Conversation

Notices

1. Embed this notice
   abrasive (abrasive@digipres.club)'s status on Monday, 08-Sep-2025 04:12:52 JST abrasive

   today we are harassing a burglar alarm system: a Bosch Solution 6000. apparently this is a high end residential/commercial system here in ANZ. despite the Bosch branding, it's designed and made by an Australian mob. despite being their current flagship, and a rev date of 2017, the design has some fascinatingly dated points: f. ex. it has an SLA battery charger which depends on a PCB-mounted filament light bulb, perhaps as a negative resistance? (over on the left)

   • Embed this notice
     ✧✦Catherine✦✧ (whitequark@mastodon.social)'s status on Monday, 08-Sep-2025 04:12:47 JST ✧✦Catherine✦✧

     in reply to

     @abrasive hell yeah ^^

   • Embed this notice
     abrasive (abrasive@digipres.club)'s status on Monday, 08-Sep-2025 04:12:48 JST abrasive

     in reply to

     • ✧✦Catherine✦✧

     @whitequark mate you absolutely smashed it

     tested program-m16c with glasgow commit d7db593e8025406432dd963766c31c5660047be7

     using the cnvss pin, as the target requires it

     read, erase-block, erase, and program all had the expected effects
     sync happily achieved at baud rates 9600, 19200, 38400, 57600 and 115200
     target initially had a custom key; I appreciated the small smoothness of the default keys still being tried when --key is supplied, so no futzing after an erase

     thank you!!

   • Embed this notice
     abrasive (abrasive@digipres.club)'s status on Monday, 08-Sep-2025 04:12:49 JST abrasive

     in reply to

     It looks like I'm not the only person who thinks this is unconscionable; someone on the Austech forums posted this handy unlocker that just needs a 5V serial port (either the official "Bosch" DF266 programming cable, or whatever TTL adapter): https://pastebin.com/ujj2Q6Tg

     It looks like a pretty simple challenge-response type thing, unsurprisingly.

     Note that the M16C pins *need* a 5V input, a 3.3V UART won't hit Vih

   • Embed this notice
     abrasive (abrasive@digipres.club)'s status on Monday, 08-Sep-2025 04:12:49 JST abrasive

     in reply to

     for anyone else silly enough to do this, the serial header is -

     1: unregulated 12V !! careful
     3: bootloader mode? tie this to gnd
     4: Rx (input to the M16C)
     5: Tx
     6: CNVss (bootloader entry control)
     9: /reset
     10: gnd

     ✧✦Catherine✦✧ repeated this.
   • Embed this notice
     abrasive (abrasive@digipres.club)'s status on Monday, 08-Sep-2025 04:12:50 JST abrasive

     in reply to

     Before I get into it though I want to have a big rant about one of their design choices. In order to program the system (or change settings later), you need the installer code. Traditionally whoever installs the alarm sets this, and does not give it to the owner. This locks the owner in to using that installer in the future.

     You can reset the installer code on this board. But to do that, you have to buy an expensive ($150+) plug-in board - that turns itself into e-waste after a single use!

   • Embed this notice
     abrasive (abrasive@digipres.club)'s status on Monday, 08-Sep-2025 04:12:51 JST abrasive

     in reply to

     Another dated bit is hiding under the plastic cover - a modem! The Australian PSTN is supposed to be retired this year but in most residential areas it's been gone for years.

     This modem chipset is kind of cool, it's a Si2400 "ISOmodem". The idea is that this replaces the traditional big expensive isolation transformer with a pair of high-voltage capacitors, providing an isolated data (and possibly power) link to a second chip on the line side which handles the analog business. Neat!

   • Embed this notice
     abrasive (abrasive@digipres.club)'s status on Monday, 08-Sep-2025 04:12:51 JST abrasive

     in reply to

     • ✧✦Catherine✦✧

     And the reason we're here: this shebang is driven by a Renesas M16C micro, which makes me wonder when that decision dates from. @whitequark has added M16C bootloader support to the Glasgow Interface Explorer, so I'm going to give it a burl.