Open doug-hoffman opened 2 years ago
garbled1
commented
2 years ago As a first look, the KAWL9SHkwMZP3ZPZGxCS5ToZMulL16lnjYXJJY6EDCo= string at the end, looks like some kind of hash of the preceeding data. My fear is that it's an encryption string... When I have some time, I might try to run it through a bunch of different things, like sha1, base64, etc etc, and see if any of them pop. Hopefully it's not an actual encryption.
doug-hoffman
commented
2 years ago A base64 encoded sha256 digest is 44 characters. Bad news... if that's what it is, I can't get the same value from base64 encoding a sha256 digest of the characters up to (or including) the comma. Going to work through some other variations too.
garbled1
commented
2 years ago So, when I crack a CRC like this.. this is how I do it:
Write a tiny chunk of code, that puts the "payload" section into a string array or similar. Then, write some for loops, to iterate over it. First, try the whole string, then the whole string minus the last char, then keep knocking chars off the end and iterate. If you have multiple algos, you can iterate those too.
Then do the whole thing over, this time skipping chars from the front.
If I get desperate, I add another loop, where as I knock each char off the end, I loop through knocking each char off the front too.
The reason for this is, sometimes a CRC will only CRC portions of the data, for example, in a message like:
0a55bleahbleahFA where 0a55 is the "command", sometimes they only CRC the payload of "bleahbleah". Sometimes they don't CRC the "length" argument, etc etc. Sometimes there is an "end of command" like the FA, which is or is not included. You never know.
Generally speaking, just write something that iterates over as many combos as you can think of, and let it run overnight if you have to. Brute force it.
doug-hoffman
commented
2 years ago That was my first thought, to try trimming the ends of the payload. No luck with sha256. Aware of any popular hash functions that yield 256 bits for embedded applications?
The problem with trying to hash only the data is that I haven't definitively identified what is/isn't data. I've hacked together a parser that treats the structure as:
| Type | State and ??? | Type | ??? | Type | Unit ID | Type | Length | Identifier | Type | ??? | Type | ??? | Type | Firmware Version | Type | Length | Name | Type | Sensor Type | Type | Temperature | Type | Battery | End of message | Beginning of checksum | Checksum |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 08 | 2ad20259 | 0a | 2908fe2e | 10 | 05 | 1a | 0c | 656339663064393431356636 | 20 | 03 | 28 | 03 | 30 | 013801 | 42 | 06 | 4f6666696365 | 48 | 03 | 50 | 7b | 58 | 29 | 12 | 2c | 643066536e397762666c3435624834666546714144426f4256744466516456703842386f616a4d334c33343d |
It seems to be stable so far. The only interesting issue I ran into, which I identified last time around, is that when the last byte of a value is >= 0x80, there will be one more byte than normal in that value. I've seen it in both the 0x0a and temperature values.
Next chance I have to look at this, I'm going to try building on to the parser to hash some/all of the data and compare to the checksum.
garbled1
commented
2 years ago That's why I'm saying don't try to figure out the data yet. Just take everything from the comma forward in the packet, and hash the whole thing, through the brute force method I mentioned.
doug-hoffman
commented
2 years ago That's what I did. Of the hash functions that yield 256 bits, I'm only aware of sha256 being commonly used. We know it's 256 bits, because that will yield 43 bytes once base 64 encoded. (The 44th byte is just padding.) With such a short list (3600 combinations) it only took a few seconds to iterate through every possibility. I also ran every possible 32-byte chunk of the sha512 hash and base 64 encoding of every possible 32-byte chunk of the payload unhashed with no luck..
Either the checksum is only based off of some pieces of data (and excludes any message structure), or there's something other than bits from the payload used to calculate it (like a string hardcoded on both ends). We also can't yet rule out it not being verified by the thermostat.
hpeyerl
commented
2 years ago I was about to say they're probably just adding a salt to it.
Interesting, the firmware image appears to be a compressed kernel with a jffs2 filesystem. On a lark, thinking I might be able to find something related to the above, I binwalk'd it, extracted the jjfs2 and mounted it. Looks to be a pretty boring busybox linux-2.6.30 arm.
Appears that most thermostat functions are done with drivers statically linked into the kernel. Anyone want to try going after them for driver source given the GPL should confer those rights on us. :-)
It appears to use a GUI app called 'maestro' which is probably some internal thing that writes to /dev/fb.
There are some Sqlite queries but no .db file.
There are also some RSA Private keys and certificates. Possibly for Skyport access or something.
-----BEGIN CERTIFICATE-----
MIIDhzCCAm+gAwIBAgIBADANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER
MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN
MTEwMjEyMTQ0NDAwWhcNMjEwMjEyMTQ0NDAwWjA7MQswCQYDVQQGEwJOTDERMA8G
A1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDA3zf8F7vglp0/ht6WMn1EpRagzSHx
mdTs6st8GFgIlKXsm8WL3xoemTiZhx57wI053zhdcHgH057Zk+i5clHFzqMwUqny
50BwFMtEonILwuVA+T7lpg6z+exKY8C4KQB0nFc7qKUEkHHxvYPZP9al4jwqj+8n
YMPGn8u67GB9t+aEMr5P+1gmIgNb1LTV+/Xjli5wwOQuvfwu7uJBVcA0Ln0kcmnL
R7EUQIN9Z/SG9jGr8XmksrUuEvmEF/Bibyc+E1ixVA0hmnM3oTDPb5Lc9un8rNsu
KNF+AksjoBXyOGVkCeoMbo4bF6BxyLObyavpw/LPh5aPgAIynplYb6LVAgMBAAGj
gZUwgZIwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUtFrkpbPe0lL2udWmlQ/rPrzH
/f8wYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJBgNV
BAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wgVGVz
dCBDQYIBADANBgkqhkiG9w0BAQUFAAOCAQEAuP1U2ABUkIslsCfdlc2i94QHHYeJ
SsR4EdgHtdciUI5I62J6Mom+Y0dT/7a+8S6MVMCZP6C5NyNyXw1GWY/YR82XTJ8H
DBJiCTok5DbZ6SzaONBzdWHXwWwmi5vg1dxn7YxrM9d0IjxM27WNKs4sDQhZBQkF
pjmfs2cb4oPl4Y9T9meTx/lvdkRYEug61Jfn6cA+qHpyPYdTH+UshITnmp5/Ztkf
m/UTSLBNFNHesiTZeH31NcxYGdHSme9Nc/gfidRa0FLOCfWxRlFqAI47zG9jAQCZ
7Z2mCGDNMhjQc+BYcdnl0lPXjdDK6V0qCg1dVewhUBcW5gZKzV7e9+DpVA==
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,A8A95B05D5B7206B
9Qd9GeArejl1GDVh2lLV1bHt0cPtfbh5h/5zVpAVaFpqtSPMrElp50Rntn9et+JA
7VOyboR+Iy2t/HU4WvA687k3Bppe9GwKHjHhtl//8xFKwZr3Xb5yO5JUP8AUctQq
Nb8CLlZyuUC+52REAAthdWgsX+7dJO4yabzUcQ22Tp9JSD0hiL43BlkWYUNK3dAo
PZlmiptjnzVTjg1MxsBSydZinWOLBV8/JQgxSPo2yD4uEfig28qbvQ2wNIn0pnAb
GxnSAOazkongEGfvcjIIs+LZN9gXFhxcOh6kc4Q/c99B7QWETwLLkYgZ+z1a9VY9
gEU7CwCxYCD+h9hY6FPmsK0/lC4O7aeRKpYq00rPPxs6i7phiexg6ax6yTMmArQq
QmK3TAsJm8V/J5AWpLEV6jAFgRGymGGHnof0DXzVWZidrcZJWTNuGEX90nB3ee2w
PXJEFWKoD3K3aFcSLdHYr3mLGxP7H9ThQai9VsycxZKS5kwvBKQ//YMrmFfwPk8x
vTeY4KZMaUrveEel5tWZC94RSMKgxR6cyE1nBXyTQnDOGbfpNNgBKxyKbINWoOJU
WJZAwlsQn+QzCDwpri7+sV1mS3gBE6UY7aQmnmiiaC2V3Hbphxct/en5QsfDOt1X
JczSfpRWLlbPznZg8OQh/VgCMA58N5DjOzTIK7sJJ5r+94ZBTCpgAMbF588f0NTR
KCe4yrxGJR7X02M4nvD4IwOlpsQ8xQxZtOSgXv4LkxvdU9XJJKWZ/XNKJeWztxSe
Z1vdTc2YfsDBA2SEv33vxHx2g1vqtw8SjDRT2RaQSS0QuSaMJimdOX6mTOCBKk1J
9Q5mXTrER+/LnK0jEmXsBXWA5bqqVZIyahXSx4VYZ7l7w/PHiUDtDgyRhMMKi4n2
iQvQcWSQTjrpnlJbca1/DkpRt3YwrvJwdqb8asZU2VrNETh5x0QVefDRLFiVpif/
tUaeAe/P1F8OkS7OIZDs1SUbv/sD2vMbhNkUoCms3/PvNtdnvgL4F0zhaDpKCmlT
P8vx49E7v5CyRNmED9zZg4o3wmMqrQO93PtTug3Eu9oVx1zPQM1NVMyBa2+f29DL
1nuTCeXdo9+ni45xx+jAI4DCwrRdhJ9uzZyC6962H37H6D+5naNvClFR1s6li1Gb
nqPoiy/OBsEx9CaDGcqQBp5Wme/3XW+6z1ISOx+igwNTVCT14mHdBMbya0eIKft5
X+GnwtgEMyCYyyWuUct8g4RzErcY9+yW9Om5Hzpx4zOuW4NPZgPDTgK+t2RSL/Yq
rE1njrgeGYcVeG3f+OftH4s6fPbq7t1A5ZgUscbLMBqr9tK+OqygR4EgKBPsH6Cz
L6zlv/2RV0qAHvVuDJcIDIgwY5rJtINEm32rhOeFNJwZS5MNIC1czXZx5//ugX7l
I4sy5nbVhwSjtAk8Xg5dZbdTZ6mIrb7xqH+fdakZor1khG7bC2uIwibD3cSl2XkR
wN48lslbHnqqagr6Xm1nNOSVl8C/6kbJEsMpLhAezfRtGwvOucoaE+WbeUNolGde
P/eQiddSf0brnpiLJRh7qZrl9XuqYdpUqnoEdMAfotDOID8OtV7gt8a48ad8VPW2
-----END RSA PRIVATE KEY-----
PolarSSLTest
-----BEGIN CERTIFICATE-----
MIIDPzCCAiegAwIBAgIBATANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER
MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN
MTEwMjEyMTQ0NDA2WhcNMjEwMjEyMTQ0NDA2WjA8MQswCQYDVQQGEwJOTDERMA8G
A1UEChMIUG9sYXJTU0wxGjAYBgNVBAMTEVBvbGFyU1NMIFNlcnZlciAxMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqQIfPUBq1VVTi/027oJlLhVhXom/
uOhFkNvuiBZS0/FDUEeWEllkh2v9K+BG+XO+3c+S4ZFb7Wagb4kpeUWA0INq1UFD
d185fAkER4KwVzlw7aPsFRkeqDMIR8EFQqn9TMO0390GH00QUUBncxMPQPhtgSVf
CrFTxjB+FTms+Vruf5KepgVb5xOXhbUjktnUJAbVCSWJdQfdphqPPwkZvq1lLGTr
lZvc/kFeF6babFtpzAK6FCwWJJxK3M3Q91Jnc/EtoCP9fvQxyi1wyokLBNsupk9w
bp7OvViJ4lNZnm5akmXiiD8MlBmj3eXonZUT7Snbq3AS3FrKaxerUoJUsQIDAQAB
o00wSzAJBgNVHRMEAjAAMB0GA1UdDgQWBBQfdNY/KcF0dEU7BRIsPai9Q1kCpjAf
BgNVHSMEGDAWgBS0WuSls97SUva51aaVD+s+vMf9/zANBgkqhkiG9w0BAQUFAAOC
AQEAvc+WwZUemsJu2IiI2Cp6liA+UAvIx98dQe3kZs2zAoF9VwQbXcYzWQ/BILkj
NImKbPL9x0g2jIDn4ZvGYFywMwIO/d++YbwYiQw42/v7RiMy94zBPnzeHi86dy/0
jpOOJUx3IXRsGLdyjb/1T11klcFqGnARiK+8VYolMPP6afKvLXX7K4kiUpsFQhUp
E5VeM5pV1Mci2ETOJau2cO40FJvI/C9W/wR+GAArMaw2fxG77E3laaa0LAOlexM6
A4KOb5f5cGTM5Ih6tEF5FVq3/9vzNIYMa1FqzacBLZF8zSHYLEimXBdzjBoN4qDU
/WzRyYRBRjAI49mzHX6raleqnw==
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAqQIfPUBq1VVTi/027oJlLhVhXom/uOhFkNvuiBZS0/FDUEeW
Ellkh2v9K+BG+XO+3c+S4ZFb7Wagb4kpeUWA0INq1UFDd185fAkER4KwVzlw7aPs
FRkeqDMIR8EFQqn9TMO0390GH00QUUBncxMPQPhtgSVfCrFTxjB+FTms+Vruf5Ke
pgVb5xOXhbUjktnUJAbVCSWJdQfdphqPPwkZvq1lLGTrlZvc/kFeF6babFtpzAK6
FCwWJJxK3M3Q91Jnc/EtoCP9fvQxyi1wyokLBNsupk9wbp7OvViJ4lNZnm5akmXi
iD8MlBmj3eXonZUT7Snbq3AS3FrKaxerUoJUsQIDAQABAoIBABaJ9eiRQq4Ypv+w
UTcVpLC0oTueWzcpor1i1zjG4Vzqe/Ok2FqyGToGKMlFK7Hwwa+LEyeJ3xyV5yd4
v1Mw9bDZFdJC1eCBjoUAHtX6k9HOE0Vd6woVQ4Vi6OPI1g7B5Mnr/58rNrnN6TMs
x58NF6euecwTU811QJrZtLbX7j2Cr28yB2Vs8qyYlHwVw5jbDOv43D7vU5gmlIDN
0JQRuWAnOuPzZNoJr4SfJKqHNGxYYY6pHZ1s0dOTLIDb/B8KQWapA2kRmZyid2EH
nwzgLbAsHJCf+bQnhXjXuxtUsrcIL8noZLazlOMxwNEammglVWW23Ud/QRnFgJg5
UgcAcRECgYEA19uYetht5qmwdJ+12oC6zeO+vXLcyD9gon23T5J6w2YThld7/OW0
oArQJGgkAdaq0pcTyOIjtTQVMFygdVmCEJmxh/3RutPcTeydqW9fphKDMej32J8e
GniGmNGiclbcfNOS8E5TGp445yZb9P1+7AHng16bGg3Ykj5EA4G+HCcCgYEAyHAl
//ekk8YjQElm+8izLtFkymIK0aCtEe9C/RIRhFYBeFaotC5dStNhBOncn4ovMAPD
lX/92yDi9OP8PPLN3a4B9XpW3k/SS5GrbT5cwOivBHNllZSmu/2qz5WPGcjVCOrB
LYl3YWr2h3EGKICT03kEoTkiDBvCeOpW7cCGl2cCgYBD5whoXHz1+ptPlI4YVjZt
Xh86aU+ajpVPiEyJ84I6xXmO4SZXv8q6LaycR0ZMbcL+zBelMb4Z2nBv7jNrtuR7
ZF28cdPv+YVr3esaybZE/73VjXup4SQPH6r3l7qKTVi+y6+FeJ4b2Xn8/MwgnT23
8EFrye7wmzpthrjOgZnUMQKBgE9Lhsz/5J0Nis6Y+2Pqn3CLKEukg9Ewtqdct2y0
5Dcta0F3TyCRIxlCDKTL/BslqMtfAdY4H268UO0+8IAQMn9boqzBrHIgs/pvc5kx
TbKHmw2wtWR6vYersBKVgVpbCGSRssDYHGFu1n74qM4HJ/RGcR1zI9QUe1gopSFD
xDtLAoGAVAdWvrqDwgoL2hHW3scGpxdE/ygJDOwHnf+1B9goKAOP5lf2FJaiAxf3
ectoPOgZbCmm/iiDmigu703ld3O+VoCLDD4qx3R+KyALL78gtVJYzSRiKhzgCZ3g
mKsIVRBq4IfwiwyMNG2BYZQAwbSDjjPtn/kPBduPzPj7eriByhI=
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIDPzCCAiegAwIBAgIBBDANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER
MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN
MTEwMjEyMTQ0NDA3WhcNMjEwMjEyMTQ0NDA3WjA8MQswCQYDVQQGEwJOTDERMA8G
A1UEChMIUG9sYXJTU0wxGjAYBgNVBAMTEVBvbGFyU1NMIENsaWVudCAyMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyHTEzLn5tXnpRdkUYLB9u5Pyax6f
M60Nj4o8VmXl3ETZzGaFB9X4J7BKNdBjngpuG7fa8H6r7gwQk4ZJGDTzqCrSV/Uu
1C93KYRhTYJQj6eVSHD1bk2y1RPD0hrt5kPqQhTrdOrA7R/UV06p86jt0uDBMHEw
MjDV0/YI0FZPRo7yX/k9Z5GIMC5Cst99++UMd//sMcB4j7/Cf8qtbCHWjdmLao5v
4Jv4EFbMs44TFeY0BGbH7vk2DmqV9gmaBmf0ZXH4yqSxJeD+PIs1BGe64E92hfx/
/DZrtenNLQNiTrM9AM+vdqBpVoNq0qjU51Bx5rU2BXcFbXvI5MT9TNUhXwIDAQAB
o00wSzAJBgNVHRMEAjAAMB0GA1UdDgQWBBRxoQBzckAvVHZeM/xSj7zx3WtGITAf
BgNVHSMEGDAWgBS0WuSls97SUva51aaVD+s+vMf9/zANBgkqhkiG9w0BAQUFAAOC
AQEAAn86isAM8X+mVwJqeItt6E9slhEQbAofyk+diH1Lh8Y9iLlWQSKbw/UXYjx5
LLPZcniovxIcARC/BjyZR9g3UwTHNGNm+rwrqa15viuNOFBchykX/Orsk02EH7NR
Alw5WLPorYjED6cdVQgBl9ot93HdJogRiXCxErM7NC8/eP511mjq+uLDjLKH8ZPQ
8I4ekHJnroLsDkIwXKGIsvIBHQy2ac/NwHLCQOK6mfum1pRx52V4Utu5dLLjD5bM
xOBC7KU4xZKuMXXZM6/93Yb51K/J4ahf1TxJlTWXtnzDr9saEYdNy2SKY/6ZiDNH
D+stpAKiQLAWaAusIWKYEyw9MQ==
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAyHTEzLn5tXnpRdkUYLB9u5Pyax6fM60Nj4o8VmXl3ETZzGaF
B9X4J7BKNdBjngpuG7fa8H6r7gwQk4ZJGDTzqCrSV/Uu1C93KYRhTYJQj6eVSHD1
bk2y1RPD0hrt5kPqQhTrdOrA7R/UV06p86jt0uDBMHEwMjDV0/YI0FZPRo7yX/k9
Z5GIMC5Cst99++UMd//sMcB4j7/Cf8qtbCHWjdmLao5v4Jv4EFbMs44TFeY0BGbH
7vk2DmqV9gmaBmf0ZXH4yqSxJeD+PIs1BGe64E92hfx//DZrtenNLQNiTrM9AM+v
dqBpVoNq0qjU51Bx5rU2BXcFbXvI5MT9TNUhXwIDAQABAoIBAGdNtfYDiap6bzst
yhCiI8m9TtrhZw4MisaEaN/ll3XSjaOG2dvV6xMZCMV+5TeXDHOAZnY18Yi18vzz
4Ut2TnNFzizCECYNaA2fST3WgInnxUkV3YXAyP6CNxJaCmv2aA0yFr2kFVSeaKGt
ymvljNp2NVkvm7Th8fBQBO7I7AXhz43k0mR7XmPgewe8ApZOG3hstkOaMvbWAvWA
zCZupdDjZYjOJqlA4eEA4H8/w7F83r5CugeBE8LgEREjLPiyejrU5H1fubEY+h0d
l5HZBJ68ybTXfQ5U9o/QKA3dd0toBEhhdRUDGzWtjvwkEQfqF1reGWj/tod/gCpf
DFi6X0ECgYEA4wOv/pjSC3ty6TuOvKX2rOUiBrLXXv2JSxZnMoMiWI5ipLQt+RYT
VPafL/m7Dn6MbwjayOkcZhBwk5CNz5A6Q4lJ64Mq/lqHznRCQQ2Mc1G8eyDF/fYL
Ze2pLvwP9VD5jTc2miDfw+MnvJhywRRLcemDFP8k4hQVtm8PMp3ZmNECgYEA4gz7
wzObR4gn8ibe617uQPZjWzUj9dUHYd+in1gwBCIrtNnaRn9I9U/Q6tegRYpii4ys
c176NmU+umy6XmuSKV5qD9bSpZWG2nLFnslrN15Lm3fhZxoeMNhBaEDTnLT26yoi
33gp0mSSWy94ZEqipms+ULF6sY1ZtFW6tpGFoy8CgYAQHhnnvJflIs2ky4q10B60
ZcxFp3rtDpkp0JxhFLhiizFrujMtZSjYNm5U7KkgPVHhLELEUvCmOnKTt4ap/vZ0
BxJNe1GZH3pW6SAvGDQpl9sG7uu/vTFP+lCxukmzxB0DrrDcvorEkKMom7ZCCRvW
KZsZ6YeH2Z81BauRj218kQKBgQCUV/DgKP2985xDTT79N08jUo3hTP5MVYCCuj/+
UeEw1TvZcx3LJby7P6Xad6a1/BqveaGyFKIfEFIaBUBItk801sDDpDaYc4gL00Xc
7lFuBHOZkxJYlss5QrGpuOEl9ZwUt5IrFLBdYaKqNHzNVC1pCPfb/JyH6Dr2HUxq
gxUwAQKBgQCcU6G2L8AG9d9c0UpOyL1tMvFe5Ttw0KjlQVdsh1MP6yigYo9DYuwu
bHFVW2r0dBTqegP2/KTOxKzaHfC1qf0RGDsUoJCNJrd1cwoCLG8P2EF4w3OBrKqv
8u4ytY0F+Vlanj5lm3TaoHSVF1+NWPyOTiwevIECGKwSxvlki4fDAA==
-----END RSA PRIVATE KEY-----
-----BEGIN DH PARAMETERS-----
MIGHAoGBAJ419DBEOgmQTzo5qXl5fQcN9TN455wkOL7052HzxxRVMyhYmwQcgJvh
1sa18fyfR9OiVEMYglOpkqVoGLN7qd5aQNNi5W7/C+VBdHTBJcGZJyyP5B3qcz32
9mLJKudlVudV0Qxk5qUJaPZ/xupz0NyoVpviuiBOI1gNi8ovSXWzAgEC
-----END DH PARAMETERS-----1 ./linuxrc
0 ./proc
23 ./.DS_Store
15 ./home/.DS_Store
0 ./home/volatile
51 ./home/bootloader/Updater.bin
5 ./home/bootloader/blupdate
1 ./home/bootloader/startupdate
56 ./home/bootloader
0 ./home/thermostat
1 ./home/gui/startgui
577 ./home/gui/stat.mxe
263 ./home/gui/fonts/arial.ttf
48 ./home/gui/fonts/VeraMono-Bold.ttf
75 ./home/gui/fonts/gen.ttf
51 ./home/gui/fonts/arb.ttf
50 ./home/gui/fonts/fut.ttf
4 ./home/gui/fonts/icomoon.ttf
490 ./home/gui/fonts
0 ./home/gui/lang
27 ./home/gui/settings.json
6 ./home/gui/images/holrp1.png
1 ./home/gui/images/svpt.png
5 ./home/gui/images/daydwn.png
2 ./home/gui/images/linvd.png
1 ./home/gui/images/bbnext.png
2 ./home/gui/images/clnxt1.png
4 ./home/gui/images/holpvo.png
3 ./home/gui/images/pcen1.png
5 ./home/gui/images/scbg.png
10 ./home/gui/images/isbg.png
