Erik Kallen

Hornbach Gateway Part 2 — Root Shell via U-Boot

Thu, 09 Apr 2026 00:00:00 +0000

Quick update on the Hornbach SMART HOME gateway hack — things moved forward faster than expected.

Finding the serial pads

In the previous post I mentioned I was waiting for a 3.3V UART adapter. In the end I did not need to order one — turns out my existing adapter can do 3.3V by moving a 0 ohm resistor to a different pad on the adapter. A two minute fix. Once I had that sorted I probed the board… and got nothing. Went back over the PCB very carefully and eventually found the culprit: the serial pads were hidden under the silkscreen on the edge of the PCB. Not the usual corner debug header — they had printed the silkscreen layer directly over the pads, presumably to make them less obvious. Once I scraped that off and soldered to the pads properly, a clean U-Boot console showed up immediately at 115200 baud.

Stopping U-Boot

The U-Boot autoboot timeout was set to 0 seconds, so there is no visible countdown — it just boots straight through. The trick is to spam a key the moment you power the board on. Keep hammering it before U-Boot even gets a chance to hand off to the kernel and you will catch it:

=>

Hornbach has not disabled the interactive prompt itself, just set the delay to zero. Key spamming works fine :D.

Getting a root shell

With a U-Boot prompt the plan is simple: load the kernel and device tree from eMMC into RAM, then set bootargs manually with init=/bin/sh appended. That tells the kernel to run /bin/sh as PID 1 instead of the normal init system, dropping you into a root shell before any of the Hornbach software starts.

The eMMC is on mmc 1 (not 0 — that would be an SD card slot). The commands:

# Select the eMMC
mmc dev 1

# Load kernel and device tree into RAM
load mmc 1:1 0x42000000 uImage
load mmc 1:1 0x43000000 dtb

# Set bootargs with init override
setenv bootargs console=ttyS0,115200 root=/dev/mmcblk1p2 rootwait init=/bin/sh

# Boot
bootm 0x42000000 - 0x43000000

A few seconds later:

[    2.847321] Run /bin/sh as init process
/ #

Root shell on the Hornbach gateway. Not bad for an afternoon’s work.

What is next

Now that I have a shell I can explore the filesystem and map out the partition layout before touching anything. And since U-Boot has USB host support, there is no need for FEL trickery to back up the eMMC — I can do it directly from the U-Boot prompt by plugging in a flash drive and copying the eMMC block device straight to it:

# Initialize USB and wait for the drive to enumerate
usb start

# Write the entire eMMC (mmc 1) to the USB drive (usb 0), 512-byte blocks
# Adjust count to match your eMMC size (e.g. 7634944 blocks = 3.9 GB)
mmc dev 1
usb dev 0
mmc read 0x42000000 0x0 0x800    # read first 1 MB into RAM as a sanity check

# Or use cp to write directly block-by-block to the USB storage
# (exact syntax depends on U-Boot build; this is the typical approach)

Alternatively, from the root shell (once the system is booted with init=/bin/sh) it is even simpler — just mount the USB drive and dd the eMMC to it:

# From the root shell after booting with init=/bin/sh
mkdir /mnt
mount /dev/sda1 /mnt
dd if=/dev/mmcblk1 of=/mnt/hornbach-emmc.img bs=1M

That gives a full backup before anything destructive happens. Once that is safely on disk I can start experimenting with flashing Home Assistant OS — more to follow!

Hacking the SMART HOME by Hornbach Gateway

Sun, 05 Apr 2026 00:00:00 +0000

So I got my hands on a SMART HOME by Hornbach gateway (model WSR 1706 V1.0) — the little smart home hub Hornbach sells in their stores to control Z-Wave and Zigbee devices. Now I have nothing against Hornbach, but their cloud-dependent locked-down firmware is not really my thing, so naturally the first thought was: can I put Home Assistant on this? Turns out yes, probably, though it is still a work in progress :D.

