AlertMe Hub - Yes, it's Linux

Extending the system, interesting uses and API twiddling.
filbert
Posts: 1
Joined: Fri Apr 13, 2012 6:57 pm

AlertMe Hub - Yes, it's Linux

Post by filbert » Fri Apr 13, 2012 7:08 pm

I've just got an AlertMe kit, and given there seems to be a problem with their website/control panel which is preventing me using the service, I thought I'd have a poke around the hardware side of things.

Turns out that the AlertMe Hub (at least the Nano that came with my Energy starter kit) runs Linux. There's a TTL serial connector on the board, which is nice and clearly marked. There's a similar port marked 'Modem' as well, presumably for the GSM modem in the Security Hub.

The pinout is fairly standard TTL, Pin 4 is GND, 2 is RX and 3 is TX. The port runs at 115200 baud.

If anyone has a guess at what the root password might be, or where to get the firmware blobs from, that'd be appreciated :)

Here, for your viewing pleasure, is the system from poweron to login prompt:

Code: Select all

„ˆHubBoot v1.01, processor ID 9231C384
Cold reset
HubOS v0.71 Copyright (C) AlertMe.com 2007-09
>
Bad reset count : 0
Loading system from NAND in 5 seconds
[OS] Mains power now on
Loading linux...
MD5 checksum passed
Operator key passed
Loading ramdisk...
MD5 checksum passed
Operator key passed
Starting linux...
Uncompressing Linux.............................................................................. done, booting the kernel.
Linux version 2.6.19 (jacky@jacky-desktop) (gcc version 3.4.6) #1 Wed Jan 19 11:11:14 GMT 2011
CPU: ARM920T [41129200] revision 0 (ARMv4T), cr=c0007177
Machine: AlertMe.com Hub CPU Board
tags address is: c001fee0
mdesc->boot_params is: 00000100
Parsing tags
tag core, flags = 00000000
tag mem32 - start: 00000000  size: 00800000
tag mem32 - start: 01000000  size: 00800000
tag mem32 - start: 04000000  size: 00800000
tag mem32 - start: 05000000  size: 00800000
Tag: initrd2 - start: 01000000 size 00200000
TAG commandline: console=ttyAM1,115200 root=/dev/mtdblock3 rootfstype=yaffs2,ext2
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 64, 32 byte lines, 8 sets
CPU0: D cache: 16384 bytes, associativity 64, 32 byte lines, 8 sets
Built 4 zonelists.  Total pages: 8128
Kernel command line: console=ttyAM1,115200 root=/dev/mtdblock3 rootfstype=yaffs2,ext2
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 8MB 8MB 8MB 8MB = 32MB total
Memory: 27908KB available (1936K code, 406K data, 104K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 2048K
NET: Registered protocol family 16
AlertMe hub PCB revision 5
ep93xx: PLL1 running at 400 MHz, PLL2 at 192 MHz
ep93xx: FCLK 200 MHz, HCLK 100 MHz, PCLK 50 MHz
AMEHUB: disabling spiflash enable

********************************************************
ep93xx_led software pwm driver startup
********************************************************