2 ./home/gui/images/clprv2.png
1 ./home/gui/images/clearr.png
3 ./home/gui/images/tpmdo2.png
2 ./home/gui/images/clhol.png
14 ./home/gui/images/daybg.png
19 ./home/gui/images/hmsnfl.png
3 ./home/gui/images/tpprmt.png
1 ./home/gui/images/arrow.png
1 ./home/gui/images/liitds.png
4 ./home/gui/images/holupu.png
2 ./home/gui/images/wfssls.png
3 ./home/gui/images/wfrefs.png
2 ./home/gui/images/oeled1.png
5 ./home/gui/images/holnxu.png
2 ./home/gui/images/oskal2.png
8 ./home/gui/images/g7bg.png
2 ./home/gui/images/limnit.png
1 ./home/gui/images/etccks.png
2 ./home/gui/images/tdmm2.png
2 ./home/gui/images/wfsskb.png
5 ./home/gui/images/altuv0.png
5 ./home/gui/images/icons/skyport.png
1 ./home/gui/images/icons/infocard.png
7 ./home/gui/images/icons/scrnsv.png
6 ./home/gui/images/icons/acc.png
7 ./home/gui/images/icons/prefs.png
1 ./home/gui/images/icons/alerr.png
8 ./home/gui/images/icons/time.png
1 ./home/gui/images/icons/images-stack.png
3 ./home/gui/images/icons/wfon.png
1 ./home/gui/images/icons/clock-select.png
1 ./home/gui/images/icons/alexc.png
6 ./home/gui/images/icons/eheat.png
1 ./home/gui/images/icons/gear.png
6 ./home/gui/images/icons/sec.png
8 ./home/gui/images/icons/sched.png
3 ./home/gui/images/icons/skicn.png
9 ./home/gui/images/icons/fnprog.png
1 ./home/gui/images/icons/dealer.png
5 ./home/gui/images/icons/wifi.png
7 ./home/gui/images/icons/info.png
9 ./home/gui/images/icons/setup.png
2 ./home/gui/images/icons/lcksm.png
7 ./home/gui/images/icons/disp.png
6 ./home/gui/images/icons/altbnr.png
2 ./home/gui/images/icons/skicy.png
6 ./home/gui/images/icons/hum.png
3 ./home/gui/images/icons/altmsg.png
7 ./home/gui/images/icons/vac.png
3 ./home/gui/images/icons/wfof.png
1 ./home/gui/images/icons/succes.png
1 ./home/gui/images/icons/alqst.png
7 ./home/gui/images/icons/alerts.png
135 ./home/gui/images/icons
2 ./home/gui/images/limnsl.png
10 ./home/gui/images/wfnfbg.png
2 ./home/gui/images/homeblits/black/hmmdo1.png
2 ./home/gui/images/homeblits/black/hmfno1.png
2 ./home/gui/images/homeblits/black/hmfna1.png
3 ./home/gui/images/homeblits/black/hmmdh2.png
3 ./home/gui/images/homeblits/black/hmmda2.png
2 ./home/gui/images/homeblits/black/hmmwh1.png
3 ./home/gui/images/homeblits/black/hmmwh2.png
1 ./home/gui/images/homeblits/black/hmfno2.png
2 ./home/gui/images/homeblits/black/hmmwo1.png
2 ./home/gui/images/homeblits/black/hmmdo2.png
3 ./home/gui/images/homeblits/black/hmmdc2.png
2 ./home/gui/images/homeblits/black/hmmwo2.png
1 ./home/gui/images/homeblits/black/hmfna2.png
2 ./home/gui/images/homeblits/black/hmmdh1.png
3 ./home/gui/images/homeblits/black/hmmwc2.png
3 ./home/gui/images/homeblits/black/hmmda1.png
6 ./home/gui/images/homeblits/black/hmmdbg.png
5 ./home/gui/images/homeblits/black/hmfnbg.png
3 ./home/gui/images/homeblits/black/hmmwc1.png
3 ./home/gui/images/homeblits/black/hmmdc1.png
49 ./home/gui/images/homeblits/black
3 ./home/gui/images/homeblits/hmcl1.png
2 ./home/gui/images/homeblits/hmstc.png
2 ./home/gui/images/homeblits/hmsti.png
10 ./home/gui/images/homeblits/hmomsg.png
2 ./home/gui/images/homeblits/hmste.png
2 ./home/gui/images/homeblits/hmsth.png
3 ./home/gui/images/homeblits/hmwm1.png
3 ./home/gui/images/homeblits/hmwm2.png
2 ./home/gui/images/homeblits/blue/hmmdo1.png
2 ./home/gui/images/homeblits/blue/hmfno1.png
2 ./home/gui/images/homeblits/blue/hmfna1.png
3 ./home/gui/images/homeblits/blue/hmmdh2.png
3 ./home/gui/images/homeblits/blue/hmmda2.png
2 ./home/gui/images/homeblits/blue/hmmwh1.png
3 ./home/gui/images/homeblits/blue/hmmwh2.png
1 ./home/gui/images/homeblits/blue/hmfno2.png
2 ./home/gui/images/homeblits/blue/hmmwo1.png
2 ./home/gui/images/homeblits/blue/hmmdo2.png
3 ./home/gui/images/homeblits/blue/hmmdc2.png
2 ./home/gui/images/homeblits/blue/hmmwo2.png
1 ./home/gui/images/homeblits/blue/hmfna2.png
2 ./home/gui/images/homeblits/blue/hmmdh1.png
3 ./home/gui/images/homeblits/blue/hmmwc2.png
3 ./home/gui/images/homeblits/blue/hmmda1.png
5 ./home/gui/images/homeblits/blue/hmmdbg.png
5 ./home/gui/images/homeblits/blue/hmfnbg.png
3 ./home/gui/images/homeblits/blue/hmmwc1.png
3 ./home/gui/images/homeblits/blue/hmmdc1.png
49 ./home/gui/images/homeblits/blue
2 ./home/gui/images/homeblits/hmstfc.png
3 ./home/gui/images/homeblits/hmcl2.png
127 ./home/gui/images/homeblits
1 ./home/gui/images/clsel.png
17 ./home/gui/images/tpsplt.png
11 ./home/gui/images/wfscan.png
2 ./home/gui/images/tiit1.png
4 ./home/gui/images/wfnwat.png
3 ./home/gui/images/pccl2.png
4 ./home/gui/images/icdelt.png
2 ./home/gui/images/clnxt2.png
1 ./home/gui/images/pes5.png
3 ./home/gui/images/pebg.png
3 ./home/gui/images/ldanim.gif
2 ./home/gui/images/bbaway.png
11 ./home/gui/images/tpedit.png
7 ./home/gui/images/tsetbg.png
2 ./home/gui/images/oskan2.png
12 ./home/gui/images/osknum.png
3 ./home/gui/images/holupn.png
2 ./home/gui/images/sixit2.png
7 ./home/gui/images/pgicon.png
1 ./home/gui/images/oebtn1.png
5 ./home/gui/images/numbg.png
4 ./home/gui/images/tpmdc2.png
2 ./home/gui/images/holchk.png
2 ./home/gui/images/oskal1.png
3 ./home/gui/images/isnxt2.png
3 ./home/gui/images/holrpo.png
1 ./home/gui/images/bbback.png
3 ./home/gui/images/tprvbg.png
1 ./home/gui/images/anldot.png
2 ./home/gui/images/wfnwof.png
4 ./home/gui/images/tpmdh2.png
19 ./home/gui/images/svbg.png
29 ./home/gui/images/anlcbg.png
3 ./home/gui/images/holck.png
3 ./home/gui/images/tpmdo1.png
2 ./home/gui/images/oskmr2.png
3 ./home/gui/images/anmfan.gif
2 ./home/gui/images/wfs4.png
11 ./home/gui/images/hmlkbg.png
12 ./home/gui/images/hmlkbr.png
2 ./home/gui/images/linvd2.png
2 ./home/gui/images/tdhp2.png
1 ./home/gui/images/pes1.png
2 ./home/gui/images/tdminm.png
2 ./home/gui/images/tpbg.png
2 ./home/gui/images/clgrid.png
4 ./home/gui/images/tpnite.png
18 ./home/gui/images/skpstatus.png
2 ./home/gui/images/g7icn.png
3 ./home/gui/images/bbhome.png
2 ./home/gui/images/wfssit.png
0 ./home/gui/images/themes/halloween
0 ./home/gui/images/themes/kitchen
0 ./home/gui/images/themes/leather
0 ./home/gui/images/themes/hanukkah
20 ./home/gui/images/themes/christmas/bg_night.jpg
1 ./home/gui/images/themes/christmas/bbbg.png
40 ./home/gui/images/themes/christmas/bg_day.jpg
60 ./home/gui/images/themes/christmas
0 ./home/gui/images/themes/everest
0 ./home/gui/images/themes/outback
0 ./home/gui/images/themes/wood
1 ./home/gui/images/themes/cinco/bbbg.png
35 ./home/gui/images/themes/cinco/bg_day.jpg
36 ./home/gui/images/themes/cinco
0 ./home/gui/images/themes/metal
0 ./home/gui/images/themes/sunset
0 ./home/gui/images/themes/coffee
0 ./home/gui/images/themes/maui
0 ./home/gui/images/themes/thanksgiving
38 ./home/gui/images/themes/buildings/bg_night.jpg
1 ./home/gui/images/themes/buildings/bbbg.png
37 ./home/gui/images/themes/buildings/bg_day.jpg
75 ./home/gui/images/themes/buildings
171 ./home/gui/images/themes
5 ./home/gui/images/tpday.png
2 ./home/gui/images/wfs5.png
10 ./home/gui/images/link.gif
2 ./home/gui/images/oskmr1.png
7 ./home/gui/images/altuv1.png
2 ./home/gui/images/alrtsv.png
1 ./home/gui/images/bbof.png
3 ./home/gui/images/tpeve.png
2 ./home/gui/images/tctuov.png
2 ./home/gui/images/tpmdsl.png
1 ./home/gui/images/alrtc1.png
3 ./home/gui/images/liitpr.png
12 ./home/gui/images/osklow.png
3 ./home/gui/images/isnxt1.png
20 ./home/gui/images/itbshort.png
2 ./home/gui/images/tphglt.png
74 ./home/gui/images/holbg.png
3 ./home/gui/images/isprv1.png
1 ./home/gui/images/alrtuv.png
4 ./home/gui/images/tpmda2.png
5 ./home/gui/images/analrt.gif
1 ./home/gui/images/pes2.png
2 ./home/gui/images/holoit.png
5 ./home/gui/images/ovbg.png
2 ./home/gui/images/tpchk.png
1 ./home/gui/images/alrtbr.png
5 ./home/gui/images/tcsplt.png
3 ./home/gui/images/holdnd.png
9 ./home/gui/images/skpaired.png
2 ./home/gui/images/clprv1.png
14 ./home/gui/images/tcedit.png
1 ./home/gui/images/tptuov.png
3 ./home/gui/images/altics.png
2 ./home/gui/images/oskdl1.png
2 ./home/gui/images/oeled0.png
1 ./home/gui/images/lock.png
3 ./home/gui/images/dglchl.png
1 ./home/gui/images/bbup.png
2 ./home/gui/images/dlreml.png
2 ./home/gui/images/alrtfn.png
1 ./home/gui/images/alrtc2.png
16 ./home/gui/images/skpair1.png
5 ./home/gui/images/holrp2.png
1 ./home/gui/images/alticr.png
9 ./home/gui/images/isdet2.png
5 ./home/gui/images/holpvu.png
8 ./home/gui/images/tdehbg.png
2 ./home/gui/images/osksp1.png
1 ./home/gui/images/pcbtd.png
2 ./home/gui/images/tiit2.png
2 ./home/gui/images/linvu2.png
2 ./home/gui/images/alrtby.png
2 ./home/gui/images/tdhrm.png
1 ./home/gui/images/hmvbar.png
7 ./home/gui/images/iebg.png
4 ./home/gui/images/hlinfu.png
4 ./home/gui/images/icfan.png
2 ./home/gui/images/linvu.png
4 ./home/gui/images/tpmda1.png
17 ./home/gui/images/altfn1.png
2 ./home/gui/images/oskdl2.png
2 ./home/gui/images/stgit2.png
1 ./home/gui/images/tpspdn.png
2 ./home/gui/images/osksf2.png
3 ./home/gui/images/holdnn.png
15 ./home/gui/images/altfn0.png
1 ./home/gui/images/track.png
3 ./home/gui/images/holupd.png
2 ./home/gui/images/sixit1.png
2 ./home/gui/images/bbaltlcom.png
1 ./home/gui/images/pes0.png
3 ./home/gui/images/wflock.png
1 ./home/gui/images/svanim.gif
5 ./home/gui/images/holnxd.png
2 ./home/gui/images/tiit3.png
9 ./home/gui/images/hollgn.png
1 ./home/gui/images/alrtc3.png
2 ./home/gui/images/wflsit.png
6 ./home/gui/images/clhead.png
2 ./home/gui/images/dlrcnt.png
2 ./home/gui/images/osksf1.png
1 ./home/gui/images/litgup.png
3 ./home/gui/images/sixbg.png
1 ./home/gui/images/alrtc4.png
1 ./home/gui/images/tpclck.png
2 ./home/gui/images/oskcl2.png
2 ./home/gui/images/holinf.png
29 ./home/gui/images/dgccbg.png
4 ./home/gui/images/holrpu.png
2 ./home/gui/images/wfs3.png
2 ./home/gui/images/wfs1.png
12 ./home/gui/images/wfskp.png
2 ./home/gui/images/tdmp2.png
4 ./home/gui/images/hlinfd.png
1 ./home/gui/images/oskovr.png
1 ./home/gui/images/mslt.png
2 ./home/gui/images/altbt1.png
1 ./home/gui/images/bbcl.png
2 ./home/gui/images/tctdov.png
2 ./home/gui/images/holhlt.png
1 ./home/gui/images/bbht.png
2 ./home/gui/images/peday0.png
2 ./home/gui/images/pechk.png
2 ./home/gui/images/hmsoff.png
2 ./home/gui/images/ieitem.png
52 ./home/gui/images/widgetbg.png
2 ./home/gui/images/oskcl1.png
14 ./home/gui/images/stgbg.png
12 ./home/gui/images/hmlkbn.png
14 ./home/gui/images/msbg.png
2 ./home/gui/images/stgit1.png
3 ./home/gui/images/litgdn.png
1 ./home/gui/images/tpmdov.png
1 ./home/gui/images/alrtbw.png
5 ./home/gui/images/holpvd.png
3 ./home/gui/images/pcen2.png
2 ./home/gui/images/liitpo.png
1 ./home/gui/images/bbdown.png
1 ./home/gui/images/oebtn2.png
1 ./home/gui/images/clnow.png
5 ./home/gui/images/wifiscan.gif
1 ./home/gui/images/bbstcl.png
3 ./home/gui/images/hmssel.png
6 ./home/gui/images/oebg.png
3 ./home/gui/images/pccl1.png
1 ./home/gui/images/msrt.png
2 ./home/gui/images/osksp2.png
2 ./home/gui/images/tdhm2.png
0 ./home/gui/images/weather
3 ./home/gui/images/peday1.png
2 ./home/gui/images/holexc.png
1 ./home/gui/images/tpspup.png
1 ./home/gui/images/bbchk.png
9 ./home/gui/images/hmmdbg.png
29 ./home/gui/images/dgchbg.png
2 ./home/gui/images/liitsl.png
12 ./home/gui/images/osksym.png
2 ./home/gui/images/tpspdb.png
2 ./home/gui/images/pcen0.png
1 ./home/gui/images/bbstht.png
2 ./home/gui/images/dlrphn.png
2 ./home/gui/images/oskan1.png
1 ./home/gui/images/liit.png
8 ./home/gui/images/isdet1.png
2 ./home/gui/images/holrit.png
11 ./home/gui/images/hmmnfl.png
4 ./home/gui/images/holrpd.png
4 ./home/gui/images/dayup.png
1 ./home/gui/images/altbt0.png
20 ./home/gui/images/wfsspc.png
15 ./home/gui/images/kpbg.png
29 ./home/gui/images/dgcibg.png
1 ./home/gui/images/pes7.png
12 ./home/gui/images/oskcap.png
2 ./home/gui/images/dlrweb.png
8 ./home/gui/images/cnicon.png
3 ./home/gui/images/tpmdh1.png
6 ./home/gui/images/hmfnbg.png
2 ./home/gui/images/tdminp.png
4 ./home/gui/images/holnxo.png
3 ./home/gui/images/holrwn.png
1 ./home/gui/images/alrtbg.png
2 ./home/gui/images/sshsbg.png
1 ./home/gui/images/etcchk.png
1 ./home/gui/images/tptdov.png
3 ./home/gui/images/tpmorn.png
2 ./home/gui/images/tdhrp.png
2 ./home/gui/images/holcb.png
5 ./home/gui/images/tpmdc1.png
3 ./home/gui/images/isprv2.png
2 ./home/gui/images/holhdr.png
2 ./home/gui/images/wfs2.png
4 ./home/gui/images/holdnu.png
1590 ./home/gui/images
16 ./home/gui/launcher.mxe
2700 ./home/gui
0 ./home/volatilerestore
12 ./home/calibrate/center.png
11 ./home/calibrate/wait.png
36 ./home/calibrate/tscalibrate
21 ./home/calibrate/fbview
1 ./home/calibrate/startcalibrate
12 ./home/calibrate/botright.png
12 ./home/calibrate/topright.png
15 ./home/calibrate/post.png
12 ./home/calibrate/botleft.png
12 ./home/calibrate/topleft.png
143 ./home/calibrate
0 ./home/secure
2913 ./home
17 ./manifest.json.gz
0 ./lib
2 ./etc/profile
1 ./etc/sddpd.conf
1 ./etc/platform
1 ./etc/br-version
0 ./etc/ld.so.conf.d
3 ./etc/ld.so.cache
1 ./etc/fstab
1 ./etc/random-seed
11 ./etc/services
1 ./etc/TZ
1 ./etc/hostname
1 ./etc/inittab
1 ./etc/init.d/S45owl
1 ./etc/init.d/rcS
1 ./etc/init.d/S09temp
2 ./etc/init.d
2 ./etc/protocols
1 ./etc/identity
1 ./etc/passwd
1 ./etc/ifplugd/ifplugd.action
1 ./etc/ifplugd
1 ./etc/resolv.conf
1 ./etc/network/interfaces
1 ./etc/network
1 ./etc/ts.conf
1 ./etc/shadow
1 ./etc/issue
1 ./etc/directfbrc
1 ./etc/securetty
2 ./etc/inputrc
1 ./etc/group
1 ./etc/hosts
33 ./etc
0 ./usr
0 ./sys
0 ./mnt
1 ./bin/pwd
1 ./bin/kill
1 ./bin/ping
1 ./bin/run-parts
1 ./bin/linux32
1 ./bin/stty
1 ./bin/setarch
1 ./bin/cp
1 ./bin/rmdir
1 ./bin/mktemp
1 ./bin/date
1 ./bin/getopt
1 ./bin/ps
1 ./bin/mkdir
1 ./bin/watch
1 ./bin/mountpoint
1 ./bin/sync
1 ./bin/hostname
1 ./bin/dumpkmap
1 ./bin/rm
1 ./bin/netstat
1 ./bin/ln
1 ./bin/fdflush
1 ./bin/mv
1 ./bin/pidof
1 ./bin/ash
1 ./bin/touch
1 ./bin/mknod
1 ./bin/cat
1 ./bin/linux64
1 ./bin/uname
1 ./bin/mount
1 ./bin/dmesg
1 ./bin/pipe_progress
1 ./bin/printenv
295 ./bin/busybox
1 ./bin/ls
1 ./bin/login
1 ./bin/false
1 ./bin/echo
1 ./bin/true
1 ./bin/chmod
783 ./bin/maestro
1 ./bin/umount
1 ./bin/sh
1099 ./bin
0 ./var
0 ./sbin
0 ./dev/tty1
0 ./dev/mtd0
0 ./dev/mmcblk0p1
0 ./dev/i2c-0
0 ./dev/tty2
0 ./dev/mtd1
0 ./dev/mtdblock1
0 ./dev/console
0 ./dev/rtc0
0 ./dev/event0
0 ./dev/ttyS0
1 ./dev/thermostat/RemoteTemp
1 ./dev/thermostat/W2
1 ./dev/thermostat/GE
1 ./dev/thermostat/W3
1 ./dev/thermostat/OB
1 ./dev/thermostat/RTCLegacy
1 ./dev/thermostat/Y1
1 ./dev/thermostat/OutdoorTemp
1 ./dev/thermostat/IndoorTemp
1 ./dev/thermostat/EquipmentType
1 ./dev/thermostat/G
1 ./dev/thermostat/W1
1 ./dev/thermostat/Y2
7 ./dev/thermostat
0 ./dev/mtd2
0 ./dev/tty
1 ./dev/backlight
0 ./dev/mtdblock0
0 ./dev/random
0 ./dev/fb0
0 ./dev/mtdblock2
0 ./dev/event1
0 ./dev/urandom
0 ./dev/watchdog
0 ./dev/null
0 ./dev/ttySDIO0
0 ./dev/tty0
0 ./dev/mmcblk0
7 ./dev
0 ./tmp
4091 .The manifest.json.gz appears to list a bunch of files that are not in the JFFS2 filesystem. Perhaps there's some other mtd partition on the device that has these files. Still no .ko's listed.
