Technical details, CP6 and TR2, Hacking.
! THIS IS NO DISCUSSION POST !
ONLY POST TECHNICAL DETAILS.....
Sorry for the shouting above, We need to keep technical details as clean as possible. Discussions need to find a place elsewhere. If you're not sure if you should post something then please consult me.
Background info:
NEEO Brain => CP6
NEEO Remote => TR2
Reply
Like
Follow
15
8replies
-
Firmwares CP6
Get CP6 in recovery mode by holding the CP6 pair button and plug in the power.
CP6 recovery: UI: http://<BRAIN_IP>/checkforfirmware?server=https%3A%2F%2Fneeo-cp6-recovery.s3.amazonaws.com CP6: https://neeo-cp6-recovery.s3.amazonaws.com/firmware_info.txt UI: http://<BRAIN_IP>/downloadfirmware?server=https%3A%2F%2Fneeo-cp6-recovery.s3.amazonaws.com CP6: https://neeo-cp6-recovery.s3.amazonaws.com/neeo_firmware_0.50.6-20180424-481315c-0523-151625_emmc.img
It is possible to tel the brain to fetch the firmware from another location.
Image is encrypted.root@kali:~/CP6# binwalk neeo_firmware_0.50.6-20180424-481315c-0523-151625_emmc.img DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 OpenSSL encryption, salted, salt: 0x-518658326412886F 11246143 0xAB9A3F MySQL MISAM compressed data file Version 6 207273445 0xC5ABDE5 MySQL ISAM index file Version 7
-
Firmware TR2
TR2 images are stored locally on the brain and can be downloaded using:Firmware images: http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/neeo.xml http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/neeo_release.bin http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/recovery_release.bin http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/bootloader_release.bin
Firmware seems not encrypted. ;-)
root@kali:~/TR2_0.53.8# binwalk bootloader_release.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 200252 0x30E3C D-Link ROMFS filesystem, version 1.0, little endian, size: <= 21024 222604 0x3658C eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/fs-ecos.c" 222642 0x365B2 eCos RTOS string reference: "ecos.c" 227412 0x37854 CRC32 polynomial table, little endian 230440 0x38428 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/scan.c" 230680 0x38518 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodelist.c" 230988 0x3864C eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/debug.h" 231368 0x387C8 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodemgmt.c" 232248 0x38B38 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/readinode.c" 236668 0x39C7C eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/gc.c" 237772 0x3A0CC eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/write.c" 239484 0x3A77C eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/memblock.cpp" 240604 0x3ABDC eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/uexception.cpp" 241348 0x3AEC4 eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/ustring.cpp" 242040 0x3B178 eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/mistream.cpp" 245600 0x3BF60 eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/bktrace.cpp" root@kali:~/TR2_0.53.8# binwalk recovery_release.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 270256 0x41FB0 D-Link ROMFS filesystem, version 1.0, little endian, size: <= 74240 384020 0x5DC14 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/fs-ecos.c" 384058 0x5DC3A eCos RTOS string reference: "ecos.c" 389096 0x5EFE8 eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/memblock.cpp" 390216 0x5F448 eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/uexception.cpp" 390768 0x5F670 eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/ustring.cpp" 391488 0x5F940 eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/mistream.cpp" 394516 0x60514 CRC32 polynomial table, little endian 397544 0x610E8 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/scan.c" 397784 0x611D8 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodelist.c" 398092 0x6130C eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/debug.h" 398472 0x61488 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodemgmt.c" 399368 0x61808 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/readinode.c" 403772 0x6293C eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/gc.c" 404876 0x62D8C eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/write.c" 406564 0x63424 eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/bktrace.cpp" root@kali:~/TR2_0.53.8# binwalk neeo_release.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 576556 0x8CC2C Unix path: /dev/flash/0/0,0xFF0000 577064 0x8CE28 D-Link ROMFS filesystem, version 1.0, little endian, size: <= 390240 1020084 0xF90B4 TIFF image data, big-endian, offset of first image directory: 264 1030832 0xFBAB0 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/fs-ecos.c" 1030870 0xFBAD6 eCos RTOS string reference: "ecos.c" 1038536 0xFD8C8 CRC32 polynomial table, little endian 1041564 0xFE49C eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/scan.c" 1041828 0xFE5A4 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodelist.c" 1042148 0xFE6E4 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/debug.h" 1042756 0xFE944 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/nodemgmt.c" 1043632 0xFECB0 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/readinode.c" 1046080 0xFF640 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/gc.c" 1048824 0x1000F8 eCos RTOS string reference: "ecos/packages/fs/jffs2/current/src/write.c" 1049820 0x1004DC eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/memblock.cpp" 1050188 0x10064C eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/uexception.cpp" 1051340 0x100ACC eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/ustring.cpp" 1051520 0x100B80 eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/mistream.cpp" 1052832 0x1010A0 eCos RTOS string reference: "ecos/packages/language/cxx/ustl/current/src/bktrace.cpp" root@kali:~/TR2_0.53.8#
-
TR2 Workings.
