Brinks BHS2000D Hack
Anonymous
Angry Man In Gauteng
Do It Yourself Home Security Alarm Forum. Ademco, GE Security, DSC, Visonic, DIY Forum
Technical Support => General Technical Questions => Topic started by: john rivers on November 24, 2004, 07:23:56 AM
Title: Brinks BHS-2000d hack
Post by: john rivers on November 24, 2004, 07:23:56 AM
Hi,
I have a Brinks BHS-2000d that came with the house I just bought. I want to change the alarm code from what the previous owners had. Can someone tell me the pin out for the terminal connection on this model (I could just trace the runs on the circuit board back to the processor but I was hoping someone could just tell me).
Is it a standard serial connection? If so what is the baud rate setting? How many characters does the password have, or if all the boards use the same password, what is it? Thanks in advance for your help.
Title: Re:Brinks BHS-2000d hack
Post by: Security Monitor on November 24, 2004, 08:15:25 PM
John, The Brink’s 1000 and 2000 series panels are not designed for programming except with a special programmer. Even if you manage to connect to the system (through the panel programming connection) you will need the panel code to access the information. Should you manage to enter the correct information and read the information in the fields, unless you know the corresponding numerical field and data sequence, it will just read a numeric value in each field. The Brink’s system also uses a layer programming, so each field will control many functions of the panel’s programming.
Example, you enter field 100 (for discussion sake). You may know that a 3 in that field means it will send a message to a pager. So you enter a 3. What you don't know is that field also controls the sirens shut off that requires a 2. So to send a message to your pager and also keep the siren shut off timer in place you need to enter a 5 (3+2), but it also controls the panel's motion delay with a 4. So to have it call your pager, shut off the siren after 20 minutes and still permit you to have an entry delay on the motions, you need to enter a 9 (3+2+4). As you can tell, it requires knowing the numerical value for each function controlled by that field. Should you get hold of a technician programming guide, you will also notice some default values, like a 1 for that field. That means that 1 controls something they don't even want a tech to mess with so they don't say what it's for except that the value for what's programmed is increased by 1.
Should you attempt to connect via the phone line, you will also need the downloaders code AND you will need to know the remote programming access field and numeric values to enable the panel to accept the changes. This isn't something they show on any sheets and isn't even known by their non tech center staff.
The short of it is, it's not something you want to go playing around with. You could end up having the siren blaring for 1 hour every time you open a door, and sending a fire trouble each time you walk in front of the motion.
Title: Re:Brinks BHS-2000d hack
Post by: dave on November 25, 2004, 06:26:09 AM
for the amount of aggrivation you are intending to go through, why don't you just replace the panel before all of that....Brink's stuff is propriatary and made by Scantronic, and IMHO junk.
Title: Re:Brinks BHS-2000d hack
Post by: john rivers on December 02, 2004, 02:49:25 PM
Thanks for your advice guys, you talked me out of trying. The alarm works. It turns on the siren when the door is opened and the siren goes off when the alarm code is entered. I just was not comfortable using the previous owner's code so I wanted to change it. I guess I'll just live with their code.
Title: Re:Brinks BHS-2000d hack
Post by: Apex on December 04, 2004, 04:18:09 PM
If it's just the user code you wish to change, check your PM mailbox. :)
Title: Re:Brinks BHS-2000d hack
Post by: dingussquatbird on June 07, 2005, 09:51:27 AM
I recently bought a house that has a BHS-1000C already installed. The previous owner did not give me the code to unlock the panel... what are my options? How long is the numeric code that enables/disables the alarm, 3 digits, 4 digits... ? I talked to Brinks and the salesman that came out to the house said that the system would run unmonitored (which is my preference), but it had to be unlocked first. They are going to charge me to unlock the system plus make me sign up for 1 year of monitoring, at a cost of about $350. If anyone has any ideas on what I can do, please let me know.
Thanks!
Title: Re:Brinks BHS-2000d hack
Post by: brade8 on June 07, 2005, 06:21:18 PM
They gave you a bunch of bull crap. The panel will work just fine non monitored. Brinks is the only company or person that can unlock that panel cause they use there propriatary equipment. The salesmen didn't use the right lingo. All that would need to be done is to disable the phone option and change the code to whatever you wanted. If you know the code already then u shouldn't need them at all. I don't know there equipment since they are the only company that use it because they like to stick there customers with the idea they can never switch alarm companies without changing out there panel. Very bad way to do business. Theres no way you need to sign a contract for them to unlock it for you. Unlocking wouldn't help you anyways. This salesmen had one thing in mind. MONEY!!! He doesn't make any money unless you sign a contract so thats what he did. Made sure you signed some kinda contract so he would make money. You can buy a new panel for cheaper then that. It would be way better then there junk and you can do whatever you want with it. You can even get it monitored with any company you want. Just make sure you don't have wireless cause it probable won't work with any other system. If there is wireless on it then you would have to replace the wireless also which would easily cost more then 350. If I were you I would get rid of that brinks system. PS the user code is usually 4 digits or somtimes 6 on rare occations.
