yashsingh1/xdaforums huggingface dataset:
[Off-topic] BuckSinister:
Old firmware Images?

Does anybody have copies of the the old firmware images that contained the php expolit? I would like to create a clone of the wink-hub-images.s3.amazonaws.com, but place the old image as the newest and change the checksums in the manifests, with the hope that my wink hub will autodowngrade. Has anyone tried this before?

I created a mini network, where the wink sites resolve to my own web servers. I have hit a bump in the road, since i can't find any rootable images to download to proceed further. Please contact me , send me a copy , or post a link to any old firmware you may be willing to share.
[Off-topic] LivinOne:
Need help from the experts, please :)

I had a new Hub that I rooted and had SSH running on. It then sat idle until today when I got my devices to connect to it.

I tried to update the firmware, using Putty, but it looks like the update removed root as I can not longer SSH into it. Is there any easy way to get it back?

tanks!
[Off-topic] zeroepoch:
No. You will need to use the method which jumpers a pin on the flash chip. Normally SSH access is preserved across upgrades for me since the enable file and keys are saved on the database partition. Maybe you did a major upgrade that wiped those or before they existed?
[Off-topic] LivinOne:
I can see the SSH prompt but root/root is no longer allowing me to login. I can't find the private key file I saved off either.

Also, do you think the original private key will work since I followed the process of adding a new public key?

I'm new to all this key certs... I cannot figure out how to make a key file that Putty will use - anyone have a file using the private key they can post as an example?

thx for the help!
[Off-topic] zeroepoch:
You will need the matching private key for the last public key you uploaded. The original private key (if you did update it later) will not work. I don't know if anyone has discovered what the default root password is, or if it's unique to each device, but I think even then password logins are disabled by default by settings in /etc/default/dropbear. If you enabled UART access you might try that but an upgrade usually disables that login path.
[Off-topic] LivinOne:
If I changed the default private/public keys... I used the ones in the how-to.

How do I make a proper .ppk file, using those keys, to use with Putty & WinSCP?

thx for the help!
[Off-topic] zeroepoch:
Sorry I don't know. I don't use putty that often, mainly ssh in Linux. Maybe someone else on this forum can prepare the file for you or provide some instructions. If you used the keys from the tutorials on the web then you might be able to recover root access.
[Off-topic] ScDoc8:
I am having difficulty finding the best time to short the pin 29 on the nand chip. I see Uboot comes up as soon as powered, and a few seconds later the kernal decompresses and boots. Is the 1-2 window after plugging in the box when I need to short the pins?

Thanks
[Off-topic] Natodd:
so I'm trying to accomplish this using your snippets of code you submitted. I have altered the relevants bits, I think. my winkkey file has a different name and location, however it won't turn my lights on or off. Aside from put the Exec plugin in place, was there other steps you needed to do to get that piece working?
[Off-topic] LivinOne:
I found my way back in (Putty & WinSCP) using my PrivateKey... now I want to re-enable ROOT password.

I have tried a few commands from the hacking wink how-tos but I get errors with both...

curl "http://192.168.2.63/database/set_dev_value.php" -d "nodeId=a&attrId=;cp /etc/shadow /etc/shadow.bak;sed -i 's/root:.*:\(.*:.*:.*:.*:::\)/root::\1/' /etc/shadow;cat /etc/shadow;"

...throws... cannot POST to /database/set_dev_value.php

curl -d cmd='sed%20-i%20%27s%2F%3D-sg%2F%3D%2F%27%20%2Fetc%2Fdefault%2Fdropbear%3B%2Fetc%2Finit.d%2FS50dropbear%20restart%3Becho%20-e%20%22%5Cn%5Cn%22%20%7C%20passwd' http://192.168.2.63/exploit.php

...throws... cannot POST to /exploit.php

why is it not able to respond to commands?

