Crestron TSW 1060. POE HA dash for $30. Firmware

Hardware
392

I need help.nI have a 1060 i want to play with but the factory reset doesnt work. I get to the menu chose factory rest and it boots to the previous owners screen that give me no access. Toolbox might help.
Thanks

393

Glad to hear ^^
In that case, would you possibly be able to help me with one of these? Having some trouble updating one

1 Like
394

Fun fact: factory reset on these devices doesn’t actually wipe everything! I’ve found some things that I really shouldn’t have found from units on eBay…

That being said, factory reset should wipe out any sort of credentials on the device. Navigate to the unit’s IP address in your browser and you should be able to set new credentials and configure things freely.

What’s the current firmware it’s running? I’ve had significant problems updating from 1.x firmware forward for whatever reason, but eventually got it to work after just continually trying a factory reset → immediate firmware update loop.

If you can, upload firmware through SFTP to the firmware folder rather than the web UI, and run the PUF command afterwards. You can also use UPGRADERESULTS to see what/where things hung.

Also, gonna put out feelers here. Any wizards/witches with JavaScript and web experience want to help build out a CH5 User Project? CrComLib seems to be the way forward that offers the least resistance as of now, and I’m kinda curious to see if we can make a proper “app” for Home Assistant with all the extra bells and whistles.

Just some examples for potential art:

  • “Instant” on/off by using Csig.Backlight_On and Csig.Backlight_Off to toggle screen status without putting the device to sleep.
  • Ability to use the hard buttons to send commands/take actions.
  • SIP integration through Rava (door controls?)
  • Better auto-brightness through Csig.Light_Sensor_Value_fb and Csig.Lcd_Brt, since the xx60 only has a “high brightness” and “low brightness” level.
  • Hidden (PIN protected) “settings” panel if you hit, e.g. the Home button 5 times.
  • MQTT (or native API?) to expose sensor entities to HA
    • Useful for things like LED bar control, state info.

I’m basically trying to envision what it’d be if we had a fully designed project that just acted as an <iframe> with “extras” slapped on top of it for various use cases.

3 Likes
395

Do the rest while you’re offline. Turn off your modem for example. Then login to its web interface and turn off the cloud connections. It’s probably resetting, then connecting to the cloud and pulling the same config back

1 Like
396

Thanks I’ll try that. I’m tempted to leave the internet connection open and run Wireshark on the communications back to base. What’s the bets I can see the authentication!
Edit:spelling

397

It’s all over SSL, you likely won’t see anything useful

1 Like
398

I just remembered that Burp Suite can intercept SSL.
I will give it a try, might get something.

Nah it needs to be browser initiated.

399

Just signed up to say thanks! It’s way easier to convert a TSS to a TSW than I thought. I got myself a TSS-1070 running firmware 2.006. I downgraded to 2.004 to get an ADB root shell. After that, it’s literally just one shell command, and the Crestron scripts do the rest—amazing. No messing around with EEPROMs, flash, or U-Boot.

I even set up a hardware UART connection and spent a lot of time stumbling in the dark, trying to figure things out. It wasn’t until I finally looked more closely at the /vendor/bin/cresinit.sh script that everything started to make sense.

400

Was running 1.002.0016, so definitely part of the 1.x problem. Tried resetting into update through sftp and ssh and worked the first time. I tried this before (with webui instead) and it didn’t work. Didn’t think to try sftp. Thank you very much! :slight_smile:

401

Whats the state of this today? Have tried combing through to see whats going on, but can’t decide if this is still viable with the mentioned DMCA, etc. Would love to do it not sure what models, etc. to get/avoid and what functionality it would offer in the current state.

402

Do you have any instructions on how to do this? I’ve been trying to keep track of the thread but it is hard.

403

Factory restore not clearing everything is likely so if someone loses credentials to their panel they’re not out of luck without having the source graphics files.

If you want to clear out the file system run the initialize command in ssh. (Granted what you’re finding may still be remnants leftover after an initialize as well, I don’t fully know.)

404

If all you want is home assistant page on a TSW then set the panel application mode to EMS and set the URL to your HASS instance. This should work for both xx60 and xx70 panels.

Most of the rooting and hacking here is to get into the more advanced functions of the panel, and/or potentially swap out software/OS to be more useful as a home assistant panel.

@cargsl The xx70 panels are still in production and widely used, providing instructions on switching them from TSS to TSW will likely bring unwanted attention from Crestron.
If it’s for an xx60 panel, search the thread for cresinit.sh.

1 Like
405

No go. I did it without an inernet connecttion and it still reverted to the same screen. No specific server it looked for. I seems to be a Teams unit. A few MS ports open, no web server or ssh.
Any sugestions on how to use this unit.

406

And you’ve definately gone through the 10-20 minute factory reset process ?

407

Yes, done the factory restore the device offered. It restores to the same screen each time, less than 10 minutes though. Toolbox cant see it either.

408

If you get to the reset menu, stay on it and see if SSH or web access is open. I managed to recover my device from some very fun errors by doing this.

If you’re still having problems, try this:

  1. Pop the device open and connect to the UART pins, discussed above.
  2. Run setprop service.adb.tcp.port 5555 and start adbd.
  3. Connect to the device via adb connect <device_ip> and adb shell.
  4. Run vi /data/crestron/config/rc.conf and set export SSHPORT="22".
  5. Run stop sshd; start sshd
  6. SSH in to the device normally.
  7. Issue command WEBSERVER ON, WEBPORT 80, SSHPORT ON, SSHPORT 22.
  8. Restart the device and pray.

If things still don’t work after this, your device is cursed. There’s probably a way to recover it via ADB, but… yeah, that sounds not fun.

1 Like
409

Thanks for the sugestions. Ill give it a bit more attention befor it hits the bin

410

Total aside, have a random sneak peek of something cool:

image
image2095×982 108 KB

Still working on a lot but I can now dump all joins from a panel to MQTT, and write commands back! Note that this does require a CH5 project and a TSW panel.

1 Like
411

I’m not sure what a CH5 project is but if I can control and get input from my TSW panels I’m all in! Would you have a need for a Noob tester?