TR2 works partially on http/3000 and partially UDP.
URL's used by TR2:
Updated component data: http://10.2.1.61:3000/projects/home/tr2/guidata_xml GUI: http://10.2.1.61:3000/projects/home/tr2/gui_xml/
Collection of my discovery tools https://github.com/nklerk/FakeBrainTool
The code isn't written to be pretty, it's written for me as a tool and have tried different stuff and old tries are not cleaned up at the moment. Use it as is, Cannot provide support on it as is, this will however get you up to speed.
-
My API brain dump
== Change Brain Name == http://10.2.1.62:3000/projects/home PUT {"label": "Slaapkamer"} http://10.2.1.7:80/json.htm?type=command¶m=udevice&idx=479&nvalue=0&svalue=10 http://10.2.1.7/json.htm?type=command¶m=udevice&idx=479&nvalue=0&svalue=0 CP6 recovery: UI: http://10.2.1.221/checkforfirmware?server=https%3A%2F%2Fneeo-cp6-recovery.s3.amazonaws.com CP6: https://neeo-cp6-recovery.s3.amazonaws.com/firmware_info.txt UI: http://10.2.1.221/downloadfirmware?server=https%3A%2F%2Fneeo-cp6-recovery.s3.amazonaws.com CP6: https://neeo-cp6-recovery.s3.amazonaws.com/neeo_firmware_0.50.6-20180424-481315c-0523-151625_emmc.img == 3000 TR2 == Updated component data: http://<BRAIN_IP>:3000/projects/home/tr2/guidata_xml UI Info: http://<BRAIN_IP>:3000/projects/home/tr2/gui_xml/ Firmware images: http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/neeo.xml http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/neeo_release.bin http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/recovery_release.bin http://<BRAIN_IP>:3000/1c5e991f04ecf55708298be91907df8894a0c38c/bootloader_release.bin == 3000 API === Blink NEEO LED: http://<BRAIN_IP>:3000/v1/systeminfo/identbrain System Info: http://<BRAIN_IP>:3000/v1/systeminfo/ API: http://<BRAIN_IP>:3000/v1/api/Recipes http://<BRAIN_IP>:3000/v1/api/activeRecipes http://<BRAIN_IP>:3000/v1/projects/home/activate http://<BRAIN_IP>:3000/v1/projects/home/activescenariokeys http://<BRAIN_IP>:3000/v1/firmware http://<BRAIN_IP>:3000/v1/firmware/check http://<BRAIN_IP>:3000/v1/wifi/settings http://<BRAIN_IP>:3000/v1/systeminfo/lan-address http://<BRAIN_IP>:3000/v1/wifi/scan http://<BRAIN_IP>:3000/v1/account/backups http://<BRAIN_IP>:3000/v1/projects/home/rooms?details=false http://<BRAIN_IP>:3000/v1/projects/home/rooms?details=true http://<BRAIN_IP>:3000/v1/neeoremote/neeolink GET http://<BRAIN_IP>:3000/v1/projects/home/configured {"configured": false}, {"configured": true} PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6232364703805341696?details=false PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6232364703805341696/devices/6343136864072892416 {"useTuner":true} GET http://<BRAIN_IP>:3000/v1/devicespecs/search?q=test GET http://<BRAIN_IP>:3000/v1/devicespecs/duiro24548 GET http://<BRAIN_IP>:3000/v1/projects/home/scheduleactivation POST http://<BRAIN_IP>:3000/v1/firmware/update Rename NEEO,-> Add room name. GET http://<BRAIN_IP>:3000/v1/projects/home/rooms?details=false PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6232364703805341696?details=false {"name":"Basement","key":"6232364703805341696","weight":6232364703805342000,"hasController":true,"nrDevices":0} Is Active? http://<BRAIN_IP>:3000/v1/api/recipes http://<BRAIN_IP>:3000/v1/projects/home/rooms/6270339705313689600/recipes/6270690949668536320/isactive #all config: http://<BRAIN_IP>:3000/v1/projects/home/ #rooms: get http://<BRAIN_IP>:3000/v1/projects/home/rooms/ http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440 //Huiskamer http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100195254173696 //Slaapkamer http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616 //test #devices: GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100195254173696/devices/6251107472669409280 Sonos GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/devices/6252410530883960832 Kodi GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/devices/6253167273914138624 GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/devices/6253205610192437248 #Trigger macros. http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/devices/6253290246809583616/macros/6253290246901858304/trigger #Recipes GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440/recipes/6251104961917091840 //TV On execute GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440/recipes/6251104962126807040 //TV Off execute GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440/recipes/6251104961917091840/execute #Scenarios GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440/scenarios/6251104961757708288/ GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100081949245440/scenarios/6251104961757708288/poweroff ## Rename Device post http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/devices/6235895575712104448/rename {"name":"HTPC"} ## Add Steps POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6236561675235885056/steps {"idx":-1,"type":"controls","scenarioKey":"6235894005670871040","scenarioName":"TV","label":"Show \"TV\" controls"} ## Edit Steps POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6236561675235885056/steps/6 {"type":"controls","label":"Show \"TV\" controls","scenarioKey":"6235894005670871040","scenarioName":"TV","client":true,"idx":6} ## Reorder Steps PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6236561675235885056/steps/reorder {"from":6,"to":5} GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6235894005809283072/execute GET http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235894005670871040/poweroff GET http://<BRAIN_IP>:3000/v1/projects/home/activescenariokeys ## start channel 3 http://<BRAIN_IP>:3000/v1/projects/home/rooms/6254713121189920768/devices/6254717517139279872/favorites/3/trigger ## Press a Button. http://<BRAIN_IP>:3000/v1/projects/home/rooms/6255382548696793088/devices/6255382711939104768/macros/6255382712043962368/trigger ## Press a button. http://<BRAIN_IP>:3000/v1/projects/home/rooms/6254713121189920768/devices/6254717517139279872/macros/6254717517164445696/trigger ## Set Slider to value PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6255382548696793088/devices/6258004627891945472/sliders/6258004627963248640 {"value":24} ## set switch PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6254713121189920768/devices/6256505782070673408/switches/6256505782175531008/on PUT http://<BRAIN_IP>:3000/v1/projects/home/rooms/6254713121189920768/devices/6256505782070673408/switches/6256505782175531008/off POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6235894005809283072/steps {"idx":-1,"type":"volume","deviceKey":"6235893934984265728","deviceName":"TV","label":"Use \"TV\" volume"} ### Adding Custom volume controlls. ### POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6243486710882107392/steps {"idx":-1,"type":"volume","deviceKey":"6240127059490766848","deviceName":"Versterker","label":"Use \"Versterker\" volume"} {"idx":-1,"type":"volume","deviceKey":"6240127059490766848","deviceName":"Versterker","label":"Use \"Versterker\" volume"} Recipe: 6243486710882107392 Vol dev: 6240127059490766848 Content-Type: application/json POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6236561675235885056/steps {"idx":-1,"type":"volume","deviceKey":"6235894225590812672","deviceName":"Versterker","label":"Use \"Versterker\" volume"} http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235894005670871040/shortcuts?deviceKey=6235893934984265728&deviceName=TV&deviceRoomKey=6235892692870496256&deviceRoomName=Huiskamer {"componentName":"DIGIT 0","componentLabel":"DIGIT 0","componentType":"button","componentKey":"6235893935416279040","deviceName":"TV","deviceRoomName":"Huiskamer","deviceRoomKey":"6235892692870496256","deviceKey":"6235893934984265728"} DELETE http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235894005670871040/shortcuts/6238812060881256448 DELETE http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235894005670871040/shortcuts?deviceKey=6235893934984265728&deviceName=TV&deviceRoomKey=6235892692870496256&deviceRoomName=Huiskamer http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235893936234168320/shortcuts?deviceKey=6235893934984265728&deviceName=TV&deviceRoomKey=6235892692870496256&deviceRoomName=Huiskamer There was something fishy going on: "[ngRepeat:dupes] Duplicates in a repeater are not allowed. Use 'track by' expression to specify unique keys. Repeater: macro in $ctrl.shortcuts.button, Duplicate key: undefined:undefined, Duplicate value: undefined http://errors.angularjs.org/1.5.7/ngRepeat/dupes?p0=macro%20in%20%24ctrl.shortcuts.button&p1=undefined%3Aundefined&p2=undefined" Delete: http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/scenarios/6235895853014319104/shortcuts/6238817644733005824 GET http://<BRAIN_IP>:3000/v1/projects/home/activate GET http://<BRAIN_IP>:3000/v1/projects/home/activescenariokeys GET http://<BRAIN_IP>:3000/v1/firmware POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/devices/6235893934984265728/favorites/76?limit=-1 {"channel":{"name":"Latest TV","language":"en","country":"GB","logoUrl":"https://channel-icons.s3.amazonaws.com/c3b6fc2e-4306-4e88-b035-e7f2eae20c28.png.thumb.png"},"channelNr":"1999"} {"channel":{"name":"Secret Circle","language":"nl","country":"NL","logoUrl":"http://www.nielsdeklerk.nl/ss.png"},"channelNr":"791"} http://<BRAIN_IP>:3000/v1/projects/home/rooms/6235892692870496256/recipes/6239176862501699584/steps {"idx":-1,"type":"volume","deviceKey":"6235894225590812672","deviceName":"Versterker","label":"Use \"Versterker\" volume"} ## Getting a Directory in: http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/devices/6254205943295246336// Kodi http://<BRAIN_IP>:3000/v1/projects/home/rooms/6252128836691951616/scenarios/6254205949775446016 http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100195254173696/devices/6251107472669409280 // Sonos http://<BRAIN_IP>:3000/v1/projects/home/rooms/6251100195254173696/scenarios/6251107483654291456 [{"id":1,"adapterName":"homey_Switch_1","type":"GAMECONSOLE","manufacturer":"Nintendo","name":"Switch","tokens":"Homey","device":{"name":"Switch","tokens":["Homey","Athom"]},"setup":{},"capabilities":[]},{"id":2,"adapterName":"homey_Wii-U_2","type":"GAMECONSOLE","manufacturer":"Nintendo","name":"Wii U","tokens":"Homey","device":{"name":"Wii U","tokens":["Homey","Athom"]},"setup":{},"capabilities":[]},{"id":4,"adapterName":"homey_Homey_4","type":"LIGHT","manufacturer":"Athom","name":"Homey","tokens":"Homey","device":{"name":"Homey","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"sensor","name":"LEDRING_SENSOR","label":"Ledring","path":"/device/homey_Homey_4/LEDRING_SENSOR","sensor":{"type":"binary","value":false}},{"type":"switch","name":"LEDRING","label":"Ledring","path":"/device/homey_Homey_4/LEDRING","sensor":"LEDRING_SENSOR"},{"type":"sensor","name":"VOICE_SENSOR","label":"Voice","path":"/device/homey_Homey_4/VOICE_SENSOR","sensor":{"type":"binary","value":false}},{"type":"switch","name":"VOICE","label":"Voice","path":"/device/homey_Homey_4/VOICE","sensor":"VOICE_SENSOR"},{"type":"sensor","name":"MUSIC_SENSOR","label":"Music","path":"/device/homey_Homey_4/MUSIC_SENSOR","sensor":{"type":"binary","value":false}},{"type":"switch","name":"MUSIC","label":"Music","path":"/device/homey_Homey_4/MUSIC","sensor":"MUSIC_SENSOR"}]},{"id":5,"adapterName":"homey_Tuner_5","type":"TUNER","manufacturer":"Onkyo","name":"Tuner","tokens":"Homey","device":{"name":"Tuner","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"button","name":"POWER