February 5. 20:00 -  Imagine the worst nose itch ever. Then imagine arms that are too short to scratch your nose. #enjoy

Honeywell/Ademco Vista ICM network

September 22, 2008 18:51 by docbliny

Spent some time figuring out what the Vista ICM module I've had installed for over a year could finally do for me. I've wanted to integrate it into mControl, but they don't have a driver. Step one was to look at the ICM and figure out how to access it and read information from it. The following attempts to document as much as I could figure out and the resulting C# component is available on the Downloads page.

Ademco/Honeywell Vista ICM (Internet Connection Module)

The following is based on a Vista ICM connected to a Vista 20P unit running “in2 fusion image_2.2.3 - Mon Jun 4 14:18:12 MDT 2007” and may contain factual errors and pure guesswork.

Operating System and Software

The device operating system is uClinux (http://www.uclinux.org).

The web server is boa (www.boa.org).

Script aliases can be viewed in the /etc/boa.conf file.

The main application running communications between the ECP bus, devices, and Ethernet is named Fusion. It would seem that it provides a scripting runtime that is relatively straightforward and should provide a nice clean way to hack the behavior of the device. Sample files are located in the /var/fusion/devices folder.

Network Ports

Port

Protocol Description
TCP 23

Telnet

Provides Telnet access to the device.

TCP 80

HTTP

Provides web browser access.

UDP 3947

UDP Datagrams

Broadcasts various system events and information.

TCP 50003

Unknown/ASCII

Provides a continuous stream of updates of text that is displayed on the alarm system’s display panel. Can be changed in advanced setup.

Telnet Access

The device has a Telnet server running. There is only one user account, root, and the password is “42666263”.

Web Tools

Client Access

Normal client access is available from a web browser from http://myhome/setup or http://1.2.3.4/setup  where 1.2.3.4 is the IP address of the unit.

Configuration

To access the device setup, open http://myhome/setup or http://1.2.3.4/setup from a web browser. The product documentation will provide additional details.

Debugging Utilities

The device provides a nice amount of debugging utilities directly over the web interface. There are two particularly interesting pages: http://myhome/debug and http://myhome/show_vars. You’ll also want to look at http://myhome/debug_output to see what options are available.

Tips

Backup Settings

Before you access the device via Telnet or make any changes, make a backup of the settings

Update to Latest Firmware

Be sure to update to the latest firmware, currently 2.2.3. It also seems that the device definitions don’t get auto-updated and thus you may have an old version of the honeywell_vista.dve file active. If this is the case, you may be missing various commands/macros, such as the Refresh macro.

One way to force an update of the device file is to make a copy of the latest available version in the /var/fusion/devices folder with a different name, and then go through the web setup to change the file used.

Security

As you’ve probably noticed, the device is wide open and doesn’t provide even HTTPS access. For this reason, it would probably be a good idea to keep this device on a separate network by adding an extra network card into one of your computers instead of having it connected to your LAN.

Digging Deeper

Try adding the “Network” device with “Web” or an IP camera to get additional packet types to be sent.

HTTP Commands

The following table lists some of the more interesting commands that may be sent using a GET request.

Path

Query Parameters Description
/cmd

?cmd=

Sends the given command to the group, unit or node.

/cmd_list  

Displays a list of all available commands.

/debug  

Displays node, port and unit information.

/show_vars    
/show_flash

?boot

?ethmac

?bootarg

?settings

?Sector=[0 – 34]

Prints a hex-dump of the requested item.

 

cmd Command

All commands start with /cmd?cmd= and are appended with a tick value. The tick value should be optional from non-web browser applications. For example:

http://myhome/cmd?cmd=(0.0.0)Monitor_1_1_2023468919

In addition to the commands below, you can send any item that is defined in the [macro] section on the /show_vars page. Commands begin with the target identified by (Group#.Node#.Unit#). The following table displays sample values. Parameters are separated by an underscore.

