HCL Custom Recovery

[jack.daniels 103]

Hi, here is the guide how to flash custom recovery image for the HCL 4.140-4.150

 

Custom recovery allows to flash unsigned firmware in your HCL. This way we can add some new features or fix annoying bugs fast.

 

First of all, I want to say, the solution is 2 years old already. The security issue allows to execute any code on the HCL side. I have reported to Fibaro support about the vulnerability allowing to have complete contol of HCL device, but they answered its user's problem

 

We need to get root access in order to flash custom recovery, but HCL's ssh server disabled password login. So we will use the root exploit to restart ssh daemon with user:password login. Then we can use ssh to complete the process.

 

Rooting

Reboot the HCL before any manipulations, because low free RAM may prevent running the ssh daemon after killing.

We will use the Python 3 for exploit, but you can prepare the request with any convenient way. Edit hcl_4140_root.py script with your credentials and run it.

 

Writing recovery image

 

Use any ssh client (like putty) to login yout HCL using username root and password hc2

 

Copy the custom recovery image hcl_cr_v10.img to /tmp folder using ssh then run:

Quote

# dd bs=1M if=/tmp/hcl_cr_v10.img of=/dev/mtdblock8

Done! Now you can reboot recovery and enjoy the unsigned flashing.

 

Please login or register to see this attachment.

 

All manipulations is at your own risk.

Please login or register to see this attachment.

Please login or register to see this attachment.

[jack.daniels 103]

Update:

4.520..4.540 root exploit added

HCL 4.540 custom image added (root shell, LUA scenes)

HCL 4.550 custom image added (root shell, LUA scenes)

Please login or register to see this attachment.

Please login or register to see this attachment.

Please login or register to see this attachment.

Edited September 19, 2019 by jack.daniels
4.550 root access fixed (reuploaded)

[jack.daniels 103]

HCL 4.560 custom image added (root shell, LUA scenes)

Please login or register to see this attachment.

[jack.daniels 103]

Last original signed vulnerable ROM with backup service bug.

You can use it to install the custom recovery.

Please login or register to see this attachment.

[jack.daniels 103]

Pending project: Homekit native support for HCL coming soon...

Please login or register to see this attachment.

Please login or register to see this attachment.

Please login or register to see this attachment.

[10der 832]

@jack.daniels do you mean Home bridge?

[jack.daniels 103]

5 minutes ago, 10der said:

@jack.daniels do you mean Home bridge?

No, nodejs is too huge to fit small HCL filesystem.

Just a native service  binary.

[10der 832]

how you implemented fibaro rooms support? cuz dy default homekit all device assigned to single room 

[jack.daniels 103]

homekit rooms have nothing to do with fibaro rooms

u can manage rooms from Home app, but manually for every accessory

Groping devices by rooms required to bypass homekit limit to 100 accessories per pridge

[jack.daniels 103]

Added support for actors and sensors

Weather sensors and thermostats will do later

Today is the test run day on the HCL device (before was running on x86 pc)

I hope all will be ok

[jack.daniels 103]

HCL 4.560 with HomeKit support built-in

Probably, it will not support all of your devices, but its a good start ;0

Setup code for the bridge acessory:

Please login or register to see this image.

/monthly_2019_10/homekitten.png.1f718c062beed30ba9631160e770e8bc.png" />

Enjoy it

 

 

 

Edited October 16, 2019 by jack.daniels
Reuploaded the image

[jack.daniels 103]

The image become unavailable somehow, so reuploading

Please login or register to see this attachment.

[jack.daniels 103]

Some details:

-instant events polling. once your device changes state it will report to the home app immediately (not once in X seconds)

-low battery warning for battery powered sensors (under 20% hardcoded)

-weather providers support (home app will see temperature and humidity)

-real voice control is now covers your fibaro hcl controller

-lightweight service binary ~300kb still leave enough ram to run HCL in usual way including LUA environment 

-zero configuration time, it just works after power on

-after adding new devices you need to re-add the bridge accessory in home app, so best practice will be to connect homekit in the last turn

 

[NunoMartins 2]

Can you see how much is the size of the partition of users can save data?

i think if it could reserve some space to do swap...

I’m not a Linux expert... ? 

[jack.daniels 103]

On 10/19/2019 at 3:21 PM, NunoMartins said:

Can you see how much is the size of the partition of users can save data?

Yes, but swap is disabled in kernel, so its useless to resize partitions etc

[jack.daniels 103]

Small update is ready. Homekitten v1.3

-Tamper status reporting in Home app

-Room devices grouping is now enabled automatic, only when devices>100

-Device name in format: "<name> - <room_name>" for non-grouped mode (easier to sort out the mass of items)

-Memory leak fixed

 

Still problem adding attachments here, so

Please login or register to see this link.

is the link

 

Edited October 22, 2019 by jack.daniels

[jack.daniels 103]

Thanks to the FibaroHome app, now I know I have a door sensor tempered for years

Please login or register to see this attachment.

[vmation.virgin 2]

Remarkable work!?

 

what's the device type supported by builtin homekit?

i have added flood sensor and switch, but both not showing in AHK app

[jack.daniels 103]

Hi @vmation.virgin supported motion, smoke, door/window, flood, temp, humidity sensors

Readd the bridge accessory after u add/remove new zwave devices

Waiting for your feedback

[vmation.virgin 2]

i re added as new home, rebooted the hcl after adding the devices, can't see any accessory under HCL from fibarohome or apple homekit application?