Setting modem fudge...********* REQUEST IRQ ****************
NET: Registered protocol family 2
IP route cache hash table entries: 256 (order: -2, 1024 bytes)
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 1024 bind 512)
TCP reno registered
EP93xx M2M driver version 0.01
Hub Upgrade driver version 1.0
ADC driver version 0.1
Generic SSP Support version 0.1
EP93xx DMA-SSP driver version 0.01
SPI Flash driver version 0.1
SPI Flash driver: Registered ssp slave interface
Ember EM260 Driver, Copyright (C) 2007 AlertMe.com
  Implementation by Mynah-Software Ltd.
EM260 driver startup ... em260 driver installed successfully.
EP93xx CPU frequency driver version 0.01
ep93xx software pwm driver starting
NetWinder Floating Point Emulator V0.97 (extended precision)
audit: initializing netlink socket (disabled)
audit(1.239:1): initialized
yaffs Jan 19 2011 11:10:18 Installing. 
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
ep93xx_wdt: EP93XX watchdog, driver version 0.3
SoftDog: cannot register miscdev on minor=130 (err=-16)
Serial: AMBA driver $Revision: 1.41 $
apb:uart1: ttyAM0 at MMIO 0x808c0000 (irq = 52) is a AMBA
apb:uart2: ttyAM1 at MMIO 0x808d0000 (irq = 54) is a AMBA
apb:uart3: ttyAM2 at MMIO 0x808e0000 (irq = 55) is a AMBA
Serial: AMBA PL011 UART driver
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
ep93xx-eth version 0.1 loading
eth0: ep93xx on-chip ethernet, IRQ 39, 00:1c:2b:01:9d:d8.
***** AME NANDFlash driver *****
** Prior to update, dev_cfg is: 08170d00
** Post update, dev_cfg is: 08170d00
Searching for NAND flash...
NAND device: Manufacturer ID: 0xec, Chip ID: 0x76 (Samsung NAND 64MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 23 at 0x0005c000
Bad eraseblock 1216 at 0x01300000
AMEFlash - Found 5 partitions
AMEFlash: Initializing partition 1
          Name: zImage
          size: 00200000
          offset: 00004000
AMEFlash: Initializing partition 2
          Name: ramdisk
          size: 00200000
          offset: 00204000
AMEFlash: Initializing partition 3
          Name: root
          size: 02000000
          offset: 00404000
AMEFlash: Initializing partition 4
          Name: download
          size: 01afc000
          offset: 02404000
AMEFlash: Initializing partition 5
          Name: persistent
          size: 00100000
          offset: 03f00000
Using static partition definition
Creating 6 MTD partitions on "NAND 64MiB 3,3V 8-bit":
0x00000000-0x04000000 : "whole-flash"
0x00004000-0x00204000 : "zImage"
0x00204000-0x00404000 : "ramdisk"
0x00404000-0x02404000 : "root"
0x02404000-0x03f00000 : "download"
0x03f00000-0x04000000 : "persistent"
ep93xx_i2c_probe started
***** EP93xx I2C Init ***** result is: 0
pca9533_attach_adapter, adapter is: c0538050 - result is: 0
Advanced Linux Sound Architecture Driver Version 1.0.13 (Tue Nov 28 14:07:24 2006 UTC).
ASoC version 0.13.3
wm8510: WM8510 Audio Codec 0.6
SETTING UP custom interface

asoc: WM8510 HiFi <-> ep93xx-i2s mapping ok
 Codec is: c054b2d0
ALSA device list:
  #0: amehub-wm8510 (WM8510)
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
RAMDISK: Compressed image found at block 0
yaffs: dev is 1048576 name is "ram0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 1.0, "ram0"
VFS: Mounted root (ext2 filesystem).

Simple initrd is active

Attempting to mount /dev/mtdblock3
yaffs: dev is 32505859 name is "mtdblock3"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.3, "mtdblock3"
yaffs: auto selecting yaffs1
block 960 is bad
Filesystem found on /dev/mtdblock3 - passing control...
save exit: isCheckpointed 0
Àyaffs: dev is 32505859 name is "mtdblock3"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.3, "mtdblock3"
yaffs: auto selecting yaffs1
block 960 is bad
VFS: Mounted root (yaffs2 filesystem).
Trying to move old root to /initrd ... okay
Freeing init memory: 104K
yaffs: dev is 32505860 name is "mtdblock4"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.4, "mtdblock4"
yaffs: auto selecting yaffs1
Setting up persistent filesystem
Attempting to mount /persistent
yaffs: dev is 32505861 name is "mtdblock5"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.5, "mtdblock5"
yaffs: auto selecting yaffs1
Initializing random number generator... done.
Creating dynamic devices
àStarting network...
udhcpc (v1.4.1) started
ep93xx-eth: PHY is a SMSC LAN8700, rev 4
REG_SELFCTL = 0x00006220  MII_BMCR = 0x00003000
Sending discover...
link down
Sending discover...
Sending discover...
No lease, forking to background
OK
àStarting alertme: In Em2xxUpgradePackage::create
em260_open called
inode minor is zero, assigning to builtin struct em260_user
Down semaphore
In crit section
Device opened, open_count is: 1
em260_open returning zero (success)
Em260 firmware version is 0x3422 - requiem260_release called
red version is 0  em260_release, open count is: 0
x3422.
Em260 fiem260_release, returning 0
rmware is up to date - skipping Em260 bootload procedure.
done