Command

Description
(0.0.0)Monitor_0_0_AppletID_[Name]

Switches the content sent to the feedback port (?)

(0.0.0)Select_1_1

Requests the security module to report its ID.

(0.1.1)Refresh

Requests the security module send out the following variables:

display

ArmStatus

Ready

ZS.[1-16]


UDP Packet Contents

The following describes most of the structure and contents broadcast by the UDP port.

Packet Types

Values

Description
0x01, 0x03

Node Discovery/Network Info

0x01, 0x04

Unit Info

0x02, 0x04

Variable

0x04, 0x01

Command/Trigger

Header

The following is a common header shared by all packet types.

Bytes

Format Description
00 – 01

UInt16

Packet type

02 – 03

UInt16

Unknown. Possibly part of the packet type. Seems to be 0x00, 0x01 always.

04 – 05

UInt16

Time code


 

Node Discovery – 0x01, 0x03

There are two versions of this packet, both with very similar content. The Vista ICM was set to a static IP address and using DHCP was not tried. Type 0 may be related to DHCP.

Type 0

Bytes

Format Description
06 – 07

UInt16

Subtype: 0x00, 0x00

08 – 09

UInt16

hb_chksm

10 – 11

2 bytes

Unknown

12 – 13

UInt16

Data length

14 – 19

6 bytes

Unknown

20 – 23

4 x UInt8

Device IP address

24 – 27

4 bytes

Unknown

28 – 33

6 x UInt8

Device MAC address

34 – 39

6 bytes

Unknown

40 - 49

10 bytes

Unknown. Last byte potentially “flags

50

UInt8

Auto incrementing number

51

Byte

Unknown, potentially padding

52 - 69 (Data length)

ASCII

sbrnd value terminated by 0x0A and padded with 0x00 as necessary

Type 1

Bytes

Format Description
06 – 07

UInt16

Subtype: 0x00, 0x01

08 – 09

UInt16

hb_chksm

10 – 11

2 bytes

Unknown

12 – 13

UInt16

Data length

14 – 19

6 bytes

Unknown

20 – 23

4 x UInt8

Device IP address

24 – 27

4 x UInt8

Device IP address

28 – 33

6 x UInt8

Device MAC address

34 – 39

6 x UInt8

Device MAC address

40 - 49

10 bytes

Unknown. Last byte potentially “flags

50

UInt8

Auto incrementing number

51

Byte

Unknown, potentially padding

52 – 69 (Data length)

ASCII

sbrnd value terminated by 0x0A and padded with 0x00 as necessary

 


 

 

Unit Info – 0x01, 0x04

This packet contains a subset of the variables for a unit.

Bytes

Format Description
06 – 07

UInt16

Subtype (?): 0x00, 0x01

08 – 09

UInt16

checksum

10 – 11

UInt16

Unit number

12 – 13

UInt16

Data length

14 – 19

6 bytes

Unknown

20 – 23

4 x UInt8

Device IP address

24 – 27

4 x UInt8

Device IP address

29 – 33

6 x UInt8

Device MAC address

34 – 39

6 x UInt8

Device MAC address

40 – 51

12 bytes

Unknown. Last byte is potentially “flags

52 – Data length

ASCII

Subset of variable values as “key=value”, delimited by 0x0A, and padded with 0x00 as necessary.


 

 

Variable – 0x02, 0x04

This packet contains a variable value. This may be sent by the SendVar() command in device scripts. This is easily the most interesting packet as it will contain the text that is displayed on the alarm panel, along with information about the state of zones (faults) and whether the alarm is armed.

Sample data values:

-          1.1.Ready=0

-          1.1.display=  Ready to Arm 

-          1.1.ZS.4=1

Bytes

Format Description
06 – 07

UInt16

Data length

08 – Data length

ASCII

Variable value as “Node#.Unit#.Key=Value” and padded/terminated with 0x00.


