MG5000 fw 4.76 with IP150 v 4.10 - Problem logging in

[renzorlive]

Hello Tertius, First of all, thank you for your work and developing this software. After managing to configure the MQTT server this is what I am getting when trying to connect to my control panel.

2017-10-01 02:09:53,599 INFO logging complete  

2017-10-01 02:09:53,601 ERROR test  

2017-10-01 02:09:53,607 INFO Setting loglevel to debug  

2017-10-01 02:09:53,618 DEBUG Logging Set to debug  

2017-10-01 02:09:53,627 INFO logging set to debug  

2017-10-01 02:09:53,635 INFO config.ini file read successfully: 2  

2017-10-01 02:09:53,644 INFO State01:Attempting connection to MQTT Broker: 127.0.0.1:1883  

2017-10-01 02:09:53,658 INFO Connected to MQTT broker with result code 0  

2017-10-01 02:09:53,658 INFO State01:MQTT client subscribed to control messages on topic: Paradox/C/#  

2017-10-01 02:09:53,674 INFO State02:Connecting to IP Module  

2017-10-01 02:09:53,684 INFO Connecting to 192.168.1.19  

2017-10-01 02:09:53,697 INFO Logging into alarm system...  

2017-10-01 02:09:53,736 DEBUG 32->   0xaa 0x8 0x0 0x3 0x8 0xf0 0x0 0xa 0xee 0xee 0xee 0xee 0xee 0xee 0xee 0xee 0x70 0x61 0x73 0x73 0x77 0x6f 0x72 0x64 0xee 0xee 0xee 0xee 0xee 0xee 0xee 0xee  

2017-10-01 02:09:55,993 ERROR State02:Error attempting connection to IP module (3): string index out of range  

[Tertiush]

Hi - I have not attempted this script with the later IP150 firmware versions, v4 and later. There's been reports of breaking changes in the new firmware. I see you are active on the OH forums, I suggest you try to downgrade the IP module and try again (not sure how to do a downgrade though...).

[renzorlive]

Yep, it was a big mistake buying this module.
My goal is DIY home automation for fun and to learn new things. I have this Paradox MG5000 from 2009, it cost a lot back then, I recently made some restorations to my house and I thought I should upgrade my alarm system with a new one but I saw on forums that I can add this wonderful IP150 module and even have integrations with other software.
Cool! I bought it, thought this would be easy : connect the module, set ip, upgrade the firmware of the control panel because it has the original fw from 2009 , add it to some HA hub and move to other project, NOT! Paradox information is not really easy available on the internet, the manuals are outdated, and top of all, when I asked them on email to share some information because my IP150 is nothing like the manuals they supplied ( I was not even aware at that moment that this 4.10 fw is the problem) they responded with the following text.

Unfortunately, Due to an agreement with our distributor network, The Paradox distributor Support will only assist distributor with issues. We do not support end user or installer when they encounter difficulties with their alarm system.

The assistance you need would be better provided to you by a qualified alarm technician who would be able to determine your requirement.

I suggest that you contact your local installer in your area if you don’t have a local installer. I am including a link to our distributor network. Simply contact the distributor nearest you, and ask them to refer an alarm company to you who is familiar with Paradox products.

Are you kidding me? I payed a lot for their alarm system, I even bought another 100$ module and planned to buy others and they are sending me off to the distributors/installers which charge a lot and have no clue about IP150.

I've spent a lot of time figuring out what is happening: I can’t do anything from the web interface, I can upgrade the control panel fw with the In-Field software and panel serial number but from Babyware I can’t connect locally via serial number or IP, only if I use their DNS account which I have to pay on the Insite Gold app… so no chance for integration with nothing yet, all solutions available were based on the old IP150 web interface which is now gone. TL:DR Anyway I am writing this on all threads that I find to make others aware of this issue. If you are buying the new IP150 you are paying 100$ + a monthly/yearly fee to have a remote on your phone and only on the phone. An outdated ugly remote actually, when people like Tertius made other app better than this one and he gets nothing, and we can't even use his app anymore. I tried to downgrade the IP150 firmware with various tricks I found on the web, like trying to flash it after reset of the control panel, reset of the module itself etc. and all I got is another trouble on the control panel which I can't get rid off, IP Unregistered.