./home/gui/images/themes/cinco/bg_night.jpg
./home/gui/images/themes/coffee/bbbg.png
./home/gui/images/themes/coffee/bg_day.jpg
./home/gui/images/themes/coffee/bg_night.jpg
./home/gui/images/themes/everest/bbbg.png
./home/gui/images/themes/everest/bg_day.jpg
./home/gui/images/themes/everest/bg_night.jpg
./home/gui/images/themes/halloween/bbbg.png
./home/gui/images/themes/halloween/bg_day.jpg
./home/gui/images/themes/halloween/bg_night.jpg
./home/gui/images/themes/hanukkah/bbbg.png
./home/gui/images/themes/hanukkah/bg_day.jpg
./home/gui/images/themes/hanukkah/bg_night.jpg
./home/gui/images/themes/kitchen/bbbg.png
./home/gui/images/themes/kitchen/bg_day.jpg
./home/gui/images/themes/kitchen/bg_night.jpg
./home/gui/images/themes/leather/bbbg.png
./home/gui/images/themes/leather/bg_day.jpg
./home/gui/images/themes/leather/bg_night.jpg
./home/gui/images/themes/maui/bbbg.png
./home/gui/images/themes/maui/bg_day.jpg
./home/gui/images/themes/maui/bg_night.jpg
./home/gui/images/themes/metal/bbbg.png
./home/gui/images/themes/metal/bg_day.jpg
./home/gui/images/themes/metal/bg_night.jpg
./home/gui/images/themes/outback/bbbg.png
./home/gui/images/themes/outback/bg_day.jpg
./home/gui/images/themes/outback/bg_night.jpg
./home/gui/images/themes/sunset/bbbg.png
./home/gui/images/themes/sunset/bg_day.jpg
./home/gui/images/themes/sunset/bg_night.jpg
./home/gui/images/themes/thanksgiving/bbbg.png
./home/gui/images/themes/thanksgiving/bg_day.jpg
./home/gui/images/themes/thanksgiving/bg_night.jpg
./home/gui/images/themes/wood/bbbg.png
./home/gui/images/themes/wood/bg_day.jpg
./home/gui/images/themes/wood/bg_night.jpg
./home/gui/images/weather/weather-few-clouds.png
./home/gui/images/weather/weather-fog.png
./home/gui/images/weather/weather-freezing-rain.png
./home/gui/images/weather/weather-icy.png
./home/gui/images/weather/weather-night-fullmoon-clear.png
./home/gui/images/weather/weather-night-fullmoon-cloudy.png
./home/gui/images/weather/weather-night-fullmoon-foggy.png
./home/gui/images/weather/weather-night-fullmoon-partially-cloudy.png
./home/gui/images/weather/weather-night-fullmoon-rain.png
./home/gui/images/weather/weather-night-fullmoon-snow.png
./home/gui/images/weather/weather-night-fullmoon-thunderstorms.png
./home/gui/images/weather/weather-overcast.png
./home/gui/images/weather/weather-showers-scattered.png
./home/gui/images/weather/weather-showers-spitting.png
./home/gui/images/weather/weather-showers.png
./home/gui/images/weather/weather-sleet.png
./home/gui/images/weather/weather-smog.png
./home/gui/images/weather/weather-snow.png
./home/gui/images/weather/weather-sunny-haze.png
./home/gui/images/weather/weather-sunny-very-few-clouds.png
./home/gui/images/weather/weather-sunny.png
./home/gui/images/weather/weather-thundershower.png
./home/gui/lang/lang_en.json
./home/gui/lang/lang_fr.json
./home/gui/lang/lang_sp.json
./home/thermostat/libmthermostat.so.1
./lib/.DS_Store
./lib/ld-uClibc-0.9.29.so
./lib/libcrypt-0.9.29.so
./lib/libdl-0.9.29.so
./lib/libgcc_s.so.1
./lib/libm-0.9.29.so
./lib/libnsl-0.9.29.so
./lib/libpthread-0.9.29.so
./lib/libresolv-0.9.29.so
./lib/librt-0.9.29.so
./lib/libuClibc-0.9.29.so
./lib/libutil-0.9.29.so
./lib/modules/owl.ko
./lib/modules/temperaturelocal.ko
./lib/modules/temperaturewired.ko
./sbin/hotplug
./sbin/ifrename
./sbin/iwconfig
./sbin/iwevent
./sbin/iwgetid
./sbin/iwlist
./sbin/iwpriv
./sbin/iwspy
./sbin/powerd
./sbin/udate
./sbin/wdt_restart
./sbin/wifi_ap.sh
./sbin/wifi_interface.sh
./sbin/wifi_network.sh
./sbin/wifi_rssi_max.sh
./sbin/wifi_scan.sh
./sbin/wifi_start.sh
./sbin/wifi_status.sh
./sbin/wifi_stop.sh
./sbin/wpa_cli
./sbin/wpa_passphrase
./sbin/wpa_supplicant
./usr/.DS_Store
./usr/bin/arm-linux-dfbdump
./usr/bin/arm-linux-dfbfx
./usr/bin/arm-linux-dfbg
./usr/bin/arm-linux-dfbinfo
./usr/bin/arm-linux-dfbinput
./usr/bin/arm-linux-dfbinspector
./usr/bin/arm-linux-dfblayer
./usr/bin/arm-linux-dfbmaster
./usr/bin/arm-linux-dfbpenmount
./usr/bin/arm-linux-dfbscreen
./usr/bin/arm-linux-directfb-config
./usr/bin/arm-linux-directfb-csource
./usr/bin/arm-linux-mkdfiff
./usr/bin/arm-linux-mkdgiff
./usr/bin/fbv
./usr/bin/file
./usr/bin/inputattach
./usr/bin/libpng12-config
./usr/bin/sqlite3
./usr/bin/sstrip
./usr/bin/ts_calibrate
./usr/bin/ts_finddev
./usr/bin/ts_test
./usr/bin/udevinfo
./usr/bin/udevtest
./usr/lib/clean.so
./usr/lib/clean_v1.so
./usr/lib/dejitter.so
./usr/lib/input.so
./usr/lib/libdaemon.so.0.4.0
./usr/lib/libdirect-1.4.so.0.3.0
./usr/lib/libdirectfb-1.4.so.0.3.0
./usr/lib/libfreetype.so.6.3.18
./usr/lib/libfusion-1.4.so.0.3.0
./usr/lib/libgmp.so.3.4.2
./usr/lib/libhistory.so.5.2
./usr/lib/libiw.so.29
./usr/lib/libjpeg.so.62.0.0
./usr/lib/libjs.so
./usr/lib/libncurses.so.5.6
./usr/lib/libpng12.so.0.32.0
./usr/lib/libreadline.so.5.2
./usr/lib/libsqlite3-3.6.10.so.0.8.6
./usr/lib/libstdc++.so.6.0.10
./usr/lib/libts-0.0.so.0.1.1
./usr/lib/libungif.so.4.1.4
./usr/lib/libz.so.1.2.3
./usr/lib/linear.so
./usr/lib/linear_h2200.so
./usr/lib/pthres.so
./usr/lib/variance.so
./usr/lib/directfb-1.4-0/inputdrivers/libdirectfb_tslib.la~
./usr/lib/directfb-1.4-0/inputdrivers/libdirectfb_tslib.o
./usr/lib/directfb-1.4-0/inputdrivers/libdirectfb_tslib.so
./usr/lib/directfb-1.4-0/interfaces/IDirectFBFont/libidirectfbfont_default.la~
./usr/lib/directfb-1.4-0/interfaces/IDirectFBFont/libidirectfbfont_default.o
./usr/lib/directfb-1.4-0/interfaces/IDirectFBFont/libidirectfbfont_default.so
./usr/lib/directfb-1.4-0/interfaces/IDirectFBFont/libidirectfbfont_dgiff.la~
./usr/lib/directfb-1.4-0/interfaces/IDirectFBFont/libidirectfbfont_dgiff.o
./usr/lib/directfb-1.4-0/interfaces/IDirectFBFont/libidirectfbfont_dgiff.so
./usr/lib/directfb-1.4-0/interfaces/IDirectFBFont/libidirectfbfont_ft2.la~
./usr/lib/directfb-1.4-0/interfaces/IDirectFBFont/libidirectfbfont_ft2.o
./usr/lib/directfb-1.4-0/interfaces/IDirectFBFont/libidirectfbfont_ft2.so
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_dfiff.la~
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_dfiff.o
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_dfiff.so
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_gif.la~
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_gif.o
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_gif.so
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_jpeg.la~
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_jpeg.o
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_jpeg.so
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_png.la~
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_png.o
./usr/lib/directfb-1.4-0/interfaces/IDirectFBImageProvider/libidirectfbimageprovider_png.so
./usr/lib/directfb-1.4-0/interfaces/IDirectFBVideoProvider/libidirectfbvideoprovider_gif.la~
./usr/lib/directfb-1.4-0/interfaces/IDirectFBVideoProvider/libidirectfbvideoprovider_gif.o
./usr/lib/directfb-1.4-0/interfaces/IDirectFBVideoProvider/libidirectfbvideoprovider_gif.so
./usr/lib/directfb-1.4-0/systems/libdirectfb_devmem.la~
./usr/lib/directfb-1.4-0/systems/libdirectfb_devmem.o
./usr/lib/directfb-1.4-0/systems/libdirectfb_devmem.so
./usr/lib/directfb-1.4-0/systems/libdirectfb_fbdev.la~
./usr/lib/directfb-1.4-0/systems/libdirectfb_fbdev.o
./usr/lib/directfb-1.4-0/systems/libdirectfb_fbdev.so
./usr/lib/directfb-1.4-0/wm/libdirectfbwm_default.la~
./usr/lib/directfb-1.4-0/wm/libdirectfbwm_default.o
./usr/lib/directfb-1.4-0/wm/libdirectfbwm_default.so
./usr/sbin/buzz_freq
./usr/sbin/doc_loadbios
./usr/sbin/docfdisk
./usr/sbin/fbset
./usr/sbin/flash_erase
./usr/sbin/flash_eraseall
./usr/sbin/flash_info
./usr/sbin/flash_lock
./usr/sbin/flash_unlock
./usr/sbin/flashcp
./usr/sbin/ftl_check
./usr/sbin/ftl_format
./usr/sbin/ifplugd
./usr/sbin/ifplugstatus
./usr/sbin/jffs2dump
./usr/sbin/mkfs.jffs
./usr/sbin/mkfs.jffs2
./usr/sbin/mtd_debug
./usr/sbin/nanddump
./usr/sbin/nandwrite
./usr/sbin/nftl_format
./usr/sbin/nftldump
./usr/sbin/sumtool
./usr/sbin/udevmonitor
./usr/share/directfb-1.2.7/cursor.dat
./usr/share/misc/file/magic.mgc
./usr/share/terminfo/a/ansi
./usr/share/terminfo/l/linux
./usr/share/terminfo/v/vt100
./usr/share/terminfo/v/vt102
./usr/share/terminfo/v/vt220
./usr/share/terminfo/x/xterm
./usr/share/terminfo/x/xterm-color
./usr/share/terminfo/x/xterm-xfree86
./usr/share/udhcpc/default.scriptSo, you can rule out it not being verified by the thermostat reasonably easy, with netcat.
Power off one of your sensors, and replay older messages from it, to the thermostat, and see what happens. If the thermostat responds to them, then try swapping the hash out with your own hash, or swapping the hash from two messages around, and see if it ignores you.
I'd hate to go all GPL on them, and lose one of the only local api thermostats out there. :)
./lib/modules/temperaturelocal.ko ./lib/modules/temperaturewired.ko
Those look like ko's tho. You might try pulling the init scripts out, and see if any of them start a listener, though it's probably in-app rather than a separate service. That second dump looks like where you store all the images for the backgrounds. I do wish there was an API to switch it to the xmas one. :)
hpeyerl
commented
2 years ago oh, I totally missed those. They're listed in the manifest but not in the jffs2 that I extracted from the update; so I don't know where they are.
hpeyerl
commented
2 years ago ::::::::::::::
S09temp
::::::::::::::
#!/bin/sh
insmod /lib/modules/temperaturelocal.ko
insmod /lib/modules/temperaturewired.ko
mknod /tmp/LocalTemp c 222 0
mknod /tmp/WiredTemp c 223 0
::::::::::::::
S45owl
::::::::::::::
#!/bin/sh
insmod /lib/modules/owl.koNothing illuminating other than I still can't find the rest of the files listed in the manifest.json.
I only extracted the 'VC' firmware, there's also "VR", "VH", "VW". I'll look in those and see if there's anything useful in those. The settings.json in the VC firmware claims it's for a T6800 Commercial.
doug-hoffman
commented
2 years ago I'm looking at the VH firmware right now. Here's the models for each:
hpeyerl
commented
2 years ago I was just unpacking the VR and it says 'Residential', so yes. Seems to be the same type of 'stuff' inside... ie: no .ko's.
the VH firmware has more goodies inside.
hpeyerl
commented
2 years ago well anyway, I'm over my 'play time' allowance for the day.
I'm sure there's a fitImage or something inside the VH firmware that has an initramfs. Though it appears to have a u-boot inside of it so maybe it's a straight dump of /dev/mtd.
VH also appears to be a more modern kernel:
Linux version 4.9.127-linux4sam_5.8+ (root@a9ad1ef288b9) (gcc version 7.3.0 (Buildroot 2018.08.1-00003-g576b333) ) #1 Thu Oct 15 23:40:14 UTC 2020q
doug-hoffman
commented
2 years ago Maestro appears to be more than just the GUI. Based on strings, it seems to also serve the local API, SSDP, "OTA" updates, wpa_supplicant config, amongst other things. It only references EVP_sha256 and EVP_sha384, so it likely only supports those two functions for hashing (although they may only be for HTTPS, I haven't found evidence that maestro handles messages on udp 5001).
It also references the library libmthermostat.so, which appears to handle thermostat functions.
Wonder if this'll be good for anything:
root:$1$JEstzl9y$Ed7nAJIsY/0irewnqZoqn1:10933:0:99999:7:::That's md5, so it may be viable to crack.
doug-hoffman
commented
2 years ago Anyone good with assembly? Found the bits that process/validate the sensor messages. Definitely base64 encoded sha256. If there's a salt in there, I don't know enough to find it.
