Visonic Powerlink2 Hacked

[Bwired]

Perhaps a difficult question to answer, but is it safe to assume that all this great Powerlink2 hack info is also relevant for the Powermax 'Complete' version?

I'm about to purchase an Complete (from UK supplier) w/ Powerlink2. As the Powerlink2 is officially designed for Visonic's Complete and Express versions

The chance that this is working is great because it are both new devices with the latest firmware. But you would do better if you check it with the supplier. If its Bob form the securityshop he can check it for you.I was about to order the Complete also but forgot it did not support X10. I only use X10 in the Powermax for reporting the status of the panel, now the powerlink2 is open I dont need it anymore.

[Bwired]

Check your spelling, Pieter

I was about to spell it like you thought, but few would understand us LOL

[olof]

Bwired,

Thanks for the info. I'm indeed buying it from Bob in the UK, and he confirms it should work with Powermax Complete version. I don't have any X10 products (and not planning to), so the Complete seems to be the one for me.

On a side note, Bob is pretty impressed with your work on the Powerlink2 stuff. And given the number of enquiries from NL (primarily based on your info on this forum), he half-jokingly is considering opening op shop over here.

Thanks again
Olof

[Bwired]

Ok I have the Visonic versions now:

Powermax Pro: 5.2.67
Powerlink2 : 6.1.11

[Bwired]

I did some more investigation on the Visonic Powerlink2
Its also very easy to request a nice XML regarding the status of the Powermax
State of the Panel (armed home, armed away or ready) and also the state of the sensors and if an alarm has been raised etc.

http://xx.xx.xx.200/web/ajax/alarm.chkstatus.ajax.php and this will return

System ready and 1 doorsensor Open

Code: Select all

<?xml version="1.0" standalone="yes" ?> 
- <reply>
  <index>18</index> 
- <cameras>
  <name>CAMERAS</name> 
  <picture_name>cam</picture_name> 
  <picture_path>/tmp/cams/</picture_path> 
  </cameras>
- <configuration>
- <sensors>
  <name>Sensor</name> 
  <index>1</index> 
  <type>Delay 1</type> 
  <location>Front Door</location> 
  </sensors>
- <sensors>
  <name>Sensor</name> 
  <index>2</index> 
  <type>Perimeter-Follow</type> 
  <location>Hall</location> 
  </sensors>
- <system>
  <name>Control Panel</name> 
  <disarm /> 
  <status>Ready</status> 
  <arm>0</arm> 
  <latchkey_enable>Latchkey Enable</latchkey_enable> 
  <ip_mode>dynamic</ip_mode> 
  <ip>x.x.x.200</ip> 
  <subnet>255.255.255.0</subnet> 
  <gateway>x.x.x.2</gateway> 
  <dns1>192.168.0.1</dns1> 
  </system>
  </configuration>
  <alerts /> 
  <alarms /> 
  <qvFullPath>/cams/sess_0e5569f301c9b5971d43891f32f56a3a/cam</qvFullPath> 
- <detectors>
- <detector>
  <zone>1</zone> 
  <loc>Front Door</loc> 
  <type>Delay 1</type> 
  <status /> 
  <isalarm>no</isalarm> 
  </detector>
- <detector>
  <zone>2</zone> 
  <loc>Hall</loc> 
  <type>Perimeter-Follow</type> 
  <status>Open</status> 
  <isalarm>no</isalarm> 
  </detector>
  </detectors>
  </reply>

System Armed Away and doorsensor Normal

Code: Select all

<?xml version="1.0" standalone="yes" ?> 
- <reply>
  <index>22</index> 
- <cameras>
  <name>CAMERAS</name> 
  <picture_name>cam</picture_name> 
  <picture_path>/tmp/cams/</picture_path> 
  </cameras>
- <configuration>
- <sensors>
  <name>Sensor</name> 
  <index>1</index> 
  <type>Delay 1</type> 
  <location>Front Door</location> 
  </sensors>
- <sensors>
  <name>Sensor</name> 
  <index>2</index> 
  <type>Perimeter-Follow</type> 
  <location>Hall</location> 
  </sensors>
- <system>
  <name>Control Panel</name> 
  <away /> 
  <status>AWAY</status> 
  <arm>1</arm> 
  <latchkey_enable>Latchkey Enable</latchkey_enable> 
  <ip_mode>dynamic</ip_mode> 
  <ip>x.x.x.200</ip> 
  <subnet>255.255.255.0</subnet> 
  <gateway>x.x.x.2</gateway> 
  <dns1>192.168.0.1</dns1> 
  </system>
  </configuration>
  <alerts /> 
  <alarms /> 
  <qvFullPath>/cams/sess_0e5569f301c9b5971d43891f32f56a3a/cam</qvFullPath> 
- <detectors>
- <detector>
  <zone>1</zone> 
  <loc>Front Door</loc> 
  <type>Delay 1</type> 
  <status /> 
  <isalarm>no</isalarm> 
  </detector>
- <detector>
  <zone>2</zone> 
  <loc>Hall</loc> 
  <type>Perimeter-Follow</type> 
  <status /> 
  <isalarm>no</isalarm> 
  </detector>
  </detectors>
  </reply>

[Bwired]

