gc.c"
    237772        0x3A0CC         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/write.c"
    239484        0x3A77C         eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/memblock.cpp"
    240604        0x3ABDC         eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/uexception.cpp"
    241348        0x3AEC4         eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/ustring.cpp"
    242040        0x3B178         eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/mistream.cpp"
    245600        0x3BF60         eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/bktrace.cpp"
    
    root@kali:~/TR2_0.53.8# binwalk recovery_release.bin
    
    DECIMAL       HEXADECIMAL     DESCRIPTION
    --------------------------------------------------------------------------------
    270256        0x41FB0         D-Link ROMFS filesystem, version 1.0, little endian, size: <= 74240
    384020        0x5DC14         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/fs-ecos.c"
    384058        0x5DC3A         eCos RTOS string reference: "ecos.c"
    389096        0x5EFE8         eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/memblock.cpp"
    390216        0x5F448         eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/uexception.cpp"
    390768        0x5F670         eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/ustring.cpp"
    391488        0x5F940         eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/mistream.cpp"
    394516        0x60514         CRC32 polynomial table, little endian
    397544        0x610E8         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/scan.c"
    397784        0x611D8         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodelist.c"
    398092        0x6130C         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/debug.h"
    398472        0x61488         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodemgmt.c"
    399368        0x61808         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/readinode.c"
    403772        0x6293C         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/gc.c"
    404876        0x62D8C         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/write.c"
    406564        0x63424         eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/bktrace.cpp"
    
    root@kali:~/TR2_0.53.8# binwalk neeo_release.bin
    
    DECIMAL       HEXADECIMAL     DESCRIPTION
    --------------------------------------------------------------------------------
    576556        0x8CC2C         Unix path: /dev/flash/0/0,0xFF0000
    577064        0x8CE28         D-Link ROMFS filesystem, version 1.0, little endian, size: <= 390240
    1020084       0xF90B4         TIFF image data, big-endian, offset of first image directory: 264
    1030832       0xFBAB0         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/fs-ecos.c"
    1030870       0xFBAD6         eCos RTOS string reference: "ecos.c"
    1038536       0xFD8C8         CRC32 polynomial table, little endian
    1041564       0xFE49C         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/scan.c"
    1041828       0xFE5A4         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodelist.c"
    1042148       0xFE6E4         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/debug.h"
    1042756       0xFE944         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodemgmt.c"
    1043632       0xFECB0         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/readinode.c"
    1046080       0xFF640         eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/gc.c"
    1048824       0x1000F8        eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/write.c"
    1049820       0x1004DC        eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/memblock.cpp"
    1050188       0x10064C        eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/uexception.cpp"
    1051340       0x100ACC        eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/ustring.cpp"
    1051520       0x100B80        eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/mistream.cpp"
    1052832       0x1010A0        eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/bktrace.cpp"
    
    root@kali:~/TR2_0.53.8#
    Reply Like
  • TR2 Workings.

    TR2 works partially on http/3000 and partially UDP.

    URL's used by TR2:

    Updated component data:
    http://10.2.1.61:3000/projects/home/tr2/guidata_xml
    
    GUI:
    http://10.2.1.61:3000/projects/home/tr2/gui_xml/
    

    Collection of my discovery tools https://github.com/nklerk/FakeBrainTool

    The code isn't written to be pretty, it's written for me as a tool and have tried different stuff and old tries are not cleaned up at the moment. Use it as is, Cannot provide support on it as is, this will however get you up to speed.

    Reply Like
  • My API brain dump

    == Change Brain Name ==
    http://10.2.1.62:3000/projects/home
    PUT {"label": "Slaapkamer"}
    
    http://10.2.1.7:80/json.htm?type=command&param=udevice&idx=479&nvalue=0&svalue=10
    http://10.2.1.7/json.htm?type=command&param=udevice&idx=479&nvalue=0&svalue=0
    