The first thing I did was crack it open, and immediately spotted an Allwinner H3 SoC — the same quad-core ARM Cortex-A7 chip found in the Orange Pi and NanoPi NEO boards. At that point I knew this was going to be fun.

UART: what is all this garbage?

Any self respecting hardware hacker starts with UART, so I soldered up to the debug pads and was immediately greeted by a stream of what looked like complete nonsense:

#^UVlt%&+,-0123@BCDE[`bcfmpqy}-

My first thought was baud rate mismatch, but switching baud rates did not help. After some digging I found the real cause: the Allwinner H3 BROM and SPL output at 1.5 Mbaud during the very early boot stage, before handing off to U-Boot which switches down to 115200. Most cheap USB-UART adapters simply cannot do 1.5M, so that early stage always looks like garbage. The fix is to just wait a few seconds — the clean 115200 output shows up once U-Boot takes over. If you want to actually decode that early output you need an FT232H or CP2102N (not the plain CP2102), but honestly waiting is fine.

One important gotcha: the H3 UART is 3.3V logic. A 5V adapter on the TX line can cause corruption or worse. For just listening it is usually tolerated, but for two-way communication you really want a proper 3.3V adapter — something I learned I need to order before I can go much further :D.

Trying the network

While waiting for the UART output to stabilise I also poked at the network side. The device shows up running OpenWrt, which was a nice surprise — but Hornbach has locked it down pretty hard. No LuCI, SSH is not on port 22, and nmap finds absolutely zero open ports. The device only talks outbound to Hornbach’s cloud. So that is a dead end and UART is where the action is going to be.

What is actually inside

The board uses eMMC soldered directly — no SD card slot populated, which rules out the easy approach of just booting from an SD card. The Z-Wave and Zigbee radios are there, plus a USB-A host port and Ethernet, which is pretty much the standard H3 reference design feature set. Hornbach is a DIY chain, not a hardware company, so this is almost certainly built by an ODM around a NanoPi NEO or Orange Pi-style reference board.

The most interesting discovery came from looking at the PCB carefully: there is an unpopulated button footprint — the pads are right there but no button is soldered. This is almost certainly the FEL button. Allwinner puts a FEL recovery mode into the H3 BROM that cannot be disabled by vendors, and ODMs routinely just leave the button unpopulated on production hardware to stop end users from using it. Joke is on them :D.

FEL mode to the rescue

FEL is a low-level USB boot protocol burned into the Allwinner silicon. When active, the device shows up over USB as vendor 1f3a, product efe8. You trigger it by holding the FEL button (or in our case, shorting those two pads) while powering on. One important detail: use a USB-A to USB-A cable with the 5V pin taped off on at least one end — the device has its own power supply and you do not want to backfeed 5V through the USB port.

# Check the device appeared in FEL mode
lsusb | grep 1f3a

# Confirm with sunxi-tools
sudo sunxi-fel version

On Arch Linux, sunxi-tools is in the AUR:

yay -S sunxi-tools

# Udev rule so you don't need sudo every time
echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="1f3a", ATTR{idProduct}=="efe8", MODE="0666"' \
  | sudo tee /etc/udev/rules.d/99-sunxi.rules
sudo udevadm control --reload-rules

Flashing Home Assistant OS

Once in FEL mode the plan is straightforward. First load a compatible U-Boot (NanoPi NEO or Orange Pi builds are good starting points) into RAM via FEL:

sunxi-fel uboot u-boot-sunxi-with-spl.bin

Then from within U-Boot or a minimal initramfs, write the Home Assistant OS image straight to the eMMC:

dd if=haos.img of=/dev/mmcblk0 bs=1M

Power cycle and it should boot straight into HAOS.

Where things stand

I have got the theory solid and the UART output decoded, but I have not yet physically shorted the FEL pads and confirmed it works — partly because my reliable 3.3V UART adapter is still in the post. Once it arrives I can do a proper two-way UART session, confirm U-Boot details, pick the right U-Boot build, and actually pull the trigger on the eMMC flash. Will post an update when that happens!

