Support for Ultrasync with Aritech ATS x500AIP series

[jnathalia]

Dear @chatziko and maybe others like @caronc,

There are many users having the alarm system of Aritech ATSx500 (like ATS3500) connected with Ultrasync on an iPhone or other. Unfortunately, this Ultrasync integration has been adopted by HA but is not supporting this family of alarm systems. My feeling says, it must be a small issue to get this working, but haven't got the know-how to solve it.

Is there any chance we can somehow cooperate to make this happen? Otherwise the documentation should be changed that it's particularly working for certain alarm systems and not Ultrasync in general...

I hope to hear something of you. Many thanks in advance.

[chatziko]

If you have some experience with python and basic web development and some time to spare it shouldn't be hard to add support for your panel. We could give some pointers to get started, general help, etc. If, on the other hand, you have no programming experience, it's not that easy to add support without access to the panel.

[jnathalia]

python doesn't look complex, but I haven't been using before...
I have been programming assembly, Pascal, C, C++, Essbase, TM1, so I'm not totally unknown.
I need some guiding on this, but I'm willing to help...!

[chatziko]

Then you should definitely go for it, it will be a fun project, the code is relatively simple.

The place to start is the ultrasync python library. It does all the communication with the panel, and is simple to run and debug, without all the complications of Home Assistant. If you can make the library work, the integration will most likely also work.

So create a config file according to the README, run ultrasync --details, and look at what error you're getting. Likely the UltraSync::login or some other function will fail.

Then you need to manually connect to the Ultrasync web interface from your browser, open the browser's developer tools and check the content of the corresponding http requests to figure out what is different between what you see and what the python libary expects.

Once you figure out the differences, you'll need to add another entry to the NX595EVendor enum, and adapt the code to perform and decode the expected requests when connected to your panel.

[caronc]

What @chatziko said; Don't be afraid to use the ultrasync tool and provide a --debug-dump. This shares with others how your alarm panel is structured so they too can help. Tests cases are built around these dumps as well.

[jnathalia]

I'm excited and have started!

But how to start with the README.md? The first easy step it says is:

`# Install ultrasync onto your system

pip install ultrasync
`

I have installed a docker on my Synology NAS, called "python" and opened a terminal. Once I key in the above, I'm already stuck. Is installing a python docker the correct way to go? Or should I take an Ubuntu docker?

Or should I install the GitHub desktop version?

I really have no idea to start, sorry it's my first time...

[chatziko]

I wouldn't do it in docker, it's not meant to run a full OS, it's hard to persist data etc. Better install a full developer environment in a VM (ubuntu, python, vscode, etc).

[jnathalia]

I have installed Ubuntu on a VM (VMware Fusion), including python3.11. VScode was initially not possible, but found the ARM64 version (Apple MacBook).

I installed pip and executed 'pip install ultrasync'!

Now ready starting to test...

When I go to /home/username/.local/bin I can see after the 'ls' command in green 'ultrasync', but that's it... how to continue? I have created a file ats3500.cfg with the IP, username and password.

I run 'python3 ultrasync --config ats3500.cfg -w --debug-dump' but this is the result:

[jnathalia]

The config only allows host, user and PIN.

When using my app "Advisor Advanced Pro" from Aritech I have to fill in at UltraSync:

• Device Name (which is just a label)
• SID number
• Ultrasync Password
• PIN

Alternatively, I can define it via Direct IP:

• Device Name (which is just a label)
• DNS/IP Address
• TCP Port (default 32000)
• Encryption Key (default 000000000000000000000000)
• PIN

I think here the authentication process already differs from what has been developed until now.

[caronc]

Can you share the html of your login page (view source, -> save). It will reveal the form (you need the variables

[jnathalia]

the ethernet card of the ATSx500 (Advanced) doesn't have it's own webpage. The only way to access is via the app as far as I know...
The ATSx000 (which is the Classic and already end of life) did have its own web page server.

I can share my app's screen, but this won't help you as you want to see how it's connecting via http...

[caronc]

You may need wireshark to capture existing communication to the device at this point then. There isn't a whole lot to work with. The script depends on the http protocol

[jnathalia]

I had a quick look at Wireshark, but it seems not to be able to capture communication at my iPhone...

Would https://proxyman.io/ a better alternative?

Or should I install it on my Win11 VM with the ATS8500 installer software to capture the communication? This can connect in both ways, IP and UltraSync...

[jnathalia]

The following is based on UltraSync communication (via the cloud):

This was just the connection process.

[jnathalia]

The following is the IP based connection, which is better as it direct and within the local network:

192.168.1.202 is my local Aritech ATS3500 panel. 192.168.194.148 is my local VM.

Is this what you are looking for? If I need to do anything else, please let me know.

[chatziko]

Seems like connections happen on port 32000 of your panel, which is what this user also reports.

Try nmap -p- 192.168.1.202 to see what else is open on the panel.

[jnathalia]

Correct, this thread has never been picked up any further...

Also 32000 is also obvious as the setting is like:

Then Nmap I should install at my Ubuntu instance right? Can it trace that IP from my ATS panel?

