I picked up a 2GIG EDGE panel (2GIG-EDG-NA-V3) that had never been activated on Alarm.com. The goal: integrate it locally with Home Assistant via its ELAN g! protocol on port 2198. No cloud. No subscription.
Hardware Overview
The EDGE runs on a Freescale i.MX8MMQ SoC under a Yocto “sumo” build (GoControl Next). Kernel 4.14.78. Two CP210x USB-serial sub-processors handle Z-Wave and cellular. WiFi is an AMPAK SoM (Broadcom-based).
Finding the UART
The board has several header candidates. I focused on two:
- J18 — 2x5 SMT, 1.27mm pitch, 3.3V. Soldered a connector. L5=TX, R5=RX, GND via screw terminal.
- J31 — 3-pin through-hole.
Standard baud rates produced either nothing or a single garbage byte on power-up. Then I found J10 — the middle pin produces a full boot log at 115200 baud via FTDI on /dev/ttyUSB0. Login prompt lands on /dev/ttymxc1.
The Authentication Challenge
root triggers an OPIE/S-Key challenge:
Password (OPIE): [c5fe-30c3 XXXXXXXX]:
OPIE is an RFC 2289 hash-chain scheme. To authenticate you need the original passphrase the chain was initialized with. The challenge times out at 60 seconds with no visible lockout.
The admin user returns immediate “Login incorrect” — no challenge at all.
I built opiekey from the Go implementation to compute responses:
git clone https://github.com/arcanericky/opiekey
cd opiekey && go build -o opiekey .
./opiekey -5 md5 <sequence> c5fe-30c3
Next step: automate passphrase brute-forcing via serial.
Network Recon
| Port | Service |
|---|---|
| 53 | dnsmasq |
| 80 | HomeLogic HTTP (404s) |
| 2198 | ELAN g! candidate |
| 8500 | Binary heartbeat |
| 8882 | TLS-PSK MQTT (pairing mode) |
| 8883 | TLS-PSK MQTT (Alarm.com) |
Port 2198 is most promising — TCP handshake completes, server waits ~10s then FINs. Client-speaks-first binary protocol matching the ELAN g! description. Port 8500 repeats a fixed 0000 1100 frame pattern.
More updates as the session continues.