    CP6 recovery:
    UI:        http://10.2.1.221/checkforfirmware?server=https%3A%2F%2Fneeo-cp6-recovery.s3.amazonaws.com
    CP6:    https://neeo-cp6-recovery.s3.amazonaws.com/firmware_info.txt
    UI:        http://10.2.1.221/downloadfirmware?server=https%3A%2F%2Fneeo-cp6-recovery.s3.amazonaws.com
    CP6:    https://neeo-cp6-recovery.s3.amazonaws.com/neeo_firmware_0.50.6-20180424-481315c-0523-151625_emmc.img
    
    == 3000 TR2 ==
    
    Updated component data:
    http://<BRAIN_IP>:3000/projects/home/tr2/guidata_xml
    
    UI Info:
    http://<BRAIN_IP>:3000/projects/home/tr2/gui_xml/
    
    Firmware images:
    http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/neeo.xml
    http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/neeo_release.bin
    http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/recovery_release.bin
    http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/bootloader_release.bin
    
    == 3000 API ===
    
    Blink NEEO LED:
    http://<BRAIN_IP>:3000/v1/systeminfo/identbrain
    
    System Info:
    http://<BRAIN_IP>:3000/v1/systeminfo/
    
    API:
    http://<BRAIN_IP>:3000/v1/api/Recipes
    http://<BRAIN_IP>:3000/v1/api/activeRecipes
    http://<BRAIN_IP>:3000/v1/projects/home/activate
    http://<BRAIN_IP>:3000/v1/projects/home/activescenariokeys
    http://<BRAIN_IP>:3000/v1/firmware
    http://<BRAIN_IP>:3000/v1/firmware/check
    http://<BRAIN_IP>:3000/v1/wifi/settings
    http://<BRAIN_IP>:3000/v1/systeminfo/lan-address
    http://<BRAIN_IP>:3000/v1/wifi/scan
    http://<BRAIN_IP>:3000/v1/account/backups
    http://<BRAIN_IP>:3000/v1/projects/home/rooms?details=false
    http://<BRAIN_IP>:3000/v1/projects/home/rooms?details=true
    http://<BRAIN_IP>:3000/v1/neeoremote/neeolink
    GET http://<BRAIN_IP>:3000/v1/projects/home/configured    {"configured": false}, {"configured": true}
    PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6232364703805341696?details=false
    PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6232364703805341696/devices/6343136864072892416 {"useTuner":true}
    GET http://<BRAIN_IP>:3000/v1/devicespecs/search?q=test
    GET http://<BRAIN_IP>:3000/v1/devicespecs/duiro24548
    GET http://<BRAIN_IP>:3000/v1/projects/home/scheduleactivation
    POST http://<BRAIN_IP>:3000/v1/firmware/update
    
    Rename NEEO,->
    
    Add room name.
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms?details=false
    
    PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6232364703805341696?details=false {"name":"Basement","key":"6232364703805341696","weight":6232364703805342000,"hasController":true,"nrDevices":0}
    
    Is Active?
    
    http://<BRAIN_IP>:3000/v1/api/recipes
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6270339705313689600/recipes/6270690949668536320/isactive
    
    #all config:
    http://<BRAIN_IP>:3000/v1/projects/home/
    
    #rooms:
    get http://<BRAIN_IP>:3000/v1/projects/home/rooms/
    
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440 //Huiskamer
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100195254173696 //Slaapkamer
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616 //test
    
    #devices:
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100195254173696/devices/6251107472669409280 Sonos
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/devices/6252410530883960832 Kodi
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/devices/6253167273914138624
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/devices/6253205610192437248
    
    #Trigger macros.
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/devices/6253290246809583616/macros/6253290246901858304/trigger
    
    #Recipes
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440/recipes/6251104961917091840    //TV On        execute
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440/recipes/6251104962126807040    //TV Off    execute
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440/recipes/6251104961917091840/execute
    
    #Scenarios
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440/scenarios/6251104961757708288/
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440/scenarios/6251104961757708288/poweroff
    
    ## Rename Device
    post http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/devices/6235895575712104448/rename
    {"name":"HTPC"}
    
    ## Add Steps
    POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6236561675235885056/steps
    {"idx":-1,"type":"controls","scenarioKey":"6235894005670871040","scenarioName":"TV","label":"Show \"TV\" controls"}
    