Brad
Jim Rojas
Jim Rojas
Anonymous Sender
Angry Man In Gauteng
Just Looking
at a vast distance.
"Anonymous Sender" <anon...@remailer.metacolo.com> wrote in message
news:93df924b16b52fff...@remailer.metacolo.com...
Jim Rojas
Thanks
Jim Rojas
George Orwell
If a 670, 1000, 1200 or 2000 panel is locked out or shutdown
in any way, simply remove the 93C46 chip with a fresh one.
If you own a 93C46 serial programmer, you can erase the chip
and start from scratch. The installation manual has a program
sheet which shows the default value for each program location.
Angry Man From Gauteng
Il mittente di questo messaggio|The sender address of this
non corrisponde ad un utente |message is not related to a real
reale ma all'indirizzo fittizio|person but to a fake address of an
di un sistema anonimizzatore |anonymous system
Per maggiori informazioni |For more info
https://www.mixmaster.it
Nomen Nescio
In address 255 enter a 1. That should load all the defaults and at the same time make the panel a local system. Then all you have to do is to change the zone types, enter times, and the master code.
If that doesn't work, get back to me. I will look at my manuals and double check for you.
Angry Man From Gauteng
Anonymous
To default the The BHS-2000D panel:
Go to location 255
Enter 1
Power down panel
You should see all zeros & the programmer will beep.
Now the panel has been defaulted.
Sorry, its been yesrs since I programmed those systems.
Angry Man In Gauteng
Jim Rojas
as good.
Jim Rojas
Nomen Nescio
Replace the chip or use an external serial programmer to erase it.
Then press 255 + 1 and see if that reloads the defaults.
Angry Man In Gauteng
shotgun boogie
> I use Raid Wasp Killer to repell lawyers. If I run out, WD-40 works
> just as good.
Hair spray and a bic lighter.
--
js
- The bigger they are, the harder they fall.
( Also, the harder they bite, punch, and kick.)
Roland More
I think he is trying to rid himself of lawyers, not Phil Spector.
"shotgun boogie" <thatsal...@yahoo.com> wrote in message
news:qzYMi.141896$Vk6....@newsfe07.phx...
Jim Rojas
of Tech Help!
Jim Rojas
BDEBJ
that's it, end of story.
there's no back door, no hack, no secret way in. if you don't know what
you're doing
(which you obviously don't) you'll just screw everything up....your
"customers" will love that!!!!
"Jim Rojas" <jro...@tech-man.com> wrote in message
news:47064116$0$32482$4c36...@roadrunner.com...
BDEBJ
seem to spend alot of time and
energy trying to "hack" systems, or steal away their customers!! you think
that maybe if you spent
that time and energy trying to please your customers, they wouldn't run off
and join brinks??? you guys seem
alot more interested in them, than they are of you! i don't think brinks (as
well as ADT and P1) would be as big as they
are if they were not doing SOMETHING right!! right or wrong, they have a
formula that works.
yes, they have deep pockets, but how do you think they got
those deep pockets?? it wasn't by bitching about the little guy!!!! wait,
that's it.. you guys must have
the "little guy" complex!!! make the customers happy, and maybe, just maybe
you'll grow up to have pockets
just as deep as the other companies.
Anonymous Sender
Brinks is permitted to violate certain US antitrust laws by offering systems that require an external programmer, that they only have access to. This is grossly prejudicially against any alarm dealer or DIY'er. We all know that Brinks does not service any panel they don't monitor. So their statement that you can buy their paperweight for $500 is an all out deceptive lie. So by educating the masses on how to reprogram their systems, Brinks would no longer be in violation of such antitrust, or anticompetitive laws.
ADT was smart enough to realize this and stopped using proprietary systems years ago for good reason. Any dealer can takeover their SW2000 & SW3000 series panels.
As I stated in other posts, Brinks does not have a presence in many countries because it doesn't feel they have to follow fair competition rules. Canada just adopted some new rules which work against Brinks and how they force customers into submission.
Careful, Big Brother Brinks is watching.
Angry Man In Gauteng
Jim Rojas
guns. An attorney is only interested in billable hours. They could care
less on the final outcome.
Jim Rojas
Jim Rojas
enough, there are back doors into everything.
Just like that 16 year old kid that found the back door to the Apple
iPhone. The iPhone is probably 1000 times more complicated than any
Brinks panel. Wouldn't you agree?
Jim Rojas
Slob
> What? No hack? No back doors? What fun is that then? If you look hard
> enough, there are back doors into everything.