ON","label":"Power On","path":"/device/homey_Tuner_5/POWER ON"},{"type":"button","name":"POWER OFF","label":"Power Off","path":"/device/homey_Tuner_5/POWER OFF"},{"type":"button","name":"0","label":"0","path":"/device/homey_Tuner_5/0"},{"type":"button","name":"1","label":"1","path":"/device/homey_Tuner_5/1"},{"type":"button","name":"2","label":"2","path":"/device/homey_Tuner_5/2"},{"type":"button","name":"3","label":"3","path":"/device/homey_Tuner_5/3"},{"type":"button","name":"4","label":"4","path":"/device/homey_Tuner_5/4"},{"type":"button","name":"5","label":"5","path":"/device/homey_Tuner_5/5"},{"type":"button","name":"6","label":"6","path":"/device/homey_Tuner_5/6"},{"type":"button","name":"7","label":"7","path":"/device/homey_Tuner_5/7"},{"type":"button","name":"8","label":"8","path":"/device/homey_Tuner_5/8"},{"type":"button","name":"9","label":"9","path":"/device/homey_Tuner_5/9"},{"type":"sensor","name":"POWER_SENSOR","label":"Power","path":"/device/homey_Tuner_5/POWER_SENSOR","sensor":{"type":"binary","value":false}},{"type":"switch","name":"POWER","label":"Power","path":"/device/homey_Tuner_5/POWER","sensor":"POWER_SENSOR"},{"type":"sensor","name":"VOLUME_SENSOR","label":"Volume","path":"/device/homey_Tuner_5/VOLUME_SENSOR","sensor":{"type":"range","range":[0,60],"unit":"dB","value":0}},{"type":"slider","name":"VOLUME","label":"Volume","path":"/device/homey_Tuner_5/VOLUME","slider":{"type":"range","sensor":"VOLUME_SENSOR","range":[0,60],"unit":"dB"}}]},{"id":6,"adapterName":"homey_Test-Light_6","type":"LIGHT","manufacturer":"Niels de Klerk","name":"Test Light","tokens":"Homey","device":{"name":"Test Light","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"button","name":"BUTTON","label":"Button","path":"/device/homey_Test-Light_6/BUTTON"},{"type":"sensor","name":"SWITCH_SENSOR","label":"Switch","path":"/device/homey_Test-Light_6/SWITCH_SENSOR","sensor":{"type":"binary","value":false}},{"type":"switch","name":"SWITCH","label":"Switch","path":"/device/homey_Test-Light_6/SWITCH","sensor":"SWITCH_SENSOR"},{"type":"sensor","name":"SLIDER_SENSOR","label":"Slider","path":"/device/homey_Test-Light_6/SLIDER_SENSOR","sensor":{"type":"range","range":[0,100],"unit":"%","value":0}},{"type":"slider","name":"SLIDER","label":"Slider","path":"/device/homey_Test-Light_6/SLIDER","slider":{"type":"range","sensor":"SLIDER_SENSOR","range":[0,100],"unit":"%"}}]},{"id":7,"adapterName":"homey_Kodi_7","type":"MEDIAPLAYER","manufacturer":"NDK","name":"Kodi","tokens":"Homey","device":{"name":"Kodi","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"button","name":"POWER ON","label":"POWER ON","path":"/device/homey_Kodi_7/POWER ON"},{"type":"button","name":"POWER OFF","label":"POWER OFF","path":"/device/homey_Kodi_7/POWER