    ## Edit Steps
    POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6236561675235885056/steps/6
    {"type":"controls","label":"Show \"TV\" controls","scenarioKey":"6235894005670871040","scenarioName":"TV","client":true,"idx":6}
    
    ## Reorder Steps
    PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6236561675235885056/steps/reorder
    {"from":6,"to":5}
    
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6235894005809283072/execute
    
    GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235894005670871040/poweroff
    
    GET http://<BRAIN_IP>:3000/v1/projects/home/activescenariokeys
    
    ## start channel 3
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6254713121189920768/devices/6254717517139279872/favorites/3/trigger
    
    ## Press a Button.
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6255382548696793088/devices/6255382711939104768/macros/6255382712043962368/trigger
    
    ## Press a button.
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6254713121189920768/devices/6254717517139279872/macros/6254717517164445696/trigger
    
    ## Set Slider to value
    PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6255382548696793088/devices/6258004627891945472/sliders/6258004627963248640
    {"value":24}
    
    ## set switch
    PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6254713121189920768/devices/6256505782070673408/switches/6256505782175531008/on
    PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6254713121189920768/devices/6256505782070673408/switches/6256505782175531008/off
    
    POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6235894005809283072/steps
    {"idx":-1,"type":"volume","deviceKey":"6235893934984265728","deviceName":"TV","label":"Use \"TV\" volume"}
    
    ### Adding Custom volume controlls. ###
    POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6243486710882107392/steps
    {"idx":-1,"type":"volume","deviceKey":"6240127059490766848","deviceName":"Versterker","label":"Use \"Versterker\" volume"}
    {"idx":-1,"type":"volume","deviceKey":"6240127059490766848","deviceName":"Versterker","label":"Use \"Versterker\" volume"}
    Recipe:  6243486710882107392
    Vol dev: 6240127059490766848
    Content-Type: application/json
    
    POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6236561675235885056/steps
    {"idx":-1,"type":"volume","deviceKey":"6235894225590812672","deviceName":"Versterker","label":"Use \"Versterker\" volume"}
    
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235894005670871040/shortcuts?deviceKey=6235893934984265728&deviceName=TV&deviceRoomKey=6235892692870496256&deviceRoomName=Huiskamer
    {"componentName":"DIGIT 0","componentLabel":"DIGIT 0","componentType":"button","componentKey":"6235893935416279040","deviceName":"TV","deviceRoomName":"Huiskamer","deviceRoomKey":"6235892692870496256","deviceKey":"6235893934984265728"}
    
    DELETE
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235894005670871040/shortcuts/6238812060881256448
    
    DELETE
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235894005670871040/shortcuts?deviceKey=6235893934984265728&deviceName=TV&deviceRoomKey=6235892692870496256&deviceRoomName=Huiskamer
    
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235893936234168320/shortcuts?deviceKey=6235893934984265728&deviceName=TV&deviceRoomKey=6235892692870496256&deviceRoomName=Huiskamer
    
    There was something fishy going on: "[ngRepeat:dupes] Duplicates in a repeater are not allowed. Use 'track by' expression to specify unique keys. Repeater: macro in $ctrl.shortcuts.button, Duplicate key: undefined:undefined, Duplicate value: undefined
    http://errors.angularjs.org/1.5.7/ngRepeat/dupes?p0=macro%20in%20%24ctrl.shortcuts.button&amp;p1=undefined%3Aundefined&amp;p2=undefined"
    
    Delete:
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235895853014319104/shortcuts/6238817644733005824
    
    GET http://<BRAIN_IP>:3000/v1/projects/home/activate
    
    GET http://<BRAIN_IP>:3000/v1/projects/home/activescenariokeys
    
    GET http://<BRAIN_IP>:3000/v1/firmware
    
    POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/devices/6235893934984265728/favorites/76?limit=-1
    {"channel":{"name":"Latest TV","language":"en","country":"GB","logoUrl":"https://channel-icons.s3.amazonaws.com/c3b6fc2e-4306-4e88-b035-e7f2eae20c28.png.thumb.png"},"channelNr":"1999"}
    