[Tertiush]

I feel your pain and I fully agree!

However, before I wrote this code I initially communicated serially to my MG5050. This works like a charm and I could monitor all the zones and alarm state. I never implemented any control, I simply snooped the Tx line going to the IP150. This line "broadcasts" all the events in the same format this code looks for. If you look at the forks of my project others have re-factored it to work with a serial connection (I used another older version of the code a friend made). All you need is a TTL serial interface (via USB-TTL serial or directly onto a ESP8266?). I know this is not what you had in mind initially, but it will work. If you cannot achieve controls through the serial interface you can always add a relay to some board and connect it to one of the alarm's inputs (zones) to arm/disarm or do something else...

[rjuch]

ah damn same issue here i guess, any plans on supporting the new ip150 FW ?

[Tertiush]

Nope sorry. It's a pity no one has figured out how to downgrade the units.

[saundersrg]

Same issue here on the V4.10. Will take it back to Communica with the receipt and see if I can beg them for the older unit.

[nezmogus]

i figured out how to downgrade IP150 firmware bellow 4.00 ;)

I will wait few weeks, until more people, who have same problem, will see this message ant then will share all the tools and instructions how to do downgrade. Until this time I’m recommending disconnect IP150 modules from internet. IP150 firmware from V4.xx updates itself on every IP150 module power cycle, so Paradox can fix their bugs and release update, which can remove possibility of downgrade.

My final conclusion about Paradox - DO NOT TRUST THIS COMPANY AND DO NOT BUY THEIR PRODUCTS ANYMORE!

I pointed them with finger to their security holes and they even didn’t fixed them all in two weeks time. They even didn’t said “Thank you” to me… because swear words are not allowed, i don’t have what to say anymore about this company.

[yozik04]

I also think that their remote connection is a large security hole. I need to downgrade my IP150 module to replace my EVO192-Serial to Arduino hack.

[mioke77]

I have the same problem with IP150

[TwixYU]

Please please please can you post the how-to-downgrade?

I accidentally upgraded my IP150 not knowing about the "cold shower" afterwards

I will never advise anyone to buy Paradox again - this is very unprofessional move from their side

[itsgabraf]

Ok, can we find out how to downgrade now please!!

[saundersrg]

While we wait... Check this out. I don't know about you guys, but if/when I ever need to replace my SP6000 I'm going this route.

https://www.kickstarter.com/projects/nateclark/konnected-alarm-panel-revive-your-wired-alarm-syst

[psyciknz]

Yeah I was looking at those as well. Has a rest api. Someone on openHAB was looking at a binding.

---

From: saundersrg notifications@github.com Sent: Sunday, June 17, 2018 6:21:08 PM To: Tertiush/ParadoxIP150v2 Cc: Subscribed Subject: Re: [Tertiush/ParadoxIP150v2] MG5000 fw 4.76 with IP150 v 4.10 - Problem logging in (#22)

While we wait... Check this out. I don't know about you guys, but if/when I ever need to replace my SP6000 I'm going this route.

https://www.kickstarter.com/projects/nateclark/konnected-alarm-panel-revive-your-wired-alarm-syst

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHubhttps://github.com/Tertiush/ParadoxIP150v2/issues/22#issuecomment-397857647, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AFGkc7OsLxYQGqpZX7AtHKq-vcAi5zLXks5t9fVUgaJpZM4PpuhG.

[nezmogus]

I do not take any responsibility and I am not liable for any damage caused through use of this information.

More than month past since I informed Paradox about their bugs. Actually, more than week ago I offered them to help fixing their systems. I received this answer:

“I have escalate your suggestion to upper management. Should we require your help, someone from Paradox will contact you.”

Unfortunately, nobody from paradox contacted me...

