Page 3 of 5

Re: Visonic Powerlink2 Hacked

PostPosted: Tue Mar 08, 2011 5:50 pm
by Bwired
olof wrote:Perhaps a difficult question to answer, but is it safe to assume that all this great Powerlink2 hack info is also relevant for the Powermax 'Complete' version?

I'm about to purchase an Complete (from UK supplier) w/ Powerlink2. As the Powerlink2 is officially designed for Visonic's Complete and Express versions
The chance that this is working is great because it are both new devices with the latest firmware. But you would do better if you check it with the supplier. If its Bob form the securityshop he can check it for you.I was about to order the Complete also but forgot it did not support X10. I only use X10 in the Powermax for reporting the status of the panel, now the powerlink2 is open I dont need it anymore.

Re: Visonic Powerlink2 Hacked

PostPosted: Tue Mar 08, 2011 5:54 pm
by Bwired
Digit wrote:Check your spelling, Pieter :lol:

I was about to spell it like you thought, but few would understand us LOL

Re: Visonic Powerlink2 Hacked

PostPosted: Wed Mar 09, 2011 9:58 am
by olof
Bwired,

Thanks for the info. I'm indeed buying it from Bob in the UK, and he confirms it should work with Powermax Complete version. I don't have any X10 products (and not planning to), so the Complete seems to be the one for me.

On a side note, Bob is pretty impressed with your work on the Powerlink2 stuff. And given the number of enquiries from NL (primarily based on your info on this forum), he half-jokingly is considering opening op shop over here.

Thanks again
Olof

Re: Visonic Powerlink2 Hacked

PostPosted: Thu Mar 17, 2011 5:14 pm
by Bwired
Ok I have the Visonic versions now:

Powermax Pro: 5.2.67
Powerlink2 : 6.1.11

Re: Visonic Powerlink2 Hacked

PostPosted: Thu Mar 17, 2011 5:38 pm
by Bwired
I did some more investigation on the Visonic Powerlink2
Its also very easy to request a nice XML regarding the status of the Powermax
State of the Panel (armed home, armed away or ready) and also the state of the sensors and if an alarm has been raised etc.

http://xx.xx.xx.200/web/ajax/alarm.chkstatus.ajax.php and this will return

System ready and 1 doorsensor Open
Code: Select all
<?xml version="1.0" standalone="yes" ?>
- <reply>
  <index>18</index>
- <cameras>
  <name>CAMERAS</name>
  <picture_name>cam</picture_name>
  <picture_path>/tmp/cams/</picture_path>
  </cameras>
- <configuration>
- <sensors>
  <name>Sensor</name>
  <index>1</index>
  <type>Delay 1</type>
  <location>Front Door</location>
  </sensors>
- <sensors>
  <name>Sensor</name>
  <index>2</index>
  <type>Perimeter-Follow</type>
  <location>Hall</location>
  </sensors>
- <system>
  <name>Control Panel</name>
  <disarm />
  <status>Ready</status>
  <arm>0</arm>
  <latchkey_enable>Latchkey Enable</latchkey_enable>
  <ip_mode>dynamic</ip_mode>
  <ip>x.x.x.200</ip>
  <subnet>255.255.255.0</subnet>
  <gateway>x.x.x.2</gateway>
  <dns1>192.168.0.1</dns1>
  </system>
  </configuration>
  <alerts />
  <alarms />
  <qvFullPath>/cams/sess_0e5569f301c9b5971d43891f32f56a3a/cam</qvFullPath>
- <detectors>
- <detector>
  <zone>1</zone>
  <loc>Front Door</loc>
  <type>Delay 1</type>
  <status />
  <isalarm>no</isalarm>
  </detector>
- <detector>
  <zone>2</zone>
  <loc>Hall</loc>
  <type>Perimeter-Follow</type>
  <status>Open</status>
  <isalarm>no</isalarm>
  </detector>
  </detectors>
  </reply>


