---
# System prepended metadata

title: C300X notes

---

# C300X notes

## How to send commands?

https://github.com/mvalla/openwebnet4j

## TODO

1)
* koush (main programmer) said we could add validation to the UI, so we will do that, the from/to/domain fields need validation that it is mandatory, they use a specific vue framework, it shouldn't be too hard
* we need to implement the Lock interface on our main.ts class and implement the unlock() function (lock() would be empty) - we know how to unlock() via a SIP MESSAGE call - nothing much needs to be written I think for sending the SIP MESSAGE
* the unlock code for the SIP message should be changeable in the UI
* nice to have: specific to scripted, but allow that the user can select another lock device instead of using the lock from the camera (for example if you install another button)

2) we need to implement an incoming call
* we need to re-add tcp transports and make sure they work (they were there before but removed them because UDP would be good enough)
* i want to cleanup the SIP to: field a bit
* we need to add an incomingCall() handler so we can handle the incoming doorbell call (not so difficult as it sounds)
* nice to have: also provide an MQTT output device

3) we need to fix audio out
* right now we have working: incoming audio and video but the microphone output is not handled - this should make the "Talk" button work in homekit

## Popular TCP/UDP ports + their communication way + (pid)

```
5060 = bt_answering_machine-> (452)
7667 = dbus-daemon 346 + bt_dbus_manager 456 (openserver, gmain, bt_answer, bt_mh, SmartToolHLS, dbus, bt_ipcamera (457)
20000 = openserver (447), BTClass->
20001 = bt_vct (450)->, scsserver (448)
30006 = bt_vct (450)
30007 = bt_av_media (451)
31006 = bt_vct (450), openserver-> (447)
31007 = bt_vct (450), openserver-> (447)
31007 = bt_av_media (451)
31013 = 
38844 = bt_vct-> (450)
40000 = openserver (447) (nobody?)
40005 = openserver (447) (nobody?)
udp/47377 = bt_answering_machine
udp/:49835 = SmartToolHLS
udp/51347 = bt_ipcamera (457)
tcp/60000 = mosquitto (371), bt_answering_machine-> (452), bt_av_media-> (451), BTClass-> (459), bt_ipcamera-> (457), bt_dbus_manager-> (456)
```

## Commands found by sniffing port 20000 and UI

```
WHO 130 = SmartToolHLS

*#130**1## => SmartToolHLS (for update check) reply = *#130**1*2## ?
*99*9##*#130**1## -> supersocket reply = *#130**1*2## ?

*7*73#0#100*## => screen off
*7*73#1#10*##  => screen 10% brightnes = dimmed?
*7*73#1#100*## => screen on

sounds and ringtones
*#8**41*60##
*8*99*##
*7*58#8#0#0**##
*#7**#31#2#0*60##
*7*73#1#100*##
*7*59#8#0#0*## => sound off?
*#8**#41*60##*8*99*##*7*58#8#0#0**##
/sounds

*8*3#6#2*410## when turning screen off

*8*21*10## => staircase lights + *8*22*10## (when using Door Entry app)

*#8**40*1*0*1173*1*25## => answering machine on ?
*#8**40*0*0*1173*1*25## => answering machine off

*8*80#6#2*10## when turning screen on (list answering machine status?)

door auto unlock on >  *8*83#1*##
door auto unlock off =>  *8*83#0*##

mute on => *#8**#33*1##
mute off => *#8**#33*0##

call forwarding disabled => *#8**37*0##
call forwarding enabled => *#8**37*2##
```

## MQTT and C300X

Mosquitto runs on port 60000
You can make it listen on 0.0.0.0 by changing bind_addr in:

```conf
# grep bind /etc/mosquitto/mosquitto.conf
# IP address/hostname to bind the default listener to. If not
# bind_address ip-address/host name
bind_address 0.0.0.0
```

Reboot and connect with MQTT explorer :)

At the moment the MQTT only gets/send traffic related to the netatmo camera integration e.g.:

