Author Topic: Trane XL950 Thermostat  (Read 39954 times)

Offline IwantSSH

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #15 on: December 09, 2011, 02:33:19 pm »
I recently purchased a XL950 ComfortLink II, and as my user name suggests I want SSH access to this device :)

After poking around the latest firmware update, I found what appears to be an /etc/shadow file listing roots hashed and salted password. I have attached it to this message as this forum thinks its a link.

I have been attempting to crack the password using John the Ripper but so far it has been unsuccessful. Hopefully someone with more resources may be able to get at this password. I am also curious why "pcap" is installed on the machine, is our thermostat watching us??? :)

Offline Juan21

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #16 on: December 10, 2011, 06:40:35 am »
Hello,
So i've got a couple more quotes and now i think it will have to be an XL15i or an XL20i.

My question is what should the appropriate air handler be for both these systems? I was asking for a Hyperion air handler since it's newer but does the XL20i not communicate with the Hyperion Tam7?

Here is the quote before any rebates. A little higher than the other quotes i've been getting, but they're sealing the ductwork and installing 3 more returns and including the trane 10 year parts and labor warranty. and after the austin energy rebates the modifications will be free.

all for 4ton systems

XL15i - $10,007
4TWX5049E1000A
GAM5A0C48M415A
HEAT= BAYEABC15BK1AA
TCONT803

XL20i- $11,657
4TWZ0048A1000A
TAM7A0C48H415A
HEAT= BAYEVBC15BK1AA
TCONT900

A couple questions, are these fair prices? Are the air handlers adequate or should i be looking for the 4TEE-C handlers with the XL20i Quote and would this be more expensive? Should I ask for an XL19i quote instead of the 20i? Would the 20i save money in electricity compared to the XL15i due to the 2 compressors?

Offline virgil382@gmail.com

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #17 on: December 22, 2011, 04:14:21 pm »
Hi IwantSSH,

I followed in your footsteps and I was also able to read the contents of /etc/shadow.  But there are actually 2 versions of this file stored in 2 different file system image files!

This is how to get the upgrade files:
1) Download the XL950 software upgrade from http://www.trane.com/residential/products/thermostatxxl.aspx, run the installer, and extract the files to a directory.

The first file system file is b_132090800701.  It's a GZIPed ext2 image file.  This is how to read its contents (including /etc/shadow):
1) Rename b_132090800701 to b_132090800701.gzip.
2) Use a program that can uncompress GZIP to extract the file rootfs.ext2.
3) Use software such as Ext2 Installable File System For Windows to mount rootfs.ext2 and access its contents (including /etc/shadow).

The second file system file (and probably the one that matters) is c_132090800701.  It's a jffs2 image file.  This is how to read its contents (including /etc/shadow):
1) Use a program such as jffs2reader.exe to extract the file.  You can get jffs2reader from here: http://www.mobileread.com/forums/showthread.php?p=1110162

I should add that I tried to mount c_132090800701 on a Linux box in order to read/write its contents, but after unsuccessful spending a day on this, I found jffs2reader.exe which can only read (not write).


One possible way to convince the XL950 to allow you to SSH into it, would be to replace the contents of /etc/shadow with your own in order to add your own known set of credentials.  The idea is to then apply these changes by performing the normal XL950 software upgrade process.  Subsequently, you should be able to SSH into the XL950 using the credentials that you added to /etc/shadow. 

Doing so, would modify the contents of either b_132090800701 or c_132090800701 (take our pick).  This means that the SHA1 hash would no longer match the one specified in m_132090800701.  So after modifying either b_132090800701 or c_132090800701, you would have to recalculate the SHA1 hash and would need to change it in m_132090800701.

Unfortunately, c_132090800701 is probably the image that's used by the XL950 to run normally.  I think that b_132090800701 is used during the upgrade process, so modifying its contents would probably not buy you anything.

Disclaimer: I have not tried changing anything and I don't know if any of this will work.  This might even break things.  If you do this, please make sure that you are willing to accept all the risks associated with doing so.

Good luck!  Please let us know if you tried this and if it worked.
« Last Edit: December 24, 2011, 10:30:29 pm by virgil382@gmail.com »

Offline stevenroka

  • Newbie
  • *
  • Posts: 16
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #18 on: January 31, 2012, 03:54:19 pm »
I have a schlage gateway, would I be able to set it up and have it communicate with the Vera2?  I'd subscribe to the monitoring fee for a month to allow me to get it on the network then cancel the service.  I'm wondering if it would still show up or if it's possible to have two gateways on the same network.

Anyone know if this is an option?

Offline agoodman82

  • Sr. Member
  • ****
  • Posts: 272
  • Karma: +1/-0
Re: Trane XL950 Thermostat
« Reply #19 on: March 21, 2012, 11:02:43 pm »
Has anyone that had posted here previously figured out how to get the Trane Comfortlink II to work with Vera? Is it confirmed that the thermostat actually does not have a z-wave chip? So far I haven't found anyone that's able to get this unit to work on anything other than the Schalge Link system. I'm very interested in getting Vera 3 and getting this thermostat as well, but i'm concerned that the two will never be able to communicate and live up to their full potential.

Offline arlane05

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #20 on: March 25, 2012, 10:30:23 am »
I found some information on the Trane website that might help, here is the link:

http://www.trane.com/Residential/Questions/What-is-the-ComfortLink-II-control

and they do mention control through Z wave. Hope this helps!