System Armed Away and doorsensor Normal
Code: Select all
<?xml version="1.0" standalone="yes" ?>
- <reply>
  <index>22</index>
- <cameras>
  <name>CAMERAS</name>
  <picture_name>cam</picture_name>
  <picture_path>/tmp/cams/</picture_path>
  </cameras>
- <configuration>
- <sensors>
  <name>Sensor</name>
  <index>1</index>
  <type>Delay 1</type>
  <location>Front Door</location>
  </sensors>
- <sensors>
  <name>Sensor</name>
  <index>2</index>
  <type>Perimeter-Follow</type>
  <location>Hall</location>
  </sensors>
- <system>
  <name>Control Panel</name>
  <away />
  <status>AWAY</status>
  <arm>1</arm>
  <latchkey_enable>Latchkey Enable</latchkey_enable>
  <ip_mode>dynamic</ip_mode>
  <ip>x.x.x.200</ip>
  <subnet>255.255.255.0</subnet>
  <gateway>x.x.x.2</gateway>
  <dns1>192.168.0.1</dns1>
  </system>
  </configuration>
  <alerts />
  <alarms />
  <qvFullPath>/cams/sess_0e5569f301c9b5971d43891f32f56a3a/cam</qvFullPath>
- <detectors>
- <detector>
  <zone>1</zone>
  <loc>Front Door</loc>
  <type>Delay 1</type>
  <status />
  <isalarm>no</isalarm>
  </detector>
- <detector>
  <zone>2</zone>
  <loc>Hall</loc>
  <type>Perimeter-Follow</type>
  <status />
  <isalarm>no</isalarm>
  </detector>
  </detectors>
  </reply>

Re: Visonic Powerlink2 Hacked

PostPosted: Fri Mar 18, 2011 5:30 pm
by Bwired
Update: I found out that now a connection via port 443 Https is possible with the Powerlink Pro.
I think Visonic updated the certificates :D

Re: Visonic Powerlink2 Hacked

PostPosted: Sat Mar 19, 2011 6:58 pm
by Bwired
update on statuscheck and sending Commands to the Visonic powerlink2

If you run this check:
http://x.x.x.200/web/ajax/alarm.chkstatus.ajax.php
It will return a full XML with complete status and settings.
If you have a large Visonics setting with lots of sensors the XML can be extensive and most of the time the XML is the same as the previous.
Thats why there is a index tag in the XML where you can check on. In the below XML the <INDEX> = 84

Code: Select all
<?xml version="1.0" standalone="yes"?>
<reply>
  <index>84</index>
  <cameras>
    <name>CAMERAS</name>
    <picture_name>cam</picture_name>
    <picture_path>/tmp/cams/</picture_path>
  </cameras>
  <configuration>
    <sensors>
      <name>Sensor</name>
      <index>1</index>
      <type>Delay 1</type>
      <location>Front Door</location>
    </sensors>
    <sensors>
      <name>Sensor</name>
      <index>2</index>
      <type>Perimeter-Follow</type>
      <location>Hall</location>
    </sensors>
    <system>
      <name>Control Panel</name>
      <disarm/>
      <status>Ready</status>
      <arm>0</arm>
      <latchkey_enable>Latchkey Enable</latchkey_enable>
      <ip_mode>dynamic</ip_mode>
      <ip>10.0.0.200</ip>
      <subnet>255.255.255.0</subnet>
      <gateway>10.0.0.2</gateway>
      <dns1>192.168.0.1</dns1>
    </system>
  </configuration>
  <alerts>
  </alerts>
  <alarms>
  </alarms>
<qvFullPath>/cams/sess_02e5d32285d5dea65a1960d18c82fd49/cam</qvFullPath><detectors>
    <detector>
        <zone>1</zone>
        <loc>Front Door</loc>
        <type>Delay 1</type>
        <status></status>
        <isalarm>no</isalarm>
    </detector>
    <detector>
        <zone>2</zone>
        <loc>Hall</loc>
        <type>Perimeter-Follow</type>
        <status></status>
        <isalarm>no</isalarm>
    </detector>
</detectors>