Enable netatmo integration

```
netatmo.setStatus {"jsonrpc":"2.0","method":"netatmo.setStatus","id":"e01fba4a-00fa-a032-cbea-ef314c6a2f66","activate":true}
netatmo.setStatus.e01fba4a-00fa-a032-cbea-ef314c6a2f66 {"jsonrpc":"2.0","id":"e01fba4a-00fa-a032-cbea-ef314c6a2f66","result":true}
MONITOR {"jsonrpc":"2.0","method":"netatmo.onStatus","params":[{"active":true,"presence":false,"status":"WAITCRED","operation":"full auth","network":"connected"}]}
```

Login to netatmo account without UI

```
netatmo.setLogin {"jsonrpc":"2.0","method":"netatmo.setLogin","id":"3eab72f1-e9e9-1e87-4fd9-071a3dc6deeb","data1":"Z2g=","data2":""}
```

## When you change the language in the GUI you see in the logs:

```
<ops>	Somethings in /var/tmp/conf.xml change, update my data
<ops>	!!! UPDATE: HMAC enable with password own "Would you like to know right ;)" !!!
```
    
WTF!
    
    
## openwebnet 
    
This password is found in `/var/tmp/conf.xml`:
    
```xml
        <sicurezza>
            <authentication>
                <hmac>1</hmac>
            </authentication>
            <pwd_open>3herereree3</pwd_open>
        </sicurezza>
```        
    
The password for the installer menu is 12345 and also found here:
    
```xml
<password>
    <enabled>0</enabled>
    <pwd>12345</pwd>
</password>
```

## Config dirs:

/home/btcino/cfg/extra/0 : 
/home/btcino/cfg/extra/7 : 
/home/btcino/cfg/extra/47 : 
/home/btcino/cfg/extra/70 : 
/home/btcino/cfg/extra/72 : 
/home/btcino/cfg/extra/84 : 
/home/btcino/cfg/extra/90 : 
/home/btcino/cfg/extra/91 : 

## Processes

| Process     | Function    |
| ----------- | ----------- |
| SmartToolHLS      | Firmware check and registration?       |
| openserver   | parses #* commands in openwebnet format        |
| BtClass* | GUI from intercom |
| flexisip | embedded SIP server |
| scsserver | server that communicates with the relay ? |
| bt_dbus_manager | distributed bus? |
| bt_answering_machine | picks up calls to record voice messages but also to view camera |
| bt_device | ? |
| bt_av_media | ? |
| configuration_manager | ? |
| bt_mhportal | registers your device into the legrand portal (for support?) |
| bt_ipcamera | ? |
| bt_scs |<bus_type>0</bus_type> <device>/dev/ttymxc1</device>|
| connmand |?|

## scsserver commands

```
*06*03*01*01*$0496A06FA4#
*01*01# <-

*06*02#*06*03*01*01*$0496A06FA0#
*01*01# <-

*06*02#*06*03*01*01*$0496A06FA4#
*01*01# <-

*06*02#*06*03*01*01*$0496A06FA0#
*01*01# <-
*06*02#
```

## Installing node on C300X

If you want to mess around with node on your intercom (do some programming), you can:

* The lastest nodejs version that is linked to the libc version of the intercom (version 27) is node v17.9.1

* login to your C300X  then make an extra directory and fetch the tar file

```
cd /home/bticino/cfg/extra
mkdir node
cd node
wget https://nodejs.org/download/release/latest-v17.x/node-v17.9.1-linux-armv7l.tar.gz
```

nodejs requires a shared file that is not present on the device (libatomic)

since all these are derived from the same base distro's I fetched the .deb files from http://ftp.de.debian.org/debian/pool/main/g/gcc-10-cross/

I downloaded 

```
http://ftp.de.debian.org/debian/pool/main/g/gcc-10-cross/libatomic1-armhf-cross_10.2.1-6cross1_all.deb
```

You may want to do that on a linux machine and extract it with

```
ar -x libatomic1-armhf-cross_10.2.1-6cross1_all.deb
tar -xvf data.tar.xz
cd usr/arm-linux-gnueabihf/lib
```

copy these two files to the intercom and place them in /lib

it now looks like this:

```
root@C3X:/lib# ls -al libatom*
-rw-r--r-- 1 root root 21828 Jan 19 10:38 libatomic.so.1
-rw-r--r-- 1 root root 21828 Jan 19 10:38 libatomic.so.1.2.0
root@C3X-00-03-50-b5-f6-ca-2193475:/lib#
```

You got everything you need to run node, on your C300X go back to your directory and extract node

```
cd /home/bticino/cfg/extra/node
tar xvfz node-v17.9.1-linux-armv7l.tar.gz
./bin/node
```

If you want to add them to the path edit the file /etc/profile

Make it look this this:

```
# /etc/profile: system-wide .profile file for the Bourne shell (sh(1))
# and Bourne compatible shells (bash(1), ksh(1), ash(1), ...).

PATH="/home/bticino/cfg/extra/node/bin:/usr/local/bin:/usr/bin:/bin"
```

## spying on 7667 broadcast communication with node

blabla later

## Python 3.6 on C300X with a script

```sh
#!/bin/sh

# download .deb from Ubuntu repository
wget -q -N http://launchpadlibrarian.net/636018265/python3.6-minimal_3.6.9-1~18.04ubuntu1.9_armhf.deb
wget -q -N http://launchpadlibrarian.net/636018261/libpython3.6-stdlib_3.6.9-1~18.04ubuntu1.9_armhf.deb
wget -q -N http://launchpadlibrarian.net/636018262/libpython3.6_3.6.9-1~18.04ubuntu1.9_armhf.deb
wget -q -N http://launchpadlibrarian.net/636018267/python3.6_3.6.9-1~18.04ubuntu1.9_armhf.deb
wget -q -N http://launchpadlibrarian.net/636018260/libpython3.6-minimal_3.6.9-1~18.04ubuntu1.9_armhf.deb

# open .deb files and extract files
ar -x python3.6-minimal_3.6.9-1~18.04ubuntu1.9_armhf.deb
tar -xf data.tar.xz
ar -x libpython3.6-stdlib_3.6.9-1~18.04ubuntu1.9_armhf.deb
tar -xf data.tar.xz
ar -x libpython3.6_3.6.9-1~18.04ubuntu1.9_armhf.deb
tar -xf data.tar.xz
ar -x python3.6_3.6.9-1~18.04ubuntu1.9_armhf.deb
tar -xf data.tar.xz
ar -x libpython3.6-minimal_3.6.9-1~18.04ubuntu1.9_armhf.deb
tar -xf data.tar.xz

# download pip from Debian repository
# wget -q -N http://security.debian.org/debian-security/pool/updates/main/p/python-pip/python3-pip_9.0.1-2+deb9u2_all.deb
# wget -q -N http://security.debian.org/debian-security/pool/updates/main/p/python-pip/python-pip-whl_9.0.1-2+deb9u2_all.deb
# wget -q -N http://security.debian.org/debian-security/pool/updates/main/p/python-pip/python-pip_9.0.1-2+deb9u2_all.deb
# wget -q -N http://security.debian.org/debian-security/pool/updates/main/p/python-urllib3/python3-urllib3_1.19.1-1+deb9u1_all.deb
wget -q -N http://ftp.es.debian.org/debian/pool/main/p/python-paho-mqtt/python3-paho-mqtt_1.5.1-1_all.deb
# wget -q -N http://launchpadlibrarian.net/353997362/python3-paho-mqtt_1.3.1-1_all.deb

# # open .deb files and extract files
# ar -x python3-pip_9.0.1-2+deb9u2_all.deb
# tar -xf data.tar.xz
# ar -x python-pip-whl_9.0.1-2+deb9u2_all.deb
# tar -xf data.tar.xz
# ar -x python-pip_9.0.1-2+deb9u2_all.deb
# tar -xf data.tar.xz
# ar -x python3-urllib3_1.19.1-1+deb9u1_all.deb
# tar -xf data.tar.xz
ar -x python3-paho-mqtt_1.5.1-1_all.deb
tar -xf data.tar.xz

# download pip from Ubuntu repository
wget -q -N https://launchpad.net/ubuntu/+source/python-pip/9.0.1-2/+build/11848026/+files/python-pip-whl_9.0.1-2_all.deb
wget -q -N https://launchpad.net/ubuntu/+source/python-pip/9.0.1-2/+build/11848026/+files/python3-pip_9.0.1-2_all.deb
wget -q -N https://launchpad.net/ubuntu/+source/python-pip/9.0.1-2/+build/11848026/+files/python-pip_9.0.1-2_all.deb

# open .deb files and extract files
ar -x python-pip-whl_9.0.1-2_all.deb
tar -xf data.tar.xz
ar -x python3-pip_9.0.1-2_all.deb
tar -xf data.tar.xz
ar -x python-pip_9.0.1-2_all.deb
tar -xf data.tar.xz

echo "Open new terminal, connect to Bticino and write this command:"
echo "  mount -oremount,rw /"
echo "Don't close your terminal and press any key to continue when done."
read pause

echo "Copy files to Bticino"
# copy files to /usr/bin
# scp -r example root@147.182.143.27:/home/remote_dir
scp -r usr/bin/ bticino:/usr/
scp -r usr/lib/ bticino:/usr/
scp -r usr/share/python-wheels/ bticino:/usr/share/

echo "Remember go to Bticino terminal and write this command to make partition read-only:"
echo "mount -oremount,ro /"