Also, I noticed /VAR/WWW folder does not exist... should it be there?

thanks for he help!
[Off-topic] checkmateyou:
I can't find the /var/www directory either. I'm trying to use the Blink app to control devices locally. Am I missing something?
[Off-topic] zeroepoch:
Now that you mention it, it looks like in a recent release the wink hub doesn't use php at all. It's not even included anymore. Although it still runs a web server since it returns wifi information when you connect to port 80. I noticed something interesting in /opt/local_control where it appears to be a node.js app. They seem to be working on local control as they promised. There is a few modules but the only service enabled is "wifi". "aau" whatever that stands for is not enabled in /opt/local_control/server.js but it appears to be something they are working on. Maybe someone with more time can look into it and see how functional it is or add a node app for aprontest access. Below is the list of handlers available for the "wifi" service.

dispatcher.dispatch('GET /networks', 'listNetworks')
dispatcher.dispatch('GET /', 'getStatus')
dispatcher.dispatch('POST /', 'post')
dispatcher.dispatch('GET /authCheck', 'heartbeat')
dispatcher.dispatch('POST /upgrade', 'upgrade')
[Off-topic] checkmateyou:
Now that they don't use .php, do you have any suggestion on how to use Blink or OpenHab? All the methods that I have seen rely on /var/www and using commands like curl "http://192.168.2.32/set_dev_value.php" -d "nodeId=a&attrId=aprontest -u -m1 -t2 -v 1;" via terminal

Thank you in advance.

Edit:

Lots of interesting info regarding local control can be found here: https://www.reddit.com/r/winkhub/comments/3kxr4q/new_firmware_and_scheduled_maintenance/

Unfortunately, no one posted how to take advantage of them. There is, fortunately, a README that contain a changelog and what seems to be an API. I will dig for further info.
[Off-topic] checkmateyou:
I have successfully added a Philips Hue bulb to the Wink Hub. Dimming and turning it off and on works, but I cannot change the color.

I have no idea how you added new attributes; could you please explain what you did, and possibly step by step please? I would very much appreciate it!
[Off-topic] Jcordeiro73:
Help...

Hi

I have a problem with my wink. I have console acces but here is the output.

Please someone help me :)

Thanks

Loading file 'DO_UPDATE' to addr 0x42000000 with size 1 (0x00000001)...

Done

word at 0x42000000 (0x31) != word at 0x42000004 (0x30)

Total of 0 word(s) were the same

NAND read: device 0 offset 0x300000, size 0x300000

3145728 bytes read: OK

Wrong Image Format for bootm command

ERROR: can't get kernel image!

NAND read: device 0 offset 0x2b00000, size 0x400000

4194304 bytes read: OK

Wrong Image Format for bootm command

ERROR: can't get kernel image!

Falling back to updater...

NAND read: device 0 offset 0x300000, size 0x300000

3145728 bytes read: OK

Wrong Image Format for bootm command

ERROR: can't get kernel image!

NAND read: device 0 offset 0x2b00000, size 0x400000

4194304 bytes read: OK

Wrong Image Format for bootm command

ERROR: can't get kernel image!

=> printenv

app_boot=run appboot_args && nand read ${loadaddr} app-kernel 0x00400000 && boot m ${loadaddr}

app_boot_bad=run updater_args; setenv bootargs ${bootargs} badapp; nand read ${l oadaddr} updater-kernel 0x00300000; bootm ${loadaddr}

appboot_args=setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ub i.mtd=5 root=ubi0:rootfs rw gpmi';

baudrate=115200

bd_addr=0021CC0892FA

boot_app=run app_boot || run app_boot_bad

boot_getflag=mtdparts default && ubi part database && ubifsmount ubi0:database & & mw 42000000 0 8 && ubifsload 42000000 DO_UPDATE 1 && run boot_logic

boot_logic=mw 42000004 30; if cmp 42000000 42000004 1; then run boot_app; else r un boot_updater; fi;

boot_updater=run updater_boot || run updater_boot_bad

bootargs=noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:roo tfs rw gpmi badupdater

bootcmd=mtdparts default; run boot_getflag || echo Falling back to updater...; r un boot_updater

bootdelay=0

bootfile=uImage

ethact=FEC0

ethaddr=00:04:00:00:00:00

ethprime=FEC0

filesize=1

loadaddr=0x42000000

mtddevname=u-boot

mtddevnum=0

mtdids=nand0=gpmi-nand

mtdparts=mtdparts=gpmi-nand:3m(u-boot),4m(updater-kernel),28m(updater-rootfs),8m (database),8m(app-kernel),-(app-rootfs)

