1. Resetting Powermax Installer Code Alarm System
2. Resetting Powermax Installer Code Alarm Free
3. Resetting Powermax Installer Code Alarm Instructions
4. Resetting Powermax Installer Code Alarm System
5. Resetting Powermax Installer Code Alarm Clock
6. Resetting Powermax Installer Code Alarm Systems

I’m not sure I can ‘disclose’ the alarm system manufacturer’s name but they sell their products all over the world (according to their website), by the way I can see them everywhere I go 🙂

A few months ago I decided to open the burglar alarm control panel at my parents’ house.

Oct 17, 2017 The reset code varies based on the manufacturer and model of your keypad. Enter in the reset code. In most cases, the reset code is either your security code followed by the off button or the “1” button. However, in some models, it may be different. After the system resets, enter in your security code to arm the system. 5: When you are on the code you wish to change press ” i/o.k ” 6: Enter new 4 digit code and press ” i/o.k ” – your new 4 digit code is now programmed in. 7: Press the ” man in the house key ” (located on the left, in between the closed padlock and open padlock symbols) until the screen shows ” o.k to exit “. I have fobs that work to set the alarm etc but do not know my user code or the master code to key in at unit on wall. I wish to reset the unit and reprogram the fobs Submitted: 8 years ago.

I then see that, once again, security is not where I would expect 🙂

My parents wanted to make some minor modification regarding the arming rule (e.g. arming garage and kitchen but not bathroom anymore during the night).

Resetting Powermax Installer Code Alarm System

They told me that the installer guy asks each time 150 € (~200 $), even for minor (and quick) modifications. I’m quite sure the guy doesn’t know he’s just changing a few bytes when he uses the user interface software from the alarm manufacturer. Anyway, he knows that the operation takes only a few minutes at most, and me too 🙂
Please note that I don’t discuss the fact that the guy has to earn his life but maybe I’m going to think of selling/installing burglar alarms…

So I opened the control panel to look for a model reference inside.
Ouch… the first bad surprise was that removing the cover fired the alarm instantly…
Fortunately we could stop the alarm bell by entering the (known) user code at the keypad.

The second surprise, pretty much worse, was that it was not possible to arm the alarm anymore 😦
Well, the installer code is needed to clear the fault… It seems that this anti-tamper system is also another way for the installer to get 150 bucks more.

From that moment it was even more important to get access to the system, I was urged to make it working again, hum. The good news was that there was a connector which looks familiar (it’s always better than proprietary interfaces…).

So I went on the manufacturer website, thinking of downloading some software…

As you can see, access to this part of the website is for authorized ressellers and installers only…
Too bad but… hey, guess what, you can register… 🙂
I first thought that I would have to wait a few days in order to let them verify my identity and so on. Working in electronic & IT, I was really thinking I could convince them to let my access the software download but… surprise, they trust you straight away, just fill the boring form and you’re done.

I thought of injecting some html to get “Other”, “End user” or even “Hacker” choice in the above listbox but no time for that 🙂

I then installed and ran the freshly downloaded user-friendly awful ancient-delphi-style software, connected computer to the electronic board through classic RS-232.

I could read a lot of things out of the alarm memory/configuration but surprise surprise I cannot modify anything without providing some ‘installer code’. My parents asked the guy but no way to get it… I’m not sure he can legally keep it from us but I then understood there was (?) another reason…

The ‘exciting’ part began and I noticed a few interesting things:

• The input password box is max 6 characters length.
• It seems that I can try as many times as I want (as I need).
• The software reacts very very quickly (for its age :)) when I try passwords, it let me think that the lock was software only and not embedded in the alarm electronic, I could have been wrong but I had this feeling :-).
• Given the fact that the code can also entered using the physical keypad it’s numeric only (confirmed in the manual).
• Regarding the alarm manual (also downloaded from the website) the installer code must be at least 4 characters long.
• The software seems to continue working after I disconnected the computer from the RS-232 electronic board.

Given all these observations, I thought of a “brute-force” attack. Nowadays it’s rarely useful (because of the usually large key space used) but here, it could take less than one day. Anyway, there were other more elegant possibilities:

• Sniffing communication between computer and electronic unit.
• Sniffing data on the PCB side.
• Playing with OllyDbg to either grab the code from memory, or inverting some conditional tests to make the software accept any code.
• Being an electronic guy, I also thought of reading the eeprom/micro-controller.

I had a quick look with OlyDbg (and some other delphi dedicated diasemblers) but too painful for me (I did some crackmes a long time ago but I don’t know much about “cracking”).

So I went for the brute-force attack and the sniffing at the same time 🙂 I quickly wrote a piece of code sending incremented numeric codes, clicking the validate button while reacting to the invalid code messagebox.

I let the brute-forcer app running and, after lunch, picked another computer to sniff data, I didn’t know that software sniffer for RS-232 would exists so I first went on using two RS-232 ports but while googling I found “free device monitoring studio”, never thought that this kind of software would exist but it makes sense!

I confirmed the fact that the software does not exchange data with electronic unit when checking entered codes… So the software would exchange the code when it “connects” to the board the first time.

There were only a few bytes and some of them immediately caught my eyes… wait… these numbers sounds familiar…maybe this is a coincidence but they are the same that my postal code! Would the installer guy use the area postal code as it’s installer code…? And would the box exchange the code with the software in plain text? It seems so, at least for my parents’ alarm 🙂

In the meantime, the brute-forcer app, stopped counting at my postal code, too.

Resetting Powermax Installer Code Alarm Free

Surprise surprise no more invalid password messagebox when trying to unlock with the local area postal code anymore 🙂 I have now full access to modify whatever I want!

