Skip to content

Reverse engineering the Essent E-thermostaat

[extoc Title=”Table of Contents”]

Getting deeper

No luck to bypass anything from the outside it seems. So my next step was to start messing with the actual firmware on the device itself. Thinking maybe I could alter the firmware to connect to a different website instead.

The Windows application has an option to update the firmware so this was my first entry point to acquire the firmware. However when sniffing all the traffic from the application, I noticed that every service regarding updating the device’s firmware, was already taken down. So no way for me to get the firmware binaries from ICY’s website.

USBPcap captured data
Some captured USB packets with Wireshark and USBPcap. Notice the ‘Leftover Capture Data’ in the final column. The first byte specifies the command followed by some arguments or a response.

However, as this application has ways to interact with the device, it could be at least interesting to see how it does this and see if there is anything there which can be useful. So I fired up Wireshark with the USBPcap driver, monitored all USB traffic and noticed interesting things. The thermostat presents itself as an HID device to Windows. Then with some basic commands the application can do some basic things as updating the schedule, the device date and time and the settings. And of course updating the firmware as well. Maybe there are some hidden commands in the software as well?

Pages: 1 2 3 4 5 6 7

9 thoughts on “Reverse engineering the Essent E-thermostaat”

  1. Enjoyed reading your article, too bad you didn’t succeed.
    I will check back later to see if you see if any progress has been made.
    In the worst case,. I have disposed of my e-thermostaat and help is too late for me

    1. Thanks for your response. For now I paid the 24 Euros so I can use the thermostat for at least another year. So probably no updates from my side, but if so I’ll let you know.

  2. Maybe it is possible to read the thermostat thermometer and rig the + and – button so you can control it with an Arduino or Pi Zero? Or even a step further, connect said Arduino or Pi to read the data that is going to the LCD?

    1. That’s probably feasible, however I doubt if that would be much less work than designing my own thermostat and letting my home automation system control it. If you already go the extra mile to get an additional device such as Arduino or Pi to read the pins, switching a relay and reading a temperature sensor is not that much work either though.

  3. I wonder if you were able to make any progress. The next year (for prolongate the subscription) is coming.
    I’m asking myself if it couldn’t be better to design an open source thermostat. But I also agree that another €23,40 shouldn’t be the problem.

    1. In the end I did design a very simple ESP8266 thermostat which communicates via SSL to my MQTT server. I can control it with my Home Assistant installation. It’s been working okay but because it sometimes crashes and I have to manually repower it, I haven’t released it yet. It’s designed to always fail safely so the heating turns off so it’s no big deal but it’s not ready to release.

      At the moment I am also considering flashing Tasmota, which I use for some of my lights. I think that is a better option.

      So to answer your question: no progress with this project and I probably never will. The thermostat was never perfect in the first place.

  4. Hi, thanks for this read! It’s a few years later now, and I was wondering if you ever did an attempt to try things out with the base station?

    1. Hi Robert, no I did not. This Essent E-thermostaat ship has sailed for me. I have moved in the meantime and am running a heat pump system now, so I have little need to control my thermostat remote anymore.

  5. Last week I tried to dump the firmware of the device using a PicKit2 programmer. After connecting succesfully, and giving the “read” command, the software says “Code protect”. So indead the PIC is read-protected 🙁

Leave a Reply

Your email address will not be published. Required fields are marked *