partition=nand0,0

serialno=152201021WZD1

stderr=serial

stdin=serial

stdout=serial

updater_args=setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ub i.mtd=2 root=ubi0:rootfs rw gpmi';

updater_boot=run updater_args && nand read ${loadaddr} updater-kernel 0x00300000 && bootm ${loadaddr}

updater_boot_bad=run appboot_args; setenv bootargs ${bootargs} badupdater; nand read ${loadaddr} app-kernel 0x00400000; bootm ${loadaddr}

ver=U-Boot 2014.01-14400-gda781c6-dirty (Apr 30 2014 - 22:35:38)
[Off-topic] paulv123:
Hi , I had a similar although different error today. I executed the "app_boot_bad" argruments and that got me going again.

Hope this helps

app_boot_bad=run updater_args; setenv bootargs ${bootargs} badapp; nand read ${loadaddr} updater-kernel 0x00300000; bootm ${loadaddr}
[Off-topic] enishoca:
Database stops working

I have rooted wink hub on 2.19 and it stops responding to the wink app and no lights turn on or off within 10 to 15 minutes of restarting - the hub is rooted, and when its in this state aprontest -l says:

Found -1 devices in database...

Couldn't get devices

Couldn't get groups

also /database becomes readonly.

now interestingly if I block external access it keeps working - so I am wondering if there still some update thing going on that breaking. Anyone else run into something similar?
[Off-topic] jbastien:
Wink Hub - easy root at anytime with console and ssh access

* Proceed with linking Wink hub with WinkApp

* Accept updates (note old php service are gone)

* open case; solder a 3-pin header

*connect a Serial2USB - TTL to RS-232 USB adapter

*solder wire to pin 29 to a micro switch to ground

*make all connections [Serial2USB] connect to PC

*on PC (terminal commands)

> minicom -s [select proper device; 112500 8N1]

> power up Wink-Hub, quickly de-press micro switch until you see UBOOT prompt “==>”

editenv appboot_args

*add: init=/bin/sh

*It needs to look like this: setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi init=/bin/sh';

saveenv

reset

*Wink-Hub will reboot with console access

*Enable SSH

echo “1” > /database/ENABLE_SSH

*on PC create ssh cert & key

ssh-keygen -t rsa

*Copy content of ~/.ssh/id_rsa.pub into clipboard

*back in minicom

echo “[PASTE id_rsa.pub FROM CLIPBOARD]” > /database/authorized_keys

*make copy of it just incase a Wink update happens

cp /database/authorized_keys /database/authorized_keys.bk

*change root password

passwd

*Enable tty via serial

nano /etc/inittab

*remove comment char (#) from line that say:

ttyAM0::respawn:/sbin/getty -L ttyAM0 115200 vt100 # GENERIC_SERIAL

*Reboot Wink-Hub and REVERT UBOOT change in bullet 6 (b)(c) remove init=/bin/sh ; 6 (f)(g)

*SSH into Wink-Hub

ssh root@IP-OF-WINK-HUB

Final View:

Now with firmware version 2.19.0 - node.js is installed and old php system gone. see attached /opt/local_control/README.md from Hub Link.
[Off-topic] LivinOne:
[MENTION=1411460]jbastian[/MENTION], that the procedure to root? Still doesn't provide local api access, correct?
[Off-topic] jbastien:
Well,

All remote devices would have to be associated using the mobile WinkApp.

And control it all via ssh > /usr/sbin/aprond command

Or use the available Serial access (I'm using it this way to with a Raspberry Pi)
[Off-topic] holmes6:
Sorry for the dumb question, but I don't have a Micro Switch.. Could you link where to order one or explain some alternate for that step? (edit: I ordered some micro switches)

I just ordered http://us.banggood.com/Wholesale-Wa...-Switch-Push-Button-DIP-P4-wp-Usa-917570.html

looks like I'll have 99 extras, lol
[Off-topic] jbastien:
You can buy one for $0.30 from Digi-Key part#: 450-1759-1-ND, but what you ordered should do the trick. You'll have to bend the pins a bit.
[Off-topic] Harj05:
Can't ssh into the hub

After i've entered the first two curl commands, I'm still not able to ssh into the hub (Connection refused error).

