Paradox alarm with IP150 interface integration

Plugins & Plugin Development General Plugin Discussion
#39

the iprs7?

I use babyware to figuring the ip150. There’s Reporting button on the main screen (or View, Reporting) then you set the GRRS/IP for receiver 1 to the IP address of the receiver (didn’t have to change the ports). Then Set an ip password (this has to be set up in iprs7 as well) .

That’s seemed to get them talking to me. But what I couldn’t figure out was the “what” events to send to the receiver. I wanted all arm/disarm and troubles. It seemed by default to just post troubles.

#40

Hi all
I registered here just so i could assit you all. I have the link to the paradox SDK/API
If anyone is interested and can assist in creating something usefull for home auto then i will share the link with them

#41

[quote=“ladanyiszabolcs, post:34, topic:187692”]Hi!

I unzipped the iParadox app and I found a “dynamically linked library” named libpdxaes128ecb.so.
I think every network packet (whitch rtaxerxes captured) is encrypted by AES128ECB.
It is hard to decrypt it…[/quote]

It seems that the 16 byte headers are never scrambled. The padding byte is 0xee. Most likely, the data after the header is scrambled with AES scrambling algorithm (128 bit blocks scrambled with a 256 bit pre shared key, ECB mode). If they were tricky then they slightly altered the method how the round keys are generated and perhaps the padding byte too. It is also likely that the first message sent to the IP150 module is an authentication message that contains the module password and this message scrambled with the module password. Perhaps the answer contains a session key. The subsequent packets are scrambled with this session key.

#42

I played a little bit. I modified the two variable (PIN, IP module’s password) and recorded the communication.
‘S1’ means the first message sent by the app to the IP module.

  • The size of the S1 is 32 byte.
  • The first 16bytes are always the same
  • The second 16bytes are pending from the IP module’s password
  • The second 16bytes are independent from the PIN code (user)
  • 11-16 bytes are always 0xee

Details:
The first 16bytes:
0000 aa 07 00 03 51 f0 00 0e 00 01 ee ee ee ee ee ee …Q…
The second 16bytes: (1. column : IP module password; 2. column : PIN)

paradox 9901 3a 62 e8 12 79 09 db 98 0f 51 85 0a ce 57 86 83 :b…y…Q…W…
paradox 9902 3a 62 e8 12 79 09 db 98 0f 51 85 0a ce 57 86 83 :b…y…Q…W…
paradox 9903 3a 62 e8 12 79 09 db 98 0f 51 85 0a ce 57 86 83 :b…y…Q…W…
paradox 9904 3a 62 e8 12 79 09 db 98 0f 51 85 0a ce 57 86 83 :b…y…Q…W…
paradox 9905 3a 62 e8 12 79 09 db 98 0f 51 85 0a ce 57 86 83 :b…y…Q…W…
xodarap 9901 60 8c e6 e5 d5 e5 b0 68 10 cd 93 19 93 0e c7 99 ......h........ xodarap 9902 60 8c e6 e5 d5 e5 b0 68 10 cd 93 19 93 0e c7 99 …h…
xodarap 9903 60 8c e6 e5 d5 e5 b0 68 10 cd 93 19 93 0e c7 99 ......h........ xodarap 9904 60 8c e6 e5 d5 e5 b0 68 10 cd 93 19 93 0e c7 99 …h…
xodarap 9905 60 8c e6 e5 d5 e5 b0 68 10 cd 93 19 93 0e c7 99 ......h........ 0000000 9901 1b 29 59 c4 a1 e5 4f 2a e6 33 63 51 f3 40 61 af .)Y...O*.3cQ.@a. 1111111 9901 6a 94 ce d3 3f 4e 87 24 a4 58 77 63 99 07 f2 a2 j...?N.$.Xwc.... 2222222 9901 d1 87 05 29 27 2f 90 bb 2e d4 7b 3d 5d 82 53 0a ...)'/....{=].S. 3333333 9901 26 0c 51 0d 18 58 ae d8 89 f4 86 e1 59 7e e6 d3 &.Q..X......Y~.. 4444444 9901 a3 33 3b 1b e2 b3 cc cd c2 d3 ef 56 f2 9b 15 1e .3;........V.... 5555555 9901 19 4c 19 67 46 bb f7 10 2a cb 7e 47 2c fe 96 2a .L.gF...*.~G,..* 6666666 9901 a5 06 7a ab 57 7e f2 27 b0 88 be 9c d0 9f 0b c2 ..z.W~.'........ 7777777 9901 10 cd aa 4f dc 15 5c c9 59 bc 8b 4d fa e2 dd 60 ...O..\.Y..M...
8888888 9901 9d cc f8 2d 39 7d 46 70 08 f8 2f 51 cb 9d 14 58 …-9}Fp…/Q…X
9999999 9901 74 10 e3 37 2c 68 cc 26 28 f7 6a 90 f9 fa a2 86 t…7,h.&(.j…

