Thats great… didnt know chatgpt could do it that easily. I was thinking it may need the code using to generate the checksum.
Odd that its using a standard polynomial but doesnt give standard result.
I mentioned earlier about getting root access on 70 series - its easy.
It absolutely failed at explaining to me what was odd about this algorithm save for mentioning the LUT, but it could transpile the code. Good enough and I don’t want to lose any sleep over it.
Then I suspect that, yeah, 1070s can be converted too at some level. Whether said conversion would survive a factory reset or a firmware upgrade would be a different question. I suppose someone interested can perform the same sort of analysis on a 1070 to see what it says/does, or badger Crestron into releasing the source code. Their source disclaimer page has a link to 1070 code, but it conveniently 404s. Does someone want to send them a check for $10 and see what you get in return?
based on @KazWolfe work. here is what I belive is a full set of config options the bytes to be loaded and the checksum.
USE AT OWN RISK - GREEN ONES ARE CONFRIMED FROM ACTUAL HARDWARE
My next aim is to establish the main area where mac address and serial number is stored such that failed boards can be swapped from one from a different item… but maintain correct mac address and serial number. I.e. board swap from tsw-560p into a tsw-1060.
4 Likes
I’ve just found this and its amazing thank you so much 
2 Likes
Anyone in UK that wants to convert but does not habe the tools PM me and we can talk.
2 Likes
First off thanks to all you all up thread for figuring this out. I’ve now got a bunch of these all over my house and they work great. I had some odd shaped holes from an old KNX install and these fit perfectly inside. The best mounting trick I’ve found is a set of 4 32mm magnets with recessed screw holes - once they’re on the wall the metal house holds them almost too tight and you have the benefit of no extra hardware needed and very easy removal if needed. This also works for the 7x0 series although the ones without the light bar have too much plastic so it’s helpful to just attach a sheet metal cutout attached to the back for the magnets to grip.
That said, I’ve not used dashboards before that weren’t on a tablet via Fully Kiosk or otherwise with the HA Mobile app loaded on the device. This means I can’t seem to make them as foolproof as the other methods. How are people dealing with the issue when your HA server restarts, if there’s a refresh the Crestron hits a wall pulling up an error window that the dashboard is not loadable (the long page of errros like ‘card-mod’ not installed). Normally a Fully Kiosk refresh would suffice or the HA Mobile App could just have a periodic refresh after reboot, but I’ve not figured out this. I suppose one could add a refresh to the dashboard Javascript but in the full error cases when HA is loading or unreachable it seems to just dead end. Also, when I reboot, it seems to require a login again which isn’t ideal but not the end of the world. Are there others who’ve got tips for these scenarios? I presume someone’s figured this out but my Googling fails to find an easy answer for this specific application of a custom browser and no other device controls (except maybe the ssh one someone mentioned, but that feels clunky b/c there’s no easy way to test if a full reboot is needed then the login issue again).
Many thanks!
I think in practice we’re still a long ways to go and we will need to figure out some way to create a User Application that does most of the hard work for us. I can’t say if it’s better to create some app that uses CH5 UIs, just uses iframes, or any other number of things to get it to work. This’d also ultimately mean we need some way to emulate a Crestron processor in Home Assistant to at least manage joins and signals.
We’re also running into an issue where these devices are just… old. They’re very capable still, but we are feeling the pain of Android 5.1.1 with no real way to upgrade or take complete control of the platform. See for example CSS quirks on the Energy dashboard.
I’m curious how far we can push these things, but we need to make integration progress first.
1 Like
all good, the progress has been great so far and thanks for the details you’ve shared in the thread. i’m finding it’s not too bad using browser_mod and the trusted_network trusted_users functionality to assign a specific user to each IP, setting a default dashboard for that unique user/dash on each tablet, then using the REST or ssh commands to reboot periodically overnight, which seems to work well enough now to keep them stable. Playing with browser_mod a bit more now to see if that may be easier to trigger refreshes periodically, but together it’s quite good now at being left alone and always reverting to the right dashboard automatically.
I now have 7 TSW-560Ps so will get a flash read.from them and the TSW-760 that came with them. That will confirm two more config sets and checksums.