    {"channel":{"name":"Secret Circle","language":"nl","country":"NL","logoUrl":"http://www.nielsdeklerk.nl/ss.png"},"channelNr":"791"}
    
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6239176862501699584/steps
    {"idx":-1,"type":"volume","deviceKey":"6235894225590812672","deviceName":"Versterker","label":"Use \"Versterker\" volume"}
    
    ## Getting a Directory in:
    
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/devices/6254205943295246336// Kodi
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/scenarios/6254205949775446016
    
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100195254173696/devices/6251107472669409280 // Sonos
    http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100195254173696/scenarios/6251107483654291456
    
    [{"id":1,"adapterName":"homey_Switch_1","type":"GAMECONSOLE","manufacturer":"Nintendo","name":"Switch","tokens":"Homey","device":{"name":"Switch","tokens":["Homey","Athom"]},"setup":{},"capabilities":[]},{"id":2,"adapterName":"homey_Wii-U_2","type":"GAMECONSOLE","manufacturer":"Nintendo","name":"Wii U","tokens":"Homey","device":{"name":"Wii U","tokens":["Homey","Athom"]},"setup":{},"capabilities":[]},{"id":4,"adapterName":"homey_Homey_4","type":"LIGHT","manufacturer":"Athom","name":"Homey","tokens":"Homey","device":{"name":"Homey","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"sensor","name":"LEDRING_SENSOR","label":"Ledring","path":"/device/homey_Homey_4/LEDRING_SENSOR","sensor":{"type":"binary","value":false}},{"type":"switch","name":"LEDRING","label":"Ledring","path":"/device/homey_Homey_4/LEDRING","sensor":"LEDRING_SENSOR"},{"type":"sensor","name":"VOICE_SENSOR","label":"Voice","path":"/device/homey_Homey_4/VOICE_SENSOR","sensor":{"type":"binary","value":false}},{"type":"switch","name":"VOICE","label":"Voice","path":"/device/homey_Homey_4/VOICE","sensor":"VOICE_SENSOR"},{"type":"sensor","name":"MUSIC_SENSOR","label":"Music","path":"/device/homey_Homey_4/MUSIC_SENSOR","sensor":{"type":"binary","value":false}},{"type":"switch","name":"MUSIC","label":"Music","path":"/device/homey_Homey_4/MUSIC","sensor":"MUSIC_SENSOR"}]},{"id":5,"adapterName":"homey_Tuner_5","type":"TUNER","manufacturer":"Onkyo","name":"Tuner","tokens":"Homey","device":{"name":"Tuner","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"button","name":"POWER ON","label":"Power On","path":"/device/homey_Tuner_5/POWER ON"},{"type":"button","name":"POWER OFF","label":"Power Off","path":"/device/homey_Tuner_5/POWER OFF"},{"type":"button","name":"0","label":"0","path":"/device/homey_Tuner_5/0"},{"type":"button","name":"1","label":"1","path":"/device/homey_Tuner_5/1"},{"type":"button","name":"2","label":"2","path":"/device/homey_Tuner_5/2"},{"type":"button","name":"3","label":"3","path":"/device/homey_Tuner_5/3"},{"type":"button","name":"4","label":"4","path":"/device/homey_Tuner_5/4"},{"type":"button","name":"5","label":"5","path":"/device/homey_Tuner_5/5"},{"type":"button","name":"6","label":"6","path":"/device/homey_Tuner_5/6"},{"type":"button","name":"7","label":"7","path":"/device