But now about IP150. To downgrade firmware bellow V4.00: Set your own DNS record on router upgrade.insightgoldatpmh.com and redirect to your_computers_IP. Unfortunately, not all routers can do this. In this case you should set external DNS server in your routers DHCP server and then set DNS record in this external DNS server and then restart IP150. By the way, restart can be done using IP150 web page. Login to your IP150 using web browser, let’s say at IP http://192.168.0.50 and then add at the end reset.html. Finally URL should look like http://192.168.0.50/reset.html and press ENTER. IP150 module should restart in few seconds. This link will not work if you are not logged to IP150.

TVPfwd_v2.zip (edited: this version adds time with milliseconds to each packet in the log file)

After that you need start (you need .net 4 for that) attached file TVPfwd.exe with these parameters:

TVPfwd.exe your_computers_IP 10000 54.165.77.37 10000 IP150_V1_32_001_ENG_downgrade_from_v4.xx.PuF

54.165.77.37 is IP of upgrade.insightgoldatpmh.com

Be sure, that IP150_V1_32_001_ENG_downgrade_from_v4.xx.PuF is in same folder as exe file. After that, connect to your panel with InField software (I was using version 5.0.11, installed together with latest BabyWare) using panel serial number and password ant start IP150 “upgrade”.

TVPfwd will work as proxy server for update process and will change firmware bytes from paradox server with bytes from attached file. All progress will be written to TXT file nearby exe. Finally, InField can show error, but don’t worry about that. Update progress you will see in console window. When packet 448 is reached, IP150 will reboot and you can try to connect to it. Some information about upgrade can be seen at http://upgrade.insightgoldatpmh.com/XXXXXXXX Replace XXXXXXXX with 8 symbols of your IP150 (NOT PANEL) serial number

IMPORTANT THINGS! After IP150 firmware downgrade and module power cycle (or using reset.html), firmware update process starts automatically. If upgrade.insightgoldatpmh.com domain isn’t blocked on your router, IP150 will update to latest version of firmware. If upgrade.insightgoldatpmh.com domain isn’t reachable IP150 will hang (in this case i just disconnected IP150 cable from panel ant connected it back and everything works fine). In other words, you need set up downgrade environment mentioned above after each IP150 power cycle.

That's all for the moment. Later I will post bonus packs :)

P.S. Sorry for my bad English :)

[nezmogus]

Bonus pack 1.

If anybody need any firmware for Paradox devices, you can download it directly from Paradox FTP server. Search for “.paradox.com” string (with dot in front) in InField.exe file and ignore everything who starts with www. You will find domain, and few bytes before this string you will find username and password in plain text.

Decrypted firmware files for those, who want play with reversing engineering decrypted firmware.zip.

To make life easier, there is cleaned firmware versions (all know for me embedded files are extracted): cleaned.ZIP

Maybe someone will find, how to downgrade bootloader from 2.13.001 to 2.12.000. I'm guessing, that bootloader won't downgrade with my method and it causes update process on each IP150 restart.

If anybody interested in more detailed firmware file structure or communication protocol with paradox upgrade server, let me know. I will write what i know.

[nezmogus]

I forgot to mention, that after downgrade you cannot use InField to upgrade or downgrade to other firmware versions. To do that, you need again use TVPfwd with different firmware version file and reset IP150 module.

[yozik04]

Thank you for sharing! As I understood TVPfwd is your creation? Did not found any mention about it on the internet. Do you plan to share its source code?

[nezmogus]

TVPfwd_source.zip

Sorry, i'm not a programmer, so source code may look messy :)

[powerwade]

Well done, thanks!

After that, connect to your panel with InField software (I was using version 5.0.11, installed together with latest BabyWare) using panel serial number and password ant start IP150 “upgrade”.

This part is not clear to me. There is no way to 'upgrade' it here - I can hit "Get latest files" but that will download the real fw files from Paradox.

[nezmogus]

What version of InFeld do you use?

In my version i see:

[nezmogus]

You can also download lower FW version files from paradox using "Get Latest Files..." button and try downgrade using them. If InFiled will not offer lower FW version files, there is one
IP150_V1_32_001_ENG.ZIP

[powerwade]

Yes, I'm using the same version 5.0.11. I tried to download and "upgrade" 4.00 using INField however the txt file in TVPfwd directory didn't change so I suppose the upload file didn't go through it? In the txt file I see START: 2018.06.19 00:47:28 And in command line there is no output for TVPfwd.exe during the upgrade - however I think that's normal.