Lots of news

Mon, 10 Jul 2017 22:42:00 +0000

Where do I start, it has been a while so naturally I finally have a lot to say :D. So first of; my Mendel90 finally got his well deserved paint job, and some needed wiring cleanup. Also while I was doing that I slapped in some new electronics (well new for me as it’s the old but well tested RAMPS 1.4 Arduino combination).

Since we are still on the subject of electronics and one of my colleagues pointed me to Pcbway (a cheap fab house) which sells you 10 prints for 5 bucks I decided to attempt to make my own PCB. So I fired up KiCad and started designing a PCB that fits snugly into the tiny space reserved for a connector board on my Mendel90 hotend carriage. 10 days later I was a proud owner of my very own PCB and by some miracle I even fits the housing, unfortunately I read the ramps schematics wrong and I had to bodge wire the entire thing, but hey what would you expect from a software dude making a pcb :P. Anyhow the rev1 is up on my Github for anyone who happens to have the same Mendel90 as me :D or ambitions to have the same one (which ever is more likely).

Continuing with colleagues… I started my own company together with two of my former colleagues, it’s called EVAbits and we do….surprise surprise engineering :D so if you need some of that done head over to our website.

Lastly I received a LCD display from my other job from an old discontinued product which I hooked up to a Raspberry Pi and IT WORKED! I had to use almost all GPIO pins though so I have to figure something out for connecting other peripherals. Ooh yea the reason I did this was for my car multimedia setup which I am building (very slowly but you know… some day it will be done). The LCD also had a touchscreen controller which I had to replace by an Arduino because I could not get it to work on my Raspberry Pi, anyway more details on the LCD in a different post.

So thats it for now, thanks for reading…if you made it this far that is :D

Mendel90 first print!

Sun, 18 Dec 2016 18:50:00 +0000

There is always that scary thought when first switching on a printer of which you have just spend a couple of hours doing the wiring and it’s getting late. You wonder if you made a mistake… yet you are in to deep so you try anyway. Flick the switch and watch for any magic smoke or popcorn sounds……..

W00t! no smoke no wierd sounds, so fire up pronterface and see if it heats up. In this case it did, so I pulled out my spool of PLA, and sliced a simple cube with pretty much default settings and low and behold filament gets extruded and the result even looks like a cube!

After a couple of prints and some fine tuning the result is actually quite pleasing, PETG sticks to the plain glass very well and looks super smooth. The machine is very consistent and requires no adjustment between prints.

More is better! Mendel90

Fri, 18 Nov 2016 18:50:00 +0000

Every self respecting 3D printing guy has to have built his own 3d printer. By buying a kit from china I felt like that was cheating. So after looking at some printer designs I decided to go with the Medel90 by Nophead. Since it is fully customizable and can be built with simple tools and someMDF board.

So I went to the hardware store to get a piece of MDF 12mm thick and a bunch of screws, some smooth rod, threaded rod, nuts and bolts. Once at home I fired up my 3d printer to print the needed parts starting with the frame blocks. To cut and drill the plates I printed the design on multiple A4 using Adobe Acrobat reader in poster mode.

Next I started on the axis, again I needed printed parts and I cut the rods to length and started mounting the Y-axis. Slowly I started to realize I needed motors to make this thing do anything at all and luckily our primary source of cheap stuff did not let me down. I bought 5 nema 17 stepper motors from a German warehouse with a torque of 6 kgcm for only €56,- and the best thing was they arrived that same week!

Now for attaching the threaded rods to the z-axis motors I needed couplers, which I did not have at hand and since ordering them from china takes 3 weeks I decided to make my own. It was a good way to test my new mini lathe :D

Thanks to my father in law I now have a simple tapping set as well, which I used to tap the holes with.

The next problem I faced was that I did not have any enstops that fitted the design, I did however have some optical endstops laying around so I used 1 of those. Be careful when connecting them though my melzy board for some reason supplies 12V to the endstop V+ pins and I fried one endstop by hooking it up to that. So after a bit of pcb trace cutting and a bodge wire 5V was where it is supposed to be and….. I decided to only use 1 optical endstop :D because I found some tactile witches on an old mouse which where a bit smaller but by printing an adapter they fit on the original design like a glove.