/homey_Tuner_5/7"},{"type":"button","name":"8","label":"8","path":"/device/homey_Tuner_5/8"},{"type":"button","name":"9","label":"9","path":"/device/homey_Tuner_5/9"},{"type":"sensor","name":"POWER_SENSOR","label":"Power","path":"/device/homey_Tuner_5/POWER_SENSOR","sensor":{"type":"binary","value":false}},{"type":"switch","name":"POWER","label":"Power","path":"/device/homey_Tuner_5/POWER","sensor":"POWER_SENSOR"},{"type":"sensor","name":"VOLUME_SENSOR","label":"Volume","path":"/device/homey_Tuner_5/VOLUME_SENSOR","sensor":{"type":"range","range":[0,60],"unit":"dB","value":0}},{"type":"slider","name":"VOLUME","label":"Volume","path":"/device/homey_Tuner_5/VOLUME","slider":{"type":"range","sensor":"VOLUME_SENSOR","range":[0,60],"unit":"dB"}}]},{"id":6,"adapterName":"homey_Test-Light_6","type":"LIGHT","manufacturer":"Niels de Klerk","name":"Test Light","tokens":"Homey","device":{"name":"Test Light","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"button","name":"BUTTON","label":"Button","path":"/device/homey_Test-Light_6/BUTTON"},{"type":"sensor","name":"SWITCH_SENSOR","label":"Switch","path":"/device/homey_Test-Light_6/SWITCH_SENSOR","sensor":{"type":"binary","value":false}},{"type":"switch","name":"SWITCH","label":"Switch","path":"/device/homey_Test-Light_6/SWITCH","sensor":"SWITCH_SENSOR"},{"type":"sensor","name":"SLIDER_SENSOR","label":"Slider","path":"/device/homey_Test-Light_6/SLIDER_SENSOR","sensor":{"type":"range","range":[0,100],"unit":"%","value":0}},{"type":"slider","name":"SLIDER","label":"Slider","path":"/device/homey_Test-Light_6/SLIDER","slider":{"type":"range","sensor":"SLIDER_SENSOR","range":[0,100],"unit":"%"}}]},{"id":7,"adapterName":"homey_Kodi_7","type":"MEDIAPLAYER","manufacturer":"NDK","name":"Kodi","tokens":"Homey","device":{"name":"Kodi","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"button","name":"POWER ON","label":"POWER ON","path":"/device/homey_Kodi_7/POWER ON"},{"type":"button","name":"POWER OFF","label":"POWER OFF","path":"/device/homey_Kodi_7/POWER OFF"},{"type":"button","name":"PLAY","label":"PLAY","path":"/device/homey_Kodi_7/PLAY"},{"type":"button","name":"PAUSE","label":"PAUSE","path":"/device/homey_Kodi_7/PAUSE"},{"type":"button","name":"STOP","label":"STOP","path":"/device/homey_Kodi_7/STOP"},
        {"type":"button","name":"ENTER","label":"ENTER","path":"/device/homey_Kodi_7/ENTER"},
        {"type":"button","name":"SELECT","label":"SELECT","path":"/device/homey_Kodi_7/SELECT"},
        {"type":"directory","name": "SONOS_QUEUE_DIRECTORY","label": "Movies0","path": "device/homey_Kodi_7/browse","directoryId": "movies","directoryType": "list","adapterName":"homey_Kodi_7"},
        {"type":"directory","name": "SPOTIFY_BROWSE_DIRECTORY","label": "Movies1","path": "device/homey_Kodi_7/browse","directoryId": "movies","directoryType": "browse","adapterName":"homey_Kodi_7"},
        {"type":"directory","name": "SONOS_BROWSE_DIRECTORY","label": "Movies2","path": "device/homey_Kodi_7/browse","directoryId": "movies","directoryType": "browse","adapterName":"directory"}
    ]}]
    