Offline Dominic

  • Sr. Newbie
  • *
  • Posts: 34
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #21 on: April 04, 2012, 12:14:19 pm »
I found some information on the Trane website that might help, here is the link:

http://www.trane.com/Residential/Questions/What-is-the-ComfortLink-II-control

and they do mention control through Z wave. Hope this helps!

I read that.  I think they're only referencing z-wave enabled lights and appliances.  I do not think the XL950 has a z-wave chip in it.  I think it's only web enabled.

I still have yet been able to figure out if we'd be able to use it.

Offline agoodman82

  • Sr. Member
  • ****
  • Posts: 272
  • Karma: +1/-0
Re: Trane XL950 Thermostat
« Reply #22 on: April 04, 2012, 11:14:07 pm »
Unfortunately, I just found the answer to the Z-Wave chip question on Nexia's website (formally Schlage Link) :(

Under the "compatibility" menu for the ComfortLink II http://nexiahome.com/Products/ProductDetail.aspx?model=ComfortLinkII it states:

"ComfortLink II control does not have Z-Wave but integrates seamlessly with the Nexia home automation system via a wireless (802.11) home network."

So, for whatever reason, Trane must have wanted to solely partner with Nexia on this thermostat, because without a z-wave chip, the ComfortLink II can't be paired with any other z-wave controller like Vera as far as I can see. The CL2 can still be controlled from a computer or smart phone free of charge within the confines of your own wireless network, but without a Nexia subscription, you wouldn't be able to remotely monitor/control your thermostat. I'm just so against the $8.99 subscription fee when you can run these devices free of charge with other z-wave controllers like Vera. This was a pretty big disappointment to me finding out the CL2 doesn't have it's own z-wave chip.
« Last Edit: April 04, 2012, 11:16:16 pm by agoodman82 »

Offline agoodman82

  • Sr. Member
  • ****
  • Posts: 272
  • Karma: +1/-0
Re: Trane XL950 Thermostat
« Reply #23 on: April 04, 2012, 11:43:01 pm »
After doing some further reading, Trane and Schlage are both brands owned by Ingersoll Rand. It makes total sense now why the Trane ComfortLinkII was only designed to work on the Nexia Home Intelligence System -- they're all a part of the same company.

Offline sep23

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #24 on: July 10, 2012, 09:00:40 pm »
I recently purchased a XL950 ComfortLink II, and as my user name suggests I want SSH access to this device :)

After poking around the latest firmware update, I found what appears to be an /etc/shadow file listing roots hashed and salted password. I have attached it to this message as this forum thinks its a link.

I have been attempting to crack the password using John the Ripper but so far it has been unsuccessful. Hopefully someone with more resources may be able to get at this password. I am also curious why "pcap" is installed on the machine, is our thermostat watching us??? :)

Hello,
   I am in the same boat as you. I would like to gain root access to the XL950 as well. Have you made any progress on logging in via SSH yet? There must be some Linux expert that can help! I know the traditional way of gaining access to Linux is via the bootloader (LiLo or Grub); in fact that method is well documented around the internet and is fairly easy to do. Unfortunately there doesn't seem to be a bootloader step visible when the XL950 is powered on. Perhaps, that step is just not echoed to the screen but is still happening. Not sure how to see it to stop it and make the changes necessary to the filesystem to gain access. Anyways, I just wanted to add my 2cents and see if anyone here has had success. Thanks!

Offline stevenroka

  • Newbie
  • *
  • Posts: 16
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #25 on: July 11, 2012, 12:02:32 pm »
No I have not yet found a solution.  I do have a nexia bridge that I haven't activated, so I might set it up and see if it can communication with my Vera2 without paying the fee.  It gives me a couple months of free use so that might give me some time to make it all work.

Offline Dominic

  • Sr. Newbie
  • *
  • Posts: 34
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #26 on: August 08, 2012, 12:18:04 pm »
For anyone still watching this, I just got an email fro Nexia:
Quote
Great news! We are pleased to announce that your Trane ComfortLink II Control now provides you with the ability to remotely monitor and control your home's heating and cooling at no charge to you! Yes, this means you will no longer have to pay a monthly subscription fee to manage your Trane ComfortLink II Control. In fact, you can manage all of your Trane ComfortLink II Controls at no charge!

You do not need to take any action to take advantage of this subscription change. We have already made the change to your account and you will no longer be billed for using Nexia™ Home Intelligence. A monthly subscription fee of $8.99 will apply if you choose to add a Nexia Home Bridge and Z-Wave® devices to your account.
 

So, for those with this thermostat, you can sign up with Nexia and control it for free.  Once you add their home bridge, then you start paying a monthly fee.  They have an iPhone and Android app so we can control it remotely.

I still would like to be able to control it in one place from Vera.  But at least we can do it for free.

Offline arlane05

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #27 on: August 08, 2012, 11:52:53 pm »
That is great news, I have been using Nexia for just the T-stat for a few months and it works great. I have not received this e-mail, is this info on their web site?

Offline leifmb

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #28 on: April 28, 2013, 08:15:28 pm »
Hey, has anyone been able to login to the XL950 yet through SSH or Web (non Nexia)?


Offline groovydude

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
Re: Trane XL950 Thermostat
« Reply #29 on: May 07, 2013, 12:05:16 pm »
A couple months ago I tried cracking the device.   Seems like they secured it pretty tight to protect their money-making subscription interests.  The communication between the t-stat and host is ssl encrypted.  I have a few more ideas left up my sleeve, but haven't had the chance, nor do I know when I will, to return to it.