Any suggestions ?
[Off-topic] mdleal:
Rooted wink will not boot unless I stop the boot process and run "nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}" I do not have the USB to TTL adapter and bootdelay is set to 0. Ideas?
[Off-topic] filon:
Hi gurus. I bought sealed Wink with version 00.01. Rooted it up.

It obviously failing to connect to the app or to update servers.

/root/platform/upgrade.sh fails with curl SSL verification.

Willing to upgrade and not really want to FTDI to it at the moment.

What I tried so far:

1. Replacing of /root/config/ca1-cert.pem with cert from http://xdaforums.com/newreply.php?do=newreply&p=60218566.

2. echo "00.86" >/database/cf_fver3.

3. Tried adding nameserver 52.4.183.25 and nameserver 52.0.103.131 to /etc/resolv/.conf (starting to get "Warning: Transient problem: timeout Will retry in 1 seconds" instead of SSL)...

Is there a way to bring this to updated version from the current one? Thanks

=================================

My "problem" was solved after short reading of update scripts.

The solution is fairly easy. Comment out last string with curl parameter and add a new one with --insecured.

BTW, root is gone:)
[Off-topic] sniper222002:
Can anyone help me out? I accidentally deleted my /etc/init.d/S41wireless and didn't get a chance to back it up.

Could someone post theirs? (Can't get my network back) :)

Thanks!!
[Off-topic] theraapster:
Here is what mine looks like (I'm on 2.49, if that matters).

#!/bin/sh
#
# Start the wireless network....
#

case "$1" in
start)
if [ -f /database/wpa_supplicant.conf ]; then
if ! /root/wifi/run.sh; then
logger -p error -s "Failed to bring up wi-fi"
fi
#Launch the connection checker
/root/wifi/check_wifi.sh &
else
logger -p info -s "Not starting wifi, no wpa_supplicant.conf"
fi
;;
stop)
logger -p info -s "Stopping wifi network"
/root/wifi/stop.sh
;;
restart|reload)
"$0" stop
sleep 1
"$0" start
;;
*)
echo "Usage: $0 {start|stop|restart}"
exit 1
esac

exit $?
[Off-topic] sniper222002:
EXCELLENT!! Thanks, got my hub up and running.. for the most part. Keeps on rebooting and I narrowed it down to couple blank files :S

Could someone post

/opt/local_control/aau/http.js ??

and I believe "monitcs" or something like that... had localhost line in there and I went back in and it was blank. then hub went into reboot loop before I could fix it.. :S

Thanks again!! :)
[Off-topic] sniper222002:
it's located at /etc/monitrc

Thanks!!

---------- Post added at 03:39 PM ---------- Previous post was at 03:36 PM ----------

oh and I also noticed that if you put a 10K or bigger resistor across RX to 3.3v pad, you can have a boot delay of 1 (Could not get it to boot without a serial cable, but this did the trick).
[Off-topic] theraapster:
Here is /etc/monitrc

# monitrc: configure monit

# use syslog system daemon to log messages with a priority assigned to each message based on the context
set logfile syslog

# specify Monit's poll cycle length and run Monit in daemon mode
set daemon 15

# set up http interface on a localhost
set httpd port 2812 address 127.0.0.1
allow localhost

# set statefile to a tmp location so it gets blown away across reboots
set statefile /tmp/monit.state

check process ntpd matching "ntpd"
if memory is greater than 2 MB then alert
start program = "/etc/rc.d/init.d/ntp start"
stop program = "/etc/rc.d/init.d/ntp stop"

check process rsyslogd with pidfile /var/run/rsyslogd.pid
if memory is greater than 5 MB then alert
start program = "/etc/rc.d/init.d/logging start"
stop program = "/etc/rc.d/init.d/logging stop"