    "directories":{
    "SONOS_QUEUE_DIRECTORY":        {"name":"SONOS_QUEUE_DIRECTORY",    "label":"Sonos Queue",        "path":"/sonos/queue/browse",    "directoryId":"sonos",    "directoryType":"list",        "adapterName":"device",        "adapterDeviceId":"Slaapkamer","key":"6251107472698769408"},
    "SPOTIFY_BROWSE_DIRECTORY":        {"name":"SPOTIFY_BROWSE_DIRECTORY",    "label":"Spotify",            "path":"/spotify/browse",        "directoryId":"spotify","directoryType":"browse",    "adapterName":"directory",    "adapterDeviceId":"Slaapkamer","key":"6251107472707158016"},
    "SONOS_BROWSE_DIRECTORY":        {"name":"SONOS_BROWSE_DIRECTORY",    "label":"Sonos Directory",    "path":"/sonos/browse",            "directoryId":"sonos",    "directoryType":"browse",    "adapterName":"device",        "adapterDeviceId":"Slaapkamer","key":"6251107472715546624"}},
    
    {"id":7,"adapterName":"homey_Kodi_7","type":"MEDIAPLAYER","manufacturer":"NDK","name":"Kodi","tokens":"Homey","device":{"name":"Kodi","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"button","name":"POWER ON","label":"POWER ON","path":"/device/homey_Kodi_7/POWER ON"},{"type":"button","name":"POWER OFF","label":"POWER OFF","path":"/device/homey_Kodi_7/POWER OFF"},{"type":"button","name":"PLAY","label":"PLAY","path":"/device/homey_Kodi_7/PLAY"},{"type":"button","name":"PAUSE","label":"PAUSE","path":"/device/homey_Kodi_7/PAUSE"},{"type":"button","name":"STOP","label":"STOP","path":"/device/homey_Kodi_7/STOP"},{"type":"button","name":"ENTER","label":"ENTER","path":"/device/homey_Kodi_7/ENTER"},{"type":"button","name":"SELECT","label":"SELECT","path":"/device/homey_Kodi_7/SELECT"},{"type":"directory","name":"SONOS_QUEUE_DIRECTORY","label":"Movies0","path":"device/homey_Kodi_7/browse","directoryId":"movies","directoryType":"list","adapterName":"homey_Kodi_7"},{"type":"directory","name":"SPOTIFY_BROWSE_DIRECTORY","label":"Movies1","path":"device/homey_Kodi_7/browse","directoryId":"movies","directoryType":"browse","adapterName":"homey_Kodi_7"},{"type":"directory","name":"SONOS_BROWSE_DIRECTORY","label":"Movies2","path":"device/homey_Kodi_7/browse","directoryId":"movies","directoryType":"browse","adapterName":"directory"},{"type":"button","name":"SONOS_QUEUE_DIRECTORY","label":"SONOS_QUEUE_DIRECTORY","path":"/device/homey_Kodi_7/SONOS_QUEUE_DIRECTORY"},{"type":"button","name":"SONOS QUEUE DIRECTORY","label":"SONOS QUEUE DIRECTORY","path":"/device/homey_Kodi_7/SONOS QUEUE DIRECTORY"},{"type":"button","name":"BROWSE","label":"BROWSE","path":"/device/homey_Kodi_7/BROWSE"},{"type":"button","name":"LIST","label":"LIST","path":"/device/homey_Kodi_7/LIST"},{"type":"button","name":"DIRECTORY","label":"DIRECTORY","path":"/device/homey_Kodi_7/DIRECTORY"}]}
    {"id":8,"adapterName":"homey_Kodi_8","type":"SONOS","manufacturer":"Sonos","name":"Kodi SONOS","tokens":"Homey","device":{"name":"Kodi","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"button","name":"POWER ON","label":"POWER ON","path":"/device/homey_Kodi_8/POWER ON"},{"type":"button","name":"POWER OFF","label":"POWER OFF","path":"/device/homey_Kodi_8/POWER OFF"},{"type":"button","name":"PLAY","label":"PLAY","path":"/device/homey_Kodi_8/PLAY"},{"type":"button","name":"PAUSE","label":"PAUSE","path":"/device/homey_Kodi_8/PAUSE"},{"type":"button","name":"STOP","label":"STOP","path":"/device/homey_Kodi_8/STOP"},{"type":"button","name":"ENTER","label":"ENTER","path":"/device/homey_Kodi_8/ENTER"},{"type":"button","name":"SELECT","label":"SELECT","path":"/device/homey_Kodi_8/SELECT"},{"type":"directory","name":"SONOS_QUEUE_DIRECTORY","label":"Movies0","path":"device/homey_Kodi_8/browse","directoryId":"movies","directoryType":"list","adapterName":"homey_Kodi_8"},{"type":"directory","name":"SPOTIFY_BROWSE_DIRECTORY","label":"Movies1","path":"device/homey_Kodi_8/browse","directoryId":"movies","directoryType":"browse","adapterName":"homey_Kodi_8"},{"type":"directory","name":"SONOS_BROWSE_DIRECTORY","label":"Movies2","path":"device/homey_Kodi_8/browse","directoryId":"movies","directoryType":"browse","adapterName":"directory"},{"type":"button","name":"SONOS_QUEUE_DIRECTORY","label":"SONOS_QUEUE_DIRECTORY","path":"/device/homey_Kodi_8/SONOS_QUEUE_DIRECTORY"},{"type":"button","name":"SONOS QUEUE DIRECTORY","label":"SONOS QUEUE DIRECTORY","path":"/device/homey_Kodi_8/SONOS QUEUE DIRECTORY"},{"type":"button","name":"BROWSE","label":"BROWSE","path":"/device/homey_Kodi_8/BROWSE"},{"type":"button","name":"LIST","label":"LIST","path":"/device/homey_Kodi_8/LIST"},{"type":"button","name":"DIRECTORY","label":"DIRECTORY","path":"/device/homey_Kodi_8/DIRECTORY"}]}
    