>
> Just like that 16 year old kid that found the back door to the Apple
> iPhone. The iPhone is probably 1000 times more complicated than any
> Brinks panel. Wouldn't you agree?
yea but it disabled the phone on the next software upgrade.
Jim Rojas
Don't worry, someone will make an iPhone utility program that will allow
updates via USB port or via bluetooth.
The game never ends.
Jim Rojas
Robert L Bass
> guys sure seem to spend alot of time and
energy trying to "hack" systems, or steal away their customers!!
For an anonymous moron who has "no bias one way or the other"
concerning Brinks, this guy sure gets defensive about Brinks.
> you think that maybe if you spent that time and energy trying to
> please your customers, they wouldn't run off and join brinks???
In the 24 years I ran an alarm company none of my customers ever went
over to Brinks. In the nine years I've operated an online business
(some of that time running both businesses at once), I've sold alarms
to numerous ex-Brinks customers who decided to DIY rather than ever
deal with Brinks or a company like it again.
> ... i don't think brinks (as well as ADT and P1) would be as big as
> they are if they were not doing SOMETHING right!!
It's called advertising. Brinks and ADT both run effective (though
grossly misleading) national television ad campaigns.
--
Regards,
Robert L Bass
=============================>
Bass Home Electronics
941-925-8650
4883 Fallcrest Circle
Sarasota · Florida · 34233
http://www.bassburglaralarms.com
=============================>
Doug
Doug
--
"Robert L Bass" <Rober...@verizon.net> wrote in message
news:_n%Ni.169$C2.33@trnddc02...
>
> In the 24 years I ran an alarm company none of my customers ever went over
> to Brinks. > Regards,
> Robert L Bass
>
> http://www.bassburgIaraIarms.com
Frank Olson
> In the 24 years I ran an alarm company
1983 to 1999 is 24 years?
> In the nine years I've operated an online business
> (some of that time running both businesses at once),
Here at least you're honest.
Jim Rojas
http://forum.homesecuritystore.com/index.php?topic=10195.0;wap2
Aynyone ever used a brinks handheld programmer?
(1/1)
newdude:
Hi guys,
I purchased a home with a brinks panel already installed from the
previous owner about 2 yrs ago. At one point I tried to get
the panel activated and to no one elses surprise, brinks monitoring fee
and required comittment was discouragement to me.
Recently, I found a board talking about a hackers version of a brinks
programmer on ebay.
(See here)
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&rd=1&item=190001185359
I took a chance and purchased it. It pretty much does everything he
claims it will. I can change zone types, attributes, master code, aux
codes, all of the important stuff no problem. But the designer of this
device makes no claim to know anything about brinks panels or other
products other than what he's learned from his own BHS2000. Now that I
have my panel set up and the eprom data backed up to disk I want to
experiment with the device programmer. Some of the data on the chip is
obvious what its purpose is. Other data is not so obvious. This brings
me to my question....
Can anyone that's ever used a Brinks/Scantronics handheld programmer
tell me some other things that it is capable of doing on a BHS2000 panel?
Thanks,
Eric
newdude:
I'd like to adjust the amount of time the siren stays on, and the
entry/exit delay time. How is this set with a brinks handheld, or is it?
Eric
Security Monitor:
Quote from: newdude on July 23, 2006, 11:07:54 AM
Can anyone that's ever used a Brinks/Scantronics handheld programmer
tell me some other things that it is capable of doing on a BHS2000 panel?
Eric,
All the Brinks programmer does is change the numeric value of a field.
In order to use and change the information, you must know what each
field represents (what it controls) and what numeric values equal what
function (what each number represents).
With that said, I add the following cautions:
1. Brinks use a layer approach to programming. Unlike typical
programming where you toggle things on & off, or change what you want
that field to do, each of their field may control a critical function
that has nothing to do with the fields name. So adding a one to a
default can enable the chimes, while adding another 2 on top of the 1
and default could make the system a silent alarm and subtracting 4 could
disable fire reporting.
2. The Letter of the panel signifies revision changes. So a 2000A has
different programming features than a 200D. I believe they had 6
revision of the 200panel alone. Unlike typical programming where they
add field to make changes, Brinks system used any available value open
within any field. So on a A panel field 101 means one thing and on a C
panel that 101 field could be do something else on top of what you
thought it did. If your using a D programming on a B panel you could
end up with a system that goes haywire when powered up or worst, fail to
sound an alarm.
3. As mentioned, they use hidden values, so a system may have a default
of 5 in a field but no where does it explain what that 5 represents.
Accidentally leaving that value out of programming could result in a
critical failure of your alarm. Also the default value could be
different between revision numbers. As an example, lets say the field
states it's for phone reporting, it could also hold an embedded value to
allow first digit master code changes. If your unaware of the whole
function of each field, you can change that field to the numeric value
that enables an event to make a report of an alarm and without knowing
it, enabled anyone to enter the first digit of your master code to shut
the alarm off.
