Reverse engineering the Essent E-thermostaat

Getting deeper

No luck to bypass anything from the outside it seems. So my next step was to start messing with the actual firmware on the device itself. Thinking maybe I could alter the firmware to connect to a different website instead.

The Windows application has an option to update the firmware so this was my first entry point to acquire the firmware. However when sniffing all the traffic from the application, I noticed that every service regarding updating the device’s firmware, was already taken down. So no way for me to get the firmware binaries from ICY’s website.

USBPcap captured data
Some captured USB packets with Wireshark and USBPcap. Notice the ‘Leftover Capture Data’ in the final column. The first byte specifies the command followed by some arguments or a response.

However, as this application has ways to interact with the device, it could be at least interesting to see how it does this and see if there is anything there which can be useful. So I fired up Wireshark with the USBPcap driver, monitored all USB traffic and noticed interesting things. The thermostat presents itself as an HID device to Windows. Then with some basic commands the application can do some basic things as updating the schedule, the device date and time and the settings. And of course updating the firmware as well. Maybe there are some hidden commands in the software as well?

4 Replies to “Reverse engineering the Essent E-thermostaat”

  1. Enjoyed reading your article, too bad you didn’t succeed.
    I will check back later to see if you see if any progress has been made.
    In the worst case,. I have disposed of my e-thermostaat and help is too late for me

    1. Thanks for your response. For now I paid the 24 Euros so I can use the thermostat for at least another year. So probably no updates from my side, but if so I’ll let you know.

  2. Maybe it is possible to read the thermostat thermometer and rig the + and – button so you can control it with an Arduino or Pi Zero? Or even a step further, connect said Arduino or Pi to read the data that is going to the LCD?

    1. That’s probably feasible, however I doubt if that would be much less work than designing my own thermostat and letting my home automation system control it. If you already go the extra mile to get an additional device such as Arduino or Pi to read the pins, switching a relay and reading a temperature sensor is not that much work either though.

Leave a Reply

Your e-mail address will not be published. Required fields are marked *