Somewhat off the infosec path, but I recently found a need to break into a GE Concord 4 home security system recently – yes, the commercial/home alarm system with door, glass break, and motion sensors that calls the company monitoring your system when the alarm is tripped. While my home alarm system has since been replaced with a newer model, the GE Concord 4 system was installed when I purchased my home, and I thought a consolidated set if instructions and details may help someone who also needs this information. My main goal was to gain access to mess around with this system and at some point sell it to someone who needs a replacement board. To be honest, the Concord 4 is overkill for single family homes as it supports 96 zones total (wired plus RF – comes with 8 zones on the standard board), 6 partitions, and 230 user codes…more than anyone could possibly need.
- 30-Mar-13 13:37 hey, thanks for this man. 09-Feb-13 16:49 Thank you very much, Perfect GE Universal All In One WebCam With Bonus Earset in packaging driver.
- USB-IF Virtual Annual Membership Meeting Registration is now open for the USB-IF Virtual Annual Membership Meeting which will take place Wednesday, March 3. More information can be found on the events page.
- GE Oil & Gas In a complex world of ever-changing technologies, GE realizes the importance of having an experienced partner to guide successful cyber security implementation. As a global leader of industrial controls, GE is well-equipped to help customers improve their security posture and support external and internal compliance policies.
- The Sentinel Administrator tool displays the key type as HASP HL Drive - 2 GB Memory or If displayed as HASP HL Drive - 2 GB Memory, it is an older style USB key. Proficy Common Licensing installs the current Sentinel support drivers and does not install older drivers. Make sure latest licensing software is installed. GE Common Licensing Installer.
One thing you’ll notice when home security systems are installed is that the original installer, or the dealer, sets the install codes on your system. You’ll need these codes should you need to change system-wide settings such as the central station (CS) number (the phone number your alarm system calls when tripped) and the system ID that let’s the monitoring center know which system is calling with an alarm. These aren’t the same as user codes or the master code – which are used to arm and disarm the system on a daily basis – but the codes required to really program the system. If you’re lucky enough to have a new system installed while you’re around always ask for the installer codes and store them some place safe. One other caveat, as you’ll see below, is that not all alarm keypads can program a system and that applies to the Concord 4 as well.
The Basics:
The following firmware and software downloads are available for accredited installers. We encourage you to keep your system working at its optimum level by staying up to date with the latest developments. For more information please don't hesitate to contact the Interlogix Technical Support team at support.interlogix.com.au.
- The system we are dealing with is a GE Concord 4 – GE Home Security was purchased by Interlogix – previously there was a Concord 3 and Concord Express, and while there isn’t much difference in these models I can’t guarantee these instructions will work for other models.
- You’ll also need a keypad that is capable of programming the Concord 4. I was lucky in that I have the keypad models (SuperBus 2000 2×16 LCD) that can program this board. In some cases, installers may only install touchpad models that can’t program the board throughout your house, and in that case you’ll also need to head over to eBay and find a new touchpad as well. As an alternative, and if you’re simply attempting to switching monitoring companies, the installer may have one of the required programming keypads. Although you’ll need the installer codes (which is the point of this post) to gain access to reprogram the system.
- You’re also going to need a copy of the installer manual – not the user manual you get that describes daily operation of the system – the installer manual can be found here
The eeprom:
Download Ge - Security Usb Devices Drivers
These boards have a removable eeprom that holds the codes and settings for the board. To get the installer codes you have a few options. You could:
- Attempt to use the default codes – usual suspects here are 4321 (default), 1234, 1111, 4112, 6321 (that’s one ADT was known to use), and 0602 (SCM monitoring used this as a default)
- Buy a new board with an eeprom configured with a default installer code (4321), or a known installer code (verify with the seller)
- Use the methods below to read the installer codes from the eeprom and then reconfigure your board – this post assumes you’re going with option 3…
Finding and removing the eeprom:
The board and eeprom (show in the pictures below) is where we’ll start. The eeprom on the Concord 4 should be a Microchip 24LC256
‘
Power the system down by removing the AC connection from the wall (or remove the power leads from the screw terminals on the leftmost side of the board, GND and Positive for the 16.5V AC transformer), and then remove the power leads from the battery or board (red and black connection in the picture below) to remove battery backup power to the board. Use a chip puller to extract the eeprom from the socket, being careful not to bend any pins. Note the orientation of the chip, with the notch towards the “top” of the board and away from the screw terminals used to connect sensors, power, and other items to the board. You’ll replace it in that same orientation prior to reconnecting power.