    {"name":"TypeError","message":"Cannot read property 'onUpdate' of undefined","stack":"TypeError: Cannot read property 'onUpdate' of undefined\n    at new <anonymous> (http://<BRAIN_IP>:3200/eui/app-38fed2c0de.js:4:8900)\n    at Object.a [as invoke] (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:3:2824)\n    at l.instance (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:3:28721)\n    at h (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:3:15712)\n    at http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:3:21603\n    at a (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:4:18500)\n    at http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:4:18672\n    at p.$eval (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:4:26219)\n    at p.$digest (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:4:24705)\n    at p.$apply (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:4:26502)"}
    
    ## TV channels:
    
    http://10.2.1.28:8080/jsonrpc?request={"jsonrpc":"2.0","id":1,"method":"VideoLibrary.GetRecentlyAddedMovies"}
    http://10.2.1.28:8080/jsonrpc?request={"jsonrpc":"2.0","id":1,"method":"VideoLibrary.GetRecentlyAddedMovies","params":{"fields":"fanart"}}
    {"jsonrpc":"2.0","method":"VideoLibrary.GetMovies","id":"1492861400409","params":{"properties":["title","thumbnail","playcount","lastplayed","dateadded","resume","rating","year","file","genre","writer","director","cast","set","studio","mpaa","fanart"],"limits":{"start":0,"end":14},"sort":{"method":"lastplayed","order":"descending"},"filter":{"operator":"true","field":"inprogress","value":""}}}
    {"jsonrpc":"2.0","method":"VideoLibrary.GetMovies","id":"1492861400413","params":{"properties":["title","thumbnail","playcount","lastplayed","dateadded","resume","rating","year","file","genre","writer","director","cast","set","studio","mpaa","fanart"],"limits":{"start":0,"end":14},"sort":{"method":"dateadded","order":"descending"},"filter":{"operator":"is","field":"playcount","value":"0"}}}
    {"jsonrpc":"2.0","method":"VideoLibrary.GetMovies","id":"1492861400417","params":{"properties":["title","thumbnail","playcount","lastplayed","dateadded","resume","rating","year","file","genre","writer","director","cast","set","studio","mpaa","fanart"],"limits":{"start":0,"end":14},"sort":{"method":"random","order":"descending"}}}
    http://10.2.1.28:8080/image/image%3A%2F%2Fsmb%253a%252f%252f10.2.1.5%252fMedia%252fVideo%252fMovies%252fTarzan%2520(1999)%252fTarzan%2520(1999)-poster.jpg%2F
    
    POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6260456061774331904/devices/6261483120093036544/favorites/0?limit=-1
    
    POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6254713121189920768/devices/6254717517139279872/favorites/0?limit=-1
    {"channel":{"name":"NPO1","language":"nl","country":"NL","logoUrl":"https://neeo-channel-icon.s3.amazonaws.com/245ffa6f-fc29-444c-92e0-33688ace007e.png.thumb.png"},"channelNr":"1"}
    {"channel":{"name":"NPO2","language":"nl","country":"NL","logoUrl":"https://channel-icons.s3.amazonaws.com/a08d2bd9-ee5c-4396-b607-633f3db8871b.png.thumb.png"},"channelNr":"2"}
    {"channel":{"name":"NPO3","language":"nl","country":"NL","logoUrl":"https://neeo-channel-icon.s3.amazonaws.com/2d0b6400-6351-4ae9-a793-b95da1f239e4.png.thumb.png"},"channelNr":"3"}
    