Update: I found out that now a connection via port 443 Https is possible with the Powerlink Pro.
I think Visonic updated the certificates

[Bwired]

update on statuscheck and sending Commands to the Visonic powerlink2

If you run this check:
http://x.x.x.200/web/ajax/alarm.chkstatus.ajax.php
It will return a full XML with complete status and settings.
If you have a large Visonics setting with lots of sensors the XML can be extensive and most of the time the XML is the same as the previous.
Thats why there is a index tag in the XML where you can check on. In the below XML the <INDEX> = 84

Code: Select all

<?xml version="1.0" standalone="yes"?>
<reply>
  <index>84</index>
  <cameras>
    <name>CAMERAS</name>
    <picture_name>cam</picture_name>
    <picture_path>/tmp/cams/</picture_path>
  </cameras>
  <configuration>
    <sensors>
      <name>Sensor</name>
      <index>1</index>
      <type>Delay 1</type>
      <location>Front Door</location>
    </sensors>
    <sensors>
      <name>Sensor</name>
      <index>2</index>
      <type>Perimeter-Follow</type>
      <location>Hall</location>
    </sensors>
    <system>
      <name>Control Panel</name>
      <disarm/>
      <status>Ready</status>
      <arm>0</arm>
      <latchkey_enable>Latchkey Enable</latchkey_enable>
      <ip_mode>dynamic</ip_mode>
      <ip>10.0.0.200</ip>
      <subnet>255.255.255.0</subnet>
      <gateway>10.0.0.2</gateway>
      <dns1>192.168.0.1</dns1>
    </system>
  </configuration>
  <alerts>
  </alerts>
  <alarms>
  </alarms>
<qvFullPath>/cams/sess_02e5d32285d5dea65a1960d18c82fd49/cam</qvFullPath><detectors>
    <detector>
        <zone>1</zone>
        <loc>Front Door</loc>
        <type>Delay 1</type>
        <status></status>
        <isalarm>no</isalarm>
    </detector>
    <detector>
        <zone>2</zone>
        <loc>Hall</loc>
        <type>Perimeter-Follow</type>
        <status></status>
        <isalarm>no</isalarm>
    </detector>
</detectors>

</reply>

All you need to do is sent the latest INDEX number with your request and you receive this when there are no changes

Code: Select all

http://x.x.x.200/web/ajax/alarm.chkstatus.ajax.php?curindex=84

Answer:
<?xml version="1.0" standalone="yes"?><reply><customStatus>[NOCNG]</customStatus></reply>

If there are changes you only recieve the Arms Status and the sensors settings, so not the complete XML. You only receive the complete XML if you dont use the curindex=xx option

Sample code for the request:

Code: Select all

objXML.Open "POST", "http://x.x.x..200/web/ajax/alarm.chkstatus.ajax.php", True
objXML.setRequestHeader "cache -Control", "no -cache"
objXML.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
sdataTosend = "curindex=84"
objXML.send sdataTosend

And with this command you can easily Arm, Armhome and Disarm the visonic panel

Code: Select all

*Login
sdataTosend = "user=admin&pass=admin"
objXML.Open "POST", "http://x.x.x.200/web/ajax/login.login.ajax.php", True
*Send Commands
objXML.Open "POST", "http://x.x.x.200/web/ajax/security.main.status.ajax.php", True
objXML.setRequestHeader "cache -Control", "no -cache"
objXML.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
sdataTosend = "set=Disarm"  (options here are :Disarm, ArmHome, ArmAway)
objXML.send sdataTosend

For Homeseer users, this can be done easy with a script!

See also http://www.bwired.nl/weblog.asp?id=418
See Roberts vlog for the Mobile Javascript variant blog.hekkers.net/2011/03/04/more-powerl ... nk2-stuff/

[Bjochems]

I'm planning to buy a Powermax Pro with the intention to connect it to a Powerlink as described in this topic.

With some discount I can buy a new Powermax Pro which is running on firmware version v4.4.20

Will this firmware work with the Powerlink module?
And is it possible to do a firmware upgrade of the Powermax Pro to the latest firmware?

[TANE]

This will not work.
You will need the firmware version >5.2
Hardware version > 6.0

This is in the powermaxpro version not available on the Dutch market.

[Bjochems]

Ok, thx

[Bwired]

Agree
I'm one of the few who got it working, did not do anything special though.
There is a very big possibilty even a new set wont work together with the powerlink2
Bad job again for Visonic!

[TANE]

There is another Powerlink that will work for sure it's called PowerlinkPro.
this is a discontinued product

Not sure about the possibilities and hack options

[Rene]

Does anybody know where I can buy a Powermax Pro with Powerlink2 module already build in? I want to replace my current Powermax Pro but keep the GSM and PC/RS232 modules currently build in.

[mhn]

I just bought a Powermax Pro. Under serial number it says V 5.3.72. But is it software or hardware version?

Where do you find the version numbers?

Regards
Morten

[TANE]

Hi Morten,

I think the software version is correct..if this is the software version. I did not found any software version under the serial number on the dutch PowermaxPro.
This can be different in other countries. Since there are lot of different dist.

You can find the software version somewhere in the menu.

Hardware version is a bit difficult to trace.