I do not blame the alarm manufacturer, because if the thief is able to remove the cover to connect some PC, this thief is certainly already inside your house (and either the alarm bell is already ringing, or he already took care of that).

What scares me is the installer guy who supposedly uses the same (logic) code everywhere (I guess it’s another one for the other local areas but I should be able do guess it :-))

Knowing that there is a logic behind the installer code, bad people could break any surrounding house and gently disarming the alarm system…
Windows are labeled with “protected by [the guy_company_name]”, I think the purpose is to ‘scare’ stupid thieves (or maybe to appeal the other ones :-)).

There is also a communication module (in option) which allows the end user to remotely (modem over phone line) arm/disarm the system, the problem is that this module also allows installer guy to make some changes remotely (still costing 150 bucks :-)?). A ‘more malicious’ attacker might try to remotely connect to random houses (the ones wearing the ‘protected stickers) using the phone book…

At least the installer guy won’t be able to do anything locally/remotely as I changed the installer code (hi thieves, I’m now using the house number haha :-)).

ADT's corporate installer code is regarded as a trade secret. While various websites have published the code, the surer way to get into a system is the 'backdoor' method. The process of getting into installer programming via the backdoor is different depending on which system you own.

Please read the following guide carefully. It will help you determine whether you can reset your ADT alarm system, even if you do not have the installer code.

1. Identify your system. ADT nearly always uses Honeywell/ADEMCO products when they install in home. Sometimes, however, they use DSC, GE/Interlogix, 2GIG, or another major brand. If your system is a Honeywell or ADEMCO and is wired, then look at the circuit board in the beige box. There will be a half inch by half inch PROM chip on it. It should look something like this:
   If you see a long rectangular PROM instead of this small, square one, or if your PROM says Safewatch Pro 2000, then you likely have a VISTA 20SE. A Safewatch Pro 3000, however, corresponds with the Honeywell/ADEMCO Vista 20P. If you have a 20SE, or any of the non-Honeywell panels mentioned above, we recommend sending an email with a picture of the system to support@alarmgrid.com or calling our main phone number (888-818-7728). This is for the commonly installed wired panels. If you have an all-in-one wireless system, such as the L7000, L3000, or the new Lyric, then go ahead and skip to step 3. If you have a Safewatch Pro 3000, 20P or any other Honeywell panel, then proceed to step 2.
2. Identify your communicator. If your system has been monitored over traditional phone line, and you are looking to have the same setup going forward, then you're ready to go. You probably don't need to add much more to your system. There are a lot of things you'll miss out on, like the ability to get text and email alerts, or the ability to see your system activity on your phone and computer. But not everybody wants that. If you do have a communicator, we can help you figure out what you need to do next. ADT often uses proprietary communicators. These communicators can usually be identified by the logo they print on the item. Sometimes, however, they use a plain old Honeywell communicator. If ADT installed a Honeywell communicator such as the iGSMV4G, GSMV4G, GSMX4G, or 7847i, then go ahead and proceed to the next step.
   
   If you have a proprietary communicator, then in order to get your system monitored, you will need to get a new system communicator. We recommend the iGSMV4G. This will give you the most options. However, if you just want internet-only communication, the 7847i may work fine for you. Ultimately, the iGSMV4G costs only a little bit more, which we think is worth the benefit. If you have a Safewatch Pro 3000 or if your system's got a PROM chip with the letters WA20P on it, but indicates a revision smaller than 9.12, then you will probably want to change out the PROM chip.
3. Backdoor into the system. Honeywell systems are simple to backdoor into. We have a simple guide on how to backdoor into your VISTA system as well as a video.
   
   For those who are looking for instructions on how to reset a wireless adt alarm panel, we have other guides that will instruct you on backdooring into them: L5100, L5200, L5210, L7000 and Lyric. In the case of both VISTAs and Lyrics, there is a way to permanently lock an end user out of programming. If this has been done to your panel, you will have to either have the old provider unlock the panel or do a full panel replacement.
4. Reset the master code. You will know as soon as you go through the guide. Once you have entered the system's programming through the back door, changing your ADT codes couldn't be simpler. Change the installer codes and ADT master codes to whatever you would like. Resetting the Master code on a Lyric is easy and is basically the same process as any of the LYNX Touch panels. Watching this should give you the steps necessary to make the changes to your L5210 or L7000.
   
   Resetting the master code on a VISTA panel is no more difficult, though it will be much more simple if you have a alphanumeric programming keypad like the 6160.
   
5. Change the installer code. The installer code is the code used to get back to the programming menu screen. The default on a Honeywell system is 4112. For most users looking to get things in working order, it will be easiest to simply set the system to 4112 for the time being. For Lyric's or the LYNX Touch panels, below is how you can change the installer code from installer programming.
   
   The VISTAs, however, are slightly different. This is a video explaining the button presses for programming a new installer code. on these systems.
   
   

Following this guide will get your ADT system up and running so that you can be monitored by any other company. You do not need the ADT installer code to actually modify the system, and following these steps will not hurt the programming in the panel. Even replacing the PROM should preserve all programming. If you have any questions about how to reset your ADT alarm panel, feel free to contact us calling the number above or emailing support@alarmgrid.com

Did you find this answer useful?

We offer alarm monitoring as low as $10 / month

Resetting Powermax Installer Code Alarm Instructions

Resetting Powermax Installer Code Alarm System

Related Products

Resetting Powermax Installer Code Alarm Clock

Resetting Powermax Installer Code Alarm Systems

Answered

Answered By

Joshua Unseth