Reading the eeprom:
To read the eeprom you’re going to need an eeprom reader. I used this one – from Amazon, ~$10 – (see image below)
The issue you’ll find with this reader is that it does NOT come with any software and only works with Windows 7 as the operating system. Luckily I had an older laptop that I could use for this task, if you don’t you could try a Windows 7 VM but I’m not sure the USB translation between host and guest will work for our needs here. Assuming you have this device and a Windows 7 system, here are the steps to get the reader software working:
- Download the USB device driver and eeprom reader/writer software
- Unzip into a directory of your choosing – create a new folder in the directory called Languages and move the english.ini file into the Languages folder
- Plug in the eeprom reader – without the eeprom chip inserted – cancel the autodriver install
- Run the driver-24cxx25xx.exe driver installer, choose install, and your system should now recognize the eeprom reader
- Run the eeprom software with the USB reader/writer inserted (again, without the eeprom from the board inserted) – it is called CH341A.exe
- In the lower left corner of the application window it should say “connected”
Now it is time to take the eerpom from our board and insert it into the USB reader/writer. This is the most confusing part as the diagram in the application, as well as other reader/writer tutorials show various orientation of the chip. What DOES work with the reader is putting the the notch (or dot) of the eeprom in the socket closest to the USB connection and with the notch facing the USB connection. If you reverse this you’ll burn up the eeprom chip – or your fingers. If you use the socket furthest away from the USB connection the chip can’t be read.
Unplug the USB reader/writer from your system, using the correct orientation place the chip in the socket and move the lever at the end opposite the USB connection down to make contact with the 8 eeprom pins. With the CH341A application running, plug the USB reader/writer back into your system. Once it shows as connected, make sure you choose 24 eeprom as the type, Microchip as the manufacturer, and MI24LC256 as the name. Hit the READ button – not erase, program, or anything else as we are not modifying the contents of the eeprom, only reading the values we need. If your output is all FF’s you’ve done something wrong as those are null hex values. If you see different hex values (besides FF’s) as you scroll the output then you’ve likely read the chip correctly.
The values we need are in the following locations:
- Main code – used to arm/disarm the system is at 0x03E2-3 (in my shot below it was reset to 9999)
- Installer code – what we are after, is at 0x03E5-6 (in my case it was set to 0602 by the installer)
Resetting the installer code/or programming the system:
With the installer code in hand, we can use our keypad to enter SYSTEM PROGRAMMING. You’ll need to reinsert the eeprom (notch up), reapply the battery power and reconnect AC power to the board. After system power up, you will do the following:
On the keypad, enter 8 + installer code (0602 in my example) and then 0 + 0 – the keypad should say SYSTEM PROGRAMMING (see below)
If you get a quick two-beeps and a return to the time/date screen then either your installer code is not correct, or your keypad is not capable of programming the system (see above). Assuming you made it this far, you can either continue using the known installer code, or reset it. Use the installer manual, starting at page 33, the instructions are pretty clear – under System -> Security we can view and change the installer codes as necessary. Reminder, the default on these boards is 4321 for the installer and a blank dealer code.
Hope that helps! Please note – I’m not actively monitoring this post for questions or comments.
Connect GE Multilin IEDs to PCs with USB ports |
This cable is the solution for users who want to communicate with GE Multilin IEDs via PCs that have USB communication ports. Using this cable is quick and easy. Simply install the cable driver on your PC, plug in the cable and you are ready to communicate.
Features and Benefits
- Designed for high speed transmissions for optimal performance
- Flexible 6 ft long cable
- Premium quality
- Ergonomic molding for easy connections
Specifications
- RS-232C standard compliant
- Powered by your computer's USB bus
- DB 9 male connector
Hardware Requirements
- Pentium II class processor or higher
- A PC with one available USB port
Supported Devices
Ge Usb Webcam Driver
- 369 Motor Management Relay
- 469 Motor Management Relay
- 489 Generator Management Relay
- 745 Transformer Management Relay
- 750/760 Feeder Management Relay
- ALPS Advanced Line Protection System
- B30 Bus Differential Relay
- B90 Bus Differential System Relay
- C30 Controller Relay
- C60 Breaker Management Relay
- D30 Line Distance Relay
- D60 Line Distance Relay
- DGP Digital Generator Protection
- DLPD Digital Line Protection System
- F35 Multiple Feeder Management Relay
- F485 Communication Converter
- FM2 Feeder Manager 2
- F60 Feeder Management Relay
- F650 Bay Controller
- G30 Generator Management Relay
- G60 Generator Management Relay
- L60 Line Phase Comparison Relay
- L90 Line Current Differential Relay
- M60 Motor Management Relay
- T35 Transformer Management Relay
- T60 Transformer Management Relay
- PQM Power Quality Meter
- PQM II Power Quality Meter
- MIB High Impedance Digital Protection Relay
- MIF Digital Feeder Relay
- MIFII Digital Feeder Relay
- MIG Digital Machine Protection Relay
- MIN Digital Ground Protection Relay
- MIV Voltage/Frequency Relay
- MIVII Voltage/Frequency Relay
- MIW Directional Power/Loss of Field Relay