Any idea what I am doing wrong? :)

[nezmogus]

Firmware v4.00 is one of Paradox fails :) Let's leave this for tomorrow. I will write more details about this version and maybe will do more tests.

[powerwade]

Excellent, thanks. Hopefully I can also downgrade this little bastard and get it finally include into my home automation system.

[mariancapota]

Amazing work! However do you have any idea why it reboots? I have left it overnight and it went to about 200 packets or so an then again from the beginning.

[nezmogus]

If it reboots and again starts update process, it mean, that firmware wasn't accepted by device. Could you please write me your device current firmware version and boot loader version. Also you can send log file to me my_nick_name @gmail.com but before, hide serial number like in a picture

[nezmogus]

Firmware V4.00: how i know, Paradox somehow failed with this version, because it was quite problematic process to update this version to newer version. IP150_v4.1_Upgrade_Procedure.pdf

when i set V4.00 firmware on my IP150 even using this Paradox instructions i didn't managed how to properly configure my router for upgrade or downgrade procedure. After a lot of retries InField refuses connect to module directly or trough internet and I've give up. Just restarted IP150 module and put other FW file to TVPfwd proxy

[nezmogus]

powerwade, try configure your router using Paradox instructions above and upgrade IP150 using lower FW version file. I see, that your boot loader still version 2.12.001 and can be, that it will allow you downgrade directly. Also can be, that you need use older InField versions, because latest InField version can refuse to send lower version FW to IP150 module because of Paradox new business plan with Insite GOLD App. Do not upgrade to never firmware, because it updates boot loader and there no known way at the moment, how to downgrade it.

[nezmogus]

Bonus Pack 2 :)

Paradox Server Capture.zip

One more tool to play with :) I was trying to analyze downgrade/upgrade communication protocol. Recognized bytes are defined as variables. First 4 bytes of packet are command bytes. All other bytes does make any known sense for upgrade process.

Upgrade communication protocol for all FW versions is almost same except one thing: with FW bellow v4.00 after firmware bytes sent, InField sends FW verification packet. FW v4.00 and above - doesn't. How i understand, instead of verification packet, v4.xx connects himself and verifies FW validity using secure (SSL) connection to Paradox API server (api.insightgoldatpmh.com)

Using this source as sample and log file from TVPfwd, you can write own firmware update server.

[nezmogus]

I was surprised, when my module didn't connect to proxy server after power off and on. I did a lot of harmful tests with my IP150, but he always was sniffing for connection to Paradox servers. At least until now... Just one mind is coming to my head: between some tests i did IP150 factory reset using pinhole button on module. I'm guessing, that this maneuver finally glued downgraded firmware inside IP150, but i can't confirm that.

WARNING! WARNING! WARNING! After that, i can't connect to my panel using internet (with panel serial number and password) and it means, i can't start IP150 upgrade process anymore. Also i can't start IP150 upgrade/downgrade process using direct connection. InField connects using direct connection, but shows error on IP150 firmware transfer. I didn't test, does panel firmware update works or not, because my panel is connected to security company and this early morning i don't want any calls from them about my alarm system failure :)

For me this is not a big problem. Finally i have always working IP150 with firmware, which allows BabyWare connection and this is everything what i need. This was my final destination and i reached it! :)

[nezmogus]

Can anyone confirm, that downgrade works on IP150 modules already sold with v4.xx firmware version? Write me to email my_nick_name @gmail.com if you don't have and don't want create GitHub account to write your answer here.

Thank you

[mioke77]

nezmogus, I tried to applying your method, but without success, my module is now 4.30 (original was 1.26) . Are you sure that you don't missed to describe any step above? Many thanks!