OFF"},{"type":"button","name":"PLAY","label":"PLAY","path":"/device/homey_Kodi_7/PLAY"},{"type":"button","name":"PAUSE","label":"PAUSE","path":"/device/homey_Kodi_7/PAUSE"},{"type":"button","name":"STOP","label":"STOP","path":"/device/homey_Kodi_7/STOP"}, {"type":"button","name":"ENTER","label":"ENTER","path":"/device/homey_Kodi_7/ENTER"}, {"type":"button","name":"SELECT","label":"SELECT","path":"/device/homey_Kodi_7/SELECT"}, {"type":"directory","name": "SONOS_QUEUE_DIRECTORY","label": "Movies0","path": "device/homey_Kodi_7/browse","directoryId": "movies","directoryType": "list","adapterName":"homey_Kodi_7"}, {"type":"directory","name": "SPOTIFY_BROWSE_DIRECTORY","label": "Movies1","path": "device/homey_Kodi_7/browse","directoryId": "movies","directoryType": "browse","adapterName":"homey_Kodi_7"}, {"type":"directory","name": "SONOS_BROWSE_DIRECTORY","label": "Movies2","path": "device/homey_Kodi_7/browse","directoryId": "movies","directoryType": "browse","adapterName":"directory"} ]}] "directories":{ "SONOS_QUEUE_DIRECTORY": {"name":"SONOS_QUEUE_DIRECTORY", "label":"Sonos Queue", "path":"/sonos/queue/browse", "directoryId":"sonos", "directoryType":"list", "adapterName":"device", "adapterDeviceId":"Slaapkamer","key":"6251107472698769408"}, "SPOTIFY_BROWSE_DIRECTORY": {"name":"SPOTIFY_BROWSE_DIRECTORY", "label":"Spotify", "path":"/spotify/browse", "directoryId":"spotify","directoryType":"browse", "adapterName":"directory", "adapterDeviceId":"Slaapkamer","key":"6251107472707158016"}, "SONOS_BROWSE_DIRECTORY": {"name":"SONOS_BROWSE_DIRECTORY", "label":"Sonos Directory", "path":"/sonos/browse", "directoryId":"sonos", "directoryType":"browse", "adapterName":"device", "adapterDeviceId":"Slaapkamer","key":"6251107472715546624"}}, {"id":7,"adapterName":"homey_Kodi_7","type":"MEDIAPLAYER","manufacturer":"NDK","name":"Kodi","tokens":"Homey","device":{"name":"Kodi","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"button","name":"POWER ON","label":"POWER ON","path":"/device/homey_Kodi_7/POWER ON"},{"type":"button","name":"POWER OFF","label":"POWER OFF","path":"/device/homey_Kodi_7/POWER OFF"},{"type":"button","name":"PLAY","label":"PLAY","path":"/device/homey_Kodi_7/PLAY"},{"type":"button","name":"PAUSE","label":"PAUSE","path":"/device/homey_Kodi_7/PAUSE"},{"type":"button","name":"STOP","label":"STOP","path":"/device/homey_Kodi_7/STOP"},{"type":"button","name":"ENTER","label":"ENTER","path":"/device/homey_Kodi_7/ENTER"},{"type":"button","name":"SELECT","label":"SELECT","path":"/device/homey_Kodi_7/SELECT"},{"type":"directory","name":"SONOS_QUEUE_DIRECTORY","label":"Movies0","path":"device/homey_Kodi_7/browse","directoryId":"movies","directoryType":"list","adapterName":"homey_Kodi_7"},{"type":"directory","name":"SPOTIFY_BROWSE_DIRECTORY","label":"Movies1","path":"device/homey_Kodi_7/browse","directoryId":"movies","directoryType":"browse","adapterName":"homey_Kodi_7"},{"type":"directory","name":"SONOS_BROWSE_DIRECTORY","label":"Movies2","path":"device/homey_Kodi_7/browse","directoryId":"movies","directoryType":"browse","adapterName":"directory"},{"type":"button","name":"SONOS_QUEUE_DIRECTORY","label":"SONOS_QUEUE_DIRECTORY","path":"/device/homey_Kodi_7/SONOS_QUEUE_DIRECTORY"},{"type":"button","name":"SONOS QUEUE DIRECTORY","label":"SONOS QUEUE DIRECTORY","path":"/device/homey_Kodi_7/SONOS QUEUE DIRECTORY"},{"type":"button","name":"BROWSE","label":"BROWSE","path":"/device/homey_Kodi_7/BROWSE"},{"type":"button","name":"LIST","label":"LIST","path":"/device/homey_Kodi_7/LIST"},{"type":"button","name":"DIRECTORY","label":"DIRECTORY","path":"/device/homey_Kodi_7/DIRECTORY"}]} {"id":8,"adapterName":"homey_Kodi_8","type":"SONOS","manufacturer":"Sonos","name":"Kodi SONOS","tokens":"Homey","device":{"name":"Kodi","tokens":["Homey","Athom"]},"setup":{},"capabilities":[{"type":"button","name":"POWER ON","label":"POWER ON","path":"/device/homey_Kodi_8/POWER ON"},{"type":"button","name":"POWER OFF","label":"POWER OFF","path":"/device/homey_Kodi_8/POWER