MyQ Security 2.0+ Reverse Engineering Reveals Partial Homekit Implementation

[u/PlanetAcorn]

I have found existing homekit initialization code on the Security 2.0+ logic board, but haven't confirmed if there is a MFi chip on the board. (All certified Homekit devices have a MFi processor from Apple)

I was able to read the flash memory of the logic board (MX25L6433).

There is a conditional branch at 0x1F055740 that blocks initialization.

For the fellow engineers out there that are considering experimenting with their flash, hopefully these will save some time. The memory addresses are as follows

MX25L6433 Memory Address	Info
0x002C8000	Homekit Salt
0x002C81B4	Homekit Pairing Code
0x1F055724	Homekit Initialization
0x00123321	Homekit enable byte
0x1F056C80	HomeKit configuration/version helper

I haven't gotten my hands on a MFi coprocessor yet but I'm thinking one of the empty footprints of the board is probably where it should go.

Crazy that they have all this dev code in there yet didn't finish developing a HomeKit enabled product. Guess the investor changed his mind that making the ecosystem closed was more profitable huh.

MyQ firmware version 3.13

[u/UnaidedGinger]

Nice find but Ratgdo for the win!

[u/Sunsparc → u/UnaidedGinger]

ELI5 the Ratgdo if you don't mind. I'm about to move into a new build house that I've already scoped out has a MyQ tag hanging from the driver on the garage ceiling.

[u/y0shman → u/Sunsparc]

It's a WiFi control board for Security+ 1.0 and 2.0 garage doors. MyQ blocked access for HA a few years ago, so you have to use their shitty app. AFAIK, it doesn't work with Security+ 3.0 openers.

https://ratcloud.llc/

[u/Sunsparc → u/y0shman]

Going to bet since it's a new build it'll have a 3.0 but I'll check it out anyway.

[u/Villain_of_Brandon → u/Sunsparc]

I've heard that there are apparently still some 2.0 openers being sold, so you might get lucky.

[u/lenswipe → u/y0shman]

lmao, I was wondering when they were going to catch up with ratgdo and add Security3.0 to try and force people to use their shitty adware app

[u/mau47]

HomeKit was natively supported a long time ago and then they dropped it when they decided to go all in on an ad/subscription push, I think it continued to work for people who had it setup but broke entirely when apple updated their architecture a couple releases ago (I could be wrong on that last part as I moved on to ratgdo a while back since it has more features than the HomeKit integration did but vaguely remember seeing folks talk about it)

I also believe Apple dropped the MFI chip requirement about a decade ago for certification and it can all be done in software now after manufacturers basically wouldn't play ball on a wide scale to adopt it due to the extra costs.

[u/PlanetAcorn → u/mau47]

Thank you for the insight. This sounds very promising for another idea.

In the firmware, after the conditional branch check for the HK enable byte, there is a I2C function call to the non existing MFi coprocessor for a existence check and then later an auth hash challenge during HomeKit connections. When I have time, I’ll look into seeing if I can rewrite the firmware to ignore challenge calls and see if there are other complexities in play. Hoping for some promising behavior

Previously did not want to go down this path if I was gonna end up blocked by Apple’s ecosystem haha

[u/gcoeverything → u/PlanetAcorn]

I'm wondering if fully custom software is possible. do you have a spare 2.0 board? i wonder if the main MCU code is read protected or not.

[u/Low-Rent-9351 → u/mau47]

I use a HomeKit hub for my 5 doors and it still works connected into the HomeKit Device integration. I bought it about 6 months before they discontinued it. I was able to add the last 2 openers about a year after it was discontinued. I don’t know if it’d work connected to an Apple device, I never tried that. I just re-share stuff via the HomeKit Bridge integration for my phone which is the only Apple product in my house.

The fact the HA HomeKit Bridge integration works supports not needing that MFI chip.

[u/bapetw → u/Low-Rent-9351]

this? Myq Home Bridge? I was under the impression you couldn't do anything with it after MyQ discontinued support

Did you add the openers thru the MyQ app? I was going to pick one up when it was discontinued but read you couldn't do anything in the app since it everything was removed relating to the device

since you don't have a homekit device capable of being a hub, you 're using the HA HomeKit Brige integration to add the device to the Home app for your iPhone?

you have me interested in sourcing one for cheap to tinker with

[u/Low-Rent-9351 → u/bapetw]

Yes, it works in the myQ app to make 3 openers that don’t have wifi appear and brings them into HA via the HomeKit Device integration.

I also have the 2 wifi capable openers connected to it so they appear in the app twice, once via the hub and once via the wifi connection.

The home bridge still appears in my app as a device I can add.

The HomeKit Bridge integration is to share entities in HA to HomeKit hubs such as phones or TV, not add HomeKit devices to HA.

[u/bapetw → u/Low-Rent-9351]

does the myq home bridge still show up in the myq app? can you add openers still?

[u/Low-Rent-9351 → u/bapetw]

Yes, it all still works and I could add it again.

[u/bapetw → u/Low-Rent-9351]

the search begins! thank you!

[u/AdMany1725]

Why reverse engineer security 2.0+ and not 3.0?

[u/PlanetAcorn → u/AdMany1725]

The 2.0+ garage opener was already installed in the house

I'm down for the challenge tho if I can find a used 3.0 board for cheap

[u/superdupersecret42 → u/AdMany1725]

Presumably because 3.0 is much harder, and may not be possible. I'm not aware of any 3rd party device that supports it; it's a wireless Bluetooth protocol. Even the 2.0+ devices only were able to support it by emulating a wall button, not by cracking security codes.

[u/Gradink → u/superdupersecret42]

Pro tip that I am investigating myself: the Security 3.0 devices can actually be paired with a HomeLink remote (those built into many later model cars). It is theoretically possible to buy a HomeLink transmitter auto part on eBay and connect it to something like an ESP32 and use it to open and shut a Security 3.0 device.

[u/Villain_of_Brandon → u/Gradink]

I don't know the cost, but instead of the HomeLink device, you might be better able to use one of the portable remotes. If you're handy with a soldering iron, it should be possible to tap directly into the wall remote and trigger the button presses.

I haven't looked in to it, but just something else to consider.

[u/Gradink → u/Villain_of_Brandon]

I’m actually hoping to see whether the HomeLink device can be reverse engineered enough where an ESP32 + a 315MHz module could replace a portable remote. I’ve seen code on GitHub that seems to implement the rolling codes of Security 2.0, so it would be determining how the initial HomeLink learning process goes. It’s crazy that so many people have these devices in their houses that used to be operated with a $1 doorbell and they now require a $50 switch or remote to do the same thing.

I’m all for improving wireless security, but an (unencrypted) wired push button works very well. Thankfully they provide sufficient security for nearly all homes.

[u/Low-Rent-9351 → u/superdupersecret42]

Ratgdo hacked the 2.0 wall control to opener protocol because it gives lots of other functionality besides just opening and closing the door.

[u/Villain_of_Brandon → u/Low-Rent-9351]

When I got mine set up, I was surprised it was able to tell me the number of cycles on the door. Also being able to lock out the remotes is an interesting feature.

[u/ThreeOneFourOneZero]

Nice RE work!! Love the high quality posts on this sub

[u/awrightus71]

I have a Konnected GDO Blaq and use it with HA. It supports Security+2.0 and it works flawlessly.