After adding some wires I could finally test if the thing moves at all and what do you know it works and even homes! So thats is my progress up to now, I still have some work to do with the hotend and cleaning up the wiring but I hope to post a first print soon!

Need some 3D printing done?

Fri, 21 Oct 2016 18:50:00 +0000

Yess, my very own 3D Printing hub is alive! Check it out at 3D Hubs Erik’s Hub

I was finally happy with the quality of my 3D printer, su much so that I decided it is good enough to sell parts printed with it. So I went over to 3D Hubs and created my own Hub.

This hub allows me to sell my 3D Print skills as a service to others. The setup process is fairly straight forward and easy to do, you simply add your printer, types of filament you own, the price you wish to receive for your services and you’re set. Well not just yet, because in order for 3D Hubs to build a trustworthy community they need to verify a few things first. So of course e-mail, but then address (yes they send you a post card :)) and of course the print quality.

The last one is not that hard, basically you have to print a Marvin keychain at the highest resolution of your printer and take some pictures of that print.

Once that is done someone will review your print and you are good to go!

So to anyone interested

Order a 3D Print

iMac why u no work?

Fri, 19 Aug 2016 22:11:10 +0000

My iMac…. I am still a bit sad thinking about it, but never give up thats what I say. After a bit of googling I found a service manual of my iMac, which stated that the LED’s on the logic board should give you an idea of whats going on. Since none of my LED’s lit up the guide stated that there might be something wrong with the power supply (that would make sense right?), so I give my Chinese friend Ali a quick look and 60 Euro’s and 1 week later I have a replacement power supply.

First thing to do hook the thing up en plug everything in and… still no freeking LED that lights up. Bummer, it wasn’t the power supply.

Moving on I came across Lois Rossmann on youtube when searching on how to repair my iMac and this dude rocks. He has this video where he replaces the SMC chip an a macbook logic board. Since my failure obviously had something to do with power failing and Lois clearly states that it is bullshit to replace the SMC and almost never works I decided to give it a shot :D

I hit Ali up once more and 20 Euro and 3 weeks later I receive a piece of cut logic board with a SMC and a solder stencil.

Next is off with the old, reball the BGA (took me 4 tries but hey I had never done it before) and on with the new (or second hand in this case).

isn’t she pretty!

So after resoldering (the BGA moved into place) and screwing the whole iMac together again (except the screen) I finally had a working LED! So I press the on button aaaaaaand………nothing DAMN IT!

Back to the drawing board I guess, My next plan of action will be buying the schematics and checking voltages I guess.

TO BE CONTINUED…

Oh by the way check out my new printer upgrades while you are on this site.

3D Printer madness

Wed, 13 Jul 2016 22:11:11 +0000

So I decided to buy a 3D printer kit from Aliexpress which is a great site for cheap stuff btw.

My budget was about 200 Euro so I had to choose wisely, making a long story short I selected an Acrylic version of the Prusa i3 with automatic leveling 2 free spools of filament (0.25KG) and a free SD Card the brand name is TronXY.

The product was shipped timely and just short of 2 weeks later it finally came.

So I started assembling (The building instruction could be found on the SD card) the thing and about 3 hours later I flipped the on switch.

So after playing with the motors for a bit I decided to test the heated bed…….BAM sparks everywhere and my iMac was off……Damn.

I still don’t know exactly what happened but something obviously was wrong, after a few days of damage assessment I found that my Melzi board (Printer main board), the LCD of the 3D printer and sadly my iMac had died, the Aliexpress seller was kind enough to send me a replacement Melzi board and I ordered a replacement LCD for about 3 eu myself.

So if you ask me was it worth it? Well, I am an engineer and in my line of duty shit happens and if shit happens we learn from it, so yes I think it was worth it, my printer is happily printing my mac is still broken, but I have gained a lot of knowledge about my iMac, the Melzi board and 3D printing in general.