Actually, marginally related: does anyone know where I can get the wall mount plates for the 760s/1060s? I don’t have access to a 3D printer so I can’t use the above-listed template, and eBay wants $100+/mount – at which point, it’s cheaper to just get more TSWs.
1 Like
You could also try looking for TS-7-MSMK (or replace TS-7 with whatever panel you have), it’s not an in-wall mount but an adhesive one.
Unless you’re looking for just the TSW mounting plate that comes with the touchpanel
In which case, you could try calling some local AV Integrators to see if they have any to scrap, or alternatively a lot of libraries these days have public use 3D printers, you could check your local ones to see if that’s an option or just use a print to order site.
Edit: Reading through the thread, just to see what will happen I submitted a support ticket with Crestron about the broken xx70 source code link, will update if I hear anything back.
1 Like
I find a set of $15 32mm magnets with an inset center hole work fantastic. I’m guessing you’re not in the UK but would offer to print you one if you were closer as a thanks.
Kazwolfe where are you based. I am about to have a batch 3d printed can add a couple.of extras.
1 Like
Amazing offers, thanks guys. I’m going to try to get a couple mounts from some people who DM’d me, and just get some more tablets to spare in case I break them. Good news is I should be able to get more hardware combinations for church’s spreadsheet.
Now to chase down Crestron documentation for custom apps…
1 Like
Confirming for TSS-7 by the way:
root@Crestron Touchpanel:/ $ hexdump /dev/mtd/mtd0
...
001f000 0011 ff00 ff01 ffff ffff ffff ffff ffff
001f010 ffff ffff ffff ffff ffff ffff ffff ffff
*
001fff0 ffff ffff ffff ffff ffff ffff ec58 caea
0020000
root@Crestron Touchpanel:/ $
So we can access the EEPROM from Android itself, which saves us a lot of headache since we can now use mtd-utils to actually extract the relevant data. Note that the mtd-utils present on the device doesn’t have flash_erase, so we need to grab a newer/more complete one. Past that, though, it’s pretty straightforward:
./nanddump -f /tmp/block.out /dev/mtd/mtd0 # read memory
./flash_erase /dev/mtd/mtd0 # erase memory
./nandwrite /dev/mtd/mtd0 block.out # write memory
Files can be pulled/pushed via adb, which is convenient enough if you already have the device open.
But sure enough, a reboot shows this TSS-7 as a TSW-760 now:
001f000 0011 ff00 ffff ffff ffff ffff ffff ffff
001f010 ffff ffff ffff ffff ffff ffff ffff ffff
*
001fff0 ffff ffff ffff ffff ffff ffff fb71 117d
0020000
I suspect there’s a way to do this (almost) purely on device too, but I just don’t want to deal with playing with dd to try and see.
3 Likes
That confirms 2 more lines of the table.
This process is only proven for tss-7, tss-10 conversion to TSW-760 and TSW-1060. Reading through the posts hardware is bived to be different between TSS-770 and TSW-770
I’d need a device to be able to provide any useful information here. I’d love to get my hands on some of that hardware, especially since it’s a significantly newer Android version and it should last quite a bit longer than 5.1.1 would, but nobody seems to be selling them used on eBay yet.
Past that, this hardware is still actively serviced by Crestron. I’d worry that providing a “free” upgrade path would interfere in such a way that would lead to Crestron sending me a very angry letter. The only reason I felt comfortable doing this with the xx60 hardware was because it’s end-of-maintenance, without even guarantee of future software updates.
At the very least, it’d need someone to successfully root a xx70 device and then start digging through everything to find whatever initializes that standalone mode. From there, the same general process would apply. As long as Crestron didn’t get smart and write the standalone data to eFUSE or some other non-programmable block, it should still be possible to tamper with it. This, however, must be left as an exercise to the reader.
Interestingly, the FCC filings for the TSW-1070 and the TSS-770 include information on both the TSW and TSS SKUs. I’m not an expert on things FCC related, but I’d suspect they’d need to be pretty similar to sport the same FCC ID.
1 Like
I’ll have a go at rooting one of my 770s this weekend if my sched allows. Will post what I discover.
1 Like