000fe15c <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base>:
fe15c: e92d4030 push {r4, r5, lr}
fe160: e5923000 ldr r3, [r2]
fe164: e24dd801 sub sp, sp, #65536 ; 0x10000
fe168: e513000c ldr r0, [r3, #-12]
fe16c: e24dd054 sub sp, sp, #84 ; 0x54
fe170: e0820000 add r0, r2, r0
fe174: e3a03000 mov r3, #0
fe178: e1a05001 mov r5, r1
fe17c: e2800004 add r0, r0, #4
fe180: e28d1018 add r1, sp, #24
fe184: e58d3018 str r3, [sp, #24]
fe188: e58d301c str r3, [sp, #28]
fe18c: e58d3020 str r3, [sp, #32]
fe190: e58d3024 str r3, [sp, #36] ; 0x24
fe194: e58d3028 str r3, [sp, #40] ; 0x28
fe198: e58d302c str r3, [sp, #44] ; 0x2c
fe19c: e58d3030 str r3, [sp, #48] ; 0x30
fe1a0: e58d3034 str r3, [sp, #52] ; 0x34
fe1a4: e58d3038 str r3, [sp, #56] ; 0x38
fe1a8: eb004e73 bl 111b7c <_ZN6shared6base646decodeERKSt6vectorIcSaIcEERS3_@@Base>
fe1ac: e1cd21d8 ldrd r2, [sp, #24]
fe1b0: e0433002 sub r3, r3, r2
fe1b4: e3530020 cmp r3, #32
fe1b8: 9a000012 bls fe208 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0xac>
fe1bc: e59d4030 ldr r4, [sp, #48] ; 0x30
fe1c0: e3540000 cmp r4, #0
fe1c4: 01a05004 moveq r5, r4
fe1c8: 0a000002 beq fe1d8 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x7c>
fe1cc: e3a05000 mov r5, #0
fe1d0: e1a00004 mov r0, r4
fe1d4: ebfd7610 bl 5ba1c <_ZdlPv@plt>
fe1d8: e59d0024 ldr r0, [sp, #36] ; 0x24
fe1dc: e3500000 cmp r0, #0
fe1e0: 0a000000 beq fe1e8 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x8c>
fe1e4: ebfd760c bl 5ba1c <_ZdlPv@plt>
fe1e8: e59d0018 ldr r0, [sp, #24]
fe1ec: e3500000 cmp r0, #0
fe1f0: 0a000000 beq fe1f8 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x9c>
fe1f4: ebfd7608 bl 5ba1c <_ZdlPv@plt>
fe1f8: e1a00005 mov r0, r5
fe1fc: e28dd801 add sp, sp, #65536 ; 0x10000
fe200: e28dd054 add sp, sp, #84 ; 0x54
fe204: e8bd8030 pop {r4, r5, pc}
fe208: e28d1050 add r1, sp, #80 ; 0x50
fe20c: e59f2100 ldr r2, [pc, #256] ; fe314 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x1b8>
fe210: e2410014 sub r0, r1, #20
fe214: eb00eefd bl 139e10 <pb_ostream_from_buffer@@Base>
fe218: e28d3050 add r3, sp, #80 ; 0x50
fe21c: e1a02005 mov r2, r5
fe220: e59f10f0 ldr r1, [pc, #240] ; fe318 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x1bc>
fe224: e2430014 sub r0, r3, #20
fe228: eb00f0ee bl 13a5e8 <pb_encode@@Base>
fe22c: e3500000 cmp r0, #0
fe230: 0affffe1 beq fe1bc <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x60>
fe234: e59d3024 ldr r3, [sp, #36] ; 0x24
fe238: e59d1028 ldr r1, [sp, #40] ; 0x28
fe23c: e0411003 sub r1, r1, r3
fe240: e351001f cmp r1, #31
fe244: 9a000020 bls fe2cc <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x170>
fe248: e3510020 cmp r1, #32
fe24c: 12833020 addne r3, r3, #32
fe250: 158d3028 strne r3, [sp, #40] ; 0x28
fe254: e3a03000 mov r3, #0
fe258: e58d3014 str r3, [sp, #20]
fe25c: ebfd7627 bl 5bb00 <EVP_sha256@plt>
fe260: e59d3024 ldr r3, [sp, #36] ; 0x24
fe264: e59d1018 ldr r1, [sp, #24]
fe268: e59d201c ldr r2, [sp, #28]
fe26c: e59dc048 ldr ip, [sp, #72] ; 0x48
fe270: e58d3004 str r3, [sp, #4]
fe274: e28d3014 add r3, sp, #20
fe278: e58d3008 str r3, [sp, #8]
fe27c: e0422001 sub r2, r2, r1
fe280: e58dc000 str ip, [sp]
fe284: e28d3050 add r3, sp, #80 ; 0x50
fe288: ebfd7856 bl 5c3e8 <HMAC@plt>
fe28c: e28d3050 add r3, sp, #80 ; 0x50
fe290: e28d1030 add r1, sp, #48 ; 0x30
fe294: e243002c sub r0, r3, #44 ; 0x2c
fe298: eb004dcc bl 1119d0 <_ZN6shared6base646encodeERKSt6vectorIcSaIcEERS3_@@Base>
fe29c: e59d4030 ldr r4, [sp, #48] ; 0x30
fe2a0: e59d3034 ldr r3, [sp, #52] ; 0x34
fe2a4: e0433004 sub r3, r3, r4
fe2a8: e353002d cmp r3, #45 ; 0x2d
fe2ac: 8affffc3 bhi fe1c0 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x64>
fe2b0: e285003c add r0, r5, #60 ; 0x3c
fe2b4: e3a0202c mov r2, #44 ; 0x2c
fe2b8: e1a01004 mov r1, r4
fe2bc: ebfd77b6 bl 5c19c <memcmp@plt>
fe2c0: e16f5f10 clz r5, r0
fe2c4: e1a052a5 lsr r5, r5, #5
fe2c8: eaffffc0 b fe1d0 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x74>
fe2cc: e28d3050 add r3, sp, #80 ; 0x50
fe2d0: e2611020 rsb r1, r1, #32
fe2d4: e243002c sub r0, r3, #44 ; 0x2c
fe2d8: ebfdffc2 bl 7e1e8 <_ZNSt6vectorIcSaIcEE17_M_default_appendEj@@Base>
fe2dc: eaffffdc b fe254 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0xf8>
fe2e0: e59d0030 ldr r0, [sp, #48] ; 0x30
fe2e4: e3500000 cmp r0, #0
fe2e8: 0a000000 beq fe2f0 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x194>
fe2ec: ebfd75ca bl 5ba1c <_ZdlPv@plt>
fe2f0: e59d0024 ldr r0, [sp, #36] ; 0x24
fe2f4: e3500000 cmp r0, #0
fe2f8: 0a000000 beq fe300 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x1a4>
fe2fc: ebfd75c6 bl 5ba1c <_ZdlPv@plt>
fe300: e59d0018 ldr r0, [sp, #24]
fe304: e3500000 cmp r0, #0
fe308: 0a000000 beq fe310 <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base+0x1b4>
fe30c: ebfd75c2 bl 5ba1c <_ZdlPv@plt>
fe310: ebfd77dd bl 5c28c <__cxa_end_cleanup@plt>
fe314: 0000ffff strdeq pc, [r0], -pc ; <UNPREDICTABLE>
fe318: 0014c3cc andseq ip, r4, ip, asr #7000fe31c <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base>:
fe31c: e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr}
fe320: e1a07000 mov r7, r0
fe324: e5b74034 ldr r4, [r7, #52]! ; 0x34
fe328: e24dd050 sub sp, sp, #80 ; 0x50
fe32c: e1570004 cmp r7, r4
fe330: 0a00003d beq fe42c <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x110>
fe334: e281600b add r6, r1, #11
fe338: e1a08001 mov r8, r1
fe33c: e1a0a000 mov sl, r0
fe340: e59f91a4 ldr r9, [pc, #420] ; fe4ec <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x1d0>
fe344: ea000005 b fe360 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x44>
fe348: ebfff8f8 bl fc730 <_ZNK7maestro6server10MacAddresseqEPKc@@Base>
fe34c: e3500000 cmp r0, #0
fe350: 1a00000e bne fe390 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x74>
fe354: e5944000 ldr r4, [r4]
fe358: e1570004 cmp r7, r4
fe35c: 0a000032 beq fe42c <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x110>
fe360: e5943008 ldr r3, [r4, #8]
fe364: e2845008 add r5, r4, #8
fe368: e5130010 ldr r0, [r3, #-16]
fe36c: e1a01006 mov r1, r6
fe370: e7953000 ldr r3, [r5, r0]
fe374: e0850000 add r0, r5, r0
fe378: e5933008 ldr r3, [r3, #8]
fe37c: e1530009 cmp r3, r9
fe380: 0afffff0 beq fe348 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x2c>
fe384: e12fff33 blx r3
fe388: e3500000 cmp r0, #0
fe38c: 0afffff0 beq fe354 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x38>
fe390: e1570004 cmp r7, r4
fe394: 0a000024 beq fe42c <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x110>
fe398: e2888008 add r8, r8, #8
fe39c: e1a01008 mov r1, r8
fe3a0: e1a02005 mov r2, r5
fe3a4: e1a0000a mov r0, sl
fe3a8: ebffff6b bl fe15c <_ZN7maestro6server13SensorManager12validateHMACERK18_sensor_SENSORDATARNS0_6SensorE@@Base>
fe3ac: e2506000 subs r6, r0, #0
fe3b0: 1a000017 bne fe414 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0xf8>
fe3b4: ebfdb2c8 bl 6aedc <_ZN6shared9SingletonINS_6LoggerEE8instanceEv@@Base>
fe3b8: e1a01005 mov r1, r5
fe3bc: e1a04000 mov r4, r0
fe3c0: e28d0014 add r0, sp, #20
fe3c4: ebfffb3b bl fd0b8 <_ZN7maestro6server6Sensor8toStringB5cxx11Ev@@Base>
fe3c8: e59d1014 ldr r1, [sp, #20]
fe3cc: e59f211c ldr r2, [pc, #284] ; fe4f0 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x1d4>
fe3d0: e59f311c ldr r3, [pc, #284] ; fe4f4 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x1d8>
fe3d4: e58d1008 str r1, [sp, #8]
fe3d8: e58d2004 str r2, [sp, #4]
fe3dc: e58d3000 str r3, [sp]
fe3e0: e1a00004 mov r0, r4
fe3e4: e59f310c ldr r3, [pc, #268] ; fe4f8 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x1dc>
fe3e8: e59f210c ldr r2, [pc, #268] ; fe4fc <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x1e0>
fe3ec: e3a01001 mov r1, #1
fe3f0: eb00726e bl 11adb0 <_ZN6shared6Logger3logENS0_5LevelEPKciS3_S3_z@@Base>
fe3f4: e59d0014 ldr r0, [sp, #20]
fe3f8: e28d301c add r3, sp, #28
fe3fc: e1500003 cmp r0, r3
fe400: 0a00000a beq fe430 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x114>
fe404: ebfd7584 bl 5ba1c <_ZdlPv@plt>
fe408: e1a00006 mov r0, r6
fe40c: e28dd050 add sp, sp, #80 ; 0x50
fe410: e8bd87f0 pop {r4, r5, r6, r7, r8, r9, sl, pc}
fe414: e1a0000a mov r0, sl
fe418: e1a02005 mov r2, r5
fe41c: e1a01008 mov r1, r8
fe420: ebfff9bc bl fcb18 <_ZN7maestro6server13SensorManager22validateSequenceNumberERK12_sensor_INFORNS0_6SensorE@@Base>
fe424: e2506000 subs r6, r0, #0
fe428: 1a000003 bne fe43c <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x120>
fe42c: e3a06000 mov r6, #0
fe430: e1a00006 mov r0, r6
fe434: e28dd050 add sp, sp, #80 ; 0x50
fe438: e8bd87f0 pop {r4, r5, r6, r7, r8, r9, sl, pc}
fe43c: e8b8000f ldm r8!, {r0, r1, r2, r3}
fe440: e28dc014 add ip, sp, #20
fe444: e8ac000f stmia ip!, {r0, r1, r2, r3}
fe448: e8b8000f ldm r8!, {r0, r1, r2, r3}
fe44c: e28d7014 add r7, sp, #20
fe450: e8ac000f stmia ip!, {r0, r1, r2, r3}
fe454: e8b8000f ldm r8!, {r0, r1, r2, r3}
fe458: e284e00c add lr, r4, #12
fe45c: e8ac000f stmia ip!, {r0, r1, r2, r3}
fe460: e8980007 ldm r8, {r0, r1, r2}
fe464: e3a08001 mov r8, #1
fe468: e88c0007 stm ip, {r0, r1, r2}
fe46c: e8b7000f ldm r7!, {r0, r1, r2, r3}
fe470: e8ae000f stmia lr!, {r0, r1, r2, r3}
fe474: e8b7000f ldm r7!, {r0, r1, r2, r3}
fe478: e8ae000f stmia lr!, {r0, r1, r2, r3}
fe47c: e8b7000f ldm r7!, {r0, r1, r2, r3}
fe480: e8ae000f stmia lr!, {r0, r1, r2, r3}
fe484: e89c0007 ldm ip, {r0, r1, r2}
fe488: e88e0007 stm lr, {r0, r1, r2}
fe48c: e5943008 ldr r3, [r4, #8]
fe490: e5c4804a strb r8, [r4, #74] ; 0x4a
fe494: e5c4804b strb r8, [r4, #75] ; 0x4b
fe498: e5130014 ldr r0, [r3, #-20] ; 0xffffffec
fe49c: e7953000 ldr r3, [r5, r0]
fe4a0: e0850000 add r0, r5, r0
fe4a4: e5933008 ldr r3, [r3, #8]
fe4a8: e12fff33 blx r3
fe4ac: e5943020 ldr r3, [r4, #32]
fe4b0: e1530008 cmp r3, r8
fe4b4: 1affffdd bne fe430 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x114>
fe4b8: e5d44040 ldrb r4, [r4, #64] ; 0x40
fe4bc: e3540000 cmp r4, #0
fe4c0: 0affffda beq fe430 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x114>
fe4c4: e1a00005 mov r0, r5
fe4c8: ebfffe12 bl fdd18 <_ZN7maestro6server13SensorManager19updateActiveSensorsEv@@Base+0x168>
fe4cc: e1a06004 mov r6, r4
fe4d0: eaffffd6 b fe430 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x114>
fe4d4: e59d0014 ldr r0, [sp, #20]
fe4d8: e28d301c add r3, sp, #28
fe4dc: e1500003 cmp r0, r3
fe4e0: 0a000000 beq fe4e8 <_ZN7maestro6server13SensorManager17handleDataMessageERK21_sensor_SensorMessage@@Base+0x1cc>
fe4e4: ebfd754c bl 5ba1c <_ZdlPv@plt>
fe4e8: ebfd7767 bl 5c28c <__cxa_end_cleanup@plt>
fe4ec: 000fc730 andeq ip, pc, r0, lsr r7 ; <UNPREDICTABLE>
fe4f0: 0014a3e8 andseq sl, r4, r8, ror #7
fe4f4: 0014a384 andseq sl, r4, r4, lsl #7
fe4f8: 00000175 andeq r0, r0, r5, ror r1
fe4fc: 0014a370 andseq sl, r4, r0, ror r3Demangling the unique symbols:
shared::Logger::log(shared::Logger::Level, char const, int, char const, char const, ...)
shared::base64::decode(std::vector<char, std::allocator
Probably we'd want to look at maestro::server::SensorManager::validateHMAC or maestro::server::SensorManager::handleDataMessage
I have work-pressures getting in the way of fun, at the moment.
doug-hoffman
commented
2 years ago Based on what we're seeing in maestro, I'm feeling fairly confident we're dealing with base 64 encoded HMAC-SHA256 and am trying to properly brute force several variations of the payload:
Session..........: venstar-hmac-all
Status...........: Running
Hash.Mode........: 1450 (HMAC-SHA256 (key = $pass))
Hash.Target......: /Users/doug/venstar/hmac-all
Time.Started.....: Mon Nov 8 06:55:41 2021, (1 hour, 2 mins)
Time.Estimated...: Tue Nov 9 15:10:03 2021, (1 day, 7 hours)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?1?1?1?1?1 [5]
Guess.Charset....: -1 ?b, -2 Undefined, -3 Undefined, -4 Undefined
Guess.Queue......: 5/8 (62.50%)
Speed.#1.........: 12617.5 kH/s (256.50ms) @ Accel:1024 Loops:256 Thr:1 Vec:4
Speed.#3.........: 146.2 MH/s (338.55ms) @ Accel:16 Loops:256 Thr:256 Vec:1
Speed.#4.........: 750.3 MH/s (376.95ms) @ Accel:256 Loops:256 Thr:64 Vec:1
Speed.#*.........: 909.1 MH/s
Recovered........: 0/96 (0.00%) Digests, 0/96 (0.00%) Salts
Progress.........: 3461644025856/105553116266496 (3.28%)
Rejected.........: 0/3461644025856 (0.00%)
Restore.Point....: 139485184/4294967296 (3.25%)
Restore.Sub.#1...: Salt:19 Amplifier:0-256 Iteration:0-256
Restore.Sub.#3...: Salt:15 Amplifier:0-256 Iteration:0-256
Restore.Sub.#4...: Salt:78 Amplifier:0-256 Iteration:0-256
Candidate.Engine.: Device Generator
Candidates.#1....: $HEX[7361b27462] -> $HEX[00001f6c64]
Candidates.#3....: $HEX[7361d16831] -> $HEX[0000ef6b6d]
Candidates.#4....: $HEX[73612ae008] -> $HEX[00003fac08]After testing some things yesterday, I've learned three new things...
The highlighted bytes seems to be a sequence number and is shorter than 4 bytes after a sensor loses power for some time:
082ad202590a2908fe2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c643066536e397762666c3435624834666546714144426f4256744466516456703842386f616a4d334c33343d
The highlighted bytes aren't obviously part of the hashed message:
082ad202590a2908fe2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c643066536e397762666c3435624834666546714144426f4256744466516456703842386f616a4d334c33343d
I was able to change 12 to 13 and have the thermostat still accept the message. I wasn't able to change 2c, but I suspect that's because it was treating it as a separator.
Manipulating the digest seems to make the stat ignore the message (it appears to actually be validated)
I didn't spend a ton of time trying to manipulate different portions of the data, since the only way to know with some level of certainty that it considers the message valid is to wait until it marks the sensor offline before trying, then see if it becomes available after sending the message. (It only considers the sensor offline if it hasn't received any messages for some time.)
doug-hoffman
commented
2 years ago Got a packet capture of the Venstar Configurator app interacting with a sensor and found something interesting...
00000000 47 45 54 20 2f 69 6e 66 6f 20 48 54 54 50 2f 31 GET /inf o HTTP/1
00000010 2e 31 0d 0a 48 6f 73 74 3a 20 31 39 32 2e 31 36 .1..Host : 192.16
00000020 38 2e 31 2e 31 3a 38 31 39 30 0d 0a 43 6f 6e 6e 8.1.1:81 90..Conn
00000030 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 ection: keep-ali
00000040 76 65 0d 0a 41 63 63 65 70 74 3a 20 61 70 70 6c ve..Acce pt: appl
00000050 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 2c 20 74 65 ication/ json, te
00000060 78 74 2f 70 6c 61 69 6e 2c 20 2a 2f 2a 0d 0a 55 xt/plain , */*..U
00000070 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c ser-Agen t: Mozil
00000080 6c 61 2f 35 2e 30 20 28 4c 69 6e 75 78 3b 20 41 la/5.0 ( Linux; A
00000090 6e 64 72 6f 69 64 20 31 31 3b 20 51 58 31 30 30 ndroid 1 1; QX100
000000A0 30 20 42 75 69 6c 64 2f 52 51 33 41 2e 32 31 31 0 Build/ RQ3A.211
000000B0 30 30 31 2e 30 30 31 3b 20 77 76 29 20 41 70 70 001.001; wv) App
000000C0 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 leWebKit /537.36
000000D0 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 (KHTML, like Gec
000000E0 6b 6f 29 20 56 65 72 73 69 6f 6e 2f 34 2e 30 20 ko) Vers ion/4.0
000000F0 43 68 72 6f 6d 65 2f 39 35 2e 30 2e 34 36 33 38 Chrome/9 5.0.4638
00000100 2e 35 30 20 4d 6f 62 69 6c 65 20 53 61 66 61 72 .50 Mobi le Safar
00000110 69 2f 35 33 37 2e 33 36 0d 0a 58 2d 52 65 71 75 i/537.36 ..X-Requ
00000120 65 73 74 65 64 2d 57 69 74 68 3a 20 63 6f 6d 2e ested-Wi th: com.
00000130 76 65 6e 73 74 61 72 2e 63 6f 6e 66 69 67 75 72 venstar. configur
00000140 61 74 6f 72 0d 0a 41 63 63 65 70 74 2d 45 6e 63 ator..Ac cept-Enc
00000150 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 20 64 65 66 oding: g zip, def
00000160 6c 61 74 65 0d 0a 41 63 63 65 70 74 2d 4c 61 6e late..Ac cept-Lan
00000170 67 75 61 67 65 3a 20 65 6e 2d 55 53 2c 65 6e 3b guage: e n-US,en;
00000180 71 3d 30 2e 39 0d 0a 0d 0a q=0.9... .
00000000 48 54 54 50 2f 31 2e 30 20 32 30 30 20 4f 4b 0d HTTP/1.0 200 OK.
00000010 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 .Content -Type: a
00000020 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 70 72 6f pplicati on/x-pro
00000030 74 6f 62 75 66 0d 0a 41 63 63 65 73 73 2d 43 6f tobuf..A ccess-Co
00000040 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 ntrol-Al low-Orig
00000050 69 6e 3a 20 2a 0d 0a 43 6f 6e 74 65 6e 74 2d 4c in: *..C ontent-L
00000060 65 6e 67 74 68 3a 20 35 30 0d 0a 0d 0a ength: 5 0....Beginning here...
0000006D 08 2a d2 02 2d 0a 29 08 00 10 12 1a 0c 63 34 62 .*..-.). .....c4b
0000007D 65 38 34 66 32 32 39 37 61 20 01 28 09 30 01 38 e84f2297 a .(.0.8
0000008D 01 42 06 52 65 6d 6f 74 65 48 01 50 87 01 58 64 .B.Remot eH.P..Xd
0000009D 12 00 ..Which looks nearly identical to what the sensor broadcasts, just without the digest:
082ad202590a29080010111a0c6334626538346632323937612001280930013801420652656d6f746548015080015864122c437473525849684d367a522b67316241413777466756442b6a38325a624d49533541727859334e543338453dAlso, notice it identifies the content type as "application/x-protobuf". Here's the relevant bit of the .proto from the android app:
syntax = "proto2";
package sensor;
import "nanopb.proto";
//Sensor state
message INFO {
enum SensorType {
OUTDOOR = 1;
RETURN = 2;
REMOTE = 3;
SUPPLY = 4;
}
enum PowerSource {
BATTERY = 1;
WIRED = 2;
}
enum SensorModel {
TEMPSENSOR = 1;
}
required uint32 sequence = 1 [(nanopb).int_size = IS_16];
required uint32 sensorId = 2 [(nanopb).int_size = IS_8];
required string mac = 3 [(nanopb).max_size = 13];
required uint32 fwMajor = 4 [(nanopb).int_size = IS_8];
required uint32 fwMinor = 5 [(nanopb).int_size = IS_8];
required SensorModel model = 6;
required PowerSource power = 7;
optional string name = 8 [(nanopb).max_size = 15];
optional SensorType type = 9;
optional uint32 temperature = 10 [(nanopb).int_size = IS_8];
optional uint32 battery = 11 [(nanopb).int_size = IS_8];
optional uint32 humidity = 12 [(nanopb).int_size = IS_8];
}Apparently, there are two special temperature values:
if($scope.data.deviceInfo.temperature == 255) {
$scope.data.deviceInfo.temperatureString = 'Sensor Open';
}
else if($scope.data.deviceInfo.temperature == 254) {
$scope.data.deviceInfo.temperatureString = 'Sensor Shorted';
}That apk also has firmware for the various wifi sensors, which could be interesting:
wifi-sensor-mini/v3.3/FC9000_RTOS-VST01-05-20939-000009_venstar_ss.img: u-boot legacy uImage, RTOS-VST01-05-20939-000009, Firmware/ARM, OS Kernel Image (Not compressed), 789600 bytes, Fri Mar 13 07:02:12 2020, Load Address: 0x0021C000, Entry Point: 0x0021C000, Header CRC: 0xACC93EFE, Data CRC: 0x36B720CB
wifi-sensor-mini/v3.3/PTIM-VST01-05-20875-000000.img: u-boot legacy uImage, PTIM-VST01-05-20875-000000, Firmware/ARM, OS Kernel Image (Not compressed), 17888 bytes, Tue Nov 26 04:12:27 2019, Load Address: 0x00208000, Entry Point: 0x00208000, Header CRC: 0xABBDA1E0, Data CRC: 0x7304748D
wifi-sensor-mini/v3.3/RLIB-VST01-05-17869-000009.img: u-boot legacy uImage, RLIB-VST01-05-17869-000009, Firmware/ARM, OS Kernel Image (Not compressed), 11056 bytes, Thu May 30 02:39:31 2019, Load Address: 0x00201000, Entry Point: 0x00201000, Header CRC: 0x4DBDDA8C, Data CRC: 0x77B3F26E
wifi-sensor-pro/v4.1/FC9000_RTOS-VST02-01-21015-200813.img: u-boot legacy uImage, RTOS-VST02-01-21015-200813, Firmware/ARM, OS Kernel Image (Not compressed), 794368 bytes, Wed Aug 12 23:52:40 2020, Load Address: 0x0021C000, Entry Point: 0x0021C000, Header CRC: 0xDD35ACEE, Data CRC: 0xA9CD9142
wifi-sensor-pro/v4.1/PTIM-VST02-01-21009-200813.img: u-boot legacy uImage, PTIM-VST02-01-21009-200813, Firmware/ARM, OS Kernel Image (Not compressed), 18160 bytes, Thu Aug 13 01:25:59 2020, Load Address: 0x00208000, Entry Point: 0x00208000, Header CRC: 0xC7888977, Data CRC: 0x9032F25E
wifi-sensor-pro/v4.1/RLIB-VST02-01-17869-000000.img: u-boot legacy uImage, RLIB-VST02-01-17869-000000, Firmware/ARM, OS Kernel Image (Not compressed), 11056 bytes, Mon Aug 5 01:49:43 2019, Load Address: 0x00201000, Entry Point: 0x00201000, Header CRC: 0xD6939534, Data CRC: 0x77B3F26ENice find (protobuf).
I wonder what RTOS they're using. Interesting.
garbled1
commented
2 years ago Have you cracked one open? Is it just an ESP with a sensor? :)
hpeyerl
commented
2 years ago ESP is not ARM. :)
garbled1
commented
2 years ago Wow.. the sensors are ARM's, that seems so wildly over-powered. I knew the base unit was from my investigations on a broken one, but the sensors. Wow.
doug-hoffman
commented
2 years ago The ACC-TSENWIFIMini is running a FCI FC9000. The original ACC-TSENWIFI is a TI CC3200R1M2, which, based on the firmware in the apk, has been replaced by the similar looking ACC-TSENWIFIPRO also running the FC9000. (I suspect the TI got dumped after it couldn't meet both of their goals of 1 year battery life and a 1-minute update interval, because they actually sent updates every 2 minutes on battery, despite saying 1 minute in the documentation.)