</reply>


All you need to do is sent the latest INDEX number with your request and you receive this when there are no changes
Code: Select all
http://x.x.x.200/web/ajax/alarm.chkstatus.ajax.php?curindex=84

Answer:
<?xml version="1.0" standalone="yes"?><reply><customStatus>[NOCNG]</customStatus></reply>

If there are changes you only recieve the Arms Status and the sensors settings, so not the complete XML. You only receive the complete XML if you dont use the curindex=xx option

Sample code for the request:
Code: Select all
objXML.Open "POST", "http://x.x.x..200/web/ajax/alarm.chkstatus.ajax.php", True
objXML.setRequestHeader "cache -Control", "no -cache"
objXML.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
sdataTosend = "curindex=84"
objXML.send sdataTosend


And with this command you can easily Arm, Armhome and Disarm the visonic panel
Code: Select all
*Login
sdataTosend = "user=admin&pass=admin"
objXML.Open "POST", "http://x.x.x.200/web/ajax/login.login.ajax.php", True
*Send Commands
objXML.Open "POST", "http://x.x.x.200/web/ajax/security.main.status.ajax.php", True
objXML.setRequestHeader "cache -Control", "no -cache"
objXML.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
sdataTosend = "set=Disarm"  (options here are :Disarm, ArmHome, ArmAway)
objXML.send sdataTosend


For Homeseer users, this can be done easy with a script!

See also http://www.bwired.nl/weblog.asp?id=418
See Roberts vlog for the Mobile Javascript variant blog.hekkers.net/2011/03/04/more-powerl ... nk2-stuff/

Re: Visonic Powerlink2 Hacked

PostPosted: Fri Jun 17, 2011 10:56 am
by Bjochems
I'm planning to buy a Powermax Pro with the intention to connect it to a Powerlink as described in this topic.

With some discount I can buy a new Powermax Pro which is running on firmware version v4.4.20

Will this firmware work with the Powerlink module?
And is it possible to do a firmware upgrade of the Powermax Pro to the latest firmware?

Re: Visonic Powerlink2 Hacked

PostPosted: Fri Jun 17, 2011 12:45 pm
by TANE
This will not work.
You will need the firmware version >5.2
Hardware version > 6.0

This is in the powermaxpro version not available on the Dutch market.

Re: Visonic Powerlink2 Hacked

PostPosted: Mon Jun 20, 2011 8:51 am
by Bjochems
Ok, thx

Re: Visonic Powerlink2 Hacked

PostPosted: Mon Jun 20, 2011 6:57 pm
by Bwired
Agree
I'm one of the few who got it working, did not do anything special though.
There is a very big possibilty even a new set wont work together with the powerlink2
Bad job again for Visonic!

Re: Visonic Powerlink2 Hacked

PostPosted: Mon Jun 20, 2011 9:25 pm
by TANE
There is another Powerlink that will work for sure it's called PowerlinkPro.
this is a discontinued product

Not sure about the possibilities and hack options

Re: Visonic Powerlink2 Hacked

PostPosted: Mon Jun 20, 2011 10:07 pm
by Rene
Does anybody know where I can buy a Powermax Pro with Powerlink2 module already build in? I want to replace my current Powermax Pro but keep the GSM and PC/RS232 modules currently build in.

Re: Visonic Powerlink2 Hacked

PostPosted: Mon Jun 20, 2011 10:33 pm
by mhn
I just bought a Powermax Pro. Under serial number it says V 5.3.72. But is it software or hardware version?

Where do you find the version numbers?

Regards
Morten

Re: Visonic Powerlink2 Hacked

PostPosted: Mon Jun 20, 2011 10:53 pm
by TANE
Hi Morten,

I think the software version is correct..if this is the software version. I did not found any software version under the serial number on the dutch PowermaxPro.
This can be different in other countries. Since there are lot of different dist.

You can find the software version somewhere in the menu.

Hardware version is a bit difficult to trace.