OFF"},{"type":"button","name":"PLAY","label":"PLAY","path":"/device/homey_Kodi_8/PLAY"},{"type":"button","name":"PAUSE","label":"PAUSE","path":"/device/homey_Kodi_8/PAUSE"},{"type":"button","name":"STOP","label":"STOP","path":"/device/homey_Kodi_8/STOP"},{"type":"button","name":"ENTER","label":"ENTER","path":"/device/homey_Kodi_8/ENTER"},{"type":"button","name":"SELECT","label":"SELECT","path":"/device/homey_Kodi_8/SELECT"},{"type":"directory","name":"SONOS_QUEUE_DIRECTORY","label":"Movies0","path":"device/homey_Kodi_8/browse","directoryId":"movies","directoryType":"list","adapterName":"homey_Kodi_8"},{"type":"directory","name":"SPOTIFY_BROWSE_DIRECTORY","label":"Movies1","path":"device/homey_Kodi_8/browse","directoryId":"movies","directoryType":"browse","adapterName":"homey_Kodi_8"},{"type":"directory","name":"SONOS_BROWSE_DIRECTORY","label":"Movies2","path":"device/homey_Kodi_8/browse","directoryId":"movies","directoryType":"browse","adapterName":"directory"},{"type":"button","name":"SONOS_QUEUE_DIRECTORY","label":"SONOS_QUEUE_DIRECTORY","path":"/device/homey_Kodi_8/SONOS_QUEUE_DIRECTORY"},{"type":"button","name":"SONOS QUEUE DIRECTORY","label":"SONOS QUEUE DIRECTORY","path":"/device/homey_Kodi_8/SONOS QUEUE DIRECTORY"},{"type":"button","name":"BROWSE","label":"BROWSE","path":"/device/homey_Kodi_8/BROWSE"},{"type":"button","name":"LIST","label":"LIST","path":"/device/homey_Kodi_8/LIST"},{"type":"button","name":"DIRECTORY","label":"DIRECTORY","path":"/device/homey_Kodi_8/DIRECTORY"}]} {"name":"TypeError","message":"Cannot read property 'onUpdate' of undefined","stack":"TypeError: Cannot read property 'onUpdate' of undefined\n at new <anonymous> (http://<BRAIN_IP>:3200/eui/app-38fed2c0de.js:4:8900)\n at Object.a [as invoke] (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:3:2824)\n at l.instance (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:3:28721)\n at h (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:3:15712)\n at http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:3:21603\n at a (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:4:18500)\n at http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:4:18672\n at p.$eval (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:4:26219)\n at p.$digest (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:4:24705)\n at p.$apply (http://<BRAIN_IP>:3200/vendor-aeb6cd91f7.js:4:26502)"} ## TV channels: http://10.2.1.28:8080/jsonrpc?request={"jsonrpc":"2.0","id":1,"method":"VideoLibrary.GetRecentlyAddedMovies"} http://10.2.1.28:8080/jsonrpc?request={"jsonrpc":"2.0","id":1,"method":"VideoLibrary.GetRecentlyAddedMovies","params":{"fields":"fanart"}} {"jsonrpc":"2.0","method":"VideoLibrary.GetMovies","id":"1492861400409","params":{"properties":["title","thumbnail","playcount","lastplayed","dateadded","resume","rating","year","file","genre","writer","director","cast","set","studio","mpaa","fanart"],"limits":{"start":0,"end":14},"sort":{"method":"lastplayed","order":"descending"},"filter":{"operator":"true","field":"inprogress","value":""}}} {"jsonrpc":"2.0","method":"VideoLibrary.GetMovies","id":"1492861400413","params":{"properties":["title","thumbnail","playcount","lastplayed","dateadded","resume","rating","year","file","genre","writer","director","cast","set","studio","mpaa","fanart"],"limits":{"start":0,"end":14},"sort":{"method":"dateadded","order":"descending"},"filter":{"operator":"is","field":"playcount","value":"0"}}} {"jsonrpc":"2.0","method":"VideoLibrary.GetMovies","id":"1492861400417","params":{"properties":["title","thumbnail","playcount","lastplayed","dateadded","resume","rating","year","file","genre","writer","director","cast","set","studio","mpaa","fanart"],"limits":{"start":0,"end":14},"sort":{"method":"random","order":"descending"}}} http://10.2.1.28:8080/image/image%3A%2F%2Fsmb%253a%252f%252f10.2.1.5%252fMedia%252fVideo%252fMovies%252fTarzan%2520(1999)%252fTarzan%2520(1999)-poster.jpg%2F POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6260456061774331904/devices/6261483120093036544/favorites/0?limit=-1 POST http://<BRAIN_IP>:3000/v1/projects/home/rooms/6254713121189920768/devices/6254717517139279872/favorites/0?limit=-1 {"channel":{"name":"NPO1","language":"nl","country":"NL","logoUrl":"https://neeo-channel-icon.s3.amazonaws.com/245ffa6f-fc29-444c-92e0-33688ace007e.png.thumb.png"},"channelNr":"1"} {"channel":{"name":"NPO2","language":"nl","country":"NL","logoUrl":"https://channel-icons.s3.amazonaws.com/a08d2bd9-ee5c-4396-b607-633f3db8871b.png.thumb.png"},"channelNr":"2"} {"channel":{"name":"NPO3","language":"nl","country":"NL","logoUrl":"https://neeo-channel-icon.s3.amazonaws.com/2d0b6400-6351-4ae9-a793-b95da1f239e4.png.thumb.png"},"channelNr":"3"} From NEEO GET http://10.2.1.43:6336/apt-d1f926be696c43f162ff2cd653eb1651f19b8909/subscribe/unique-device-id-001/6257921335054303232 http://10.2.1.8:6336/homey_Homey-LED-ring_21/subscribe/default/6257934191611084800 ===================================== DEBUG uriparts[0] DEBUG uriparts[1]homey_Homey-LED-ring_21 DEBUG uriparts[2]subscribe DEBUG uriparts[3]default DEBUG uriparts[4]6257934834690162688 DEBUG uriparts[5]undefined DEBUG uriparts[6]undefined ===================================== http://<BRAIN_IP>:3000/v1/api/notificationkey/Homey_Devicedatabase_10.2.1.8/homey_Homey-LED-ring_21/ [{"name":"BRIGHTNESS","type":"slider","label":"Brightness","eventKey":"6257934834690162688:BRIGHTNESS_SENSOR"}] POST http://<BRAIN_IP>:3000/v1/notifications {"type":"6257934834690162688:BRIGHTNESS_SENSOR","data":100} Subscribe to Device Driver - Registreer uripart[3] unique-device-id-001 - geen idee waar uripart[4] belangrijk voor is. 6257921335054303232 To NEEO GET http://<BRAIN_IP>:3000/v1/api/notificationkey/src-331dae2ba62e9fdd766dd270f4b11aed0bff24e4/apt-d1f926be696c43f162ff2cd653eb1651f19b8909/unique-device-id-001 http://<BRAIN_IP>:3000/v1/api/notificationkey/Homey_Devicedatabase_10.2.1.8/homey_Versterker-Volume_18/VOLUME_SENSOR/default {"type":"6257978958768242688:VOLUME_SENSOR","data": Volume } [{ "name": "example-slider", "type": "slider", "label": "my slider", "eventKey": "6257921335054303232:EXAMPLE-SLIDER_SENSOR" }, { "name": "example-switch", "type": "switch", "label": "my switch", "eventKey": "6257921335054303232:EXAMPLE-SWITCH_SENSOR" }] POST http://neeo-b7503e07.local:3000/v1/notifications {"type":"6257921335054303232:EXAMPLE-SLIDER_SENSOR","data": } {"type":"6258004627891945472:VOLUME_SENSOR,"data":[[volume]]} {"type":"6263775363747282944:EXAMPLE-TEXT_SENSOR","data":"Update 166"} -
Rooting progres and CP6 Hardware:
CP6, Pin2Pwn doesn't work. It's protected.
Firmware Image is encrypted.To gain console access on the CP6, You'll need a TTL UART Serial adapter.
I'm using this one: https://nl.aliexpress.com/item/USB2-0-to-TTL-UART-5PIN-Module-Serial-Converter-CP2102-STC-PRGMR-with-Metal-case/32649877341.html?spm=a2g0s.9042311.0.0.27424c4dkedeWoYou need to connect to TX, RX and GND.
CP6 TX<-> Adapter RX
CP6 RX<-> Adapter TX
CP6 GND <-> Adapter GND
Here are more pica's
The square chip on the right lower corner is the eMMC chip.
The 6 resistors left of the chip are lines to the chip. I've used R105 to shorten the eMMC for Pin2PWN.
The used hardware comes from: https://aw-som.com/ They sell development boards as well making a entry possibly a bit more easy. -
Did you ever get any further with this? I'm sorry I don't have the technical knowledge to help.
-
Niels de Klerk how can i contact you? I have a question regarding FakeBrainTool.. thanks! (I tried getting a hold of you via twitter as well on a tweet)