Both the FCI and TI variants have 6 small contacts labeled "ICP" that aren't coated like the rest of the PCB. The TI variant also has a spot for 6 header pins. Can't find much info on these. Both have one 3.3v and one ground. I soldered pins on the TI and tried hooking each pin to the RX on a rs232 adapter. Found one that was doing something, but only got garbage (or nothing) at every baud rate I tried.
hpeyerl
commented
2 years ago You probably found the JTAG pins.
doug-hoffman
commented
2 years ago That was a thought I had. Definitely wayyyy outside my area of expertise here. (I'm a network/server/security person at $dayjob.)
hpeyerl
commented
2 years ago yeah, and probably wouldn't yield much useful information. Or rather, there's still plenty of potential traction without resorting to JTAG.
doug-hoffman
commented
2 years ago Hopefully not. Seems like we've got just about everything we need except for the HMAC secret at this point. Still working on that, but I've got to slow it down to keep my office a reasonable temp during the day.
hpeyerl
commented
2 years ago I spent a couple mostly fruitless hours manually decompiling the code above. I should have looked at it more before making my stupid comments in https://github.com/hpeyerl/venstar_colortouch/issues/34#issuecomment-963120224 :-)
Anyway, I'm not good at decompiling EABI but I'm left with the impression that the code seems to be checking the characteristics of the MacAddr (probably of the inbound message) and possibly passing all or part of it off to sha256.
maestro::server::SensorManager::handleDataMessage() is calling maestro::server::MacAddress::operator==(char const*) const, comparing it against one of the arguments of handleDataMessage() (returning a fail if the cmp doesn't succeed) and then calling maestro::server::SensorManager::validateHMAC() which does the base64 decode and sha256.
But since the 'identifier' in the message already contains a mac address, I'm not convinced they're also using it as a SALT.
doug-hoffman
commented
2 years ago You look at the call to openssl's HMAC() in maestro::server::SensorManager::validateHMAC() at all? That's what has me feeling confident about it being base64 encoded HMAC-SHA256. We should only need the second argument to that call to figure this whole thing out, but I'm probably even worse at decompiling, so I've not had much luck making sense of what it's actually passing.
hpeyerl
commented
2 years ago That brings us right back to JTAG.
On a lark to see if I could write some code to generate similar code to what we see above to figure out which 'thing' is the key argument, I quickly hacked this up:
#include <stdint.h>
#include <string.h>
#include <openssl/hmac.h>
int
main()
{
int i;
char *key="mumble";
int keylen=strlen(key);
char *data="the quick brown fox jumped over the lazy dog";
int datalen=strlen(data);
unsigned char res[1024];
unsigned int reslen=-1;
HMAC(EVP_sha256(), (void *)key, keylen, data, datalen, res, &reslen);
for(i=0; i<reslen; i++)
printf("%02x ", res[i]);
printf("\n");
}Compiled:
cc -mcpu=cortex-a5 -g test.c -o test -L/usr/lib/arm-linux-gnueabihf -lssl -lcryptoand it runs.
Unfortunately, the objdump is not really meaningfully similar:
HMAC(EVP_sha256(), (void *)key, keylen, data, datalen, res, &reslen);
105c0: ebffffad bl 1047c <EVP_sha256@plt>
105c4: e51b2018 ldr r2, [fp, #-24] ; 0xffffffe8
105c8: e24b3e41 sub r3, fp, #1040 ; 0x410
105cc: e2433004 sub r3, r3, #4
105d0: e2433008 sub r3, r3, #8
105d4: e58d3008 str r3, [sp, #8]
105d8: e24b3e41 sub r3, fp, #1040 ; 0x410
105dc: e2433004 sub r3, r3, #4
105e0: e2433004 sub r3, r3, #4
105e4: e58d3004 str r3, [sp, #4]
105e8: e58d2000 str r2, [sp]
105ec: e51b3014 ldr r3, [fp, #-20] ; 0xffffffec
105f0: e51b2010 ldr r2, [fp, #-16]
105f4: e51b100c ldr r1, [fp, #-12]
105f8: ebffff9c bl 10470 <HMAC@plt>According to gdb, r1 contains the key (which is 'fp-12').
(gdb) print key
$14 = 0x106dc "mumble"
(gdb) info registers
r0 0x76f16c2c 1995533356
r1 0x106dc 67292
r2 0x6 6
r3 0x106e4 67300
r4 0x0 0
r5 0x1066c 67180
r6 0x10488 66696
r7 0x0 0
r8 0x0 0
r9 0x0 0
r10 0x76fff000 1996484608
r11 0x7efff564 2130703716
r12 0x76e35800 1994610688
sp 0x7efff138 0x7efff138
lr 0x105c4 67012
pc 0x105f8 0x105f8 <main+128>
cpsr 0x60000010 1610612752
fpscr 0x0 0Unfortunately, the code you disassembled above:
fe25c: ebfd7627 bl 5bb00 <EVP_sha256@plt>
fe260: e59d3024 ldr r3, [sp, #36] ; 0x24
fe264: e59d1018 ldr r1, [sp, #24]
fe268: e59d201c ldr r2, [sp, #28]
fe26c: e59dc048 ldr ip, [sp, #72] ; 0x48
fe270: e58d3004 str r3, [sp, #4]
fe274: e28d3014 add r3, sp, #20
fe278: e58d3008 str r3, [sp, #8]
fe27c: e0422001 sub r2, r2, r1
fe280: e58dc000 str ip, [sp]
fe284: e28d3050 add r3, sp, #80 ; 0x50
fe288: ebfd7856 bl 5c3e8 <HMAC@plt>appears to use a different calling convention or backend or something above my paygrade.
Of course, my Pi has gcc 8.3.0 and who knows what vintage of gcc they used to build maestro.
One might be tempted to conclude the key is at sp+0x50 but ultimately, it doesn't matter because we don't know what any of that stuff is at runtime; which brings us back to JTAG.
doug-hoffman
commented
2 years ago I was really hoping for something pointing to an address in the file that I didn't know enough to find. Damn.
It starts to look slightly more similar once you tell the compiler to optimize (-O2):
HMAC(EVP_sha256(), (void *)key, keylen, data, datalen, res, &reslen);
4d8: ebfffff2 bl 4a8 <EVP_sha256@plt>
4dc: e2451004 sub r1, r5, #4
4e0: e58d1008 str r1, [sp, #8]
4e4: e59f3064 ldr r3, [pc, #100] ; 550 <main+0x90>
4e8: e59f1064 ldr r1, [pc, #100] ; 554 <main+0x94>
4ec: e3a0202c mov r2, #44 ; 0x2c
4f0: e08f3003 add r3, pc, r3
4f4: e88d0024 stm sp, {r2, r5}
4f8: e08f1001 add r1, pc, r1
4fc: e3a02006 mov r2, #6
500: ebffffe5 bl 49c <HMAC@plt>But just slightly. Who knows what compiler options they used.
$ arm-none-eabi-readelf -hnA maestro2
ELF Header:
Magic: 7f 45 4c 46 01 01 01 03 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - GNU
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x65a90
Start of program headers: 52 (bytes into file)
Start of section headers: 1365344 (bytes into file)
Flags: 0x5000200, Version5 EABI, soft-float ABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 9
Size of section headers: 40 (bytes)
Number of section headers: 27
Section header string table index: 26
Displaying notes found in: .note.ABI-tag
Owner Data size Description
GNU 0x00000010 NT_GNU_ABI_TAG (ABI version tag)
OS: Linux, ABI: 4.1.0
Attribute Section: aeabi
File Attributes
Tag_CPU_name: "ARM926EJ-S"
Tag_CPU_arch: v5TEJ
Tag_ARM_ISA_use: Yes
Tag_THUMB_ISA_use: Thumb-1
Tag_ABI_PCS_wchar_t: 4
Tag_ABI_FP_rounding: Needed
Tag_ABI_FP_denormal: Needed
Tag_ABI_FP_exceptions: Needed
Tag_ABI_FP_number_model: IEEE 754
Tag_ABI_align_needed: 8-byte
Tag_ABI_align_preserved: 8-byte, except leaf SP
Tag_ABI_enum_size: intCompared to the file I got from arm-linux-gnueabi-gcc -mcpu=arm926ej-s -g test.c -o test -L/usr/lib/arm-linux-gnueabi/ -lssl -lcrypto -O2 cross-compiling on Debian 11:
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: DYN (Shared object file)
Machine: ARM
Version: 0x1
Entry point address: 0x55c
Start of program headers: 52 (bytes into file)
Start of section headers: 8784 (bytes into file)
Flags: 0x5000200, Version5 EABI, soft-float ABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 9
Size of section headers: 40 (bytes)
Number of section headers: 37
Section header string table index: 36
Displaying notes found in: .note.gnu.build-id
Owner Data size Description
GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring)
Build ID: 2e7fd96e5fa9e09caa88884e825dfb1850321a4f
Displaying notes found in: .note.ABI-tag
Owner Data size Description
GNU 0x00000010 NT_GNU_ABI_TAG (ABI version tag)
OS: Linux, ABI: 3.2.0
Attribute Section: aeabi
File Attributes
Tag_CPU_name: "5TEJ"
Tag_CPU_arch: v5TEJ
Tag_ARM_ISA_use: Yes
Tag_THUMB_ISA_use: Thumb-1
Tag_ABI_PCS_wchar_t: 4
Tag_ABI_FP_rounding: Needed
Tag_ABI_FP_denormal: Needed
Tag_ABI_FP_exceptions: Needed
Tag_ABI_FP_number_model: IEEE 754
Tag_ABI_align_needed: 8-byte
Tag_ABI_align_preserved: 8-byte, except leaf SP
Tag_ABI_enum_size: intPossible stupid question time... has anyone tried to get maestro running on an ARM device yet? I spent several hours trying to get qemu to boot various bits of the update.bin with no luck. I think I'm going to move on to getting it to run on an RPi. Based on the arguments I found, it looks like it may be possible to get it to work without all of the thermostat hardware:
144d58: 0a 4d 61 65 73 74 72 6f 20 76 7b 41 64 64 20 73 .Maestro v{Add s
144d68: 6f 6d 65 20 76 65 72 73 69 6f 6e 20 68 65 72 65 ome version here
144d78: 7d 0a 00 00 55 73 61 67 65 3a 20 20 6d 61 65 73 }...Usage: maes
144d88: 74 72 6f 32 20 6f 70 74 69 6f 6e 73 20 5b 20 69 tro2 options [ i
144d98: 6e 70 75 74 66 69 6c 65 20 2e 2e 2e 20 5d 0a 0a nputfile ... ]..
144da8: 20 20 66 69 6c 65 6e 61 6d 65 20 20 20 20 20 20 filename
144db8: 20 20 20 20 20 20 20 20 20 20 52 75 6e 20 65 78 Run ex
144dc8: 65 63 75 74 61 62 6c 65 20 61 70 70 6c 69 63 61 ecutable applica
144dd8: 74 69 6f 6e 0a 0a 20 20 2d 63 20 20 2d 2d 63 6f tion.. -c --co
144de8: 6e 66 69 67 20 20 20 20 20 20 20 20 20 20 20 20 nfig
144df8: 53 65 74 20 63 6f 6e 66 69 67 75 72 61 74 69 6f Set configuratio
144e08: 6e 20 66 69 6c 65 0a 0a 20 20 2d 68 20 20 2d 2d n file.. -h --
144e18: 68 65 6c 70 20 20 20 20 20 20 20 20 20 20 20 20 help
144e28: 20 20 44 69 73 70 6c 61 79 20 74 68 69 73 20 75 Display this u
144e38: 73 61 67 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e sage information
144e48: 0a 20 20 2d 6a 20 20 2d 2d 6a 73 20 20 20 20 20 . -j --js
144e58: 20 20 20 20 20 20 20 20 20 20 20 45 78 65 63 75 Execu
144e68: 74 65 20 6a 61 76 61 73 63 72 69 70 74 20 66 69 te javascript fi
144e78: 6c 65 0a 20 20 2d 6c 20 20 2d 2d 6c 6f 67 3d 3c le. -l --log=<
144e88: 6c 65 76 65 6c 3e 20 20 20 20 20 20 20 53 65 74 level> Set
144e98: 74 69 6e 67 20 75 70 20 6c 6f 67 20 6c 65 76 65 ting up log leve
144ea8: 6c 20 28 66 72 6f 6d 20 30 20 74 6f 20 35 29 0a l (from 0 to 5).
144eb8: 20 20 2d 64 20 20 2d 2d 64 65 62 75 67 20 20 20 -d --debug
144ec8: 20 20 20 20 20 20 20 20 20 20 53 65 74 74 69 6e Settin
144ed8: 67 20 64 65 62 75 67 67 65 72 0a 20 20 2d 66 20 g debugger. -f
144ee8: 20 2d 2d 64 66 62 44 65 62 75 67 20 20 20 20 20 --dfbDebug
144ef8: 20 20 20 20 20 53 65 74 74 69 6e 67 20 64 66 62 Setting dfb
144f08: 20 74 6f 20 64 65 62 75 67 0a 20 20 2d 6e 20 20 to debug. -n
144f18: 2d 2d 6e 6f 6d 6f 64 20 20 20 20 20 20 20 20 20 --nomod
144f28: 20 20 20 20 44 69 73 61 62 6c 65 20 6d 6f 64 75 Disable modu
144f38: 6c 65 73 3a 20 74 68 65 72 6d 6f 73 74 61 74 20 les: thermostat
144f48: 61 6e 64 20 63 61 72 64 0a 20 20 2d 73 20 20 2d and card. -s -
144f58: 2d 73 69 7a 65 20 20 20 20 20 20 20 20 20 20 20 -size
144f68: 20 20 20 53 65 74 20 77 69 64 6f 77 20 73 69 7a Set widow siz
144f78: 65 73 20 3c 77 3e 78 3c 68 3e 0a 20 20 2d 6f 20 es <w>x<h>. -o
144f88: 20 2d 2d 6e 6f 2d 6f 74 61 20 20 20 20 20 20 20 --no-ota
144f98: 20 20 20 20 20 44 69 73 61 62 6c 65 20 6f 74 61 Disable otaDependencies sorted:
venstar@debian:/home/gui$ ./startgui
./startgui: line 6: killall: command not found
./startgui: line 9: /usr/scripts/wlan0_powersave_off.sh: No such file or directory
Starting launcher
Json config: {"loglevel":4,"width":480,"height":272,"debugger":false,"allowPureJs":false,"directFBdebug":false,"disableServer":false,"disableModules":false,"disableOta":false,"gui":"/home/volatile/gui.db","datamap":"/home/volatile/datamap.db","identity":"/etc/identity","brandName":"/etc/datamapBrand","sddpConfig":"/etc/sddpd.conf","localTemp":"/sys/bus/iio/devices/iio:device0/in_voltage6_raw","wiredTemp":"/sys/bus/iio/devices/iio:device0/in_voltage5_raw","shtTemp":"/sys/devices/platform/ahb/ahb:apb/f8010000.i2c/i2c-0/0-0040/hwmon/hwmon0/temp1_input","shtHum":"/sys/devices/platform/ahb/ahb:apb/f8010000.i2c/i2c-0/0-0040/hwmon/hwmon0/humidity1_input","firmwareVersion":"/home/volatile/version","serialNumber":"/home/volatile/serial_numer","sensorFile":"/home/volatile/sensors.dat","backgroundImg":"/home/calibrate/wait.png","awayObject":"sow","awayCallback":"clearVacation","settingsObject":"compatibler","settingsCallback":"write","otaConfig":"/home/gui/ota.json","watchdog":"/dev/WDRST"}
[2021-11-13 16:42:53.346][E][0][Settings][GUISettings.cpp:150] Could not load serial number file
[2021-11-13 16:42:53.366][W][0][Maestro][Maestro.cpp:102] Execute without modules
[2021-11-13 16:42:53.406][E][0][Watchdog][Watchdog.cpp:88] Failed to open watchdog device /dev/WDRST
[2021-11-13 16:42:53.887][E][0][DukWrap][DukWrapFile.cpp:99] File::load() for file /etc/identity failed.
[2021-11-13 16:42:53.893][E][0][DukWrap][DukWrap.cpp:68] Runtime error: 'Error: File::load() for file /etc/identity failed. '
Quiting application...
Start tscalibrate
/home/calibrate/startcalibrate: 17: tscalibrate: not found
Launching main app
Json config: {"loglevel":4,"width":480,"height":272,"debugger":false,"allowPureJs":false,"directFBdebug":false,"disableServer":false,"disableModules":false,"disableOta":false,"gui":"/home/volatile/gui.db","datamap":"/home/volatile/datamap.db","identity":"/etc/identity","brandName":"/etc/datamapBrand","sddpConfig":"/etc/sddpd.conf","localTemp":"/sys/bus/iio/devices/iio:device0/in_voltage6_raw","wiredTemp":"/sys/bus/iio/devices/iio:device0/in_voltage5_raw","shtTemp":"/sys/devices/platform/ahb/ahb:apb/f8010000.i2c/i2c-0/0-0040/hwmon/hwmon0/temp1_input","shtHum":"/sys/devices/platform/ahb/ahb:apb/f8010000.i2c/i2c-0/0-0040/hwmon/hwmon0/humidity1_input","firmwareVersion":"/home/volatile/version","serialNumber":"/home/volatile/serial_numer","sensorFile":"/home/volatile/sensors.dat","backgroundImg":"/home/calibrate/wait.png","awayObject":"sow","awayCallback":"clearVacation","settingsObject":"compatibler","settingsCallback":"write","otaConfig":"/home/gui/ota.json","watchdog":"/dev/WDRST"}
[2021-11-13 16:42:54.654][E][0][Settings][GUISettings.cpp:150] Could not load serial number file
[2021-11-13 16:42:54.712][E][0][Thermostat][Thermostat.cpp:862] No file /sys/bus/iio/devices/iio:device0/in_voltage6_raw
[2021-11-13 16:42:54.715][E][0][Thermostat][Thermostat.cpp:862] No file /sys/bus/iio/devices/iio:device0/in_voltage5_raw
stat: init called (default residential version 81).
Invalid thermostat type!: No such file or directory
[2021-11-13 16:42:54.724][E][0][Thermostat][Thermostat.cpp:428] Thermostat Lib failed to initialize!
[2021-11-13 16:42:54.738][W][0][Card][NetworkCard.cpp:80] No wireless interface detected!
sh: 1: rfkill: not found
[2021-11-13 16:42:54.789][W][4][Card][NetworkCard.cpp:434] No wireless interface. Could not start!
[2021-11-13 16:42:54.848][F][0][Main][main.cpp:84] Received signal 11
./startgui: line 23: 2412 Aborted $MAESTRO -j $@ /home/gui/stat.mxe
./startgui: line 25: /dev/thermostat/G: No such file or directory
./startgui: line 26: /dev/thermostat/W1: No such file or directory
./startgui: line 27: /dev/thermostat/W2: No such file or directory
./startgui: line 28: /dev/thermostat/W3: No such file or directory
./startgui: line 29: /dev/thermostat/Y1: No such file or directory
./startgui: line 30: /dev/thermostat/Y2: No such file or directoryFound my last microSD dead, so I'm working in qemu right now with no wireless interface. At least it's running. May be able to fake the stuff it's missing well enough to make it happy.
doug-hoffman
commented
2 years ago Got most of the errors taken care of by symlinking stuff to /dev/zero or /dev/null, and running as root:
venstar@debian:/home/gui$ sudo ./startgui
wdt_restart: no process found
Starting launcher
Json config: {"loglevel":5,"width":480,"height":272,"debugger":true,"allowPureJs":false,"directFBdebug":false,"disableServer":false,"disableModules":false,"disableOta":true,"gui":"/home/volatile/gui.db","datamap":"/home/volatile/datamap.db","identity":"/etc/identity","brandName":"/etc/datamapBrand","sddpConfig":"/etc/sddpd.conf","localTemp":"/dev/zero","wiredTemp":"/dev/zero","shtTemp":"/dev/zero","shtHum":"/dev/zero","firmwareVersion":"/home/volatile/version","serialNumber":"/home/volatile/serial_numer","sensorFile":"/home/volatile/sensors.dat","backgroundImg":"/home/calibrate/wait.png","awayObject":"sow","awayCallback":"clearVacation","settingsObject":"compatibler","settingsCallback":"write","otaConfig":"/home/gui/ota.json","watchdog":"/dev/WDRST"}
[2021-11-13 17:57:14.914][W][0][Maestro][Maestro.cpp:102] Execute without modules
[2021-11-13 17:57:14.941][W][0][Maestro][Maestro.cpp:486] Stop heartbeat because debugger enabled!
[2021-11-13 17:57:14.942][W][0][DukWrap][DukDebugger.cpp:367] Debugger is enabled only in debug build
Start tscalibrate
/home/calibrate/startcalibrate: 17: tscalibrate: not found
Launching main app
Json config: {"loglevel":5,"width":480,"height":272,"debugger":true,"allowPureJs":false,"directFBdebug":false,"disableServer":false,"disableModules":false,"disableOta":true,"gui":"/home/volatile/gui.db","datamap":"/home/volatile/datamap.db","identity":"/etc/identity","brandName":"/etc/datamapBrand","sddpConfig":"/etc/sddpd.conf","localTemp":"/dev/zero","wiredTemp":"/dev/zero","shtTemp":"/dev/zero","shtHum":"/dev/zero","firmwareVersion":"/home/volatile/version","serialNumber":"/home/volatile/serial_numer","sensorFile":"/home/volatile/sensors.dat","backgroundImg":"/home/calibrate/wait.png","awayObject":"sow","awayCallback":"clearVacation","settingsObject":"compatibler","settingsCallback":"write","otaConfig":"/home/gui/ota.json","watchdog":"/dev/WDRST"}
stat: init called (default residential version 81).
stat: thread running.
stat: hour = 22, min = 57, day = 5, epoch = 1636844235.
stat: O valve, gas, gas.
[2021-11-13 17:57:16.031][W][0][Maestro][Maestro.cpp:395] OTA is disabled
[2021-11-13 17:57:16.055][W][0][Maestro][Maestro.cpp:486] Stop heartbeat because debugger enabled!
[2021-11-13 17:57:16.056][W][0][DukWrap][DukDebugger.cpp:367] Debugger is enabled only in debug build
./startgui: line 23: 4803 Segmentation fault $MAESTRO -j $@ /home/gui/stat.mxeThe main process is crashing when it encounters some bad data (presumably from something that is unexpectedly null or zero):
(gdb) start
Temporary breakpoint 3 at 0x5d3d8
Starting program: /usr/bin/maestro2 --config maestro.json -d stat.mxe
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
Temporary breakpoint 3, 0x0005d3d8 in main ()
(gdb) continue
Continuing.