[mioke77]

Your proxy was started and the GW serve the local IP for upgrade.insightgoldatpmh.com

[nezmogus]

mioke77, what is your InField version? Try use latest 5.0.11, installed with BabyWare 5.1.0 http://www.paradox.com/Download/Babyware.asp?CATID=9

When IP150 module is selected in InField, Step 3 should look like this:

[mioke77]

you're a rockstar!!! indeed, this was the problem, I had ver 5.0.5. Thanks! The ip1500 it stucks and the process is blocking too, at a different point every time after is physical removed from the panel, like for mariancapota :(

[mioke77]

START: 2018.06.22 23:46:53 Connected: 54.165.77.37:10000 Connected: System.Net.Sockets.Socket Received : 54.165.77.37 -> 192.168.161.12 : 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 72 Original BOOTLOADER version 001!: 53 Modified BOOTLOADER version 001!: 8192 Received : 192.168.161.230 -> 192.168.161.12 : 72 FF 0B 02 00 00 A9 6C 00 00 00 00 XX XX XX XX 00 20 02 12 00 23 05 20 13 A4 44 57 49 50 31 35 30 20 00 00 15 49 50 31 35 30 5F 4C 41 54 45 53 54 2E 50 55 46 Received : 54.165.77.37 -> 192.168.161.12 : A5 11 00 30 XX XX XX XX A9 6C A4 9F B9 57 00 57 08 Original BOOTLOADER version 002!: 18 Modified BOOTLOADER version 002!: 8192 Received : 192.168.161.230 -> 192.168.161.12 : A5 12 00 34 00 03 3F A9 6C A4 44 0A 3C 57 02 12 00 DB Received : 54.165.77.37 -> 192.168.161.12 : A5 0D 00 36 XX XX XX XX A9 6C A4 44 48 Received : 192.168.161.230 -> 192.168.161.12 : A5 06 00 34 00 DF posArray: 00-00 Packet: 1 of 448 HEX: A5 07 04 11 00 00 EB 61 9C 8D 67 C9 D5 D5 C7 31 9B 05 AA 52 3B EB A1 57 88 B2 28 9C 1D 35 C2 FE 27 B6 E2 D0 C5 92 27 18 A0 15 8F 14 63 81 39 F0 47 C8 F7 D1 75 CC 25 96 C1 2B 0A 05 32 D9 42 9C 18 CA 1D 56 15 DF 4D EA 3C 23 3C 45 2D A0 28 43 9E 44 B1 60 E8 AC 17 32 7F D4 B9 33 0B 5A 2A 93 03 21 8C B5 14 17 C0 17 33 87 83 DF 3C AB 6A 2C A9 07 A3 42 82 91 57 03 A9 24 72 A6

[nezmogus]

mioke77, try to use this proxy version. It will add time to each packet in the log. TVPfwd_v2.zip

Seems like in mariancapota case there was problem with internet connection. Maybe you have same problem - slow or not stable internet? Maybe log with time in milliseconds will explain this...

[mioke77]

Finally, it managed to write all 448 packages, whit initial proxy version, it could be an internet connection problem, my provider registers congestion every weekend. Many Thanks! Would be the best if someone could found a solution to downgrade the boot-loader also!

[nezmogus]

Glad to hear it :) I'm sure, that bootloader downgrade is possible, but not sure, that problem is only in bootloader.... Anyway, full and correct downgrade is possible, but i already spent to much time for that. It looks like buying IP150S would be much cheaper than my time spent on downgrade analysis. I solved my problem and shared almost all details. Now let someone else to continue my work and I will be glad to share everything i know about it.

[powerwade]

I was 'able' to upload a lower version firmware with InField 4.9.10. The upgrade process went through in InField with no error. But after rebooting I no longer can connect to it with Panel SN (Internet tab) and it seems I ended up having version 'none' reported by InField 5.0.11 - I still can login through the Static IP tab.

After this I also lost the web connection, I use(d) port 10443 to connect to the web interface.

For some reason the IP150 doesn't connect to TVPfwd, I see no output on the command line even I did the dns change in the router (upgrade.insightgoldatpmh.com points to my windows PC IP). Whatever I do this doesn't print me anything if I upgrade the IP150.