[chatziko]

Basically the integration needs to communicate over http, the supported panels have a web interface on port 80. You can check in wireshark whether the communication on port 32000 is http (which I doubt). Otherwise maybe there is an http interface on some other port, you can try http://192.168.1.202:80, http://192.168.1.202:32000 in your browser, or use nmap to find other open ports (but again it's unlikely to have an http interface on some weird port).

If the panel has no http interface then you're probably out of luck. Reverse-engineering a custom binary protocol is hard and time consuming, and would also require to essentially re-write the integration from scratch (the existing code wouldn't be that useful).

[jnathalia]

The Aritech ATSx500A-IP panels do not have a web interface. This is confirmed by my installer and it also clarifies why at the IP address no http(s) page is responding. The latest ATSx700 seems to have this, but this panel is only a few months old and we have been living for 15 years with the ATSx500 series at many residences.

When using the Ultrasync communication protocol, it communicates via http but this is via a cloud server (you can see 2 URL's in the first screen dump). The internal address cannot be accessed via :80 or :32000 or any other port unfortunately.

I'm very much afraid, your last paragraph is the truth although I don't want to hear... and the option of a login via the URL as snagged might be possible:

• webauth-a.ultraconnect.com
• stun-eu21a.ultraconnect.com

I also found at the settings of my panel the URL atw1.ultrconnect.com:8081

Although I have said the current Ultrasync integration is only a combination of host, username and PIN code, the Ultrasync for ATSx500 has fields like host, SID number, password and PIN code. Maybe we can just extend the integration with one field? To answer this, the question is, is the field "host" referring to an IP address or cloud/http address? Is the field "username" meant for SID? Is "PIN" meant for password or PIN?

Alternatively, the app is also just communicating via cloud (Ultrasync) or direct via IP. Would it help to snag with https://proxyman.io/ on an iPhone and see what kind of communication exists via Ultrasync/cloud?

[bcjvandeven]

Communication with an ATS Classic, ATSx000 or an ATSx500 is available through the SDK, written in C#. The SDK contains various DLL's and drivers. The ATS Advanced documentation is very extensive and complex and contains a PDF of 1800 pages. If you are interested in developing something together, please email me. I'm still too new to C#, but i'm to interested in a solution.
With the SDK it is possible to connect via USB, IP or Ultrasync.

[jnathalia]

@bcjvandeven, this is correct. For the ATSx700, Axon, it has been changed to an API...

I have implemented according to this thread https://github.com/tdeckers/utcar/issues/2

All is functioning fine. The downside is that for each PIR or magnetic contact, you have to create a "bypass" at your ATSx500 like a filter, output and (virtual) zone to monitor its status.

I'm still working on it, but in the screen dump below you can see what I have realised:

Please check the multi status (not binary) on the right side (disarmed, partially armed, full armed) and the status of the window (TV Kamer Raam Links). I will try to add in alarm status as well for the corresponding area. Still some work to do, but it works.

Ultimately, the SDK solution is the best. There are 2 suppliers in NL where you can buy it, but expensive. This is for free...

[bcjvandeven]

@jnathalia A great solution, an X-SIA receiver for the Osborn Hoffman protocol, which is more than sufficient for most applications! Switching areas on and off could be done perfectly on a contact basis!

[jnathalia]

You mean to influence from outside your ATS by using a binary actor to arm/disarm the alarm? I prefer not to do that. I have the app if I want. For me, it's more for reading the status of the panel as I have built several automations to turn on/off lights, pumps, ventilation etc... this is my main purpose. Plus if there is any alarm I can see it in one overview quickly what's happening, especially when I make a floor plan and implement all those sensors.

I have done this for another project and looks really cool!

[bcjvandeven]

The wish to switch the alarm system and outputs may be personal. But I think the X-SIA receiver is a great solution, it has many advantages. Super!

[darkl0rd]

First of apologies for opening a new issue, I missed this one.

I have an ATSx500 system myself, these systems need to do their initial authentication through a cloud server (ultraconnect.com). There is an excellent blog post that describes how to do this (https://diy.2pmc.net/after-a-firmware-update-disabled-local-access-the-goal-is-to-restore-the-remote-control-functionality-of-the-hills-alarm-system-in-home-assistant/)

I have managed to connect successfully by following these instructions, however I am unable to adapt the ultrasync library to make it work.

Worth noting, the blog post states that his system previously worked through a local webpage, but that a firmware update resulted in also requiring the cloud connection; this probably means that in the near future more systems will follow; for that reason alone it might be worth updating this code to ensure continued support of existing systems that upgrade their firmware.

If I can be of any help, please let me know. I'm happy to use my panel for testing.

[jnathalia]

Great article, a good example how to determine the communication between app and the alarm system. However, this is for the Hills Home Security System. Although it's Interlogix (Ultrasync), it's slightly different for the ATSx500 unfortunately. If someone could follow the same procedure as Csaba Peter did, I'm sure it can be found out what is currently lacking for the ATSx500.

I'm not putting the effort in it. The best path is using the SDK, next to this reverse engineering of Csaba Peter, in my opinion.

As I have fixed it by programming my ATS3500 and caught the info via SIA, I get all the information required for any status of the alarm system. Not ideal, but working properly and fast...