 

 

Command/Trigger/Event – 0x04, 0x01

This packet contains information about a command that was executed, such as arm, disarm, a zone fault, or an alarm event (fire, low battery, etc). This is likely to be the most reliable indicator of events. There can be one two three parameters passed with this packet. Zone trigger events are sent the first time the zone indicates activity and is reset after 30 seconds.

The high-level format is:

cmd=(0.0.0)_T_name:parameter1(parameter2,parameter3)

Sample data values:

cmd=(0.0.0)_T_Security:Disarmed

cmd=(0.0.0)_T_Security:Armed Away

cmd=(0.0.0)_T_Security:Office Window

Bytes

Format Description
06 – 07

UInt16

Data length

08 – Data length

ASCII

Command value as “cmd=value” and padded/terminated with 0x00.

 


 

 

Vista Security Variables

The following table lists some common variables that are sent out by the ICM.

Variable

Known Values Description
ArmStatus

0 = Disarmed

1 = Arm stay

2 = Arm away

 
AlarmEvent

Numeric value

Alarm event count. A better option is to watch for the Alarm trigger.

display

“****DISARMED****”

  Ready to Arm 

“DISARMED CHIME”

DISARMED BYPASS

ARMED ***AWAY***

ARMED ***STAY***

***NIGHT-STAY***

ARMED *MAXIMUM*

ARMED *INSTANT*

DISARM SYSTEM

“Test In Progress”

“Busy-Standby”

“FAULT …”

“CHECK …”

“ALARM”

“EXIT ALARM”

“AC LOSS”

“SYSTEM LO BAT”

“LO BAT”

“RCVR Jam”

“Open Circuit”

“BYPAS …”

“Alarm Canceled”

“COMM. FAILURE  

“ZONES FAULTED”
“You may exit now”

“Hit * for faults”

“MODEM COMM”

 

Alarm panel display text. Likely to be different between various Vista models. Text is usually padded with spaces on one or both sides to make up a 16 character string. The variable name is pre-pended with the device number such as “1.1.display=****DISARMED****”.

FireEvent

Numeric value

Fire event count. A better option is to watch for the Fire trigger.

ID

ECP bus device ID between 16 - 23

The keypad ID given to the Vista ICM.

Ready

0 = Not ready

1 = Ready

Whether the unit is ready.

ZS

0 = No fault

1 = First fault

2 = Additional fault

Zone state. The variable name is pre-pended with the device number and appended with the zone number, for example “1.1.ZS.4=1”.

 

Vista Security Triggers

Trigger

Description
Alarm

The alarm has tripped.

Fire

Fire sensor tripped.

Low Battery

Low battery warning.

Power Failure

AC power lost.

Power Returned

AC power restored.

Disarmed

System disarmed.

Armed Stay

Armed in stay mode.

Armed Away

Armed in away mode.

 

Comments (13) -

1/19/2009 10:54:13 AM #

Aigars

Sounds very interesting! So if you say UDP and TCP ports should brodcast, what is needed to initialize this? I use Autoit3 for TCP communication.
If I connect to UDP port 3947 there is nothing coming out of it.

Aigars Latvia

1/25/2009 11:20:40 PM #

Prajesh

This is brilliant.

Prajesh United States

7/1/2009 8:26:12 AM #

Yuergen

I've installed a Vista ICM module to my alarm system which works fine. The problem I'm having is that within the setup program under the advanced screen I do not see the Backup/Restore options to allow me to back up the configuration. Also the custom zone tags are not being sent to my email but instead I'm receiving the alarm zone number. Anyone have any ideas?

Thanks . . .

Yuergen United States

7/21/2009 6:53:54 PM #

Hoodia

Great post - keep it up man Smile

Hoodia Denmark

8/17/2009 1:55:43 PM #

Olav Hindahl

I have installed and used the ICM on my P20 Alarm box for the last year. The unit is performing well. The  Zone tags in the Alarm Panel has to be written into the numbered zones in the ICM unit itself.

When an alarm is activated my PDA rings and downloads an E-mail indicating the Zone violated.

