Liftmaster Wired Keypad/MQTT controller Hacking

[palayman]

Have some free time and am annoyed by the lack of control in the MyQ app. Would really like to schedule turning wireless remote access on and off from my ISY.  You can do this from the wired keypad, but not from MyQ. Will probably use a Raspberry Pi and MQTT to talk to the MQTT node server.

Have started snooping the signals from the Liftmaster wired remote and it doesn't look like there is any king of rolling code involved, but it will take some time to decode.  Was wondering if anyone new if these signals had already been hacked?  I'm more experienced hacking RF with RTL 433 or using the Universal Radio Hacker.  Is there something similar for Simple low frequency serial signals like those on the keypad power lines?

Many thanks,

Paul

[Goose66]

Could you just hack the contact closure for the lock button and the led leads for lock status?

As far as MQTT nodeserver and a remote raspberry pi, why not just implement a simple web server and host the Node Server REST API directly, and bypass Polyglot altogether.

Edited December 14, 2020 by Goose66

[palayman]

6 minutes ago, Goose66 said:

Could you just hack the contact closure for the lock button and the led leads for lock status?

As far as MQTT nodeserver and a remote raspberry pi, why not just implement a simple web server and host the Node Server REST API directly, and bypass Polyglot altogether.

Thought about about hacking the buttons as you suggest, but then new Liftmaster controls don't have just simple lock button.  It is buried a couple of levels deep in a menu system using an LCD display.  Could still accomplish as you suggest, but don't like doing it "open loop", in case something went wrong.  Could end up opening the door instead of locking out the wireless remotes. I should try an older wired button to see if they are capable of locking out the remotes in parallel with the new one.

The rest API is a good suggestion instead of the MQTT implementation.

[MrBill]

54 minutes ago, palayman said:

Thought about about hacking the buttons as you suggest, but then new Liftmaster controls don't have just simple lock button.  It is buried a couple of levels deep in a menu system using an LCD display.  Could still accomplish as you suggest, but don't like doing it "open loop", in case something went wrong.  Could end up opening the door instead of locking out the wireless remotes. I should try an older wired button to see if they are capable of locking out the remotes in parallel with the new one.

The rest API is a good suggestion instead of the MQTT implementation.

LM889 has a physical lock button, but it's momentary not latched. It needs to be held about 2 seconds to make the locked state change.  When locked the normally solid Amber light flashes fast until unlocked by again holding 2 seconds.  

The 889 LM works for LiftMaster Security+ Garage Door Openers manufactured after 1998. Look for a purple “Learn” button and antenna wire or orange/red “Learn” button with a gray antenna wire.

[Goose66]

1 hour ago, MrBill said:

LM889 has a physical lock button, but it's momentary not latched. It needs to be held about 2 seconds to make the locked state change.  When locked the normally solid Amber light flashes fast until unlocked by again holding 2 seconds.  

Those are the ones I have too. Yes, hacking these at the button level would be sketch. Hacking a menu button to step through a sequence on an LCD control pad is too messy even for my tastes. Really should be in the API, seems like something I would want to do from the mobile app.

Edited December 14, 2020 by Goose66

[MrBill]

7 minutes ago, Goose66 said:

Those are the ones I have too. Yes, hacking these at the button level would be sketch. Hacking a menu button to step through a sequence on an LCD control pad is too messy even for my tastes. Really should be in the API, seems like something I would want to do from the mobile app.

I have one of those LCD versions on the newest operator... I hate it!   The time is almost always flashing because it's not set and the menu's are a pain.  The other 3 have the 889's which I added/swapped the originals to get the older doors to work on myQ

Edited December 14, 2020 by MrBill

[palayman]

6 minutes ago, Goose66 said:

Those are the ones I have too. Yes, hacking these at the button level would be sketch. Hacking a menu button to step through a sequence on an LCD control pad is too messy even for my tastes. Really should be in the API, seems like something I would want to do from the mobile app.

Yes, it seems like something you should be able to do through the app, but you can't.

[Goose66]

Let me try just sending a "lock" and "unlock" action through the API just to see what happens.

UPDATE: No joy ☹️

Edited December 14, 2020 by Goose66

[larryllix]

35 minutes ago, MrBill said:

I have one of those LCD versions on the newest operator... I hate it!   The time is almost always flashing because it's not set and the menu's are a pain.  The other 3 have the 889's which I added/swapped the originals to get the older doors to work on myQ

Ditto here! Except my older dumb unit always has the wrong time on it as every power blink crashes it again. I finally gave up. My newer Battery backed MyQ unit was the same thing. While quickly attempting to set it up I gave up after it showed the process crashed, locked me out, and I had to get out the ladder again and push some combination of buttons to factory reset it. I never did get back to it for the last 24 months now. Yesterday I walked by it and the time and date was exact! Co-incidence or has this thing learned how to access the web on it's own and get accurate time? LOL..Whatever!  I have learned to ignore the gadgets that require setting until my whole ISY Insteon system went down to about 25% success. How can a simple battery charger put out that much electrical noise?

Better yet. How can a simple RF remote receiver put out that much Insteon noise on an AC motor GDO?

[Goose66]

I am always amazed at all the new functionality they try and add to these things. It's a garage door opener. I need to be able to open it. I need to be able to close it. I don't need an LCD screen with a menu of options. That's what I have my ISY for!

But if you're going to add a lockout function, then make it accessible remotely. If I am at home and have access to the local keypad (or LCD screen), I probably don't want to engage my lockout. It's when I am sitting at the airport waiting for my plane to Fiji that I remember that I need to lockout my garage door openers (and adjust the thermostats, and turn on the random light routines, etc.).

Edited December 14, 2020 by Goose66

[lilyoyo1]

14 hours ago, Goose66 said:

It's when I am sitting at the airport waiting for my plane to Fiji that I remember that I need to lockout my garage door openers (and adjust the thermostats, and turn on the random light routines, etc.).

My garages are plugged into controlled receptacles that will turn off (disconnecting the garage doors) if vacation mode is enabled, the doors are closed, and our phones are off network. 

[palayman]

2 hours ago, lilyoyo1 said:

My garages are plugged into controlled receptacles that will turn off (disconnecting the garage doors) if vacation mode is enabled, the doors are closed, and our phones are off network. 

Was considering doing that, but sometimes the remote control via MyQ won't respond properly after the power outage until a local open/close event is initiated. Also, they're off for an extended period of time the internal battery dies and needs to be replaced.

As part of my hacking I tried to find the FCCID for the wired remote pad.  Unfortunately it says "FCCID N/A".  This is strange. Now I have more questions about its actual operation.  Need to look at the power lines to it with the Keypad disconnected.  Maybe the signals are initiated at the Opener and the Keypad just "interferes" with them.

Does anyone have a Liftmaster wired keypad with an actual FCCID on it?

Paul

Edited December 15, 2020 by palayman