check process lutron-core with pidfile /var/run/lutron-core.pid
group wink-services
if cpu > 80% for 8 cycles then restart
if 8 restarts within 40 cycles then exec "/bin/sh -c 'reboot'"
start program = "/etc/rc.d/init.d/lutron start"
stop program = "/etc/rc.d/init.d/lutron stop"

check process ZigBeeHACoord with pidfile /var/run/ZigBeeHACoord.pid
group wink-services
if totalcpu > 80% for 8 cycles then restart
if 8 restarts within 40 cycles then exec "/bin/sh -c 'reboot'"
start program = "/etc/rc.d/init.d/zigbee start"
stop program = "/etc/rc.d/init.d/zigbee stop"

check process aprond with pidfile /var/run/aprond.pid
group wink-services
if cpu > 80% for 8 cycles then restart
if 8 restarts within 40 cycles then exec "/bin/sh -c 'reboot'"
start program = "/etc/rc.d/init.d/apron start"
stop program = "/etc/rc.d/init.d/apron stop"
depends on lutron-core
depends on ZigBeeHACoord

check process hub with pidfile /var/run/hub.pid
group wink-services
start program = "/etc/rc.d/init.d/wink start"
stop program = "/etc/rc.d/init.d/wink stop"
depends on aprond

check process localcontrol matching "node"
group wink-services
if cpu > 80% for 8 cycles then restart
if memory > 35 MB then restart
if 8 restarts within 40 cycles then exec "/bin/sh -c 'reboot'"
start program = "/etc/rc.d/init.d/localcontrol start"
stop program = "/etc/rc.d/init.d/localcontrol stop"

check system $HOST
if memory > 85% then exec "/bin/sh -c 'reboot'"
if cpu(user) > 75% for 40 cycles then exec "/bin/sh -c 'reboot'"
if cpu(system) > 75% for 40 cycles then exec "/bin/sh -c 'reboot'"
if loadavg(5min) is greater than 3 then alert
[Off-topic] sniper222002:
thank you all! Wink is back up and running error free! you guys rock!!

now, how the heck to I get this working with OpenHAB... :S I can get a list of devices on the Hub with the list command, SSH in without a key, just a password... back to scratching my head on how to intergrate this! lol :)
[Off-topic] sniper222002:
did notice that if you solder a 10k resistor to RX and 3.3V pad the hub boots with bootdelay 5 :)

---------- Post added at 06:06 AM ---------- Previous post was at 06:05 AM ----------

Just curious, checked /sbin/ifup and it looks like jibbrish.. could someone confirm? maybe post for comparison?

Thanks!!
[Off-topic] zeroepoch:
You can just short them with a jumper wire. It just needs a constant high voltage to think it's connected but nothing transmitting. I've had mine like this with a 1 sec boot delay for over 6 months probably and it works perfectly. I've even updated the hub firmware a number of times since doing this and the boot delay is still there. I also have headers soldered on my hub so that makes it much easier to jumper.
[Off-topic] sniper222002:
Just curious, checked /sbin/ifup and it looks like jibbrish.. could someone confirm? maybe post for comparison?

Thanks!!
[Off-topic] dick99999:
'quickly de-press' meaning quickly press and hold the button down?
[Off-topic] dick99999:
Mine seems a simlink to busybox

lrwxrwxrwx 1 14 Feb 1 02:58 ifconfig -> ../bin/busybox

lrwxrwxrwx 1 14 Feb 1 02:58 ifdown -> ../bin/busybox

lrwxrwxrwx 1 14 Feb 1 02:58 ifup -> ../bin/busybox

lrwxrwxrwx 1 14 Feb 1 02:58 init -> ../bin/busybox
[Off-topic] gsmhelper:
Hi all,

I got my hub rooted and changed couple things and now it's not working anymore.

I'm too old for this stuff, I let my son play with it. But he wants to start all over again by updated to the latest firmware and test out with normal "out of the box".

Then he will start to mess around with it for local access with new nodes.js language.