Oh and I managed to fix the Melzi board that was broken, by replacing the FTDI and Atmega1284 so now I have a spare one yeay!

Mini kitchen with LED cooking top

Thu, 28 Apr 2016 23:11:11 +0000

Recently I constructed a wooden play kitchen for my daughter. The kitchen came as a self build package.

After quite a bit of sanding and a few extra screws I had the basic structure ready

Of course beeing an engineer this is when the fun stuff started, so I decided to make a few changes to the plan. First I bought some 0804 Red SMD led’s off ebay, next I went to the local plastic plate supplier and picked up a tinted plate of 30 x 40 x 0.5 cm, and finally got some long shaft 10k potentiometers. I still had an Arduino mini laying around and some proto PCB.

The schematics for the board can be found here

This is what it kind of looks like on a breadboard

So I soldered one hot plate up to see if it has the desired effect and luckily it was to my liking.

What remained was to do the other 3 plates and the front panel controls.

All that was left to do was mount the assembly and behold! we have a working stove.

To save power I run the Arduino on a 1 MHz clock instead of the default of 8 MHz

The Arduino code used is the following:

int knop1 = A3;
int knop2 = A1;
int knop3 = A5;
int knop4 = A2;

int oven = A0;

int plaat1 = 3;
int plaat2 = 5;
int plaat3 = 6;
int plaat4 = 9;

int oven_led = 11;

int pot_power = 10;


void setup() {
  // declare the ledPin as an OUTPUT:
  pinMode(plaat1, OUTPUT);
  pinMode(plaat2, OUTPUT);
  pinMode(plaat3, OUTPUT);
  pinMode(plaat4, OUTPUT);
  pinMode(oven_led, OUTPUT);

  pinMode(pot_power, OUTPUT);

  //Serial.begin(57600);

}

void loop() {
  digitalWrite(pot_power, HIGH);
  // read the value from the sensor:
  int knop1Value = analogRead(knop1);
  int knop2Value = analogRead(knop2);
  int knop3Value = analogRead(knop3);
  int knop4Value = analogRead(knop4);

  digitalWrite(pot_power, LOW);

  //Serial.println(knop2Value);

  int knop1Out = map(knop1Value, 0,2023,0,255);
  int knop2Out = map(knop2Value, 0,2023,0,255);
  int knop3Out = map(knop3Value, 0,2023,0,255);
  int knop4Out = map(knop4Value, 0,2023,0,255);

  analogWrite(plaat1, knop1Out);
  analogWrite(plaat2, knop2Out);
  analogWrite(plaat3, knop3Out);
  analogWrite(plaat4, knop4Out);



  delay(100);
}

iMac hdd replacement

Thu, 05 Nov 2015 13:18:11 +0000

Last week I replaced my terribly slow harddisk with a brand new Samsung EVO 850 500GB SSD. Since I own an iMac this is not a straight forward as one might think.

I have been wanting to replace the harddisk since I baught it because at the time I thought it was going to be simple and was not prepaired to pay the extra 500 euros for the flash drive apple offered as an option. Turned out at that point there was no easy way to replace the harddrive since the tools and adhesive strips where not readily available.

Well a couple of years later and that all changes so. First thing I had to do was buy a set of replacement adhesive strips from iFixit for closing up the iMac once the process is finished.

The kind people form iFixit also included a tool for breaking the old adhesive without damaging the iMac. So following the guide I removed the screen by cutting away the adhesive usign th supplied tool, then got aout a set of old bank/discount cards and used them to pry the remaining adhesive away, and finally I could open the iMac.

Next I had to remove the left speaker (right on the image above) with two torx screws pop out the old hdd, and in with the new.

Note: you need to buy a 2.5 to 3.5inch bracket converter and if possible the big kind because mine only came half way which I solved with some elastic bands

Anyway after removing the remains of the old adhesive strips and sticking on the new I tested if everything worked and closed her up again.

I now have a blazing fast pc again :smiley: