Somfy Connexoon/Tahoma jailbreak

Yes, the test user can confirm that it is working, without errors. :wink:
Just download a new version of the custom_components from Donny, and reinstall in HA.
Thanks for the good work!.

Regards.

If anyone is looking to automate Somfy blinds with HA and doesn’t want to shell out the quite frankly extortionate £149 for the hub, take a look here: GitHub - paultbarrett/esphome-somfy: Esphome configuration for Somfy Blind

< £10 worth of components and 30 minutes of soldering and you have your very own offline hub, I’m using it with 4x blinds and it seems to work perfectly.

Hello Swifty,

The problem is that Somfy has two types of protocols.
The RTS 433Mhz protocol, wich is cheap to assemble.
The IO 868Mhz protocol, wich is not cheap, and not yet to integrate without a Hub.

I have the IO 868Mhz protocol, and the connexoon Hub to integrate it.
So if you have a DIY solution for IO 868Mhz protocol, it would be nice?.

Regards.

1 Like

Ah interesting I wasn’t aware Somfy had another protocol.
Not looked into the 868mhz version, but maybe you could get away with using something like RFLink?

Hello, it works for me with the Dommy update.
Now can the system do without the cloud?

add devices without the cloud?
dialog with mqtt for other platforms?

I spotted gdb and strace in /etc/init.d/*
only the bins are not available.
Regards,

Hello, it works for me with the Dommy update.
Now can the system do without the cloud?

add devices without the cloud?
dialog with mqtt for other platforms?

I spotted gdb and strace in /etc/init.d/*
only the bins are not available.
Regards,

1 Like

Hello Yves,

Yes, with the modded firmware, and the modded HA integration the system works without the cloud.
However, both ways work at the same time. So i have the HA cloud integration and the HA local integration at the same time, just to test it out, and it works great.

Not sure about new devices, normally you add devices not within HA, so i think when you add a new device to the connexoon, and you reconfigure the integration, the new devices should show up.
I only have 2 screens, and not planning to add more devices soon, so not being able to test.

Regards.

1 Like

Hi Donny,
I’m also highly interested in this topic and tried to apply your tutorial on my connexoon. I did everything exactly as described, but unfortunately I did not get it to work.

After flashing the patched firmware back to the connexoon, it restarts as usual and everything looks fine. However, I when I try to ssh into the device, I always get an error message saying: “No supported authentication methods available (server sent: publickey)”. I started over with the tutorial multiple times, but each and every time the same problem occurs.

It somehow seems that ssh has been enabled, but the device expects an authentication with private/public key instead of user/password. My KizOS version is “2021.5.4-29”. The file /etc/version has value “20211203223235”.

Did you (or anyone else) encounter the same problem or maybe could think of a solution for this?

Thanks and best regards,
Michael

Hmm, perhaps they disabled password authentication in a newer firmware version. I assume you edited the /etc/shadow file to add your own password hash? If yes, you can either:

  • Change the SSH configuration to allow password authentication
  • Add your own SSH public key to the root user

Thank you Donny, that did the trick! So for all people facing the same problem:

You have to edit file /etc/default/dropbear in ubi-root as well as ubi-rootB. Remove the line with “DROPBEAR_EXTRA_ARGS”, which adds the cmd option -s to dropbear config. This option is used to disable password login.

Best regards!

3 Likes

hello,
it works perfectly for me!
But with the new version of home assistant 2022.2.2, does it still work?

Awesome discovery. Thanks for your work on this!

Has anyone tried this with Cozytouch?

I got ssh access into the box and was able to add it to home assistant but it only displays some presets (which don’t work). The sensors and the climate entity are missing (for the radiator). I assume it’s because only some of the integration has been reworked to function locally?

I get this for the device

And I see this under entities

In the normal integration i see this (example of one heater)

The JSON it returns via the local API is probably just slightly different from the regular one. At least that’s how it was with my connexoon. You can check by visiting:

http://192.168.x.x/enduser-mobile-web/1/enduserAPI/setup/devices

It does need your local token in the headers:

X-Auth-Token: <token>

Just FYI this is what my output looks like:

[
  {
    "deviceURL": "internal://1234-1234-1234/pod/0",
    "available": true,
    "synced": true,
    "type": 1,
    "states": [
      {
        "type": 3,
        "name": "core:CountryCodeState",
        "value": "NL"
      },
      {
        "type": 1,
        "name": "internal:LightingLedPodModeState",
        "value": 1
      },
      {
        "type": 3,
        "name": "core:NameState",
        "value": "Box"
      },
      {
        "type": 3,
        "name": "core:ConnectivityState",
        "value": "online"
      },
      {
        "type": 3,
        "name": "core:LocalIPv4AddressState",
        "value": "N/A"
      }
    ],
    "label": "Box",
    "subsystemId": 0,
    "attributes": [],
    "enabled": true,
    "controllableName": "internal:PodMiniComponent",
    "definition": {
      "states": [
        {
          "name": "core:ConnectivityState"
        },
        {
          "name": "core:CountryCodeState"
        },
        {
          "name": "core:LocalIPv4AddressState"
        },
        {
          "name": "core:NameState"
        },
        {
          "name": "internal:LastActionConfigButtonState"
        },
        {
          "name": "internal:LightingLedPodModeState"
        }
      ],
      "widgetName": "Pod",
      "type": "ACTUATOR",
      "commands": [
        {
          "commandName": "activateCalendar",
          "nparams": 0
        },
        {
          "commandName": "deactivateCalendar",
          "nparams": 0
        },
        {
          "commandName": "getName",
          "nparams": 0
        },
        {
          "commandName": "refreshPodMode",
          "nparams": 0
        },
        {
          "commandName": "refreshUpdateStatus",
          "nparams": 0
        },
        {
          "nparams": 1,
          "commandName": "setCalendar",
          "paramsSig": "p1"
        },
        {
          "nparams": 1,
          "commandName": "setCountryCode",
          "paramsSig": "p1"
        },
        {
          "nparams": 1,
          "commandName": "setLightingLedPodMode",
          "paramsSig": "p1"
        },
        {
          "commandName": "setPodLedOff",
          "nparams": 0
        },
        {
          "commandName": "setPodLedOn",
          "nparams": 0
        },
        {
          "commandName": "update",
          "nparams": 0
        }
      ],
      "uiClass": "Pod"
    }
  },
  {
    "deviceURL": "io://1234-1234-1234/5928357",
    "available": true,
    "synced": true,
    "type": 1,
    "states": [
      {
        "type": 3,
        "name": "core:StatusState",
        "value": "available"
      },
      {
        "type": 3,
        "name": "core:DiscreteRSSILevelState",
        "value": "good"
      },
      {
        "type": 1,
        "name": "core:RSSILevelState",
        "value": 86
      },
      {
        "type": 1,
        "name": "core:DeploymentState",
        "value": 0
      },
      {
        "type": 11,
        "name": "core:ManufacturerSettingsState",
        "value": {
          "current_position": 0
        }
      },
      {
        "type": 3,
        "name": "core:OpenClosedState",
        "value": "closed"
      },
      {
        "type": 1,
        "name": "core:TargetClosureState",
        "value": 0
      },
      {
        "type": 6,
        "name": "core:MovingState",
        "value": false
      },
      {
        "type": 3,
        "name": "core:NameState",
        "value": "Zonnescherm"
      },
      {
        "type": 1,
        "name": "core:Memorized1PositionState",
        "value": 105
      }
    ],
    "label": "Zonnescherm",
    "subsystemId": 0,
    "attributes": [
      {
        "type": 3,
        "name": "core:Manufacturer",
        "value": "Somfy"
      },
      {
        "type": 3,
        "name": "core:FirmwareRevision",
        "value": "5071665X10\u0003"
      }
    ],
    "enabled": true,
    "controllableName": "io:HorizontalAwningIOComponent",
    "definition": {
      "states": [
        {
          "name": "core:AdditionalStatusState"
        },
        {
          "name": "core:DeploymentState"
        },
        {
          "name": "core:DiscreteRSSILevelState"
        },
        {
          "name": "core:ManufacturerSettingsState"
        },
        {
          "name": "core:Memorized1PositionState"
        },
        {
          "name": "core:MovingState"
        },
        {
          "name": "core:NameState"
        },
        {
          "name": "core:OpenClosedState"
        },
        {
          "name": "core:RSSILevelState"
        },
        {
          "name": "core:SecuredPositionState"
        },
        {