Welcome to AlertMe Linux.



uclibc login: 

User avatar
roobarb!
Site Admin
Posts: 193
Joined: Mon Nov 21, 2011 4:56 pm
Location: Manchester, UK
Contact:

Re: AlertMe Hub - Yes, it's Linux

Post by roobarb! » Fri Apr 13, 2012 11:17 pm

Fantastic! I've been waiting for someone to do this for ages. Resisted the temptation to sneak around in my own hub because it is actually sat there, behaving itself and being an alarm system. :)

Well done!
Alerty - control your AlertMe system with my third-party app for iPhone and iPod Touch. Available on iTunes!

bendy
Posts: 2
Joined: Thu Apr 19, 2012 8:29 am

Re: AlertMe Hub - Yes, it's Linux

Post by bendy » Thu Apr 19, 2012 8:35 am

looks like we might need to do this as alertme looks like history!

User avatar
roobarb!
Site Admin
Posts: 193
Joined: Mon Nov 21, 2011 4:56 pm
Location: Manchester, UK
Contact:

Re: AlertMe Hub - Yes, it's Linux

Post by roobarb! » Wed May 16, 2012 5:02 pm

As a comparison to the Nano Hub, I soldered some header pins to the debug holes on an AlertMe Hub (full version, although this output was recorded while disconnected from it's comms board). Using a TTL-232R-3V3, pin 4 is furthest from the DEBUG label and follows the same order: Pin 4 is GND (Black), 3 is TX (Orange) and 2 is RX (Yellow). Again, the port runs at 115200 baud.

Code: Select all

HubBoot v1.01, processor ID 921311CD
Cold reset
HubOS v0.71 Copyright (C) AlertMe.com 2007-09
>
 Bad reset count : 0
Loading system from NAND in 5 seconds
[OS] Mains power now on
Loading linux...
MD5 checksum passed
Operator key passed
Loading ramdisk...
MD5 checksum passed
Operator key passed
Starting linux...
Uncompressing Linux.............................................................................. done, booting the kernel.
Linux version 2.6.19 (ajh@ahughes-studioxps-6W2T7K1) (gcc version 3.4.6) #1 Tue May 31 17:59:44 BST 2011
CPU: ARM920T [41129200] revision 0 (ARMv4T), cr=c0007177
Machine: AlertMe.com Hub CPU Board
tags address is: c001fee0
mdesc->boot_params is: 00000100
Parsing tags
tag core, flags = 00000000
tag mem32 - start: 00000000  size: 00800000
tag mem32 - start: 01000000  size: 00800000
tag mem32 - start: 02000000  size: 00800000
tag mem32 - start: 03000000  size: 00800000
tag mem32 - start: 04000000  size: 00800000
tag mem32 - start: 05000000  size: 00800000
tag mem32 - start: 06000000  size: 00800000
tag mem32 - start: 07000000  size: 00800000
Tag: initrd2 - start: 01000000 size 00200000
TAG commandline: console=ttyAM1,115200 root=/dev/mtdblock3 rootfstype=yaffs2,ext2
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 64, 32 byte lines, 8 sets
CPU0: D cache: 16384 bytes, associativity 64, 32 byte lines, 8 sets
Built 8 zonelists.  Total pages: 16256
Kernel command line: console=ttyAM1,115200 root=/dev/mtdblock3 rootfstype=yaffs2,ext2
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 8MB 8MB 8MB 8MB 8MB 8MB 8MB 8MB = 64MB total
Memory: 60348KB available (1936K code, 406K data, 104K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 2048K
NET: Registered protocol family 16
AlertMe hub PCB revision 1
ep93xx: PLL1 running at 400 MHz, PLL2 at 192 MHz
ep93xx: FCLK 200 MHz, HCLK 100 MHz, PCLK 50 MHz
AMEHUB: disabling spiflash enable

********************************************************
ep93xx_led software pwm driver startup
********************************************************