Json config: {"loglevel":5,"width":480,"height":272,"debugger":true,"allowPureJs":false,"directFBdebug":false,"disableServer":false,"disableModules":false,"disableOta":true,"gui":"/home/volatile/gui.db","datamap":"/home/volatile/datamap.db","identity":"/etc/identity","brandName":"/etc/datamapBrand","sddpConfig":"/etc/sddpd.conf","localTemp":"/dev/zero","wiredTemp":"/dev/zero","shtTemp":"/dev/zero","shtHum":"/dev/zero","firmwareVersion":"/home/volatile/version","serialNumber":"/home/volatile/serial_numer","sensorFile":"/home/volatile/sensors.dat","backgroundImg":"/home/calibrate/wait.png","awayObject":"sow","awayCallback":"clearVacation","settingsObject":"compatibler","settingsCallback":"write","otaConfig":"/home/gui/ota.json","watchdog":"/dev/WDRST"}
[New Thread 0xb5b25220 (LWP 4778)]
stat: init called (default residential version 81).
[New Thread 0xb5324220 (LWP 4779)]
stat: thread running.
[New Thread 0xb4b23220 (LWP 4780)]
stat: hour = 22, min = 55, day = 5, epoch = 1636844139.
stat: O valve, gas, gas.
[Detaching after vfork from child process 4781]
[New Thread 0xb3fff220 (LWP 4783)]
[New Thread 0xb37fe220 (LWP 4784)]
[2021-11-13 17:55:39.268][W][0][Maestro][Maestro.cpp:395] OTA is disabled
[Detaching after vfork from child process 4785]
[2021-11-13 17:55:39.298][W][0][Maestro][Maestro.cpp:486] Stop heartbeat because debugger enabled!
[2021-11-13 17:55:39.299][W][0][DukWrap][DukDebugger.cpp:367] Debugger is enabled only in debug build
[2021-11-13 17:55:39.322][E][0][Maestro][Maestro.cpp:608] Data error!
[2021-11-13 17:55:39.324][F][0][DukWrap][DukWrap.cpp:21] FATAL ERROR: uncaught: 'Data error!'
Thread 1 "maestro2" received signal SIGABRT, Aborted.
0xb6624d78 in raise () from /lib/arm-linux-gnueabi/libc.so.6Seems like a good point to wrap up for the day. I'll dig further into this next time...
hpeyerl
commented
2 years ago You got a lot further with Qemu than I imagined. It occurred to me yesterday but I dismissed it as being too much effort (because I'm inherently lazy).
I have a Pi CM4; maybe I'll get some time this morning to see if I can get Maestro to run and do something.
@doug-hoffman were you able to find the rest of the files referenced in the manifest?
I seem to have lost maestro in my jffs2 image or something. If we can get it running, then recompiling openssl with debug symbols and setting a breakpoint at HMAC will tell us what we need; assuming we can stimulate it by replaying a packet.
hpeyerl
commented
2 years ago Spent a few hours getting as far as you did on my 3D printer's Pi-3B. I transferred the JFFS2 contents over to my pi (because there's no mtdram driver on my pi). I chroot'ed into the VH root dir, did a bunch of 'mount --bind' to resolve some shlib problems so I could run gdbserver inside the chroot. Did all the ln -s's to /dev/null same as you.
/dev/mmcblk0p2 on /home/pi/VH/usr/share type ext4 (rw,noatime)
/dev/mmcblk0p2 on /home/pi/VH/lib/arm-linux-gnueabihf type ext4 (rw,noatime)
proc on /home/pi/VH/proc type proc (rw,relatime)
tmpfs on /home/pi/VH/run type tmpfs (rw,nosuid,nodev,mode=755)Thread names are:
maestro.strace.8082:prctl(PR_SET_NAME, "TimerManager") = 0
maestro.strace.8084:prctl(PR_SET_NAME, "Thermostat") = 0
maestro.strace.8096:prctl(PR_SET_NAME, "NetworkCard") = 0
maestro.strace.8097:prctl(PR_SET_NAME, "SocketManager") = 0
maestro.strace.8098:prctl(PR_SET_NAME, "OtaDownloader") = 0Looks to me like it's the main program getting the SIGABRT.
Unsurprisingly, it never gets as far as HMAC().
I was trying to get i2c-stub.ko compiled for my Pi because the Thermostat thread is looking for an I2C dev addr=0x40:
openat(AT_FDCWD, "/sys/devices/platform/ahb/ahb:apb/f8010000.i2c/i2c-0/0-0040/hwmon/hwmon0/humidity1_inputwhich is, in all likelihood, an Si7021. With some amount of effort, we could probably fake it out with an i2c-stub-dump and maybe satisfy that thread. Not sure whether that will be worth the effort. My kernel build is producing armv6 modules instead of armv7 so that's what I'm presently arguing with.
Curiously, it hasn't written anything to /dev/fb0 yet.
One of the threads forks/execs /usr/sbin/udate which is trying to read from an eeprom on I2C:
openat(AT_FDCWD, "/dev/i2c-0", O_RDWR|O_LARGEFILE) = 4
ioctl(4, _IOC(_IOC_NONE, 0x7, 0x3, 0), 0x51) = -1 ENOTTY (Inappropriate ioctl for device)
fstat64(1, {st_mode=S_IFCHR|0666, st_rdev=makedev(0x1, 0x3), ...}) = 0
ioctl(1, TCGETS, 0x7ea59504) = -1 ENOTTY (Inappropriate ioctl for device)
close(4) = 0
write(1, "udate: read from eeprom failed\n", 31) = 31Looks like it's a combo RTC/eeprom and setting the date/time:
date -s "%d-%d-%d %02d:%02d:%02d"anyway, no tangible progress..
hpeyerl
commented
2 years ago This makes things a bit quieter but doesn't fix anything.
mkdir -p /sys/bus/iio/devices/iio:device0
echo 6.0 > /sys/bus/iio/devices/iio:device0/in_voltage6_raw
echo 5.0 > /sys/bus/iio/devices/iio:device0/in_voltage5_raw
mkdir -p /sys/devices/platform/ahb/ahb:apb/f8010000.i2c/i2c-0/0-0040/hwmon/hwmon0/
echo 20 > /sys/devices/platform/ahb/ahb:apb/f8010000.i2c/i2c-0/0-0040/hwmon/hwmon0/temp1_input
echo "40" > /sys/devices/platform/ahb/ahb:apb/f8010000.i2c/i2c-0/0-0040/hwmon/hwmon0/humidity1_inputGuess we may not need i2c-stubs.ko.
This is an interesting spelling error perhaps?
maestro.strace.8423:openat(AT_FDCWD, "/home/volatile/serial_numer", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)Creating that file shuts that error up.
I'm wondering if DukDebugger is part of this: https://github.com/svaarala/duktape
There are lots of enticing symbols to set breakpoints at:
maestro::duk_wrap::CallLaterEvent::CallLaterEvent(duk_hthread*, duk_hthread*)
maestro::duk_wrap::CallLaterEvent::getStashName[abi:cxx11]()
maestro::duk_wrap::CallLaterEvent::proceed(void*)
maestro::duk_wrap::CallLaterEvent::toString[abi:cxx11]()
maestro::duk_wrap::CallLaterEvent::~CallLaterEvent()
maestro::duk_wrap::DirectFBEventFabric::createEvent(DFBWindowEvent&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) const
maestro::duk_wrap::DirectFBEventFabric::~DirectFBEventFabric()
maestro::duk_wrap::DukDebugger::DukDebugger()
maestro::duk_wrap::DukDebugger::attach()
maestro::duk_wrap::DukDebugger::cooperate()
maestro::duk_wrap::DukDebugger::detach()
maestro::duk_wrap::DukDebugger::enable(bool)
maestro::duk_wrap::DukDebugger::finish()
maestro::duk_wrap::DukDebugger::isEnabled()
maestro::duk_wrap::DukDebugger::setContext(duk_hthread*)
maestro::duk_wrap::DukDebugger::setTransportType(maestro::duk_wrap::DukDebugger::TransportType)
maestro::duk_wrap::DukDebugger::~DukDebugger()
maestro::duk_wrap::DukDirectFBEvent::DukDirectFBEvent(DFBWindowEvent&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)
maestro::duk_wrap::DukDirectFBEvent::proceed(void*)
maestro::duk_wrap::DukDirectFBEvent::toString[abi:cxx11]()
maestro::duk_wrap::DukDirectFBEvent::~DukDirectFBEvent()
maestro::duk_wrap::DukSocketClientStatusEvent::DukSocketClientStatusEvent(unsigned int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, maestro::net::SocketStatus, std::vector<unsigned char, std::allocator<unsigned char> > const&)
maestro::duk_wrap::DukSocketClientStatusEvent::proceed(void*)
maestro::duk_wrap::DukSocketClientStatusEvent::~DukSocketClientStatusEvent()
.......etc.....So it looks like what's happening is the "Data Error" being reported by Duk is a result of reading stat.mxe (passed to maestro2 by startgui).
I ran stat.mxe through js-beautify and it turns into 21,000 lines of Javascript that appears to be the thermostat operational interface. According to 'vim' syntax parsing, there's an unterminated string that causes the rest of the file after it to be interpreted as a string. It's a ginormous regex so I just deleted it. Look for "PATTERN:".
That didn't seem to fix it. The various js-beautify things I've found just hung.
I need to get on with my day.
hpeyerl
commented
2 years ago It's like a scab. I can't stop picking at it.
I used Chrome to format 'stat.mxe' and then started maestro2 using that and it no longer crashes. Now it appears to be 'running' (though it's unahppy about sensors obviously.
Json config: {"loglevel":4,"width":480,"height":272,"debugger":true,"allowPureJs":false,"directFBdebug":true,"disableServer":false,"disableModules":false,"disableOta":true,"gui":"/home/volatile/gui.db","datamap":"/home/volatile/datamap.db","identity":"/etc/identity","brandName":"/etc/datamapBrand","sddpConfig":"/etc/sddpd.conf","localTemp":"/sys/bus/iio/devices/iio:device0/in_voltage6_raw","wiredTemp":"/sys/bus/iio/devices/iio:device0/in_voltage5_raw","shtTemp":"/sys/devices/platform/ahb/ahb:apb/f8010000.i2c/i2c-0/0-0040/hwmon/hwmon0/temp1_input","shtHum":"/sys/devices/platform/ahb/ahb:apb/f8010000.i2c/i2c-0/0-0040/hwmon/hwmon0/humidity1_input","firmwareVersion":"/home/volatile/version","serialNumber":"/home/volatile/serial_numer","sensorFile":"/home/volatile/sensors.dat","backgroundImg":"/home/calibrate/wait.png","awayObject":"sow","awayCallback":"clearVacation","settingsObject":"compatibler","settingsCallback":"write","otaConfig":"/home/gui/ota.json","watchdog":"/dev/WDRST"}
stat: init called (default residential version 81).
stat: thread running.
Detaching from process 9777
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: hour = 17, min = 45, day = 6, epoch = 1636911955.
stat: O valve, gas, gas.
[2021-11-14 17:45:55.889][W][0][Maestro][Maestro.cpp:395] OTA is disabled
Detaching from process 9781
[2021-11-14 17:45:55.900][W][0][Maestro][Maestro.cpp:486] Stop heartbeat because debugger enabled!
[2021-11-14 17:45:55.901][W][0][DukWrap][DukDebugger.cpp:367] Debugger is enabled only in debug build
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: thermistor failure.
stat: one minute processing @ 17:45.
stat: generic data @ 19 changed from 0 to 111.
stat: generic data @ 58 changed from 0 to 10.
stat: generic data @ 99 changed from 0 to 255.
stat: sending event 1 (1 0 0).
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: thermistor failure.
~~~~~~~~~~~~~~~~~~~~~~~~~| DirectFB 1.7.7 |~~~~~~~~~~~~~~~~~~~~~~~~~~
(c) 2012-2015 DirectFB integrated media GmbH
(c) 2001-2015 The world wide DirectFB Open Source Community
(c) 2000-2004 Convergence (integrated media) GmbH
----------------------------------------------------------------
(*) DirectFB/Core: Single Application Core. (2020-10-15 23:34)
(*) Direct/Memcpy: Using libc memcpy()
(*) Direct/Thread: Started 'Fusion Dispatch' (9783) [MESSAGING - OTHER/0] <8388608>...
(*) Direct/Thread: Started 'VT Switcher' (9786) [CRITICAL - OTHER/0] <8388608>...
(*) Direct/Thread: Started 'VT Flusher' (9787) [DEFAULT - OTHER/0] <8388608>...
(*) DirectFB/FBDev: Found 'BCM2708 FB' (ID 0) with frame buffer at 0x3eaf0000, 1066k (MMIO 0x00000000, 0k)
(*) Direct/Thread: Started 'Hotplug with Linux Input' (9788) [INPUT - OTHER/0] <8388608>...
(*) DirectFB/Input: Hot-plug detection enabled with Linux Input Driver
(*) DirectFB/Graphics: Generic Software Rasterizer 0.7 (directfb.org)
(*) DirectFB/Core/WM: Default 0.3 (directfb.org)
(*) Direct/Thread: Started 'Genefx' (9789) [DEFAULT - OTHER/0] <8388608>...
(!!!) *** ONCE [no mode found for 480x272] *** [fbdev.c:1360 in dfb_fbdev_find_mode()]
(*) FBDev/Mode: Setting 480x272 RGB32
(*) FBDev/Mode: Switched to 480x272 (virtual 480x272) at 32 bit (RGB32), pitch 1920
(*) Direct/Interface: Loaded 'PNG' implementation of 'IDirectFBImageProvider'.
(*) FBDev/Mode: Setting 480x272 RGB32
(*) FBDev/Mode: Switched to 480x272 (virtual 480x272) at 32 bit (RGB32), pitch 1920
(*) FBDev/Mode: Setting 480x272 RGB32
(*) FBDev/Mode: Switched to 480x272 (virtual 480x272) at 32 bit (RGB32), pitch 1920
(*) Direct/Interface: Loaded 'FT2' implementation of 'IDirectFBFont'.
[2021-11-14 17:45:58.774][W][0][DukWrap][DukWrapHomekit.cpp:50] Remove Homekit!
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: thermistor failure.
[2021-11-14 17:45:58.811][E][0][GUI][Backlight.cpp:305] Backlight file not exists
[2021-11-14 17:45:58.811][E][0][GUI][Backlight.cpp:328] Failed to open file
[2021-11-14 17:45:58.811][E][0][GUI][Backlight.cpp:405] Failed to set backlight level 80
(!!!) *** UNIMPLEMENTED [fusion_get_fusionee_pid] *** [fusion.c:4147]
(*) Direct/Interface: Loaded 'Gif' implementation of 'IDirectFBVideoProvider'.
Detaching from process 9793
mode: 2
-o offset: 209622 us
-f freq.adjust: 0 (65536 = 1ppm)
maxerror: 538500
esterror: 0
status: 8193 (PLL)
-p timeconstant: 7
precision: 1 us
tolerance: 32768000
-t tick: 10000 us
time.tv_sec: 1636911958
time.tv_usec: 917817999
return value: 0 (clock synchronized)
(*) Direct/Interface: Using 'JPEG' implementation of 'IDirectFBImageProvider'.
(!!!) *** WARNING [Non-flipping window surface and no 'autoflip-window' option used] *** [idirectfbsurface_window.c:449 in IDirectFBSurface_Window_Construct()]
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: thermistor failure.
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: thermistor failure.
stat: one minute processing @ 17:46.
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: thermistor failure.
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: thermistor failure.
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: read_bool_dev: EOF
stat: thermistor failure.
(!!!) *** WARNING [Non-flipping window surface and no 'autoflip-window' option used] *** [idirectfbsurface_window.c:449 in IDirectFBSurface_Window_Construct()]
(!!!) *** WARNING [Non-flipping window surface and no 'autoflip-window' option used] *** [idirectfbsurface_window.c:449 in IDirectFBSurface_Window_Construct()]I set a breakpoint at HMAC() and of course it doesn't get there. I haven't tried sending a sensor packet to it.
gdbserver :8888 maestro2 -j --config maestro.json stat.mxe_formattedIt's like a scab. I can't stop picking at it.
That's how I was yesterday. Try spoofing a packet with this:
echo -n 82bd202590a2908872f10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c627742346a6b71635870344a745a4d505449486d4c797231436766714f52533152614a744a50622f49446f3d | xxd -p -r | socat - UDP-DATAGRAM:255.255.255.255:5001,broadcastThat's a "button press" packet, so it should get it to do things, even if it's not paired.
hpeyerl
commented
2 years ago Nothin. The packet did show up on the Pi though on the 'eth0' interface because I don't have my 'wlan0' configured. Not sure if it specifically binds to
root@octopi:/home/pi/VH# tcpdump -v -X -s 0 -n port 5001
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
19:30:09.763178 IP (tos 0x0, ttl 64, id 62011, offset 0, flags [DF], proto UDP (17), length 121)
192.168.34.135.47893 > 255.255.255.255.5001: UDP, length 93
0x0000: 4500 0079 f23b 4000 4011 6509 c0a8 2287 E..y.;@.@.e...".
0x0010: ffff ffff bb15 1389 0065 1073 82bd 2025 .........e.s...%
0x0020: 90a2 9088 72f1 0051 a0c6 5633 9663 0643 ....r..Q..V3.c.C
0x0030: 9343 1356 6362 0032 8033 0013 8014 2064 .C.Vcb.2.3.....d
0x0040: f666 6696 3654 8035 07b5 8291 22c6 2774 .ff.6T.5....".'t
0x0050: 2346 a6b7 1635 8703 44a7 45a4 d505 4494 #F...5..D.E...D.
0x0060: 86d4 c797 2314 3676 6714 f525 3315 2614 ....#.6vg..%3.&.
0x0070: a744 a506 22f4 9446 f3 .D.."..F.I'll play more maybe later or tomorrow. I'm over my playtime allotment again.
doug-hoffman
commented
2 years ago Hmm. That sucks. I feel like we're so close. Were you running that on the same RPi as maestro2? It won't receive it's own broadcast traffic, so you'd have to do something more like:
echo -n 82bd202590a2908872f10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c627742346a6b71635870344a745a4d505449486d4c797231436766714f52533152614a744a50622f49446f3d | xxd -p -r | socat - UDP-DATAGRAM:127.0.0.1:5001Maybe with something other than the loopback interface as the destination. You can check what's listening on UDP 5001 with lsof -iUDP:5001. It shouldn't matter that it's normally expecting it as broadcast/multicast.
I'm stuck trying to get a working frame buffer in qemu. It definitely won't work without one.
I never did find the missing files from the manifest. I'm guessing some of the stuff like the kernel modules may only exist in the initrd. Looking at /home/gui/ota.json and /etc/fstab, we don't seem to be missing anything other than the env and secure partitions that probably aren't included in the update. I haven't managed to find the initrd yet to look at it, and, until we know we need something that's missing, I'm focusing my efforts elsewhere.
{
"uri":"https://ctupdate.skyport.io/feed",
"clientCert": "/home/secure/skyport_public.pem",
"clientKey": "/home/secure/skyport_private.pem",
"caInfo": "/home/volatile/skyport_root.pem",
"firmwareCert":"/home/gui/codesign.pem",
"env":"/dev/mtd2",
"envVar":"bank",
"kernelA":"/dev/mtd4",
"kernelB":"/dev/mtd5",
"rootA":"/dev/mtd6",
"rootB":"/dev/mtd7",
"interval":240
}/dev/root / jffs2 rw,noauto,noatime,nodiratime,sync,user 0 1
/dev/mtdblock8 /home/volatile jffs2 rw,noatime,nodiratime,sync 1 1
/dev/mtdblock9 /home/secure jffs2 ro,noatime,nodiratime,sync 1 1Compiled the virtual framebuffer kernel module and I've got it running now. Bad news... it's not listening on UDP 5001:
$ sudo lsof -i | grep maestro
maestro2 8173 root 11u IPv4 25088 0t0 UDP *:1900 Tried running the startgui script, but still nothing listening on UDP 5001. (Just got spammed with tslib: Selected device is not a touchscreen (must support ABS event type) by launcher.mxe, so it may not have fully started.) I wonder if we need to go through some initial setup from the GUI to get to the point that it's listening to sensors.
doug-hoffman
commented
2 years ago Built a virtual touchscreen driver, loaded it, and launcher.mxe is much happier. Had to change /dev/input/event0 to /dev/input/event1 in /home/gui/exports.sh to use the new device and comment out /home/calibrate/startcalibrate so it wouldn't hang (presumably) waiting for a calibration.
Even so, it still gives up for some reason:
bash-4.4# maestro2 --config /home/gui/maestro.json -no /home/gui/launcher.mxe
Json config: {"loglevel":5,"width":480,"height":272,"debugger":true,"allowPureJs":false,"directFBdebug":false,"disableServer":false,"disableModules":false,"disableOta":true,"gui":"/home/volatile/gui.db","datamap":"/home/volatile/datamap.db","identity":"/etc/identity","brandName":"/etc/datamapBrand","sddpConfig":"/etc/sddpd.conf","localTemp":"/dev/null","wiredTemp":"/dev/null","shtTemp":"/dev/null","shtHum":"/dev/null","firmwareVersion":"/home/volatile/version","serialNumber":"/home/volatile/serial_numer","sensorFile":"/home/volatile/sensors.dat","backgroundImg":"/home/calibrate/wait.png","awayObject":"sow","awayCallback":"clearVacation","settingsObject":"compatibler","settingsCallback":"write","otaConfig":"/home/gui/ota.json","watchdog":"/dev/WDRST"}
[2021-11-14 22:43:47.791][W][0][Maestro][Maestro.cpp:102] Execute without modules
[2021-11-14 22:43:47.831][W][0][Maestro][Maestro.cpp:486] Stop heartbeat because debugger enabled!
[2021-11-14 22:43:47.835][W][0][DukWrap][DukDebugger.cpp:367] Debugger is enabled only in debug buildIt looks like the last file it's interacting with is /home/volatile/gui.db (that I copied from /home/volatilerestore). I'm guessing it's not happy with something it found.
hpeyerl
commented
2 years ago Yes, I was sending packets from a different host.