          "name": "core:StatusState"
        },
        {
          "name": "core:TargetClosureState"
        }
      ],
      "widgetName": "PositionableHorizontalAwning",
      "type": "ACTUATOR",
      "commands": [
        {
          "nparams": 1,
          "commandName": "advancedRefresh",
          "paramsSig": "p1"
        },
        {
          "commandName": "close",
          "nparams": 0
        },
        {
          "nparams": 1,
          "commandName": "delayedStopIdentify",
          "paramsSig": "p1"
        },
        {
          "commandName": "deploy",
          "nparams": 0
        },
        {
          "commandName": "down",
          "nparams": 0
        },
        {
          "commandName": "getName",
          "nparams": 0
        },
        {
          "commandName": "identify",
          "nparams": 0
        },
        {
          "commandName": "keepOneWayControllersAndDeleteNode",
          "nparams": 0
        },
        {
          "commandName": "my",
          "nparams": 0
        },
        {
          "commandName": "open",
          "nparams": 0
        },
        {
          "nparams": 1,
          "commandName": "pairOneWayController",
          "paramsSig": "p1,*p2"
        },
        {
          "commandName": "refreshMemorized1Position",
          "nparams": 0
        },
        {
          "nparams": 2,
          "commandName": "runManufacturerSettingsCommand",
          "paramsSig": "p1,p2"
        },
        {
          "commandName": "sendIOKey",
          "nparams": 0
        },
        {
          "nparams": 1,
          "commandName": "setClosure",
          "paramsSig": "p1"
        },
        {
          "nparams": 1,
          "commandName": "setConfigState",
          "paramsSig": "p1"
        },
        {
          "nparams": 1,
          "commandName": "setDeployment",
          "paramsSig": "p1"
        },
        {
          "nparams": 1,
          "commandName": "setMemorized1Position",
          "paramsSig": "p1"
        },
        {
          "nparams": 1,
          "commandName": "setName",
          "paramsSig": "p1"
        },
        {
          "nparams": 1,
          "commandName": "setPosition",
          "paramsSig": "p1"
        },
        {
          "nparams": 1,
          "commandName": "setSecuredPosition",
          "paramsSig": "p1"
        },
        {
          "commandName": "startIdentify",
          "nparams": 0
        },
        {
          "commandName": "stop",
          "nparams": 0
        },
        {
          "commandName": "stopIdentify",
          "nparams": 0
        },
        {
          "commandName": "undeploy",
          "nparams": 0
        },
        {
          "commandName": "unpairAllOneWayControllers",
          "nparams": 0
        },
        {
          "commandName": "unpairAllOneWayControllersAndDeleteNode",
          "nparams": 0
        },
        {
          "nparams": 1,
          "commandName": "unpairOneWayController",
          "paramsSig": "p1,*p2"
        },
        {
          "commandName": "up",
          "nparams": 0
        },
        {
          "nparams": 1,
          "commandName": "wink",
          "paramsSig": "p1"
        }
      ],
      "uiClass": "Awning"
    }
  },
  {
    "deviceURL": "io://1234-1234-1234/16516299",
    "available": true,
    "synced": true,
    "type": 5,
    "states": [],
    "label": "IO (16516299)",
    "subsystemId": 0,
    "attributes": [
      {
        "type": 3,
        "name": "core:Manufacturer",
        "value": "Somfy"
      }
    ],
    "enabled": true,
    "controllableName": "io:StackComponent",
    "definition": {
      "states": [],
      "widgetName": "IOStack",
      "type": "PROTOCOL_GATEWAY",
      "commands": [
        {
          "nparams": 1,
          "commandName": "advancedSomfyDiscover",
          "paramsSig": "p1"
        },
        {
          "nparams": 0,
          "commandName": "discover1WayController",
          "paramsSig": "*p1,*p2"
        },
        {
          "nparams": 1,
          "commandName": "discoverActuators",
          "paramsSig": "p1"
        },
        {
          "nparams": 1,
          "commandName": "discoverSensors",
          "paramsSig": "p1"
        },
        {
          "commandName": "discoverSomfyUnsetActuators",
          "nparams": 0
        },
        {
          "commandName": "joinNetwork",
          "nparams": 0
        },
        {
          "commandName": "resetNetworkSecurity",
          "nparams": 0
        },
        {
          "commandName": "shareNetwork",
          "nparams": 0
        }
      ],
      "uiClass": "ProtocolGateway"
    }
  }
]```