```

## Python 3.6 on C300X

Python 3.5 is on it but is completely stripped of of modules.

The 3.6 version is libc compatible.

Download all these .deb files:

http://launchpadlibrarian.net/500216402/python3-urllib3_1.22-1ubuntu0.18.04.2_all.deb
http://launchpadlibrarian.net/356487925/python3-six_1.11.0-2_all.deb
http://launchpadlibrarian.net/392789389/python3-requests_2.18.4-2ubuntu0.1_all.deb
http://launchpadlibrarian.net/647055408/python3-setuptools_39.0.1-2ubuntu0.1_all.deb
http://launchpadlibrarian.net/540553979/python3-pip_9.0.1-2.3~ubuntu1.18.04.5_all.deb
http://launchpadlibrarian.net/449402975/python3-distutils_3.6.9-1~18.04_all.deb
http://launchpadlibrarian.net/647055407/python3-pkg-resources_39.0.1-2ubuntu0.1_all.deb
http://launchpadlibrarian.net/363026904/python3-retrying_1.3.3-3_all.deb
http://launchpadlibrarian.net/360197292/python3-packaging_17.1-1_all.deb
http://launchpadlibrarian.net/235674915/python3-progress_1.2-1_all.deb

```
-rw-rw-r--  1 hass hass  524592 Nov 25 22:46 libpython3.6-minimal_3.6.9-1~18.04ubuntu1.9_armhf.deb
-rw-rw-r--  1 hass hass 1637984 Nov 25 22:46 libpython3.6-stdlib_3.6.9-1~18.04ubuntu1.9_armhf.deb
-rw-rw-r--  1 hass hass 1343684 Nov 25 22:46 python3.6-minimal_3.6.9-1~18.04ubuntu1.9_armhf.deb
-rw-rw-r--  1 hass hass  202788 Nov 25 22:46 python3.6_3.6.9-1~18.04ubuntu1.9_armhf.deb
```

I started from the bionic build:

https://launchpad.net/ubuntu/bionic/armhf/libpython3.6-minimal/3.6.9-1~18.04ubuntu1.9

https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+build/24869636 are probably the recommended .deb files to install

Please paste the download links below F:

http://launchpadlibrarian.net/636018260/libpython3.6-minimal_3.6.9-1~18.04ubuntu1.9_armhf.deb

and so on :)

Put them all in the same directory and then

```
ar -x libatomic1-armhf-cross_10.2.1-6cross1_all.deb
tar -xvf data.tar.gz

... repeat for the 4 files ...



```

now copy `/usr/lib/python3.6` to your C300X

and `/usr/bin/*.3.6`

I did not bother copying the share directory

To install python pip:

https://launchpad.net/ubuntu/+source/python-pip/9.0.1-2/+build/11848026

(I only installed https://launchpad.net/ubuntu/zesty/amd64/python-pip-whl/9.0.1-2)

So you can try if it works if you also install the 2 other .deb files