My question is how to reset this thing to the manufacture state? TIA
[Off-topic] e8link:
I just received a wink hub from amazon warehouse deals, so I suspect it's been updating to whatever newest firmware is available for the wink hub. Does anyone know if the latest firmware still allows the wink hub to be rooted? I would like to connect this to my smartthings setup for lutron caseta control.
[Off-topic] CAL7:
I want the same thing. But, my research tells me that if your hub is updated, it takes a soldering iron to root it. Please post if you find a method that is easier.
[Off-topic] dick99999:
Indeed that's what I did in March 2016, using the write up of jbastien. I'd like to have/make the 433MHz mode work for European 433Mhz equipment. Anybody any experience or hints?
[Off-topic] dick99999:
I can't help you with analysing the boot logs. Regarding the UART, I wonder whether you did the revert-step of jbastien's write up?

*Reboot Wink-Hub and REVERT UBOOT change in bullet 6 (b)(c) remove init=/bin/sh ; 6 (f)(g)
[Off-topic] CantSleepAWink:
Thanks!

I missed that step - and with reverting the change I made - it works!

setenv bootdelay 1

I've also assigned a static IP using the instructions found here:

hXXp dubya x3 dot rootwink dotcom /viewtopic.php?t=95

Happy winking!
[Off-topic] Quinn000:
I've been having a peculiar issue, the wifi driver (A broadcom DHD [Dongle Host Drive]) seems to be initializing correctly, but It returns a Wireless Event - TOO BIG error.

Also, whilst pairing the hub, the app will fail but the hub will connect and store the credentials in wpa_supplicant.config.

However the light does not turn blue and the serial monitor reports:

dhd_aoe_hostip_clr failed code -23

aoe_update_host_ipv4_table failed

dhd_aoe_hostip_clr failed code -23

aoe_update_host_ipv4_table failed

dhd_aoe_hostip_clr failed code -23

aoe_update_host_ipv4_table failed

dhd_aoe_hostip_clr failed code -23

aoe_update_host_ipv4_table failed

dhd_aoe_hostip_clr failed code -23

aoe_update_host_ipv4_table failed

dhd_aoe_hostip_clr failed code -23

aoe_update_host_ipv4_table failed

A ping to google reports proper network communication, I can even ping the wink servers...

This is starting to piss me off. I'm now assuming some kind of kernel/driver corruption but I have no idea what handles what and I don't feel like reverse engineering the OS.

How can I:

Reflash the uImage files to their corresponding kernel blocks

and

Where can I:

Get more info on the file structure

Get the original firmware for the 5 partitions (AS WELL AS THE DATABASE)

????

Is there not a way to reflash the entire file structure (including uBoot)? As in a NUKE and BOOT method? How the hell does WINK program these in the first place?
[Off-topic] rom1011:
No httpd on 2.66 firmware?

Has anyone a wink hub with the 2.66 firmware? It seems like they removed the httpd serving the static content and the entire /var/www/ directory. Only the node.sj server for the official API is still there. I was still able to root it using the NAND method but now I I can't run aprontest through http. Could still use ssh though. Did I miss something?
[Off-topic] Jeffrccar:
FYI, set_dev_value

If you lost http from upgrade:

set_dev_value.php

<?php
$nodeId = $_POST['nodeId'];
$attrId = $_POST['attrId'];
$v = $_POST['value'];

//$who = exec('whoami');
//echo $who;
//passthru("sudo ls", $retval);

//echo "nodeId=" .$nodeId . " attrId=" . $attrId . " value=" . $v;
$cmd = 'sudo ' . dirname(__FILE__) . '/php2apron set_value ' . $nodeId . " " . $attrId . " " . $v;

//echo $cmd . " ";

passthru($cmd, $retval);
echo "ret_code=" . $retval;

?>
[Off-topic] zeroepoch:
Something must have changed in the 3.3.25 update (wink hub 1) because I got an SSH host key warning and when I delete that and accept the new host key it denies my SSH private key. I've been using the same SSH key for a long time so that would leave me to believe it remove my public key or SSH was reset. I still have the boot timeout set (if not reverted) so I suppose I could use the original trick with the serial port to get root by overriding init, but I don't really have a strong need for root so I haven't tried it yet. Just wondering if anyone else noticed the same thing.
[Off-topic] t-o-f-u:
i saw the same thing and confirmed my key was still there and correct. the init script looked the same, too. i didn't check the passwd/shadow files, maybe they locked the root account?