Setting modem fudge...********* REQUEST IRQ ****************
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 2048 bind 1024)
TCP reno registered
EP93xx M2M driver version 0.01
Hub Upgrade driver version 1.0
ADC driver version 0.1
Generic SSP Support version 0.1
EP93xx DMA-SSP driver version 0.01
SPI Flash driver version 0.1
SPI Flash driver: Registered ssp slave interface
Ember EM260 Driver, Copyright (C) 2007 AlertMe.com
  Implementation by Mynah-Software Ltd.
EM260 driver startup ... em260 driver installed successfully.
EP93xx CPU frequency driver version 0.01
ep93xx software pwm driver starting
NetWinder Floating Point Emulator V0.97 (extended precision)
audit: initializing netlink socket (disabled)
audit(1.249:1): initialized
yaffs May 31 2011 17:58:24 Installing.
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
ep93xx_wdt: EP93XX watchdog, driver version 0.3
SoftDog: cannot register miscdev on minor=130 (err=-16)
Serial: AMBA driver $Revision: 1.41 $
apb:uart1: ttyAM0 at MMIO 0x808c0000 (irq = 52) is a AMBA
apb:uart2: ttyAM1 at MMIO 0x808d0000 (irq = 54) is a AMBA
apb:uart3: ttyAM2 at MMIO 0x808e0000 (irq = 55) is a AMBA
Serial: AMBA PL011 UART driver
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
ep93xx-eth version 0.1 loading
eth0: ep93xx on-chip ethernet, IRQ 39, 00:1c:2b:01:09:9d.
***** AME NANDFlash driver *****
** Prior to update, dev_cfg is: 08170d40
** Post update, dev_cfg is: 08170d40
Searching for NAND flash...
NAND device: Manufacturer ID: 0xec, Chip ID: 0x76 (Samsung NAND 64MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 59 at 0x000ec000
Bad eraseblock 3532 at 0x03730000
AMEFlash - Found 5 partitions
AMEFlash: Initializing partition 1
          Name: zImage
          size: 00200000
          offset: 00004000
AMEFlash: Initializing partition 2
          Name: ramdisk
          size: 00200000
          offset: 00204000
AMEFlash: Initializing partition 3
          Name: root
          size: 02000000
          offset: 00404000
AMEFlash: Initializing partition 4
          Name: download
          size: 01afc000
          offset: 02404000
AMEFlash: Initializing partition 5
          Name: persistent
          size: 00100000
          offset: 03f00000
Using static partition definition
Creating 6 MTD partitions on "NAND 64MiB 3,3V 8-bit":
0x00000000-0x04000000 : "whole-flash"
0x00004000-0x00204000 : "zImage"
0x00204000-0x00404000 : "ramdisk"
0x00404000-0x02404000 : "root"
0x02404000-0x03f00000 : "download"
0x03f00000-0x04000000 : "persistent"
ep93xx_i2c_probe started
***** EP93xx I2C Init ***** result is: 0
pca9533_attach_adapter, adapter is: c02a844c - result is: 0
i2c_adapter i2c-0: sendbytes: error - bailout.
Advanced Linux Sound Architecture Driver Version 1.0.13 (Tue Nov 28 14:07:24 2006 UTC).
ASoC version 0.13.3
wm8510: WM8510 Audio Codec 0.6
SETTING UP custom interface

asoc: WM8510 HiFi <-> ep93xx-i2s mapping ok
 Codec is: c05782d0
ALSA device list:
  #0: amehub-wm8510 (WM8510)
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
RAMDISK: Compressed image found at block 0
yaffs: dev is 1048576 name is "ram0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 1.0, "ram0"
VFS: Mounted root (ext2 filesystem).

Simple initrd is active

Attempting to mount /dev/mtdblock3
yaffs: dev is 32505859 name is "mtdblock3"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.3, "mtdblock3"
yaffs: auto selecting yaffs1
Filesystem found on /dev/mtdblock3 - passing control...
save exit: isCheckpointed 0
¿yaffs: dev is 32505859 name is "mtdblock3"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.3, "mtdblock3"
yaffs: auto selecting yaffs1
VFS: Mounted root (yaffs2 filesystem).
Trying to move old root to /initrd ... okay
Freeing init memory: 104K
yaffs: dev is 32505860 name is "mtdblock4"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.4, "mtdblock4"
yaffs: auto selecting yaffs1
block 1228 is bad
Setting up persistent filesystem
Attempting to mount /persistent
yaffs: dev is 32505861 name is "mtdblock5"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.5, "mtdblock5"
yaffs: auto selecting yaffs1
Initializing random number generator... done.
Creating dynamic devices
¿Starting network...
Start connectd...
OK
¿Starting alertme: In Em2xxUpgradePackage::create
em260_open called
inode minor is zero, assigning to builtin struct em260_user
Down semaphore
In crit section
Device opened, open_count is: 1
em260_open returning zero (success)
ep93xx-eth: PHY is a SMSC LAN8700, rev 3
REG_SELFCTL = 0x00006220  MII_BMCR = 0x00003000
Em260 firmware version is 0x3422 - requiem260_release called
red version is 0  em260_release, open count is: 0
x3422.
Em260 fiem260_release, returning 0
rmware is up to date - skipping Em260 bootload procedure.
done
link down



Welcome to AlertMe Linux.

uclibc login:
At first glance, one thing that is different is that there's twice as much memory in the full Hub - 64MB as opposed to 32MB in the Nano. I was also really impressed with the design of the Hub itself; the main board sits on one side, the comms board on the other, linked with a small ribbon cable. The battery backup is a set of Varta VH4000 cells made into a battery, which sits in a carrier in the centre of the Hub. Very neat - I also took some pics, which I'll try to upload somewhere.
Alerty - control your AlertMe system with my third-party app for iPhone and iPod Touch. Available on iTunes!

robwalker
Posts: 3
Joined: Sat Jul 14, 2012 9:18 am

Re: AlertMe Hub - Yes, it's Linux

Post by robwalker » Sun Jul 22, 2012 2:57 pm

My first thought is that AlertMe are very likely breaking the law if they're not making the source code available...

phil4
Posts: 34
Joined: Fri Nov 25, 2011 11:27 pm
Location: Oxfordshire
Contact:

Re: AlertMe Hub - Yes, it's Linux

Post by phil4 » Sun Jul 22, 2012 9:48 pm

I'd guess that depends on whether a) they've made any changes and b) whether what they changed was GPL'd in the first place, and finally c) they've been asked, and refused.

I'm unsure if all those criteria have been met yet.

User avatar
roobarb!
Site Admin
Posts: 193
Joined: Mon Nov 21, 2011 4:56 pm
Location: Manchester, UK
Contact:

Re: AlertMe Hub - Yes, it's Linux

Post by roobarb! » Mon Jul 23, 2012 10:37 am

Very true. If you change the GPL'd stuff, you have to make those changes available. But you can run your own copyright code on Linux and there is no requirement to make the source for that available.
Alerty - control your AlertMe system with my third-party app for iPhone and iPod Touch. Available on iTunes!

habile2
Posts: 6
Joined: Mon Aug 20, 2012 4:38 pm

Re: AlertMe Hub - Yes, it's Linux

Post by habile2 » Mon Aug 20, 2012 4:43 pm

robwalker wrote:My first thought is that AlertMe are very likely breaking the law if they're not making the source code available...
They will (or used to) make the GPLd source available. You had to e-mail a specific address which I can't recall and they sent the source to you. I have to say there wasn't anything of any interest because as they only have to supply the GPL stuff all you see in the code they have customised around Python etc.

C.

wpiman
Posts: 9
Joined: Mon Sep 10, 2012 5:59 pm

Re: AlertMe Hub - Yes, it's Linux

Post by wpiman » Mon Oct 08, 2012 10:08 pm

Did you try the usual suspects?

root with no password
root with password password
root with password root

User avatar
roobarb!
Site Admin
Posts: 193
Joined: Mon Nov 21, 2011 4:56 pm
Location: Manchester, UK
Contact:

Re: AlertMe Hub - Yes, it's Linux

Post by roobarb! » Wed Oct 10, 2012 7:29 am

wpiman wrote:Did you try the usual suspects?

root with no password
root with password password
root with password root
For a security system, I'd have been disappointed if it were that simple! ;)
Alerty - control your AlertMe system with my third-party app for iPhone and iPod Touch. Available on iTunes!

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests