{"id":14344,"date":"2020-09-12T09:54:53","date_gmt":"2020-09-12T16:54:53","guid":{"rendered":"http:\/\/ainslies.net\/?p=14344"},"modified":"2020-09-12T09:54:53","modified_gmt":"2020-09-12T16:54:53","slug":"wink-hub-2-teardown","status":"publish","type":"post","link":"https:\/\/ainslies.net\/?p=14344","title":{"rendered":"Wink Hub 2 teardown"},"content":{"rendered":"\n

So for a while I’ve been looking at hacking into the wink hub 2. I’ve had it for a number of years and so far it has just worked for what I needed it for. Then wink starts with the subscription nonsense and this morning it refused to connect at all. So time to take it apart.<\/p>\n\n\n\n

It’s a pretty easy disassemble. <\/p>\n\n\n\n

  1. 2 screws under the rubber bumper on the device.<\/li>
  2. Pull the base free, you’ll see the bottom edge of the PCB.<\/li>
  3. The one side snaps of with a little bit of pressure separating the 2 halves. I used a spudger to help it along.<\/li><\/ol>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    Awesome looks like there are headers on the board again. Lets see the other side.<\/p>\n\n\n\n

    \"\"
    Front side<\/figcaption><\/figure>\n\n\n\n

    They were even kind enough to label all of them. So I soldered on a UART header and connected up my FTDI cable.<\/p>\n\n\n\n

    No surprise here, it’s running u-boot<\/p>\n\n\n\n

    \n\n
    U-Boot 2015.04 (Sep 02 2016 - 20:09:54)
    \n
    \nCPU:   Freescale i.MX6UL rev1.1 at 396 MHz
    \nCPU:   Temperature 30 C
    \nReset cause: POR
    \nBoard: MX6UL Flex Wink Hub V2
    \nI2C:   ready
    \nDRAM:  512 MiB
    \nNAND:  128 MiB
    \nIn:    serial
    \nOut:   serial
    \nErr:   serial
    \nNet:   FEC0
    \nNormal Boot
    \nHit any key to stop autoboot:  0 
    \nUBI: attaching mtd1 to ubi0
    \nUBI: scanning is finished
    \nUBI: attached mtd1 (name "mtd=2", size 10 MiB) to ubi0
    \nUBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
    \nUBI: min.\/max. I\/O unit sizes: 2048\/2048, sub-page size 2048
    \nUBI: VID header offset: 2048 (aligned 2048), data offset: 4096
    \nUBI: good PEBs: 80, bad PEBs: 0, corrupted PEBs: 0
    \nUBI: user volume: 1, internal volumes: 1, max. volumes count: 128
    \nUBI: max\/mean erase counter: 1444\/964, WL threshold: 4096, image sequence number: 720637420
    \nUBI: available PEBs: 0, total reserved PEBs: 80, PEBs reserved for bad PEB handling: 20
    \nLoading file 'DO_UPDATE' to addr 0x83000000 with size 1 (0x00000001)...
    \nDone
    \nTotal of 1 word(s) were the same
    \n
    \nLoading from nand0, offset 0x3700000
    \n   Image Name:   Linux-3.14.52
    \n   Image Type:   ARM Linux Kernel Image (uncompressed)
    \n   Data Size:    50856042 Bytes = 48.5 MiB
    \n   Load Address: 80800000
    \n   Entry Point:  80800000
    \nSecure boot on, reading 50868256 bytes to get SRK data
    \n
    \nAuthenticate image from DDR location 0x80800000...
    \n
    \nSecure boot enabled
    \n
    \nHAB Configuration: 0xcc, HAB State: 0x99
    \nNo HAB Events Found!<\/div><\/div>\n\n<\/pre>\n\n\n\n
    and Linux<\/p>\n\n\n\n
    \n\n
    Booting Linux on physical CPU 0x0
    \nLinux version 3.14.52 (ubuntu@a1b25e96d169) (gcc version 5.3.0 (Buildroot 2016.05) ) #2 PREEMPT Tue Jun 11 19:47:11 UT9
    \nCPU: ARMv7 Processor &#91;410fc075] revision 5 (ARMv7), cr=10c53c7d
    \nCPU: PIPT \/ VIPT nonaliasing data cache, VIPT aliasing instruction cache
    \nMachine model: Wink Hub2 \/ Flex 40-00041-01
    \ncma: CMA: reserved 192 MiB at 94000000
    \nMemory policy: Data cache writeback
    \nCPU: All CPU(s) started in SVC mode.
    \nBuilt 1 zonelists in Zone order, mobility grouping on.  Total pages: 130048
    \nKernel command line: console=ttymxc0,115200 mtdparts=gpmi-nand:3m(boot),32m(updater),10m(database),10m(dbBackup),-(app)
    \nPID hash table entries: 2048 (order: 1, 8192 bytes)
    \nDentry cache hash table entries: 65536 (order: 6, 262144 bytes)
    \nInode-cache hash table entries: 32768 (order: 5, 131072 bytes)
    \nMemory: 269128K\/524288K available (6092K kernel code, 309K rwdata, 1888K rodata, 44846K init, 378K bss, 255160K reserv)
    \nVirtual kernel memory layout:
    \n    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    \n    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    \n    vmalloc : 0xa0800000 - 0xff000000   (1512 MB)
    \n    lowmem  : 0x80000000 - 0xa0000000   ( 512 MB)
    \n    modules : 0x7f000000 - 0x80000000   (  16 MB)
    \n      .text : 0x80008000 - 0x807d32a0   (7981 kB)
    \n      .init : 0x807d4000 - 0x8339f9f4   (44847 kB)
    \n      .data : 0x833a0000 - 0x833ed5a0   ( 310 kB)
    \n       .bss : 0x833ed5ac - 0x8344bdbc   ( 379 kB)
    \nSLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    \nPreemptible hierarchical RCU implementation.
    \nNR_IRQS:16 nr_irqs:16 16
    \nSwitching to timer-based delay loop
    \nsched_clock: 32 bits at 3000kHz, resolution 333ns, wraps every 1431655765682ns
    \nclocksource_of_init: no matching clocksources found
    \nConsole: colour dummy device 80x30
    \nCalibrating delay loop (skipped), value calculated using timer frequency.. 6.00 BogoMIPS (lpj=30000)
    \npid_max: default: 32768 minimum: 301
    \nMount-cache hash table entries: 1024 (order: 0, 4096 bytes)
    \nMountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
    \nCPU: Testing write buffer coherency: ok
    \nSetting up static identity map for 0x805d2980 - 0x805d29d8
    \ndevtmpfs: initialized
    \nVFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
    \npinctrl core: initialized pinctrl subsystem
    \nregulator-dummy: no parameters
    \nNET: Registered protocol family 16
    \nDMA: preallocated 256 KiB pool for atomic coherent allocations
    \ncpuidle: using governor ladder
    \ncpuidle: using governor menu
    \nUse WDOG1 as reset source
    \nsyscon 20c8000.anatop: regmap &#91;mem 0x020c8000-0x020c8fff] registered
    \nvdd3p0: 2625 &lt;--> 3400 mV at 3000 mV 
    \ncpu: 725 &lt;--> 1450 mV at 1150 mV 
    \nvddsoc: 725 &lt;--> 1450 mV at 1175 mV 
    \nsyscon 20e4000.iomuxc-gpr: regmap &#91;mem 0x020e4000-0x020e7fff] registered
    \nsyscon 21ac000.romcp: regmap &#91;mem 0x021ac000-0x021affff] registered
    \nsyscon 21bc000.ocotp-ctrl: regmap &#91;mem 0x021bc000-0x021bffff] registered
    \nhw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
    \nhw-breakpoint: maximum watchpoint size is 8 bytes.
    \nimx6ul-pinctrl 20e0000.iomuxc: initialized IMX pinctrl driver
    \n20dc000.gpc supply pu not found, using dummy regulator
    \nbio: create slab &lt;bio-0> at 0
    \nmxs-dma 1804000.dma-apbh: initialized
    \nwlreg_on: 3300 mV 
    \ni2c-core: driver &#91;max17135] using legacy suspend method
    \ni2c-core: driver &#91;max17135] using legacy resume method
    \nSCSI subsystem initialized
    \ni2c i2c-0: IMX I2C adapter registered
    \npps_core: LinuxPPS API ver. 1 registered
    \npps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti &lt;giometti@linux.it>
    \nPTP clock support registered
    \nMIPI CSI2 driver module loaded
    \nBluetooth: Core ver 2.18
    \nNET: Registered protocol family 31
    \nBluetooth: HCI device and connection manager initialized
    \nBluetooth: HCI socket layer initialized
    \nBluetooth: L2CAP socket layer initialized
    \nBluetooth: SCO socket layer initialized
    \nSwitched to clocksource mxc_timer1
    \ncfg80211: Calling CRDA to update world regulatory domain
    \nNET: Registered protocol family 2
    \nTCP established hash table entries: 4096 (order: 2, 16384 bytes)
    \nTCP bind hash table entries: 4096 (order: 2, 16384 bytes)
    \nTCP: Hash tables configured (established 4096 bind 4096)
    \nTCP: reno registered
    \nUDP hash table entries: 256 (order: 0, 4096 bytes)
    \nUDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    \nNET: Registered protocol family 1
    \nRPC: Registered named UNIX socket transport module.
    \nRPC: Registered udp transport module.
    \nRPC: Registered tcp transport module.
    \nRPC: Registered tcp NFSv4.1 backchannel transport module.
    \nBus freq driver module loaded
    \nfutex hash table entries: 256 (order: -1, 3072 bytes)
    \nNFS: Registering the id_resolver key type
    \nKey type id_resolver registered
    \nKey type id_legacy registered
    \njffs2: version 2.2. (NAND) \ufffd\u00a9 2001-2006 Red Hat, Inc.
    \nfuse init (API version 7.22)
    \nmsgmni has been set to 909
    \nio scheduler noop registered
    \nio scheduler deadline registered
    \nio scheduler cfq registered (default)
    \nimx-weim 21b8000.weim: Driver registered.
    \nMIPI DSI driver module loaded
    \nMIPI DSI driver module loaded
    \nimx-sdma 20ec000.sdma: no event needs to be remapped
    \nimx-sdma 20ec000.sdma: loaded firmware 3.2
    \nimx-sdma 20ec000.sdma: initialized
    \nSerial: IMX driver
    \n2018000.serial: ttymxc6 at MMIO 0x2018000 (irq = 71, base_baud = 5000000) is a IMX
    \n2020000.serial: ttymxc0 at MMIO 0x2020000 (irq = 58, base_baud = 5000000) is a IMX
    \nconsole &#91;ttymxc0] enabled
    \n21e8000.serial: ttymxc1 at MMIO 0x21e8000 (irq = 59, base_baud = 5000000) is a IMX
    \n21ec000.serial: ttymxc2 at MMIO 0x21ec000 (irq = 60, base_baud = 5000000) is a IMX
    \n21f0000.serial: ttymxc3 at MMIO 0x21f0000 (irq = 61, base_baud = 5000000) is a IMX
    \n21f4000.serial: ttymxc4 at MMIO 0x21f4000 (irq = 62, base_baud = 5000000) is a IMX
    \nserial: Freescale lpuart driver
    \n&#91;drm] Initialized drm 1.1.0 20060810
    \n&#91;drm] Initialized vivante 1.0.0 20120216 on minor 0
    \nbrd: module loaded
    \nloop: module loaded
    \nnand: device found, Manufacturer ID: 0x2c, Chip ID: 0xf1
    \nnand: Micron MT29F1G08ABAEAWP
    \nnand: 128MiB, SLC, page size: 2048, OOB size: 64
    \ngpmi-nand 1806000.gpmi-nand: enable the asynchronous EDO mode 5
    \nBad block table found at page 65472, version 0x01
    \nBad block table found at page 65408, version 0x01
    \n5 cmdlinepart partitions found on MTD device gpmi-nand
    \nCreating 5 MTD partitions on "gpmi-nand":
    \n0x000000000000-0x000000300000 : "boot"
    \n0x000000300000-0x000002300000 : "updater"
    \n0x000002300000-0x000002d00000 : "database"
    \n0x000002d00000-0x000003700000 : "dbBackup"
    \n0x000003700000-0x000008000000 : "app"
    \ngpmi-nand 1806000.gpmi-nand: driver registered.
    \nspi_imx 2008000.ecspi: probed
    \n2188000.ethernet supply phy not found, using dummy regulator
    \npps pps0: new PPS source ptp0
    \nlibphy: fec_enet_mii_bus: probed
    \nfec 2188000.ethernet eth0: registered PHC device 0
    \nsnvs_pwrkey 20cc000.snvs-pwrkey: can't get snvs clock
    \ninput: 20cc000.snvs-pwrkey as \/devices\/soc0\/soc.0\/2000000.aips-bus\/20cc000.snvs-pwrkey\/input\/input0
    \nsnvs_pwrkey 20cc000.snvs-pwrkey: i.MX snvs powerkey probed
    \nsnvs_rtc 20cc034.snvs-rtc-lp: can't get snvs-rtc clock
    \nsnvs_rtc 20cc034.snvs-rtc-lp: rtc core: registered 20cc034.snvs-rtc-lp as rtc0
    \ni2c \/dev entries driver
    \ni2c-core: driver &#91;mag3110] using legacy suspend method
    \ni2c-core: driver &#91;mag3110] using legacy resume method
    \nimx2-wdt 20bc000.wdog: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
    \nBluetooth: HCI UART driver ver 2.2
    \nBluetooth: HCI H4 protocol initialized
    \nBluetooth: HCI BCSP protocol initialized
    \nBluetooth: HCIATH3K protocol initialized
    \nsdhci: Secure Digital Host Controller Interface driver
    \nsdhci: Copyright(c) Pierre Ossman
    \nsdhci-pltfm: SDHCI platform and OF driver helper
    \nsdhci-esdhc-imx 2190000.usdhc: assigned as wifi host
    \nmmc0: no vqmmc regulator found
    \nmmc0: no vmmc regulator found
    \nmmc0: SDHCI controller on 2190000.usdhc &#91;2190000.usdhc] using ADMA
    \ncaam 2140000.caam: Instantiated RNG4 SH0
    \ncaam 2140000.caam: Instantiated RNG4 SH1
    \ncaam 2140000.caam: device ID = 0x0a160300 (Era 8)
    \ncaam 2140000.caam: job rings = 3, qi = 0
    \ncaam algorithms registered in \/proc\/crypto
    \ncaam_jr 2141000.jr0: registering rng-caam
    \nplatform caam_sm: blkkey_ex: 8 keystore units available
    \nplatform caam_sm: 64-bit clear key:
    \nplatform caam_sm: &#91;0000] 00 01 02 03 04 0f 06 07
    \nplatform caam_sm: 64-bit black key:
    \nplatform caam_sm: &#91;0000] b1 01 3c 01 e6 9f 29 08
    \nplatform caam_sm: &#91;0008] 2f 69 a6 64 1d f3 6b cc
    \nplatform caam_sm: 128-bit clear key:
    \nplatform caam_sm: &#91;0000] 00 01 02 03 04 0f 06 07
    \nplatform caam_sm: &#91;0008] 08 09 0a 0b 0c 0d 0e 0f
    \nplatform caam_sm: 128-bit black key:
    \nplatform caam_sm: &#91;0000] 74 8e 55 37 ba 98 77 d0
    \nplatform caam_sm: &#91;0008] 8d f9 26 49 cd a9 f8 8d
    \nplatform caam_sm: 192-bit clear key:
    \nplatform caam_sm: &#91;0000] 00 01 02 03 04 0f 06 07
    \nplatform caam_sm: &#91;0008] 08 09 0a 0b 0c 0d 0e 0f
    \nplatform caam_sm: &#91;0016] 10 11 12 13 14 15 16 17
    \nplatform caam_sm: 192-bit black key:
    \nplatform caam_sm: &#91;0000] 61 6b 5f 74 d5 e9 57 76
    \nplatform caam_sm: &#91;0008] 73 b1 5f 36 fa 8e 22 94
    \nplatform caam_sm: &#91;0016] dc 02 a9 90 b6 8c f0 19
    \nplatform caam_sm: &#91;0024] f3 c6 97 5a eb 0a b0 da
    \nplatform caam_sm: 256-bit clear key:
    \nplatform caam_sm: &#91;0000] 00 01 02 03 04 0f 06 07
    \nplatform caam_sm: &#91;0008] 08 09 0a 0b 0c 0d 0e 0f
    \nplatform caam_sm: &#91;0016] 10 11 12 13 14 15 16 17
    \nplatform caam_sm: &#91;0024] 18 19 1a 1b 1c 1d 1e 1f
    \nplatform caam_sm: 256-bit black key:
    \nplatform caam_sm: &#91;0000] d5 bd 4b c6 48 da 05 f7
    \nplatform caam_sm: &#91;0008] 7f 87 21 1c e9 23 35 72
    \nplatform caam_sm: &#91;0016] ff 57 5d 54 3f b8 56 ef
    \nplatform caam_sm: &#91;0024] 8b 66 bd ae de e9 30 40
    \nplatform caam_sm: 64-bit unwritten blob:
    \nplatform caam_sm: &#91;0000] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0008] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0016] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0024] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0032] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0040] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0048] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0056] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0064] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0072] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0080] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0088] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: 128-bit unwritten blob:
    \nplatform caam_sm: &#91;0000] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0008] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0016] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0024] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0032] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0040] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0048] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0056] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0064] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0072] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0080] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0088] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: 196-bit unwritten blob:
    \nplatform caam_sm: &#91;0000] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0008] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0016] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0024] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0032] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0040] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0048] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0056] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0064] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0072] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0080] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0088] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: 256-bit unwritten blob:
    \nplatform caam_sm: &#91;0000] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0008] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0016] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0024] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0032] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0040] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0048] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0056] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0064] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0072] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0080] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0088] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: 64-bit black key in blob:
    \nplatform caam_sm: &#91;0000] 58 4f 4e fa 09 9e 64 82
    \nplatform caam_sm: &#91;0008] 1b d9 73 32 64 a2 c8 86
    \nplatform caam_sm: &#91;0016] 3c 8f 96 4c 12 3d 03 df
    \nplatform caam_sm: &#91;0024] c6 5f 0b e5 45 e6 25 cb
    \nplatform caam_sm: &#91;0032] 46 2b c4 de 9a 6f d1 a3
    \nplatform caam_sm: &#91;0040] 32 1a fd 8a 85 73 fb 3e
    \nplatform caam_sm: &#91;0048] 52 1a 8c 14 1b 91 34 69
    \nplatform caam_sm: &#91;0056] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0064] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0072] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0080] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0088] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: 128-bit black key in blob:
    \nplatform caam_sm: &#91;0000] b1 ce cb b1 b1 4f 98 79
    \nplatform caam_sm: &#91;0008] 06 28 f1 89 d9 fe aa 7f
    \nplatform caam_sm: &#91;0016] 0b 33 49 18 d7 ae e6 6e
    \nplatform caam_sm: &#91;0024] 96 4c 10 68 41 94 4b 50
    \nplatform caam_sm: &#91;0032] 27 63 54 0f 8e af 14 b9
    \nplatform caam_sm: &#91;0040] 43 e9 de 90 ba 6c c0 d4
    \nplatform caam_sm: &#91;0048] 8b 95 5b 2c fe 0c 1d 7f
    \nplatform caam_sm: &#91;0056] 14 c2 01 c3 b6 cd 82 11
    \nplatform caam_sm: &#91;0064] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0072] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0080] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0088] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: 192-bit black key in blob:
    \nplatform caam_sm: &#91;0000] 1a 95 36 5d 3f fb 19 58
    \nplatform caam_sm: &#91;0008] 98 32 c3 2c fc 73 9f 43
    \nplatform caam_sm: &#91;0016] 5c a5 30 c2 b2 14 57 8f
    \nplatform caam_sm: &#91;0024] ff 4e 1b 67 79 42 a8 ad
    \nplatform caam_sm: &#91;0032] 47 f0 22 5a ff 63 d0 23
    \nplatform caam_sm: &#91;0040] 75 73 c6 da 23 03 40 8c
    \nplatform caam_sm: &#91;0048] d2 50 2d 64 cb 22 9d 0c
    \nplatform caam_sm: &#91;0056] dd a4 67 4f 3e f9 fd f0
    \nplatform caam_sm: &#91;0064] bd 2e 47 14 85 59 fc 80
    \nplatform caam_sm: &#91;0072] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0080] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0088] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: 256-bit black key in blob:
    \nplatform caam_sm: &#91;0000] fd 6a a3 76 12 d8 11 61
    \nplatform caam_sm: &#91;0008] 7f b3 5d a1 6c 86 08 03
    \nplatform caam_sm: &#91;0016] 36 f4 dc 55 cd 03 1f 4a
    \nplatform caam_sm: &#91;0024] e4 99 24 e6 ab 1e a9 96
    \nplatform caam_sm: &#91;0032] 7f 3c aa a9 52 3f 1b f0
    \nplatform caam_sm: &#91;0040] 31 99 fb 84 42 e9 33 02
    \nplatform caam_sm: &#91;0048] 51 13 dd 5d 3a ff d5 37
    \nplatform caam_sm: &#91;0056] d2 00 6c 28 40 2c 8e d1
    \nplatform caam_sm: &#91;0064] a9 71 34 69 39 57 46 5e
    \nplatform caam_sm: &#91;0072] ae e9 fa 20 61 1e 16 3a
    \nplatform caam_sm: &#91;0080] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: &#91;0088] 00 00 00 00 00 00 00 00
    \nplatform caam_sm: restored 64-bit black key:
    \nplatform caam_sm: &#91;0000] 7d 43 74 34 c3 f0 d4 c0
    \nplatform caam_sm: &#91;0008] 30 dd bf a6 d4 09 5e c5
    \nplatform caam_sm: restored 128-bit black key:
    \nplatform caam_sm: &#91;0000] 74 8e 55 37 ba 98 77 d0
    \nplatform caam_sm: &#91;0008] 8d f9 26 49 cd a9 f8 8d
    \nplatform caam_sm: restored 192-bit black key:
    \nplatform caam_sm: &#91;0000] 61 6b 5f 74 d5 e9 57 76
    \nplatform caam_sm: &#91;0008] 73 b1 5f 36 fa 8e 22 94
    \nplatform caam_sm: &#91;0016] 45 10 62 b4 5d ca 9a 2c
    \nplatform caam_sm: &#91;0024] 5a db 0f 5c 12 10 b7 4a
    \nplatform caam_sm: restored 256-bit black key:
    \nplatform caam_sm: &#91;0000] d5 bd 4b c6 48 da 05 f7
    \nplatform caam_sm: &#91;0008] 7f 87 21 1c e9 23 35 72
    \nplatform caam_sm: &#91;0016] ff 57 5d 54 3f b8 56 ef
    \nplatform caam_sm: &#91;0024] 8b 66 bd ae de e9 30 40
    \nsnvs-secvio 20cc000.caam-snvs: can't get snvs clock
    \nsnvs-secvio 20cc000.caam-snvs: violation handlers armed - trusted state
    \nNET: Registered protocol family 26
    \nTCP: cubic registered
    \nNET: Registered protocol family 10
    \nsit: IPv6 over IPv4 tunneling driver
    \nNET: Registered protocol family 17
    \nBluetooth: RFCOMM TTY layer initialized
    \nBluetooth: RFCOMM socket layer initialized
    \nBluetooth: RFCOMM ver 1.11
    \nBluetooth: BNEP (Ethernet Emulation) ver 1.3
    \nBluetooth: BNEP filters: protocol multicast
    \nBluetooth: BNEP socket layer initialized
    \nBluetooth: HIDP (Human Interface Emulation) ver 1.2
    \nBluetooth: HIDP socket layer initialized
    \n8021q: 802.1Q VLAN Support v1.8
    \nKey type dns_resolver registered
    \ncpu cpu0: dev_pm_opp_get_opp_count: device OPP not found (-19)
    \nwlreg_on: disabling
    \nregulator-dummy: disabling
    \nsnvs_rtc 20cc034.snvs-rtc-lp: setting system clock to 1970-01-01 00:00:01 UTC (1)
    \nFreeing unused kernel memory: 44844K (807d4000 - 8339f000)
    \nCreating symlinks in \/dev
    \nStarting RGB LED control deamon.
    \nMounting database
    \nUBI: attaching mtd3 to ubi0
    \nUBI: scanning is finished
    \nUBI: attached mtd3 (name "dbBackup", size 10 MiB) to ubi0
    \nUBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
    \nUBI: min.\/max. I\/O unit sizes: 2048\/2048, sub-page size 2048
    \nUBI: VID header offset: 2048 (aligned 2048), data offset: 4096
    \nUBI: good PEBs: 80, bad PEBs: 0, corrupted PEBs: 0
    \nUBI: user volume: 1, internal volumes: 1, max. volumes count: 128
    \nUBI: max\/mean erase counter: 3500\/2311, WL threshold: 4096, image sequence number: 1098468252
    \nUBI: available PEBs: 0, total reserved PEBs: 80, PEBs reserved for bad PEB handling: 20
    \nUBI: background thread "ubi_bgt0d" started, PID 146
    \nUBI device number 0, total 80 LEBs (10158080 bytes, 9.7 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0)
    \nUBIFS: background thread "ubifs_bgt0_0" started, PID 148
    \nUBIFS: recovery needed
    \nUBIFS: recovery completed
    \nUBIFS: mounted UBI device 0, volume 0, name "database_backup"
    \nUBIFS: LEB size: 126976 bytes (124 KiB), min.\/max. I\/O unit sizes: 2048 bytes\/2048 bytes
    \nUBIFS: FS size: 5840896 bytes (5 MiB, 46 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
    \nUBIFS: reserved for root: 275879 bytes (269 KiB)
    \nUBIFS: media format: w4\/r0 (latest is w4\/r0), UUID 8DE4614F-E3DC-432A-8AB1-B1F386BEDD5A, small LPT model
    \n\/database_backup mounted Ok on: 1 attempt(s)
    \nUBI: attaching mtd2 to ubi1
    \nUBI: scanning is finished
    \nUBI: attached mtd2 (name "database", size 10 MiB) to ubi1
    \nUBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
    \nUBI: min.\/max. I\/O unit sizes: 2048\/2048, sub-page size 2048
    \nUBI: VID header offset: 2048 (aligned 2048), data offset: 4096
    \nUBI: good PEBs: 80, bad PEBs: 0, corrupted PEBs: 0
    \nUBI: user volume: 1, internal volumes: 1, max. volumes count: 128
    \nUBI: max\/mean erase counter: 1444\/964, WL threshold: 4096, image sequence number: 720637420
    \nUBI: available PEBs: 0, total reserved PEBs: 80, PEBs reserved for bad PEB handling: 20
    \nUBI: background thread "ubi_bgt1d" started, PID 161
    \nUBI device number 1, total 80 LEBs (10158080 bytes, 9.7 MiB), available 0 LEBs (0 bytes), LEB sizUBIFS: background thr3
    \ne 126976 bytes (124.0 KiB)
    \nUBIFS: recovery needed
    \nUBIFS: recovery completed
    \nUBIFS: mounted UBI device 1, volume 0, name "database"
    \nUBIFS: LEB size: 126976 bytes (124 KiB), min.\/max. I\/O unit sizes: 2048 bytes\/2048 bytes
    \nUBIFS: FS size: 5840896 bytes (5 MiB, 46 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
    \nUBIFS: reserved for root: 275879 bytes (269 KiB)
    \nUBIFS: media format: w4\/r0 (latest is w4\/r0), UUID 91FBBF89-8591-4596-B9B4-0D331602A906, small LPT model
    \n\/database mounted Ok on: 1 attempt(s)
    \nAttempting to backup database
    \nsending incremental file list
    \nrandom: nonblocking pool is initialized<\/div><\/div>\n\n<\/pre>\n\n\n\n
    Unfortunately it looks like secure boot has been enabled. It’s an imx6 so hopefully we can get it into SDP mode.<\/p>\n\n\n\n
    No surprise that there isn’t source code published by wink.<\/p>\n\n\n\n
    https:\/\/github.com\/winkapp\/wink-hub-kernel-public<\/a><\/p>\n\n\n\n
    I’ve already contacted them twice about releasing new code but no response from their support yet.<\/p>\n\n\n\n
    https:\/\/www.wink.com\/help\/contact\/<\/a><\/p>\n\n\n\n
    Maybe if we all ask nicely they will release some.<\/p>\n","protected":false},"excerpt":{"rendered":"
    So for a while I’ve been looking at hacking into the wink hub 2. I’ve had it for a number of years and so far it has just worked for what I needed it for. Then wink starts with the … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-14344","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/ainslies.net\/index.php?rest_route=\/wp\/v2\/posts\/14344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ainslies.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ainslies.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ainslies.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ainslies.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14344"}],"version-history":[{"count":1,"href":"https:\/\/ainslies.net\/index.php?rest_route=\/wp\/v2\/posts\/14344\/revisions"}],"predecessor-version":[{"id":14347,"href":"https:\/\/ainslies.net\/index.php?rest_route=\/wp\/v2\/posts\/14344\/revisions\/14347"}],"wp:attachment":[{"href":"https:\/\/ainslies.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ainslies.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ainslies.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}