    From NEEO
    GET http://10.2.1.43:6336/apt-d1f926be696c43f162ff2cd653eb1651f19b8909/subscribe/unique-device-id-001/6257921335054303232
        http://10.2.1.8:6336/homey_Homey-LED-ring_21/subscribe/default/6257934191611084800
    
    
    
    =====================================
    DEBUG uriparts[0]
    DEBUG uriparts[1]homey_Homey-LED-ring_21
    DEBUG uriparts[2]subscribe
    DEBUG uriparts[3]default
    DEBUG uriparts[4]6257934834690162688
    DEBUG uriparts[5]undefined
    DEBUG uriparts[6]undefined
    =====================================
    
    http://<BRAIN_IP>:3000/v1/api/notificationkey/Homey_Devicedatabase_10.2.1.8/homey_Homey-LED-ring_21/
    [{"name":"BRIGHTNESS","type":"slider","label":"Brightness","eventKey":"6257934834690162688:BRIGHTNESS_SENSOR"}]
    
    POST http://<BRAIN_IP>:3000/v1/notifications
    {"type":"6257934834690162688:BRIGHTNESS_SENSOR","data":100}
    
    
    Subscribe to Device Driver
    - Registreer uripart[3]                                unique-device-id-001
    - geen idee waar uripart[4] belangrijk voor is.        6257921335054303232
    
    To NEEO
    GET http://<BRAIN_IP>:3000/v1/api/notificationkey/src-331dae2ba62e9fdd766dd270f4b11aed0bff24e4/apt-d1f926be696c43f162ff2cd653eb1651f19b8909/unique-device-id-001
    
    http://<BRAIN_IP>:3000/v1/api/notificationkey/Homey_Devicedatabase_10.2.1.8/homey_Versterker-Volume_18/VOLUME_SENSOR/default
    {"type":"6257978958768242688:VOLUME_SENSOR","data":
    Volume
    }
    
    [{
        "name": "example-slider",
        "type": "slider",
        "label": "my slider",
        "eventKey": "6257921335054303232:EXAMPLE-SLIDER_SENSOR"
    },
    {
        "name": "example-switch",
        "type": "switch",
        "label": "my switch",
        "eventKey": "6257921335054303232:EXAMPLE-SWITCH_SENSOR"
    }]
    
    POST http://neeo-b7503e07.local:3000/v1/notifications
    {"type":"6257921335054303232:EXAMPLE-SLIDER_SENSOR","data": }
    
    {"type":"6258004627891945472:VOLUME_SENSOR,"data":[[volume]]}
    
    {"type":"6263775363747282944:EXAMPLE-TEXT_SENSOR","data":"Update 166"}
    
    Reply Like
  • Rooting progres and CP6 Hardware:

    CP6, Pin2Pwn doesn't work. It's protected.
    Firmware Image is encrypted.

    To gain console access on the CP6, You'll need a TTL UART Serial adapter.
    I'm using this one: https://nl.aliexpress.com/item/USB2-0-to-TTL-UART-5PIN-Module-Serial-Converter-CP2102-STC-PRGMR-with-Metal-case/32649877341.html?spm=a2g0s.9042311.0.0.27424c4dkedeWo

    You need to connect to TX, RX and GND.
    CP6 TX<-> Adapter RX
    CP6 RX<-> Adapter TX
    CP6 GND <-> Adapter GND

     

    Here are more pica's

     

     

     The square chip on the right lower corner is the eMMC chip.
    The 6 resistors left of the chip are lines to the chip. I've used R105 to shorten the eMMC for Pin2PWN.

    The used hardware comes from: https://aw-som.com/ They sell development boards as well making a entry possibly a bit more easy.

    Reply Like 5
Like10 Follow