4. You also need to know when to use a single digit "1" or a double
digit "01" to represent the same value.
5. Some systems have a burned in system check if any phone number is
entered. That means that at some point the panel will automatically
start dialing that number to check in. I do not believe you can disable
that function. You can turn off the daily test, but not the embedded
panel checks. Unless your only using a revision number that support
paging, entering any number into the receiver number fields will cause a
communications failure to be displayed on the keypads.
6. Don’t forget you, must tell the panel to accept the numeric value
change. Just entering it will not make the change. If not done
correctly, if you go to field 50 and make it a 10 and next go to field
60 and make it a 5, if you didn’t use the accept key, what you did was
go to field 50 and next went to field 10 and next to field 60 without
making the changes. Watch each step, as entering a value does not
change the field until you tell it to accept it as a change.
7. DO NOT use the Load Brinks Defaults unless you must default
everything and do not use the Auto Programming as it will create all the
values as Brinks wants them, not the way you want them. (see #5 above)
I'm not a fan of anyone ever fiddling with the Brinks programming since
with so many embedded hidden values, if you make a mistake, you could be
dead in the waters requiring a full system default or loading back the
old values. But if you don't know what mistake was made, you'll
probably make it again.
Good luck.
==
Just wanted to add one more thing. Make sure you KNOW the exact model
and revision number of the panel. Don't only go by the decal in the
can. Since it's common for them to just change the chip to add features
to an older system, the can could say 2000X but it's really a 2000Y.
And, make sure you do have a 2000 series panel and not an older 1000
(the board and keypads look alike), or the modified 1200 series that
used the same keypads as the 2000 but is a streamlined panel.
Navigation
[0] Message Index
Jim Rojas
older 670, 1000, 1200, & 2000 Brinks panels using an Acron P4000 eprom
programmer. You do have to pull he chip off the main board though. Then
all you need is a program function map to get you through the
programming. Anyone familiar with how Moose panel programming works
should have no problem doing this. I am also looking into the
possibility of using the Moose Z1100P programmer to accomplish the same
thing without removing the chip. Many of those older panels used the
same exact chips. I will create diagram pinouts, with step by step
instructions, so these programmers can be interfaced without that much
trouble.
Brinks will probably argue that since Acron was purchased by
Scantronics, therefore the P4000 contains their intellectual property as
well... :)
This information will be added to the November 2007 issue of Tech Help.
I will continue to publish more information as I discover them.
Jim Rojas
Roland Moore
I had an Acron burner. I remember it as being in an all aluminum case with
the black knob selector. I think there were 4 "pages" to the program. I used
it to program the 8 channel Acron slave dialer with it. Was that a 4000 or
was that some earlier version?
"Jim Rojas" <jrojas+tech-man.com> wrote in message
news:4718c530$0$15420$4c36...@roadrunner.com...
Seccon1
"Anonymous" <nob...@mixmin.net> wrote in message
news:bea16ef3c5f7331d...@anon.mixmaster.mixmin.net...
Jim Rojas
Z1100P programmer as well. It's their trade secret.
Jim Rojas
jacobg...@gmail.com
omarro...@gmail.com
Jacob Grahn
landsh...@gmail.com
What is wrong?
ero...@gmail.com
when I stopped paying for monitoring I unplugged the phone cable so they could not send a disable signal. Everything works fine except once a day it beeps when it dials out. I figured out if I set off the alarm it will be set to beep a few minutes after that event. so i can set the time it beeps to when i want. searched and asking here because I found a programmer but don't know the settings. I just want to switch off the dial out or maybe have it dial my cell. does anyone have an uploaded copy of the instructions and master key#s if any?
mleuck
> I know this is from 2007, now its 2020, I'm using a brinks 2000 system,
> when I stopped paying for monitoring I unplugged the phone cable so they could not send a disable signal. Everything works fine except once a day it beeps when it dials out. I figured out if I set off the alarm it will be set to beep a few minutes after that event. so i can set the time it beeps to when i want. searched and asking here because I found a programmer but don't know the settings. I just want to switch off the dial out or maybe have it dial my cell. does anyone have an uploaded copy of the instructions and master key#s if any?
Jim Davis
(Said the climber just before he died from hypothermia and high altitude sickness)
mleuck
jacobg...@gmail.com
> I know this is from 2007, now its 2020, I'm using a brinks 2000 system,
> when I stopped paying for monitoring I unplugged the phone cable so they could not send a disable signal. Everything works fine except once a day it beeps when it dials out. I figured out if I set off the alarm it will be set to beep a few minutes after that event. so i can set the time it beeps to when i want. searched and asking here because I found a programmer but don't know the settings. I just want to switch off the dial out or maybe have it dial my cell. does anyone have an uploaded copy of the instructions and master key#s if any?