With a few cameras installed I also receive an E-mail with a set of pictures at the same time.

Oly

Olav Hindahl United States

9/12/2009 7:04:42 PM #

Anthony

Has any one made a better web interface (or applet) to access their Vista security panel?

The current one is a bit on the wait and click next pace and you can't use the keyboard to submit any commands. Also the interface only shows 1 line alternating between the 2 alpha lines on the control panel.

I want to create a better iphone interface then what is available (since it isn't good at all), but I was wondering if anyone had done any programming work or uploaded any better web pages to their ICM?

I found a nice ICM viewer app but it does not support sending any commands to the ICM itself.

I would love a PC based keypad where I can control the panel via my PC to do some advanced functions (such as the X10) and not need additional X10 equipment for the PC and instead use the ICM as the middle man to the control panel.

Anthony United States

9/22/2009 10:54:15 AM #

Tom

Thanks for this info!  This will help me make my own php control scripts!

Thanks! Thanks! Thanks!

Tom United States

10/8/2009 11:15:31 AM #

Jaime

Working on a Java program and have it almost done, except that I have some commands to open and close relays, but I think I can do that through Macros but have not found out how to update and or change the macros on the ICM, I see it has a total of 12 Macros that can be run, but am unable to change them  help would be greatly appreciated.
Contact me at charrod(AT)hotmail . com

Jaime United States

10/22/2009 6:46:36 PM #

Darin

I've modified my pda_vista.htm file so it looks better on the iPhone the only kicker is you have to keep uploading the file if you restart the device or make changes. I also created an icon to display on my iPhone to launch the page in safari. Below is my code.

<!-- iPhone Specific mods by dables -->
<link rel="apple-touch-icon" href="http://10.10.2.20/apple-touch-icon.png"; />
<meta name="viewport" content="width=device-width" />
<meta name="viewport" content="height=device-height,width=device-width" />

<script language="JavaScript">
window.addEventListener('load', function(){
setTimeout(scrollTo, 0, 0, 1);
}, false);
</script>

<!-- End iPhone Specific mods by dables -->

Darin United States

3/28/2010 12:08:01 PM #

jeremy

Now that they have discontinued this part.  Has anyone picked up/or knows how to get the email service to continue?

jeremy United States

2/13/2011 7:16:18 PM #

Anthony

From some work, I have worked out alot of the code from the ICM by using IIS and a simple redirect in the ICM.

I built 3 scripts, default.aspx, time.aspx, and email.aspx, then using some sniffing was able to simulate the requests to in2networks webserver and get the responses.  This allows to change the config file on the fly, just change the DNS server to a machine where you can control what happens.

Also now since it's been a while, there is a hosts files on the ICM unit which is in flash which you can telnet to and override the in2networks ip address to your webserver instead. From there you can monitor all the traffic from the icm, and then build your own email alerting system.

web traffic similiar to: /default.aspx node=1&mac=00%3A00%3A00%3A00%3A00%3A00&msgtype=C&groupID=123456&ntname=Honeywell+ECP&1.type=Security&1.class=Security&1.name=Security&1.page=vista.htm&1.display=+DISARMED+CHIME

Anthony United States

2/15/2011 11:01:32 AM #

Geoff

Anthony, would you be willing to share your *.aspx and *.aspx.cs files?  I am also interested in running my own IIS server.  Also when you modify the host file on the ICM, does it reset when the power goes out, or are you able to modify it permanently?  I can be contacted at mckoolsmiff(at)gmail(dot)com.  Thanks in advance!

Geoff United States

2/24/2011 2:09:10 PM #

Scott

Anthony, I would be interested in those aspx pages as well if you would not mind sharing them. Maybe setup a project on codeplex.com or google code? That way it could live, and others could contribute? Just a thought.

Scott

Scott United States

Pingbacks and trackbacks (1)+

Add comment




  Country flag
biuquote
  • Comment
  • Preview
Loading