I thought for sure I saw something listening at 5001 yesterday but clearly not.
whatever is camped out on 1900/udp isn't reading from its socket. It's recvq is full.
anyway, I can't get sucked into this today.
btw, the .db's have fairly simple schemas if you go at them with sqlite3 CLI.
garbled1
commented
2 years ago Isn't 1900 SSDP?
doug-hoffman
commented
2 years ago It should be, and there are references to SSDP all over in maestro, so it'd make sense.
I did look at the data in gui.db a bit. Nothing obvious that'd change the behavior for remote sensors. Guess it could be waiting for connectivity on the wireless interface before actually taking its network responsibilities seriously.
I should hopefully have a bunch of microSDs later today to begin working on this from an RPi. Curious to see what output (if any) I get on the framebuffer at each stage. Hopefully that shines some light on why we aren't seeing normal behavior. The virtual touchscreen interface I found does have a client to send touch events, so we should be able to interact with the interface as normal.
I also have a second thermostat on order to attempt some more potentially dangerous things. It's been dipping below freezing lately, so I can't risk breaking the one that actually keeps the house warm.
garbled1
commented
2 years ago Yeah, it definitely does SSDP. I have C code that talks to that, but I'll be eventually be adding discovery to the HA integration.
hpeyerl
commented
2 years ago I've been periodically checking the framebuffer. This is what's on mine now:
doug-hoffman
commented
2 years ago I just remembered, when I was working on discovery for my HA integration, SSDP was not at all reliable. It would typically be several days between SSDP announcements. Maybe it's a buggy implementation and whatever is causing that delay is related to the receive queue being full.
The protocol for Venstar Wi-Fi sensors is undocumented. Let's try to figure it out, so we can decode/encode them.
What I've identified so far
The sensors broadcast their data to the local network (255.255.255.255) and multicast to the all hosts group (224.0.0.1) on UDP port 5001. Updates are sent every minute for mini Wi-Fi sensors set to "remote", every two minutes for the original Wi-Fi sensors set to "remote", and every 20 seconds for "supply" and "return".
Messages appear to be a series of TLVs, with the length being unspecified for some types.
Type:
08= State,10= Unit ID,1a= Identifier,30= Firmware version,42= Name,48= Sensor Type,50= Temperature,58= Battery State:2a= Normal,2b= Ready to link (button pressed) Unit ID:00to13Identifier: Only MAC address observed Sensor type:01= Outdoor,02= Return,03= Remote,04= Supply Temperature:00= -40.0°C toff= 87.5°C, in 0.5° steps. Temperature increases at a rate no faster than 1.5°/update and decreases at 0.5°/update.Sample messages
First line is when the message was received, for an understanding of timing. Second is the message in hex. Third is the message in ascii with non-printable characters replaced by a period.
Messages sent by sensors during normal operation
``` 2021-11-06 08:56:52.273645 082ad202590a2908f42e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c356242302f796467507872336d644b554c4d7a504c4f7350527a65384f65545244613975306d456a486d6f3d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,5bB0/ydgPxr3mdKULMzPLOsPRze8OeTRDa9u0mEjHmo= 2021-11-06 08:57:01.498718 082ad2025f0a2f08bdca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c5139633959707a634f52586170326b4950447435455a486b3165336f6b5865434b382f6a7072585269524d3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,Q9c9YpzcORXap2kIPDt5EZHk1e3okXeCK8/jprXRiRM= 2021-11-06 08:57:02.932190 082ad202600a3008bcc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804508b015864122c414f313855307279633069575472745a54343072716b44486b6f4b597a4a683045784b6459692f654d37413d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,AO18U0ryc0iWTrtZT40rqkDHkoKYzJh0ExKdYi/eM7A= 2021-11-06 08:57:05.912636 082ad2025e0a2e08b14010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c574d5068576b7652794455316f59595936484474664b5142764c754e4a4c3948376a4c4d33773749394e513d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,WMPhWkvRyDU1oYYY6HDtfKQBvLuNJL9H7jLM3w7I9NQ= 2021-11-06 08:57:10.009835 082ad202620a3208f9c60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c524833357731506f3357567a6630656964755464444e394d354f523369414356564866535768496f6c48513d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,RH35w1Po3WVzf0eiduTdDN9M5OR3iACVVHfSWhIolHQ= 2021-11-06 08:57:10.828285 082ad2025e0a2e08ac4010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c4f6f55566f2f62317249494f364979653963755477776a6d707877424871494f57704243396269667134493d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,OoUVo/b1rIIO6Iye9cuTwwjmpxwBHqIOWpBC9bifq4I= 2021-11-06 08:57:16.505114 082ad2025e0a2e08a6d80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507b5833122c386864364455686d664f2b6a6b31506e7a334c70434e6f44535774575a3275517250424c754e35744a52733d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P{X3.,8hd6DUhmfO+jk1Pnz3LpCNoDSWtWZ2uQrPBLuN5tJRs= 2021-11-06 08:57:24.502644 082ad202600a3008c7d80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507b5820122c5154794745484b6b33746956544c72684d32465470412f50742b68487136555741576a766f4e55754d73343d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P{X .,QTyGEHKk3tiVTLrhM2FTpA/Pt+hHq6UWAWjvoNUuMs4= 2021-11-06 08:57:25.413231 082ad202600a3008ea0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582d122c39567874366f6d696b74656a306971356f37635a322f5a38625372635136662f726153724a6e5a54664d593d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X-.,9Vxt6omiktej0iq5o7cZ2/Z8bSrcQ6f/raSrJnZTfMY= 2021-11-06 08:57:26.421120 082ad2025f0a2f08beca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c4f72485a597166443451494f773841764a6a416276796d4f69314976564c6d4c34553673554a71765a66633d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,OrHZYqfD4QIOw8AvJjAbvymOi1IvVLmL4U6sUJqvZfc= 2021-11-06 08:57:27.487416 082ad202600a3008bdc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804508b015864122c656b53536a38344c557a5638597172586e48576c4a712b38326c412b52477937334d57574f4f55497851513d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,ekSSj84LUzV8YqrXnHWlJq+82lA+RGy73MWWOOUIxQQ= 2021-11-06 08:57:31.801574 082ad2025a0a2a08990510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c767968642f422f767936684d612b416a754a526d684c63755a72504a6167616b645a5a674a495849316d773d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,vyhd/B/vy6hMa+AjuJRmhLcuZrPJagakdZZgJIXI1mw= 2021-11-06 08:57:47.529351 082ad202590a2908f52e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c556c724b622b6264564c41726d506b414d4473504330785a684665446b734351454c5863616b4f6f5733633d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,UlrKb+bdVLArmPkAMDsPC0xZhFeDksCQELXcakOoW3c= 2021-11-06 08:57:48.207560 082ad2025f0a2f08bfca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c75616b5961523634775356524e3737306756756e6361456638544138675865324c4a73696839672b6f4d553d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,uakYaR64wSVRN770gVuncaEf8TA8gXe2LJsih9g+oMU= 2021-11-06 08:57:49.071664 082ad202600a3008bec40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804508f015864122c316d7a666c2b77742b32327651614666504a756b557645304c6a447250686e41703453494469374d3664553d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,1mzfl+wt+22vQaFfPJukUvE0LjDrPhnAp4SIDi7M6dU= 2021-11-06 08:58:01.076149 082ad2025e0a2e08b24010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c414c487366454338474b58714c6f5a32313443765a7a45533549762f59654b41384c6f4e34394f497751303d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,ALHsfEC8GKXqLoZ214CvZzES5Iv/YeKA8LoN49OIwQ0= 2021-11-06 08:58:05.157292 082ad202620a3208fac60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c6539496b4d714a4a666e4565674836305354547a4c49476a447434694e46676a4550565358377447434f513d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,e9IkMqJJfnEegH60STTzLIGjDt4iNFgjEPVSX7tGCOQ= 2021-11-06 08:58:05.981605 082ad2025e0a2e08ad4010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c47636d616971614357507231346468463841784f6c5544526849755a3250795a4c716c4a64416c715445303d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,GcmaiqaCWPr14dhF8AxOlUDRhIuZ2PyZLqlJdAlqTE0= 2021-11-06 08:58:09.549607 082ad2025f0a2f08c0ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c45364231592f6653794c6a327533314f37446e6b6d45464544637130596e566f70495354446643415652513d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,E6B1Y/fSyLj2u31O7DnkmEFEDcq0YnVopISTDfCAVRQ= 2021-11-06 08:58:11.895550 082ad2025e0a2e08a7d80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507b5833122c77595a2b35783173755341346c547a742f4c414e317556675155524a3252556d742b41505068394e3138453d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P{X3.,wYZ+5x1suSA4lTzt/LAN1uVgQURJ2RUmt+APPh9N18E= 2021-11-06 08:58:15.147704 082ad202600a3008bfc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c7948045093015864122c594644764b5a737a43744472703858477461752f614f6b4571737536545763327a43454c7679494a6f43733d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,YFDvKZszCtDrp8XGtau/aOkEqsu6TWc2zCELvyIJoCs= 2021-11-06 08:58:19.587852 082ad202600a3008c8d80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5820122c5a2b316462335954313842422b4f4248674e495a6d2f422f66434767636b3668486a3936504149723172553d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X .,Z+1db3YT18BB+OBHgNIZm/B/fCGgck6hHj96PAIr1rU= 2021-11-06 08:58:20.701146 082ad202600a3008eb0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c6459414f6c484f5936565972775a7a37514e4752507971356d3873417536752f654d5163574c6352754e6b3d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,dYAOlHOY6VYrwZz7QNGRPyq5m8sAu6u/eMQcWLcRuNk= 2021-11-06 08:58:30.878551 082ad2025f0a2f08c1ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c33644b6a516a7339655a4f38644c4d4e62346d416a6448323479794575367572665853794c5032645775553d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,3dKjQjs9eZO8dLMNb4mAjdH24yyEu6urfXSyLP2dWuU= 2021-11-06 08:58:36.870836 082ad202600a3008c0c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c7948045096015864122c7350664b5a45496b45356f7556527172307577417650712f6e524b7951776b4337397667614a597a4452413d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,sPfKZEIkE5ouVRqr0uwAvPq/nRKyQwkC79vgaJYzDRA= 2021-11-06 08:58:42.219485 082ad2025a0a2a089a0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c48655a6a4837333938305250386a546d694b3461654c2b75622b4d6d464837486c506645466935624f52493d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,HeZjH73980RP8jTmiK4aeL+ub+MmFH7HlPfEFi5bORI= 2021-11-06 08:58:42.817426 082ad202590a2908f62e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c336f61346d49486c79646256397074532b372b454f337935696946764a66657859374e3438414342524b453d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,3oa4mIHlydbV9ptS+7+EO3y5iiFvJfexY7N48ACBRKE= 2021-11-06 08:58:52.143797 082ad2025f0a2f08c2ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c2b4e766978346658424c35647834434f70454d5631523759333843386169306349736d614472635a446a4d3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,+Nvix4fXBL5dx4COpEMV1R7Y38C8ai0cIsmaDrcZDjM= 2021-11-06 08:58:56.152689 082ad2025e0a2e08b34010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c4a6b425051746c572f4e636c6a4b2b2f75705779513169692f53687350704942326a724e786d4a756a73453d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,JkBPQtlW/NcljK+/upWyQ1ii/ShsPpIB2jrNxmJujsE= 2021-11-06 08:58:58.799947 082ad202600a3008c1c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c7948045099015864122c33486532747a364961592b3159563547493452624e4e654858414b666c4e4641316475382b384c45756e493d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,3He2tz6IaY+1YV5GI4RbNNeHXAKflNFA1du8+8LEunI= 2021-11-06 08:59:00.326699 082ad202620a3208fbc60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c7a35394a4f6e2f6544705a3434666c39566c556d596b2b685663435a45654d326c597a4c4476484d2f676b3d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,z59JOn/eDpZ44fl9VlUmYk+hVcCZEeM2lYzLDvHM/gk= 2021-11-06 08:59:01.067395 082ad2025e0a2e08ae4010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c58544376635167325753424c355776357a422b74764d77342b55465a526631734752506c68724d386758673d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,XTCvcQg2WSBL5Wv5zB+tvMw4+UFZRf1sGRPlhrM8gXg= 2021-11-06 08:59:07.084170 082ad2025e0a2e08a8d80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507b5833122c6c666658344270687a742b523135483871426377367766766669794478727876427353392f77667430394d3d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P{X3.,lffX4Bphzt+R15H8qBcw6wfvfiyDxrxvBsS9/wft09M= 2021-11-06 08:59:13.543068 082ad2025f0a2f08c3ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c364757326d485a4664594f694447432f5476314e766f596b784c693070416a616473786d4b72667a4242493d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,6GW2mHZFdYOiDGC/Tv1NvoYkxLi0pAjadsxmKrfzBBI= 2021-11-06 08:59:14.673454 082ad202600a3008c9d80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5820122c324f71332b504e6b374a526b3178476a3574756f41645a4e6a4f567654677054613052594f7a4271702b453d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X .,2Oq3+PNk7JRk1xGj5tuoAdZNjOVvTgpTa0RYOzBqp+E= 2021-11-06 08:59:15.889145 082ad202600a3008ec0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c574c6335696d4a73345a58474d327a53494147706f4739706870774861564c795943376d584641452f67553d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,WLc5imJs4ZXGM2zSIAGpoG9phpwHaVLyYC7mXFAE/gU= 2021-11-06 08:59:20.199002 082ad202600a3008c2c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509b015864122c486651577a70596a775031387146374b493934657572724b62566a7466672b4c344856735368694851646b3d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,HfQWzpYjwP18qF7KI94eurrKbVjtfg+L4HVsShiHQdk= 2021-11-06 08:59:34.943179 082ad2025f0a2f08c4ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c39746d592b45774675675167694345446345724b59727550343737696766477555506265484637784f57383d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,9tmY+EwFugQgiCEDcErKYruP477igfGuUPbeHF7xOW8= 2021-11-06 08:59:38.006144 082ad202590a2908f72e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c722b783337324a39515148524d56674c63586d49366d7731344e3173736e7230446643685a45426a6a77453d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,r+x372J9QQHRMVgLcXmI6mw14N1ssnr0DfChZEBjjwE= 2021-11-06 08:59:41.497467 082ad202600a3008c3c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509c015864122c306d7059354433634b43463364454a574c374c7a5a52574b725643364a744a445a732f307268504678766f3d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,0mpY5D3cKCF3dEJWL7LzZRWKrVC6JtJDZs/0rhPFxvo= 2021-11-06 08:59:51.239010 082ad2025e0a2e08b44010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c4d6457614c44574c30564f316d31444e642f73447951792f5232712b5877592b4c68566c753255542f68493d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,MdWaLDWL0VO1m1DNd/sDyQy/R2q+XwY+LhVlu2UT/hI= 2021-11-06 08:59:52.637661 082ad2025a0a2a089b0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c68494631776e5453796e725872444336646e6c6d446351354b6f4d494b7845594f796f6d785377593235593d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,hIF1wnTSynrXrDC6dnlmDcQ5KoMIKxEYOyomxSwY25Y= 2021-11-06 08:59:55.530558 082ad202620a3208fcc60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c574e574a4d4c6f74776c576a397344644367587443382b7038685a6a7163426d615a6359395775735974513d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,WNWJMLotwlWj9sDdCgXtC8+p8hZjqcBmaZcY9WusYtQ= 2021-11-06 08:59:56.154966 082ad2025e0a2e08af4010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c70704a4153592b7953312b744a7a733656757a45584b6b70394f4279584e506f4438527a52644d756c614d3d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,ppJASY+yS1+tJzs6VuzEXKkp9OByXNPoD8RzRdMulaM= 2021-11-06 08:59:56.661587 082ad2025f0a2f08c5ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c2f7539364f336579477a6b74445a6866694c2f5269352f536a766e625056734d6945586b4564612f464b453d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,/u96O3eyGzktDZhfiL/Ri5/SjvnbPVsMiEXkEda/FKE= 2021-11-06 09:00:02.374806 082ad2025e0a2e08a9d80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507b583c122c437476567071366a4873643673633577726c632b4543565135326e356b6e5263417a6f38534145357465343d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P{X<.,CtvVpq6jHsd6sc5wrlc+ECVQ52n5knRcAzo8SAE5te4= 2021-11-06 09:00:07.494337 082ad202600a3008c4c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509d015864122c51364b3439574d467a5156722b316f7a656155787261396b41546f2f5a4a7674614d6875503450577444773d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,Q6K49WMFzQVr+1ozeaUxra9kATo/ZJvtaMhuP4PWtDw= 2021-11-06 09:00:09.851975 082ad202600a3008cad80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5820122c4a2b4b4a4e644e424b4b4139484f2b4e734a624d73717347467952732f5639644b52626a565a77473031513d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X .,J+KJNdNBKKA9HO+NsJbMsqsGFyRs/V9dKRbjVZwG01Q= 2021-11-06 09:00:11.180534 082ad202600a3008ed0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c6c565578424d507933506d6f77587731374152574d697631777a6a4432534151785a6176725666726c68413d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,lVUxBMPy3PmowXw17ARWMiv1wzjD2SAQxZavrVfrlhA= 2021-11-06 09:00:18.471153 082ad2025f0a2f08c6ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c52323642766d534d697359384c75714e676f78655a6f50424b387968416d66785337414954394978696e513d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,R26BvmSMisY8LuqNgoxeZoPBK8yhAmfxS7AIT9IxinQ= 2021-11-06 09:00:33.194660 082ad202590a2908f82e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c5966546e546f7471445254556a35424b595234395872583069417032654e49667336392b7233734c4768493d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,YfTnTotqDRTUj5BKYR49XrX0iAp2eNIfs69+r3sLGhI= 2021-11-06 09:00:35.092409 082ad202600a3008c5c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509e015864122c6758343765567a687539755266772f426b634449756c7035505a636a417844657a31774a4d6e364d6b64383d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,gX47eVzhu9uRfw/BkcDIulp5PZcjAxDez1wJMn6Mkd8= 2021-11-06 09:00:39.756501 082ad2025f0a2f08c7ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c4b41574c3953486b774d5a50335a505a4778435335546f5a4d756c4c31366c6e6a59584a4a59364544436f3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,KAWL9SHkwMZP3ZPZGxCS5ToZMulL16lnjYXJJY6EDCo= 2021-11-06 09:00:46.325635 082ad2025e0a2e08b54010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c6354334a33636e36563670306270562f6f6b483767375257327a39786c313073787a625358594e6b4650773d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,cT3J3cn6V6p0bpV/okH7g7RW2z9xl10sxzbSXYNkFPw= 2021-11-06 09:00:50.617051 082ad202620a3208fdc60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c7338742f3869554f52614158767a716a64584e5172436834506d667864754e556f476b546968764d6e79343d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,s8t/8iUORaAXvzqjdXNQrCh4PmfxduNUoGkTihvMny4= 2021-11-06 09:00:51.242689 082ad2025e0a2e08b04010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c624e652b33412b4e42735768586d79322b793764386a66693044516a324e4c5a6c77314a627a746c547a633d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,bNe+3A+NBsWhXmy2+y7d8jfi0DQj2NLZlw1JbztlTzc= 2021-11-06 09:00:56.444929 082ad202600a3008c6c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509e015864122c4c30624375414e364d65457833534f596b38545a396e2f715231514c787631502f642b4c483748664848383d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,L0bCuAN6MeEx3SOYk8TZ9n/qR1QLxv1P/d+LH7HfHH8= 2021-11-06 09:00:57.666048 082ad2025e0a2e08aad80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5836122c5a72305a6d3769336e4276394171385642655673396c4b32794a48383667676b323575417565322f4b45513d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X6.,Zr0Zm7i3nBv9Aq8VBeVs9lK2yJH86ggk25uAue2/KEQ= 2021-11-06 09:01:01.421733 082ad2025f0a2f08c8ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c464a38456e485773666b2b4e31434c6f74707566574966472b3858397352494a4c624961727250787470303d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,FJ8EnHWsfk+N1CLotpufWIfG+8X9sRIJLbIarrPxtp0= 2021-11-06 09:01:03.055634 082ad2025a0a2a089c0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c43766c59566e67562f31655a693331322b4a39576254477a7a423738534c347248386b44414f69614d726f3d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,CvlYVngV/1eZi312+J9WbTGzzB78SL4rH8kDAOiaMro= 2021-11-06 09:01:05.037001 082ad202600a3008cbd80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5820122c58736a4f65502f345446634942627a2f444145586d5267304d4b6554774b3147543676496a6865444748633d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X .,XsjOeP/4TFcIBbz/DAEXmRg0MKeTwK1GT6vIjheDGHc= 2021-11-06 09:01:06.266005 082ad202600a3008ee0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c397a4635773739334a7351646a5a74334641754932527a375a4f4b32692f334d52536b3272713738626f453d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,9zF5w793JsQdjZt3FAuI2Rz7ZOK2i/3MRSk2rq78boE= 2021-11-06 09:01:17.846000 082ad202600a3008c7c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509e015864122c4a776e426a7244436b4333524b2f312f4c3977554b43554348464e4e55734d4d75394a69725455495047593d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,JwnBjrDCkC3RK/1/L9wUKCUCHFNNUsMMu9JirTUIPGY= 2021-11-06 09:01:23.085303 082ad2025f0a2f08c9ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c4639774458594548544866375938715a694e7858394a64656c68596f36442b634d304b52646a656a7a4c733d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,F9wDXYEHTHf7Y8qZiNxX9JdelhYo6D+cM0KRdjejzLs= 2021-11-06 09:01:28.485870 082ad202590a2908f92e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c6b725062564457536463706f63626d4f584d42644a696d6d6d3645504f46565a5854443477572f763254673d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,krPbVDWSdcpocbmOXMBdJimmm6EPOFVZXTD4wW/v2Tg= 2021-11-06 09:01:39.141954 082ad202600a3008c8c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509f015864122c72616842483145466f465a3131696a73544b5a306a55787754795a5952723742426b6b7a376a68556a52633d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,rahBH1EFoFZ11ijsTKZ0jUxwTyZYRr7BBkkz7jhUjRc= 