Thanks for the suggestions. I think the issue might be the local api / hub. Based on your output it doesn’t look like my bridge is reporting any radiators (or at least I think that’s what it is saying). The output is certainly shorter than yours!

They do show up in the cozytouch app so I’m unsure what’s going on.

I get the following from the request (http://192.168.x.x/enduser-mobile-web/1/enduserAPI/setup/devices)

[
  {
    "deviceURL": "io://1234-1234-1234/9775556",
    "available": true,
    "synced": true,
    "type": 5,
    "states": [],
    "label": "IO (9775556)",
    "subsystemId": 0,
    "attributes": [
      {
        "type": 3,
        "name": "core:Manufacturer",
        "value": "Somfy"
      }
    ],
    "enabled": true,
    "controllableName": "io:StackComponent",
    "definition": {
      "states": [],
      "widgetName": "IOStack",
      "type": "PROTOCOL_GATEWAY",
      "commands": [
        {
          "nparams": 1,
          "commandName": "discoverActuators",
          "paramsSig": "p1"
        },
        {
          "commandName": "joinNetwork",
          "nparams": 0
        },
        {
          "nparams": 1,
          "commandName": "advancedSomfyDiscover",
          "paramsSig": "p1"
        },
        {
          "commandName": "resetNetworkSecurity",
          "nparams": 0
        },
        {
          "commandName": "shareNetwork",
          "nparams": 0
        },
        {
          "nparams": 0,
          "commandName": "discover1WayController",
          "paramsSig": "*p1,*p2"
        },
        {
          "nparams": 1,
          "commandName": "discoverSensors",
          "paramsSig": "p1"
        },
        {
          "commandName": "discoverSomfyUnsetActuators",
          "nparams": 0
        }
      ],
      "uiClass": "ProtocolGateway"
    }
  },
  {
    "deviceURL": "internal://1234-1234-1234/pod/0",
    "available": true,
    "synced": true,
    "type": 1,
    "states": [
      {
        "type": 1,
        "name": "internal:LightingLedPodModeState",
        "value": 1
      },
      {
        "type": 3,
        "name": "core:CountryCodeState",
        "value": "NZ"
      },
      {
        "type": 3,
        "name": "core:LocalIPv4AddressState",
        "value": "N/A"
      },
      {
        "type": 3,
        "name": "core:NameState",
        "value": "Box"
      },
      {
        "type": 3,
        "name": "core:ConnectivityState",
        "value": "offline"
      }
    ],
    "label": "Box",
    "subsystemId": 0,
    "attributes": [],
    "enabled": true,
    "controllableName": "internal:PodMiniComponent",
    "definition": {
      "states": [
        {
          "name": "core:ConnectivityState"
        },
        {
          "name": "core:LocalIPv4AddressState"
        },
        {
          "name": "core:CountryCodeState"
        },
        {
          "name": "internal:LightingLedPodModeState"
        },
        {
          "name": "core:NameState"
        },
        {
          "name": "internal:LastActionConfigButtonState"
        }
      ],
      "widgetName": "Pod",
      "type": "ACTUATOR",
      "commands": [
        {
          "commandName": "deactivateCalendar",
          "nparams": 0
        },
        {
          "commandName": "refreshPodMode",
          "nparams": 0
        },
        {
          "commandName": "getName",
          "nparams": 0
        },
        {
          "commandName": "setPodLedOff",
          "nparams": 0
        },
        {
          "nparams": 1,
          "commandName": "setCalendar",
          "paramsSig": "p1"
        },
        {
          "commandName": "setPodLedOn",
          "nparams": 0
        },
        {
          "commandName": "activateCalendar",
          "nparams": 0
        },
        {
          "nparams": 1,
          "commandName": "setLightingLedPodMode",
          "paramsSig": "p1"
        },
        {
          "commandName": "update",
          "nparams": 0
        },
        {
          "commandName": "refreshUpdateStatus",
          "nparams": 0
        },
        {
          "nparams": 1,
          "commandName": "setCountryCode",
          "paramsSig": "p1"
        }
      ],
      "uiClass": "Pod"
    }
  }
]

Hi!

So you know, I’m the one who found the Jailbreak method using the USB debug interface on the TaHoma. Just passing by to let you know that my project was only on hold but that I’m still working on it.

I’m amazed by what this community was able to pull off with it! I saw the internal application but was unable to find how to enable it and put it to actual use. Great job!

On my side, out of curiosity, I’m still working on reversing the actual radio protocol. I have some insights and am able to decode some parts of it sniffed directly on the air. The protocol frames are cryptographically signed but not encrypted :slight_smile:

For that, I’m creating a custom OS stack for the TaHoma. So far I have an operational bootloader and u-boot.

I’ll keep updates on Github but will for sure check this thread from time to time.

8 Likes

Fyi, I posted a small update to the blog:

TL;DR, there are some changes and you can use the newly introduced developer mode if you’re willing to generate SSL certificates! Also check out this topic: Overkiz API and Somfy API - #1777 by imick

1 Like

I have a connexoon, wanted to jailbreak but i’m not getting the Atmel bootloader. When i shortcut pin 9 and 3,3v indeed the power LED is off but nothing happens. Tried several times and with different USB cables…

Does anyone have a functioning patched image they can share? I tried the guide on the newest firmware that was released a few weeks ago, but that doesn’t seem to work.

For what is this relevant now since somfy switches to local API on official Image?

As far as I know that’s only true for the Tahoma, not the Connexoon