So for a while I’ve been looking at hacking into the wink hub 2. I’ve had it for a number of years and so far it has just worked for what I needed it for. Then wink starts with the subscription nonsense and this morning it refused to connect at all. So time to take it apart.
It’s a pretty easy disassemble.
- 2 screws under the rubber bumper on the device.
- Pull the base free, you’ll see the bottom edge of the PCB.
- The one side snaps of with a little bit of pressure separating the 2 halves. I used a spudger to help it along.
Awesome looks like there are headers on the board again. Lets see the other side.
They were even kind enough to label all of them. So I soldered on a UART header and connected up my FTDI cable.
No surprise here, it’s running u-boot
U-Boot 2015.04 (Sep 02 2016 - 20:09:54)
CPU: Freescale i.MX6UL rev1.1 at 396 MHz
CPU: Temperature 30 C
Reset cause: POR
Board: MX6UL Flex Wink Hub V2
I2C: ready
DRAM: 512 MiB
NAND: 128 MiB
In: serial
Out: serial
Err: serial
Net: FEC0
Normal Boot
Hit any key to stop autoboot: 0
UBI: attaching mtd1 to ubi0
UBI: scanning is finished
UBI: attached mtd1 (name "mtd=2", size 10 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 80, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 1444/964, WL threshold: 4096, image sequence number: 720637420
UBI: available PEBs: 0, total reserved PEBs: 80, PEBs reserved for bad PEB handling: 20
Loading file 'DO_UPDATE' to addr 0x83000000 with size 1 (0x00000001)...
Done
Total of 1 word(s) were the same
Loading from nand0, offset 0x3700000
Image Name: Linux-3.14.52
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 50856042 Bytes = 48.5 MiB
Load Address: 80800000
Entry Point: 80800000
Secure boot on, reading 50868256 bytes to get SRK data
Authenticate image from DDR location 0x80800000...
Secure boot enabled
HAB Configuration: 0xcc, HAB State: 0x99
No HAB Events Found!
and Linux
Booting Linux on physical CPU 0x0
Linux version 3.14.52 (ubuntu@a1b25e96d169) (gcc version 5.3.0 (Buildroot 2016.05) ) #2 PREEMPT Tue Jun 11 19:47:11 UT9
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine model: Wink Hub2 / Flex 40-00041-01
cma: CMA: reserved 192 MiB at 94000000
Memory policy: Data cache writeback
CPU: All CPU(s) started in SVC mode.
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 130048
Kernel command line: console=ttymxc0,115200 mtdparts=gpmi-nand:3m(boot),32m(updater),10m(database),10m(dbBackup),-(app)
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 269128K/524288K available (6092K kernel code, 309K rwdata, 1888K rodata, 44846K init, 378K bss, 255160K reserv)
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
vmalloc : 0xa0800000 - 0xff000000 (1512 MB)
lowmem : 0x80000000 - 0xa0000000 ( 512 MB)
modules : 0x7f000000 - 0x80000000 ( 16 MB)
.text : 0x80008000 - 0x807d32a0 (7981 kB)
.init : 0x807d4000 - 0x8339f9f4 (44847 kB)
.data : 0x833a0000 - 0x833ed5a0 ( 310 kB)
.bss : 0x833ed5ac - 0x8344bdbc ( 379 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Preemptible hierarchical RCU implementation.
NR_IRQS:16 nr_irqs:16 16
Switching to timer-based delay loop
sched_clock: 32 bits at 3000kHz, resolution 333ns, wraps every 1431655765682ns
clocksource_of_init: no matching clocksources found
Console: colour dummy device 80x30
Calibrating delay loop (skipped), value calculated using timer frequency.. 6.00 BogoMIPS (lpj=30000)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x805d2980 - 0x805d29d8
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
pinctrl core: initialized pinctrl subsystem
regulator-dummy: no parameters
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
cpuidle: using governor ladder
cpuidle: using governor menu
Use WDOG1 as reset source
syscon 20c8000.anatop: regmap [mem 0x020c8000-0x020c8fff] registered
vdd3p0: 2625 <--> 3400 mV at 3000 mV
cpu: 725 <--> 1450 mV at 1150 mV
vddsoc: 725 <--> 1450 mV at 1175 mV
syscon 20e4000.iomuxc-gpr: regmap [mem 0x020e4000-0x020e7fff] registered
syscon 21ac000.romcp: regmap [mem 0x021ac000-0x021affff] registered
syscon 21bc000.ocotp-ctrl: regmap [mem 0x021bc000-0x021bffff] registered
hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
hw-breakpoint: maximum watchpoint size is 8 bytes.
imx6ul-pinctrl 20e0000.iomuxc: initialized IMX pinctrl driver
20dc000.gpc supply pu not found, using dummy regulator
bio: create slab <bio-0> at 0
mxs-dma 1804000.dma-apbh: initialized
wlreg_on: 3300 mV
i2c-core: driver [max17135] using legacy suspend method
i2c-core: driver [max17135] using legacy resume method
SCSI subsystem initialized
i2c i2c-0: IMX I2C adapter registered
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
PTP clock support registered
MIPI CSI2 driver module loaded
Bluetooth: Core ver 2.18
NET: Registered protocol family 31
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
Switched to clocksource mxc_timer1
cfg80211: Calling CRDA to update world regulatory domain
NET: Registered protocol family 2
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Bus freq driver module loaded
futex hash table entries: 256 (order: -1, 3072 bytes)
NFS: Registering the id_resolver key type
Key type id_resolver registered
Key type id_legacy registered
jffs2: version 2.2. (NAND) �© 2001-2006 Red Hat, Inc.
fuse init (API version 7.22)
msgmni has been set to 909
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
imx-weim 21b8000.weim: Driver registered.
MIPI DSI driver module loaded
MIPI DSI driver module loaded
imx-sdma 20ec000.sdma: no event needs to be remapped
imx-sdma 20ec000.sdma: loaded firmware 3.2
imx-sdma 20ec000.sdma: initialized
Serial: IMX driver
2018000.serial: ttymxc6 at MMIO 0x2018000 (irq = 71, base_baud = 5000000) is a IMX
2020000.serial: ttymxc0 at MMIO 0x2020000 (irq = 58, base_baud = 5000000) is a IMX
console [ttymxc0] enabled
21e8000.serial: ttymxc1 at MMIO 0x21e8000 (irq = 59, base_baud = 5000000) is a IMX
21ec000.serial: ttymxc2 at MMIO 0x21ec000 (irq = 60, base_baud = 5000000) is a IMX
21f0000.serial: ttymxc3 at MMIO 0x21f0000 (irq = 61, base_baud = 5000000) is a IMX
21f4000.serial: ttymxc4 at MMIO 0x21f4000 (irq = 62, base_baud = 5000000) is a IMX
serial: Freescale lpuart driver
[drm] Initialized drm 1.1.0 20060810
[drm] Initialized vivante 1.0.0 20120216 on minor 0
brd: module loaded
loop: module loaded
nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xf1
nand: Micron MT29F1G08ABAEAWP
nand: 128MiB, SLC, page size: 2048, OOB size: 64
gpmi-nand 1806000.gpmi-nand: enable the asynchronous EDO mode 5
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
5 cmdlinepart partitions found on MTD device gpmi-nand
Creating 5 MTD partitions on "gpmi-nand":
0x000000000000-0x000000300000 : "boot"
0x000000300000-0x000002300000 : "updater"
0x000002300000-0x000002d00000 : "database"
0x000002d00000-0x000003700000 : "dbBackup"
0x000003700000-0x000008000000 : "app"
gpmi-nand 1806000.gpmi-nand: driver registered.
spi_imx 2008000.ecspi: probed
2188000.ethernet supply phy not found, using dummy regulator
pps pps0: new PPS source ptp0
libphy: fec_enet_mii_bus: probed
fec 2188000.ethernet eth0: registered PHC device 0
snvs_pwrkey 20cc000.snvs-pwrkey: can't get snvs clock
input: 20cc000.snvs-pwrkey as /devices/soc0/soc.0/2000000.aips-bus/20cc000.snvs-pwrkey/input/input0
snvs_pwrkey 20cc000.snvs-pwrkey: i.MX snvs powerkey probed
snvs_rtc 20cc034.snvs-rtc-lp: can't get snvs-rtc clock
snvs_rtc 20cc034.snvs-rtc-lp: rtc core: registered 20cc034.snvs-rtc-lp as rtc0
i2c /dev entries driver
i2c-core: driver [mag3110] using legacy suspend method
i2c-core: driver [mag3110] using legacy resume method
imx2-wdt 20bc000.wdog: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
Bluetooth: HCI UART driver ver 2.2
Bluetooth: HCI H4 protocol initialized
Bluetooth: HCI BCSP protocol initialized
Bluetooth: HCIATH3K protocol initialized
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
sdhci-pltfm: SDHCI platform and OF driver helper
sdhci-esdhc-imx 2190000.usdhc: assigned as wifi host
mmc0: no vqmmc regulator found
mmc0: no vmmc regulator found
mmc0: SDHCI controller on 2190000.usdhc [2190000.usdhc] using ADMA
caam 2140000.caam: Instantiated RNG4 SH0
caam 2140000.caam: Instantiated RNG4 SH1
caam 2140000.caam: device ID = 0x0a160300 (Era 8)
caam 2140000.caam: job rings = 3, qi = 0
caam algorithms registered in /proc/crypto
caam_jr 2141000.jr0: registering rng-caam
platform caam_sm: blkkey_ex: 8 keystore units available
platform caam_sm: 64-bit clear key:
platform caam_sm: [0000] 00 01 02 03 04 0f 06 07
platform caam_sm: 64-bit black key:
platform caam_sm: [0000] b1 01 3c 01 e6 9f 29 08
platform caam_sm: [0008] 2f 69 a6 64 1d f3 6b cc
platform caam_sm: 128-bit clear key:
platform caam_sm: [0000] 00 01 02 03 04 0f 06 07
platform caam_sm: [0008] 08 09 0a 0b 0c 0d 0e 0f
platform caam_sm: 128-bit black key:
platform caam_sm: [0000] 74 8e 55 37 ba 98 77 d0
platform caam_sm: [0008] 8d f9 26 49 cd a9 f8 8d
platform caam_sm: 192-bit clear key:
platform caam_sm: [0000] 00 01 02 03 04 0f 06 07
platform caam_sm: [0008] 08 09 0a 0b 0c 0d 0e 0f
platform caam_sm: [0016] 10 11 12 13 14 15 16 17
platform caam_sm: 192-bit black key:
platform caam_sm: [0000] 61 6b 5f 74 d5 e9 57 76
platform caam_sm: [0008] 73 b1 5f 36 fa 8e 22 94
platform caam_sm: [0016] dc 02 a9 90 b6 8c f0 19
platform caam_sm: [0024] f3 c6 97 5a eb 0a b0 da
platform caam_sm: 256-bit clear key:
platform caam_sm: [0000] 00 01 02 03 04 0f 06 07
platform caam_sm: [0008] 08 09 0a 0b 0c 0d 0e 0f
platform caam_sm: [0016] 10 11 12 13 14 15 16 17
platform caam_sm: [0024] 18 19 1a 1b 1c 1d 1e 1f
platform caam_sm: 256-bit black key:
platform caam_sm: [0000] d5 bd 4b c6 48 da 05 f7
platform caam_sm: [0008] 7f 87 21 1c e9 23 35 72
platform caam_sm: [0016] ff 57 5d 54 3f b8 56 ef
platform caam_sm: [0024] 8b 66 bd ae de e9 30 40
platform caam_sm: 64-bit unwritten blob:
platform caam_sm: [0000] 00 00 00 00 00 00 00 00
platform caam_sm: [0008] 00 00 00 00 00 00 00 00
platform caam_sm: [0016] 00 00 00 00 00 00 00 00
platform caam_sm: [0024] 00 00 00 00 00 00 00 00
platform caam_sm: [0032] 00 00 00 00 00 00 00 00
platform caam_sm: [0040] 00 00 00 00 00 00 00 00
platform caam_sm: [0048] 00 00 00 00 00 00 00 00
platform caam_sm: [0056] 00 00 00 00 00 00 00 00
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 128-bit unwritten blob:
platform caam_sm: [0000] 00 00 00 00 00 00 00 00
platform caam_sm: [0008] 00 00 00 00 00 00 00 00
platform caam_sm: [0016] 00 00 00 00 00 00 00 00
platform caam_sm: [0024] 00 00 00 00 00 00 00 00
platform caam_sm: [0032] 00 00 00 00 00 00 00 00
platform caam_sm: [0040] 00 00 00 00 00 00 00 00
platform caam_sm: [0048] 00 00 00 00 00 00 00 00
platform caam_sm: [0056] 00 00 00 00 00 00 00 00
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 196-bit unwritten blob:
platform caam_sm: [0000] 00 00 00 00 00 00 00 00
platform caam_sm: [0008] 00 00 00 00 00 00 00 00
platform caam_sm: [0016] 00 00 00 00 00 00 00 00
platform caam_sm: [0024] 00 00 00 00 00 00 00 00
platform caam_sm: [0032] 00 00 00 00 00 00 00 00
platform caam_sm: [0040] 00 00 00 00 00 00 00 00
platform caam_sm: [0048] 00 00 00 00 00 00 00 00
platform caam_sm: [0056] 00 00 00 00 00 00 00 00
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 256-bit unwritten blob:
platform caam_sm: [0000] 00 00 00 00 00 00 00 00
platform caam_sm: [0008] 00 00 00 00 00 00 00 00
platform caam_sm: [0016] 00 00 00 00 00 00 00 00
platform caam_sm: [0024] 00 00 00 00 00 00 00 00
platform caam_sm: [0032] 00 00 00 00 00 00 00 00
platform caam_sm: [0040] 00 00 00 00 00 00 00 00
platform caam_sm: [0048] 00 00 00 00 00 00 00 00
platform caam_sm: [0056] 00 00 00 00 00 00 00 00
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 64-bit black key in blob:
platform caam_sm: [0000] 58 4f 4e fa 09 9e 64 82
platform caam_sm: [0008] 1b d9 73 32 64 a2 c8 86
platform caam_sm: [0016] 3c 8f 96 4c 12 3d 03 df
platform caam_sm: [0024] c6 5f 0b e5 45 e6 25 cb
platform caam_sm: [0032] 46 2b c4 de 9a 6f d1 a3
platform caam_sm: [0040] 32 1a fd 8a 85 73 fb 3e
platform caam_sm: [0048] 52 1a 8c 14 1b 91 34 69
platform caam_sm: [0056] 00 00 00 00 00 00 00 00
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 128-bit black key in blob:
platform caam_sm: [0000] b1 ce cb b1 b1 4f 98 79
platform caam_sm: [0008] 06 28 f1 89 d9 fe aa 7f
platform caam_sm: [0016] 0b 33 49 18 d7 ae e6 6e
platform caam_sm: [0024] 96 4c 10 68 41 94 4b 50
platform caam_sm: [0032] 27 63 54 0f 8e af 14 b9
platform caam_sm: [0040] 43 e9 de 90 ba 6c c0 d4
platform caam_sm: [0048] 8b 95 5b 2c fe 0c 1d 7f
platform caam_sm: [0056] 14 c2 01 c3 b6 cd 82 11
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 192-bit black key in blob:
platform caam_sm: [0000] 1a 95 36 5d 3f fb 19 58
platform caam_sm: [0008] 98 32 c3 2c fc 73 9f 43
platform caam_sm: [0016] 5c a5 30 c2 b2 14 57 8f
platform caam_sm: [0024] ff 4e 1b 67 79 42 a8 ad
platform caam_sm: [0032] 47 f0 22 5a ff 63 d0 23
platform caam_sm: [0040] 75 73 c6 da 23 03 40 8c
platform caam_sm: [0048] d2 50 2d 64 cb 22 9d 0c
platform caam_sm: [0056] dd a4 67 4f 3e f9 fd f0
platform caam_sm: [0064] bd 2e 47 14 85 59 fc 80
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 256-bit black key in blob:
platform caam_sm: [0000] fd 6a a3 76 12 d8 11 61
platform caam_sm: [0008] 7f b3 5d a1 6c 86 08 03
platform caam_sm: [0016] 36 f4 dc 55 cd 03 1f 4a
platform caam_sm: [0024] e4 99 24 e6 ab 1e a9 96
platform caam_sm: [0032] 7f 3c aa a9 52 3f 1b f0
platform caam_sm: [0040] 31 99 fb 84 42 e9 33 02
platform caam_sm: [0048] 51 13 dd 5d 3a ff d5 37
platform caam_sm: [0056] d2 00 6c 28 40 2c 8e d1
platform caam_sm: [0064] a9 71 34 69 39 57 46 5e
platform caam_sm: [0072] ae e9 fa 20 61 1e 16 3a
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: restored 64-bit black key:
platform caam_sm: [0000] 7d 43 74 34 c3 f0 d4 c0
platform caam_sm: [0008] 30 dd bf a6 d4 09 5e c5
platform caam_sm: restored 128-bit black key:
platform caam_sm: [0000] 74 8e 55 37 ba 98 77 d0
platform caam_sm: [0008] 8d f9 26 49 cd a9 f8 8d
platform caam_sm: restored 192-bit black key:
platform caam_sm: [0000] 61 6b 5f 74 d5 e9 57 76
platform caam_sm: [0008] 73 b1 5f 36 fa 8e 22 94
platform caam_sm: [0016] 45 10 62 b4 5d ca 9a 2c
platform caam_sm: [0024] 5a db 0f 5c 12 10 b7 4a
platform caam_sm: restored 256-bit black key:
platform caam_sm: [0000] d5 bd 4b c6 48 da 05 f7
platform caam_sm: [0008] 7f 87 21 1c e9 23 35 72
platform caam_sm: [0016] ff 57 5d 54 3f b8 56 ef
platform caam_sm: [0024] 8b 66 bd ae de e9 30 40
snvs-secvio 20cc000.caam-snvs: can't get snvs clock
snvs-secvio 20cc000.caam-snvs: violation handlers armed - trusted state
NET: Registered protocol family 26
TCP: cubic registered
NET: Registered protocol family 10
sit: IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Bluetooth: RFCOMM TTY layer initialized
Bluetooth: RFCOMM socket layer initialized
Bluetooth: RFCOMM ver 1.11
Bluetooth: BNEP (Ethernet Emulation) ver 1.3
Bluetooth: BNEP filters: protocol multicast
Bluetooth: BNEP socket layer initialized
Bluetooth: HIDP (Human Interface Emulation) ver 1.2
Bluetooth: HIDP socket layer initialized
8021q: 802.1Q VLAN Support v1.8
Key type dns_resolver registered
cpu cpu0: dev_pm_opp_get_opp_count: device OPP not found (-19)
wlreg_on: disabling
regulator-dummy: disabling
snvs_rtc 20cc034.snvs-rtc-lp: setting system clock to 1970-01-01 00:00:01 UTC (1)
Freeing unused kernel memory: 44844K (807d4000 - 8339f000)
Creating symlinks in /dev
Starting RGB LED control deamon.
Mounting database
UBI: attaching mtd3 to ubi0
UBI: scanning is finished
UBI: attached mtd3 (name "dbBackup", size 10 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 80, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 3500/2311, WL threshold: 4096, image sequence number: 1098468252
UBI: available PEBs: 0, total reserved PEBs: 80, PEBs reserved for bad PEB handling: 20
UBI: background thread "ubi_bgt0d" started, PID 146
UBI device number 0, total 80 LEBs (10158080 bytes, 9.7 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0)
UBIFS: background thread "ubifs_bgt0_0" started, PID 148
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "database_backup"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 5840896 bytes (5 MiB, 46 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
UBIFS: reserved for root: 275879 bytes (269 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 8DE4614F-E3DC-432A-8AB1-B1F386BEDD5A, small LPT model
/database_backup mounted Ok on: 1 attempt(s)
UBI: attaching mtd2 to ubi1
UBI: scanning is finished
UBI: attached mtd2 (name "database", size 10 MiB) to ubi1
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 80, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 1444/964, WL threshold: 4096, image sequence number: 720637420
UBI: available PEBs: 0, total reserved PEBs: 80, PEBs reserved for bad PEB handling: 20
UBI: background thread "ubi_bgt1d" started, PID 161
UBI device number 1, total 80 LEBs (10158080 bytes, 9.7 MiB), available 0 LEBs (0 bytes), LEB sizUBIFS: background thr3
e 126976 bytes (124.0 KiB)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 1, volume 0, name "database"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 5840896 bytes (5 MiB, 46 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
UBIFS: reserved for root: 275879 bytes (269 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 91FBBF89-8591-4596-B9B4-0D331602A906, small LPT model
/database mounted Ok on: 1 attempt(s)
Attempting to backup database
sending incremental file list
random: nonblocking pool is initialized
Unfortunately it looks like secure boot has been enabled. It’s an imx6 so hopefully we can get it into SDP mode.
No surprise that there isn’t source code published by wink.
https://github.com/winkapp/wink-hub-kernel-public
I’ve already contacted them twice about releasing new code but no response from their support yet.
https://www.wink.com/help/contact/
Maybe if we all ask nicely they will release some.
Any idea if it will be possible to flash something else on there? HomeAssistant?
Flashing something else on there would not be that difficult ( might need to solder some wires to the SPI bus ) .
Homeassistant is just the application. What’s also needed is the u-boot and kernel sources so that you can get it to talk to the HW properly.
What needs to happen is Wink needs to be convinced to release the source code. I’ve tried contacting them on multiple occasions and multiple ways to release the code.
If the community got together and made an outcry about Wink violating the GPL then they might get the message and release the code as they are required to.
While looking at th FCC internal photos I noticed a micro USB port, 2 jumper blocks, and 2 dip switch blocks that have been removed from production units. Any idea what these removed items might do?
Other than what is in the page I didn’t do much digging. As it is an imx6 it will have SDP so you could load a custom u-boot and kernel on there if the security fuses haven’t been blown.
The jumpers and DIP switches could be for setting the boot mode so that you could get into SDP and the micro USB would be the port that was enabled for SDP.
IIRC there was also something that looked like a JTAG header but I think that was for one of the RF interfaces.
So I decided to look at this again now the the hub is completely useless ( either wink.com is down or the app ignores my notification preferences and is binging every 3 seconds ).
I’ve found the OTG port and boot mode pins that probably has SDP and I’m going to try uploading my own u-boot. There’s a chance they’ve blown fuses so this isn’t possible but we’ll see when my micro USB B connectors show up 🙂
Worst case I might just erase the flash ( they covered the pins on the flash with some kind of epoxy to make this more difficult ).
Thats the SDP port and the boot mode configuration. The LCD_DATA lines are also used for boot configuration if the fuses haven’t been blown.
I also had a poke at the Wink Hub v2, wrote it up in a bit more detail here: https://sensepost.com/blog/2023/investigating-the-wink-hub-2/
Also some discussion here: https://www.reddit.com/r/winkhub/comments/13wko51/wink_hub_2_teardown/
Would be curious to know if you made any further progress? One thing I am really looking for is the URL to a firmware update, which would enable grey box attacks vs black box!