#43

Hi!
AES produces totally different encrypted data by changing even a bit in the key or in the data block to be encrypted. It is hard to find the decryption method by inspecting the encrypted data produced with different keys. In my opinion, a much better approach is trying to find the decryption algorithm by altering the original Rijndael (AES) algorithm.

#44

Hi everyone

Any update on the development of the plugin for Vera and Paradox IP150 ? I have just purchased my IP150 and tring to configure it. But i’m waiting for the pluging before buying my Veraplus controler. Did someone ask Paradox for the API ?

Thanks to keep eveyone updated.

Martin
Quebec, Canada

#45

There we two folks on this thread who mentioned that they may have access to the SDK. Can anyone share it please? I’m desperately trying to write t the PRT3 module but it’s so limited and full of inconsistencies I’d far prefer to use IP via an official SDK.

#46

@rtaxerxes / @emc2

and anyone else interested. I have attached rtaxerxes’s pcap file stream as a hex dump. Blocks aligned to the left are transmits to the alarm. Indented blocks are alarm replies.

All blocks start with a line that is not encoded, beginning with aa hex and padded out to 16 bytes with ee hex. All other lines are encoded.

@rtaxerxes - I think your password is six characters long?

#47

@ladanyiszabolcs

I get the same results as you. The following comments are for a EVO192 panel:

The encrypted IP150 password is contained in the first message sent to the panel, as part of bytes 10h to 1fh and is not influenced/complicated by the following values:

  1. the IP150 MAC address
  2. the IP150 IP address
  3. the WinLoad / BabyWare options set up in the actual panel ie: “Panel ID” (default: 0000) or the “PC password” (default: 0000)
  4. Babyware allow the user to select different encryption strengths. Changing these does not influence/complicate this first message.

The second message sent to the panel almost certainly contains an encoded session key as part of bytes 10h to 1fh. Every time a login is performed, they change.

In this code, at line 238, one of the bytes in the initial command is set to 08h, instead of the normal 09h. Allowing the use of plain text for the first command.

I tried this in a quick Lua hack and I could send the IP150 password as plain text and get a logged in response from the IP150. It appears the response contains a session key in bytes 11h to 20h but how to use it? The key is 8 bytes long hex, eg “580D0E70E01E3B2”, just like the session key hidden in the html code, as used by the web page access method.

So for encrypted results, two things need to happen:

  1. the session key needs to be extracted/decoded - probably encrypted using the IP150 password “somehow”.
  2. then the session key need to be applied to all the data “somehow”.
#48

@tracstarr

The second is a slightly custom rc4 hash of the panel code.

I see that RC4 routine here on line 51:

Do you know of any rc4 online encoders that implement this? All the ones I tried failed to give the correct result. What’s “slightly custom” about it? It might be applicable to the decoding of the session key as discussed above.

EDIT: further investigation indicates it is indeed a custom version and generates nothing like the outputs of the RC4 online tools.

#49

Hi everyone.

I have found a tread on the Smarttings Forum : Paradox Alarms via IP module - Devices & Integrations - SmartThings Community
They seems to have find a way to connect to the IP150. They have put the code here : GitHub - tracstarr/ParadoxAlarmControl: Paradox Alarm Control via IP150 module

ALSO FUND DIRECTLY ON PARADOX WEBSITE :

CMSI - SDK
The CMSI SDK (Central Monitoring Station Integration Software Development Kit) enables central monitoring stations to monitor
and control registered Paradox accounts from third party applications like automation software. The CMSI SDK gives the CMS
the complete functionality of the IPRS-7 control over panels from within their automation software. The central monitoring software
uses the IPRS-7 emulator as a bridge to perform actions directly with the connected account.
Use of the CMSI SDK is reliant upon the central monitoring station integrating the IPRS-7 emulator.
For more information and to request the CMSI SDK, please contact distributorsupport@paradox.com.