2021-11-06 09:01:41.412645 082ad2025e0a2e08b64010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c307832596d4b314e4f2f7344734f304936444172534e76786547723430516e5857415259416d412b70306b3d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,0x2YmK1NO/sDsO0I6DArSNvxeGr40QnXWARYAmA+p0k= 2021-11-06 09:01:44.465624 082ad2025f0a2f08caca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c35324162757a484e4875336362662b393663676c486857585737337a545671796379674b69314b54746d633d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,52AbuzHNHu3cbf+96cglHhWXW73zTVqycygKi1KTtmc= 2021-11-06 09:01:45.703871 082ad202620a3208fec60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c4e4647374757756a6155756c416b3549494f63694437716f72725a4d62556c6f5743786c65306c656d57513d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,NFG7GWujaUulAk5IIOciD7qorrZMbUloWCxle0lemWQ= 2021-11-06 09:01:46.326362 082ad2025e0a2e08b14010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c6b424972486b77793268697046764d68422f53354f76365a6171705a61754550794d7036687169657744493d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,kBIrHkwy2hipFvMhB/S5Ov6ZaqpZauEPyMp6hqiewDI= 2021-11-06 09:01:52.955900 082ad2025e0a2e08abd80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c6b5a6e6f653969634d37394249644a46364c38725865636b56597349626469356352467074307a6c6654553d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,kZnoe9icM79BIdJF6L8rXeckVYsIbdi5cRFpt0zlfTU= 2021-11-06 09:02:00.229338 082ad202600a3008ccd80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5820122c47614a726f485052616f6749636f696b347732516d4e70782b6e625144694b4f32454852746a64376179553d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X .,GaJroHPRaogIcoik4w2QmNpx+nbQDiKO2EHRtjd7ayU= 2021-11-06 09:02:00.746153 082ad202600a3008c9c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509f015864122c2b743261326775742b777849517156487841764b7943742f4453612f6f6e6142322b566f444c77342f54343d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,+t2a2gut+wxIQqVHxAvKyCt/DSa/onaB2+VoDLw4/T4= 2021-11-06 09:02:01.659217 082ad202600a3008ef0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c4a766369637152414d6852772b54634a4a626a43717137647554732b3879727a4a4970705971684a6748493d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,JvcicqRAMhRw+TcJJbjCqq7duTs+8yrzJIppYqhJgHI= 2021-11-06 09:02:05.764045 082ad2025f0a2f08cbca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c61684a76784e706b3648506a66567752326b6d764956316b774e352b4e77593161374c35755356615870513d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,ahJvxNpk6HPjfVwR2kmvIV1kwN5+NwY1a7L5uSVaXpQ= 2021-11-06 09:02:13.473658 082ad2025a0a2a089d0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c6b43344142566d666d2f483474454566493576417935673144766b31444731324349717571446b70584d6f3d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,kC4ABVmfm/H4tEEfI5vAy5g1Dvk1DG12CIquqDkpXMo= 2021-11-06 09:02:22.388623 082ad202600a3008cac40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509f015864122c6d6e48422b394f57343939376e3756447277702b47587139444a476d62532f424a587944726d38727564343d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,mnHB+9OW4997n7VDrwp+GXq9DJGmbS/BJXyDrm8rud4= 2021-11-06 09:02:23.775412 082ad202590a2908fa2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c4771713644373850494e54734a706d58334c3269362b394c41506d6277414c54766e66564c436b7a5979553d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,Gqq6D78PINTsJpmX3L2i6+9LAPmbwALTvnfVLCkzYyU= 2021-11-06 09:02:26.958853 082ad2025f0a2f08ccca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c72426d4d4b2f735051754e57334d69755134745a344a6e346c65342b6d4b686d7166692b7a2b70326b4c4d3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,rBmMK/sPQuNW3MiuQ4tZ4Jn4le4+mKhmqfi+z+p2kLM= 2021-11-06 09:02:36.602116 082ad2025e0a2e08b74010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c51356f67496b3050554968755971524842764d745163696c634230746f544456494273487456326e3547383d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,Q5ogIk0PUIhuYqRHBvMtQcilcB0toTDVIBsHtV2n5G8= 2021-11-06 09:02:40.792478 082ad202620a3208ffc60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c34622b56715a66345432695138356244696255414b75425936776a6a6854724d535a7052775447494542513d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,4b+VqZf4T2iQ85bDibUAKuBY6wjjhTrMSZpRwTGIEBQ= 2021-11-06 09:02:41.412220 082ad2025e0a2e08b24010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c34334b6e446d6379494953675170626e393673534c5a4d367062494a414a4c4c522b3565743179574476453d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,43KnDmcyIISgQpbn96sSLZM6pbIJAJLLR+5et1yWDvE= 2021-11-06 09:02:44.050023 082ad202600a3008cbc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c4c4f727750756a79636435654f46444755376b65356a6446685a36507a50646246774845745765706432593d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,LOrwPujycd5eOFDGU7ke5jdFhZ6PzPdbFwHEtWepd2Y= 2021-11-06 09:02:48.246768 082ad2025e0a2e08acd80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c41364a4a2b7448367876426a384a53344d794e6c554654667a4146697430686a73456c4c434c37486a6b4d3d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,A6JJ+tH6xvBj8JS4MyNlUFTfzAFit0hjsElLCL7HjkM= 2021-11-06 09:02:48.358846 082ad2025f0a2f08cdca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c4f496e3841375274614a7a2f54586b6278544f6f38496e777632754f56376b6435522f2b374b4a31546d383d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,OIn8A7RtaJz/TXkbxTOo8Inwv2uOV7kd5R/+7KJ1Tm8= 2021-11-06 09:02:55.721291 082ad202600a3008cdd80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5828122c415055712f7151307a78617035624e67687a574a4c3452693052654164736c46414d5a43765a35304855773d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X(.,APUq/qQ0zxap5bNghzWJL4Ri0ReAdslFAMZCvZ50HUw= 2021-11-06 09:02:57.155279 082ad202600a3008f00110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c5230584f653852736952643635394e34694a776d685946486f772b6664657779537138327a7941525538593d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,R0XOe8RsiRd659N4iJwmhYFHow+fdewySq82zyARU8Y= 2021-11-06 09:03:08.656138 082ad2025a0a2a089e0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c46396379357a6e435a786a6e31624d6770677272364b526c4c6936484d545a5a79714537793774746f6f493d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,F9cy5znCZxjn1bMgpgrr6KRlLi6HMTZZyqE7y7ttooI= 2021-11-06 09:03:09.002609 082ad202600a3008ccc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c7557664768706f41464566464b59376f7367627037585758794c77652f645278566e444f66536f793541593d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,uWfGhpoAFEfFKY7osgbp7XWXyLwe/dRxVnDOfSoy5AY= 2021-11-06 09:03:09.758641 082ad2025f0a2f08ceca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c416b55534c6447544d4d782f35355344674d72496579733977574b2b6a41644166564257362f377a7349493d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,AkUSLdGTMMx/55SDgMrIeys9wWK+jAdAfVBW6/7zsII= 2021-11-06 09:03:19.066138 082ad202590a2908fb2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c656279374972736e76624e436b427a4f6c77707251687569615357762f4e322f51316e774f6c424e3445513d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,eby7IrsnvbNCkBzOlwprQhuiaSWv/N2/Q1nwOlBN4EQ= 2021-11-06 09:03:30.337928 082ad202600a3008cdc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c42596777645268635a4f3934676d4d554857464857524a37784935777663742f4d5354616746386269686b3d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,BYgwdRhcZO94gmMUHWFHWRJ7xI5wvct/MSTagF8bihk= 2021-11-06 09:03:31.160625 082ad2025f0a2f08cfca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c4744564e443962575730583647506336522f32734e7242714d422f76514331587977426d6c4a612f6e396b3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,GDVND9bWW0X6GPc6R/2sNrBqMB/vQC1XywBmlJa/n9k= 2021-11-06 09:03:31.686155 082ad2025e0a2e08b84010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c6977754a462b7849323470624e36777a6748756e516954437a786a564b646163507065586d3767324464553d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,iwuJF+xI24pbN6wzgHunQiTCzxjVKdacPpeXm7g2DdU= 2021-11-06 09:03:36.164881 082ad202620a320880c70210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c65462b552f37424d59432b486b6e4574464b4356646d6e334a352f4d7772647357434830306844315865593d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,eF+U/7BMYC+HknEtFKCVdmn3J5/MwrdsWCH00hD1XeY= 2021-11-06 09:03:36.498667 082ad2025e0a2e08b34010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c4848433758627256664f494954724b7072633264714a6668797437726b2f3262354d5a47594836756852553d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,HHC7XbrVfOIITrKprc2dqJfhyt7rk/2b5MZGYH6uhRU= 2021-11-06 09:03:43.537077 082ad2025e0a2e08add80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c577869697a736c56676378504b626b4f6959426c597979386d78454a5047306641524e4c654971504136633d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,WxiizslVgcxPKbkOiYBlYyy8mxEJPG0fARNLeIqPA6c= 2021-11-06 09:03:51.127794 082ad202600a3008ced80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5828122c3966496f4458316a554b4b51496e63394b307368536c343263417162756d55597a626c4e6b596d343930553d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X(.,9fIoDX1jUKKQInc9K0shSl42cAqbumUYzblNkYm490U= 2021-11-06 09:03:51.634558 082ad202600a3008cec40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c477638306f4c52766c4f6c704e37434130744d584b6a6f44794b4668396a636c5342617068356c736f52453d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,Gv80oLRvlOlpN7CA0tMXKjoDyKFh9jclSBaph5lsoRE= 2021-11-06 09:03:52.352146 082ad2025f0a2f08d0ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c536c734d536948474678517746413371646133366234695235704a7932324b787747694c61435a443970513d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,SlsMSiHGFxQwFA3qda36b4iR5pJy22KxwGiLaCZD9pQ= 2021-11-06 09:03:52.356086 082ad202600a3008f10110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c7962514b6773754a31514b3038687a546933534b2f584e3863783644715241377a4251436c4d68596b55773d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,ybQKgsuJ1QK08hzTi3SK/XN8cx6DqRA7zBQClMhYkUw= 2021-11-06 09:04:12.932599 082ad202600a3008cfc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c6f356637674d776a314c344a4572464736396233536b646c4f32314571717735477379444f5465664646733d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,o5f7gMwj1L4JErFG69b3SkdlO21Eqqw5GsyDOTefFFs= 2021-11-06 09:04:13.853831 082ad2025f0a2f08d1ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c4d436a4f774c7a4f67553562676d386b71654f327954364874562b595838594e753354683467566e6863343d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,MCjOwLzOgU5bgm8kqeO2yT6HtV+YX8YNu3Th4gVnhc4= 2021-11-06 09:04:14.356548 082ad202590a2908fc2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c796d6559746d2b6934514a2b6b3859715a4c573571796a512f574a65514d514d326f4f47506e2f347843303d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,ymeYtm+i4QJ+k8YqZLW5qyjQ/WJeQMQM2oOGPn/4xC0= 2021-11-06 09:04:19.044042 082ad2025a0a2a089f0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c36384362727a656d316a71545061455662732f5a674d4932506136386c5939714d725475616e546950676b3d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,68Cbrzem1jqTPaEVbs/ZgMI2Pa68lY9qMrTuanTiPgk= 2021-11-06 09:04:26.874854 082ad2025e0a2e08b94010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c7a6b69326349705839325a6152496363455a666d3769346f6f417276314244776f6570496839574f7531383d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,zki2cIpX92ZaRIccEZfm7i4ooArv1BDwoepIh9WOu18= 2021-11-06 09:04:31.353223 082ad202620a320881c70210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507d582f122c646d5641784770537077766d7a4c6b794f55566341442f6a61614d487861376756744c4b4f373864354e4d3d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P}X/.,dmVAxGpSpwvmzLkyOUVcAD/jaaMHxa7gVtLKO78d5NM= 2021-11-06 09:04:31.584851 082ad2025e0a2e08b44010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c336a43385876502f4534616c78646d474b6a586e31453057745176794c527658664363557131794556536f3d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,3jC8XvP/E4alxdmGKjXn1E0WtQvyLRvXfCcUq1yEVSo= 2021-11-06 09:04:34.331134 082ad202600a3008d0c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c3259466535486b45706a6559702b5357356968522f7939392b4b65456150726a504a6e6452535a635536733d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,2YFe5HkEpjeYp+SW5ihR/y99+KeEaPrjPJndRSZcU6s= 2021-11-06 09:04:35.254981 082ad2025f0a2f08d2ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c72344953624e67524a495a54724d73677832634c2b784b50544b5a7871543255674d30306d314e6c42316f3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,r4ISbNgRJIZTrMsgx2cL+xKPTKZxqT2UgM00m1NlB1o= 2021-11-06 09:04:38.827506 082ad2025e0a2e08aed80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c634c667a623577447070375a62625a48483732556350324a5270467a6a48616b486e644c6c5045324a47493d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,cLfzb5wDpp7ZbbZHH72UcP2JRpFzjHakHndLlPE2JGI= 2021-11-06 09:04:46.211077 082ad202600a3008cfd80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5828122c785a346d63646e595359654f6b614f4e7762334f4c5057317633667642613346694e367679754f6f316a303d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X(.,xZ4mcdnYSYeOkaONwb3OLPW1v3fvBa3FiN6vyuOo1j0= 2021-11-06 09:04:47.441915 082ad202600a3008f20110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c384d3075463961384a3576364b6863454a3758536d5a625261556a443159304f2b4136686b6654394634733d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,8M0uF9a8J5v6KhcEJ7XSmZbRaUjD1Y0O+A6hkfT9F4s= 2021-11-06 09:04:56.652476 082ad2025f0a2f08d3ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c765048512f6b792b645039734c7a6f4f4e664b55737432326a4f537576784335555a432f2f7063657047593d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,vPHQ/ky+dP9sLzoONfKUst22jOSuvxC5UZC//pcepGY= 2021-11-06 09:04:56.857121 082ad202600a3008d1c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c312f4e6e44314759425a706568354d4f33374b6f494b4837332b4b714b2f446b4d3772692f7951456445493d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,1/NnD1GYBZpeh5MO37KoIKH73+KqK/DkM7ri/yQEdEI= 2021-11-06 09:05:09.749458 082ad202590a2908fd2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c6b2b5462504353366e492b4470516b714461796c717561784b75344f504669756661336263527842544e413d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,k+TbPCS6nI+DpQkqDaylquaxKu4OPFiufa3bcRxBTNA= 2021-11-06 09:05:18.768553 082ad2025f0a2f08d4ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c50625635562f763044556e6c384a384366734368323579486d445a73784a61396e535475674c314a505a553d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,PbV5V/v0DUnl8J8CfsCh25yHmDZsxJa9nSTugL1JPZU= 2021-11-06 09:05:19.111849 082ad202600a3008d2c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c5776457743715465384c30644d526a766379446d6861524f484d596945764a4b3831554d586953356542383d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,WvEwCqTe8L0dMRjvcyDmhaROHMYiEvJK81UMXiS5eB8= 2021-11-06 09:05:21.964492 082ad2025e0a2e08ba4010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c363349736d53386154626f2b2b6761706e694351427644766d75793254674d715745725255367351536e413d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,63IsmS8aTbo++gapniCQBvDvmuy2TgMqWErRU6sQSnA= 2021-11-06 09:05:26.541145 082ad202620a320882c70210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507d582f122c71307651704f6e73774d624155336a4b5872532f6470527631487377726d764974386f546e4a46307451673d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P}X/.,q0vQpOnswMbAU3jKXrS/dpRv1HswrmvIt8oTnJF0tQg= 2021-11-06 09:05:26.674157 082ad2025e0a2e08b54010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c6b3130685a365431495937584970374b58524634564144377951386c4472425676794841775875775933733d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,k10hZ6T1IY7XIp7KXRF4VAD7yQ8lDrBVvyHAwXuwY3s= 2021-11-06 09:05:29.435325 082ad2025a0a2a08a00510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c716a766b63436f3276466f716e49784233345a4f4b6264637649474c56427874496a4a694466596b4272413d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,qjvkcCo2vFoqnIxB34ZOKbdcvIGLVBxtIjJiDfYkBrA= 2021-11-06 09:05:34.017589 082ad2025e0a2e08afd80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c4857534a3330646b716d434a2b4b6c6f664157696a4f68705565795950514f45394b65516b4678423270303d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,HWSJ30dkqmCJ+KlofAWijOhpUeyYPQOE9KeQkFxB2p0= 2021-11-06 09:05:40.474412 082ad202600a3008d3c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509f015864122c655974367451693470505a2b36624c537766624c6752494451716d346d51716c446256596e4e5164652f733d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,eYt6tQi4pPZ+6bLSwfbLgRIDQqm4mQqlDbVYnNQde/s= 2021-11-06 09:05:40.922253 082ad2025f0a2f08d5ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c454b76503079667451696f316661494b585878476275377333674f45786168584137444e7775486e7835773d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,EKvP0yftQio1faIKXXxGbu7s3gOExahXA7DNwuHnx5w= 2021-11-06 09:05:41.297027 082ad202600a3008d0d80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5828122c3047784d523063694b7a366b30354b6649704d4e423867344d353164462f4b556b6949336e454d6c536a6f3d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X(.,0GxMR0ciKz6k05KfIpMNB8g4M51dF/KUkiI3nEMlSjo= 2021-11-06 09:05:42.527542 082ad202600a3008f30110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c5968633846744772495076704a4148656565327750587364485a65435831556f737836713746486a6d796b3d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,Yhc8FtGrIPvpJAHeee2wPXsdHZeCX1Uosx6q7FHjmyk= 2021-11-06 09:06:01.874799 082ad202600a3008d4c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509f015864122c2f514378566e52494a794c6a7468343265442b74416e61424f4c41504870366b7a743939746d4b6d4554453d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,/QCxVnRIJyLjth42eD+tAnaBOLAPHp6kzt99tmKmETE= 2021-11-06 09:06:05.039876 082ad202590a2908fe2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c643066536e397762666c3435624834666546714144426f4256744466516456703842386f616a4d334c33343d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,d0fSn9wbfl45bH4feFqADBoBVtDfQdVp8B8oajM3L34= 2021-11-06 09:06:06.003023 082ad2025f0a2f08d6ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c705a7348624353436a48672b364e66787a2f6c624b624b51416d384a43715367447a702b336e35587542383d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,pZsHbCSCjHg+6Nfxz/lbKbKQAm8JCqSgDzp+3n5XuB8= 2021-11-06 09:06:17.046709 082ad2025e0a2e08bb4010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507d5838122c6f7a524c4530452b55724f737970686d6e6971694a5878386c354d5a5857434b694b5572422f73433938413d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P}X8.,ozRLE0E+UrOsyphmniqiJXx8l5MZXWCKiKUrB/sC98A= 2021-11-06 09:06:21.757415 082ad2025e0a2e08b64010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c7a78434a464a55454d4179595367315735566c56466746683079772b63594f4b38687a646e6758427749413d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,zxCJFJUEMAyYSg1W5VlVFgFh0yw+cYOK8hzdngXBwIA= 2021-11-06 09:06:21.836122 082ad202620a320883c70210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507d582e122c474c6e7a33774c6f2b6e797a4256454d5252537768466f34497a6668384c34316e544e41583236714848343d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P}X..,GLnz3wLo+nyzBVEMRRSwhFo4Izfh8L41nTNAX26qHH4= 2021-11-06 09:06:23.786170 082ad202600a3008d5c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c346843644f79304147414c6c414a7a61443534436c5046617351704d633375507038654d356a492f5a63733d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,4hCdOy0AGALlAJzaD54ClPFasQpMc3uPp8eM5jI/Zcs= 2021-11-06 09:06:27.685555 082ad2025f0a2f08d7ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c61747462374a767058584c3733324b4b755650634770304474634c426b386f4f454a2b51466338554477383d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,attb7JvpXXL732KKuVPcGp0DtcLBk8oOEJ+QFc8UDw8= 2021-11-06 09:06:29.511453 082ad2025e0a2e08b0d80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c354156386e672f626945615a475753535761517350366e7a566c484b686a557251467279326b48487264453d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,5AV8ng/biEaZGWSSWaQsP6nzVlHKhjUrQFry2kHHrdE= 2021-11-06 09:06:36.384213 082ad202600a3008d1d80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5828122c344c35534d7250564c594c6e574130386a384d6d6663477476324b2f34435636376c455745374b47666b303d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X(.,4L5SMrPVLYLnWA08j8MmfcGtv2K/4CV67lEWE7KGfk0= 2021-11-06 09:06:37.613790 082ad202600a3008f40110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c6f4b2b71636c61616b4374376a30764264416c5a69575165786f6f6d395146315756686247637a614f584d3d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,oK+qclaakCt7j0vBdAlZiWQexoom9QF1WVhbGczaOXM= 2021-11-06 09:06:39.826400 082ad2025a0a2a08a10510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c6549425a3258584e634c5a58796f43535a304b625732503276345646376345686931397942524d3135356b3d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,eIBZ2XXNcLZXyoCSZ0KbW2P2v4VF7cEhi19yBRM155k= 2021-11-06 09:06:45.902491 082ad202600a3008d6c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c465434686263783574792b726753594e5376316e57396853374f4f2f327059767578426f58773172664b383d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,FT4hbcx5ty+rgSYNSv1nW9hS7OO/2pYvuxBoXw1rfK8= 2021-11-06 09:06:48.973872 082ad2025f0a2f08d8ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c653736785033756374443456457735687a706f637746717035367663546d5572774e364874336d784777733d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,e76xP3uctD4VEw5hzpocwFqp56vcTmUrwN6Ht3mxGws= ```Messages sent by sensors during link mode
``` 2021-11-06 09:12:50.148661 082bd202590a2908872f10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c627742346a6b71635870344a745a4d505449486d4c797231436766714f52533152614a744a50622f49446f3d .+..Y.)../....ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,bwB4jkqcXp4JtZMPTIHmLyr1CgfqORS1RaJtJPb/IDo= ```What are your thoughts, @garbled1?