TVPfwd.exe 192.168.1.52 10000 54.165.77.37 10000 IP150_V1_32_001_ENG_downgrade_from_v4.xx.PuF

This is going to be fun as I see at this point :)

[nezmogus]

powerwade, i saw similar view in my experiments, but it was after downgrade to v4.00 from v4.20 :) Your situation is little bit different. If you know how to use WireShark, filter IP150 activity on the network and update process between IP150 and InField. Write me to email if you do that. I will explain personally, what you should look for in captured packets.

Other possible solutions: try remove DNS record from your router and disconnect power from IP150 and reconnect it back. Check for connection after 5 minutes or more. In this time IP150 should download original firmware from paradox server. Probably it will be v4.30, but from this version downgrade should work. Try to use standard ports. Also you can try reset IP150 to factory defaults using needle. Press and hold until LED's starts flashing, then release and pres shortly once.

IP150 connects to TVPfwd from version 4.10 and up. How i told earlier, v4.00 is Paradox fail, it is intermediate version between 1.32 and 4.10. v4.00 still have v1.32 web functionality (?), but how i understand, communication protocols used by Tertiush project - already removed. From v4.10 web functionality also removed.

[powerwade]

I'm already doing some packet capture on my router with tcpdump, however I am not yet analyzing it. I was able to auto-upgrade to 4.30 by removing the dns entry from the router, but for some reason when I re-add it and manually reboot the IP150 it connect to TVPfwd but packets are hanging at 1.

Packet: 1 of 448

About a minute later, the IP150 reboots itself and I no longer can ping it and it tries to connect to TVPfwd again... and so again. I tried to repalce the firmware files serverd by TVPfwd but still no luck.

Now I have a fully upgraded (4.30) IP150 that should be downgraded by the knowledge shared above - somehow :)

[nezmogus]

Keep in mind, that I uploaded only one firmware file v1.32.001 for use with TVPfwd. All other files are only for those, who want analyse deeper how IP150 works. TVPfwd does not understand them.

[ebikarimi]

hi nezmogus, Thanks for the info i have the same problem with ip 150 recently i was decided to update my ip150 module, used infield software, available version is 4,the module was updated but not completely succeed, now there is no web page, it can not connect to control panel, cannot chage ip address, i can only ping the module, and find in infiled search field, the firmware version is 'none', bootloader version is 2.13, i can not update or downgrade the module, infield say: unable to connect, error code 33. its seems there is no firmware on module how can i recover firmware or install firmware on it?

please help me please!

[nezmogus]

ebikarimi, give to IP150 module full internet access (do not block on router and remove DNS records if you added them before), disconnect power, reconnect it and wait at least 5 minutes. IP150 should download latest firmware and restart. After that you should have web access and InField connection using panel serial number

[ebikarimi]

Dear zmogus thanks for your answer,but unfortunately on the IP150 i did not set default gateway and DNS, so you think that module will try to connect to internet without gateway? and unfortunately in the module setting window, any ip changes did not apply. i'm not good with this situation, because this fault is about Paradox, not me and other, Paradox must informs users and installer befor upgrading the IP150 to version 4 in incompatibility, in my country IP150 is too expensive and I'm curseing myself why I updated the module, so by the way, I thank you very much for following the problem and publishing this page im will try again with your instruct.

[nezmogus]

ebikarimi, start BabyWare, in Accounts pres Add and then Connection options button "..."

Then in IP/Static section pres find button

In the list you should see your IP150 module. Select it and pres Configure button

There you should be able to configure IP address

[powerwade]

Finally everything works for me too. I was able to downgrade my IP150 from 4.0 to 1.32, and the python script can talk to the alarm system thought it. Thanks for all the help and suggestions :)

My upgrade-downgrade path that worked for me original 4.0 => 4.1 (with infield) => 1.32 (with DNS hack + TVPfwd)

[ebikarimi]

Dear nezmogus

IP changes did not apply due to flowing error:

[nezmogus]

Put all parameters to that window, then disconnect power from IP150, connect it back and only then pres OK button in (2-5 seconds after power restore). Maybe it will help. Other solution is to use reset to factory defaults button, but looks like it works only when IP150 boots properly...

Is your module always visible for BabyWare/InField search or just some time after powering module up?