Let me know if it help some how.

Keep us update !

#50

May need to start a new thread here somewhere. There are at least five methods of connecting to these panels:

  1. interfacing to the panel 4 wire “combus” like this:

    Interfacing with Paradox home security system – Martin's corner on the web

  2. direct connection to the serial interface eg:

    https://harizanov.com/2014/07/interfacing-with-paradox-home-security-system-attempt-2/

  3. interfacing with the serial interface using an APR3-PRT3 (as per Guest’s Vera plugin)

    Paradox Alarm Plugin

    http://goo.gl/9GAeGh

  4. via an IP150 and the web interface it provides at http://Paradox_IP150_IP_address/login_page.html

    PGMs are not controllable using this method, excepting the two IP150 PGMs.

    ParadoxIP150/IP150-MQTT.py at master · Tertiush/ParadoxIP150 · GitHub

    GitHub - tracstarr/ParadoxAlarmControl: Paradox Alarm Control via IP150 module

  5. using a socket connection on port 10000 to access the IP150, as used by the Paradox programs “Babyware” and “Winload”

    ParadoxIP150v2/IP150-MQTTv2.py at master · Tertiush/ParadoxIP150v2 · GitHub

My previous comments have been referring to method 5.

Paradox IP150 web page scraper plugin
#51

Maybe someone can point me in the right direction here. I am EXTREMELY interested in being able to integrate Paradox in to my own Vera set up. However where I am different, is I work for a national Paradox distributor and have access to virtually all equipment and their Tech department.

I can see that the EVO board can be connected to via the [url=http://code.mios.com/trac/mios_paradox-alarm]http://code.mios.com/trac/mios_paradox-alarm[/url] in option 3 above.

Where can i find more info on what is supported, and how?

Ideally I would like to find a way to control the MG-5050 board via an IP150 as per your option 4 above.

#52

Re: option 3) - check with @Guessed

http://forum.micasaverde.com/index.php/topic,2492.msg282628.html#msg282628

Re: option 4) - scraping a web page gives a very fragile result. The Paradox page implementation is also pretty crude, but I’m working on a very simple plugin. I hope to have variables for each zone and to be able to arm/disarm the alarm. That’s about it. Other than that I would have to think about it. This may all take awhile, as I have other stuff on.

A few issues:
a) you have to poll a complete web page, which tends to make the response time somewhat sluggish. Especially when one considers the IP150 is talking to the alarm systems using a low speed serial connection.
b) any passwords or keypad codes may have to be coded in; making them quite vulnerable plus they probably end up on the mios servers. I’ll work on that one.
c) I’m not inclined to have child devices. Having to mess around with 192 of them eg the Paradox EVO, seems like too much work.
d) I’m wondering if Vera is up to the job.

Re: option 5) the IP150 password encoding in the first command needs to be determined

#53

Hi everyone

I have found someone on a forum who realy know the way to communicate with the Paradox Alarm thrue the IP150. I knows everything we need. He develop a apps on androids. https://play.google.com/store/apps/details?id=com.rashoft.alarmin

Thanks again everyone. Like a said before. I’m waiting for someone to develop a plugin to order my VeraPlus.

#54

@aunpixel I’m interested in the EVO192 and have applied this method to it:

It will not work for the EVO192, while it apparently works for the MG-5050. It would be useful to know what lines 265 to 331 do but they are uncommented.

#55

Alright, I’ve picked up a Paradox MG5050 and IP150 module…so what would you like to know?

On another note, Paradox have provided me some extremely useful documentation for integrating an Evo with the PRT3 module.

CBUS%20-%20Programming%20Guide.pdf
PRT3%20-%20Installation%20Guide%20V1.20.pdf
ASCII%20-%20Programming%20Guide.pdf

#56

[quote=“a-lurker, post:54, topic:187692”]@aunpixel I’m interested in the EVO192 and have applied this method to it:

It will not work for the EVO192, while it apparently works for the MG-5050. It would be useful to know what lines 265 to 331 do but they are uncommented.[/quote]

I’ve just found the information. I’m not a developer. Me i have a Paradox SP6000 and the IP150 module. You have to ask the programer for the information.

#57

Experimental Paradox IP150 web page scraper:

http://forum.micasaverde.com/index.php/topic,38854.0.html

#58

same problem here, unable to see anything under alarm info