GlobalGuard's cloud went dark years ago. The panel still armed the house — but if it tripped while nobody was home, no one was ever told. Over two days we reverse-engineered its radio hub, built a local bridge on a Raspberry Pi, and wired the whole thing into Home Assistant: phone alerts, per-room zones, arm and disarm, and voice control. No cloud. No new hardware. No subscription.
The GlobalGuard kit — an Everspring hub, a Friedland/Honeywell panel, PIRs, door contacts and remotes — still worked perfectly on the wall. You could arm and disarm from the keypad every day. The problem was everything past the wall.
Everspring's notification cloud (his2x.com) had gone NXDOMAIN. So the one job that mattered when you were out — telling you the alarm had tripped — silently stopped, and had for years.
The obstacles
A packet capture on the Pi caught what every port scan had missed. From there it was a five-step chase to make the hub talk to us instead of a cloud that no longer answered.
tcpdump on the Pi showed a 30.0-second beacon, clockwork, broadcasting over UDP. The hub was alive and well — it just spoke a protocol nothing had been listening for.
Cold knocks got nothing. The hub is a callback device: it dials out to whoever it believes is the app. We had to look like that app.
We decompiled the old Friedland PC software. The DES key baked inside it — 12345678 — only ever encrypts stored strings. The actual alarm link on 5046 is plain, unencrypted U-Net. Nothing to crack.
The app announces itself with a 32-byte discovery broadcast carrying its own IP address. We replayed that packet with the Pi's IP — and the hub dialled straight back.
A PIN handshake, then a burst request for the event log. The reply came back as 10-byte records — which we decoded, field by field, into real events.
One event, straight off the wire
The year needs a quirky offset (+1792), month and day are zero-based, and byte 7 — the status — is the whole story: 03 is an intruder trip, 11/12 are arm/disarm. Everything downstream is built on this one record.
The panel and hub are untouched — they do exactly what they always did. The Pi simply becomes the thing the hub dials home to, then fans the events out to everywhere they need to go.
A trip on an armed zone fires a high-priority notification on its own alarm channel — full volume, past silent mode.
Ten sensors surface as proper HA entities — including three remotes tucked in the van, so a break-in there trips the house alarm.
Full arm, day-mode part-arm, and PIN-guarded disarm — spoken, tapped, or scheduled, running entirely on your own kit.
The 30-second beacon that gave the game away now doubles as a liveness check — if the hub goes quiet, you hear about it.
The whole dashboard travels with you over an outbound-only tunnel — no open ports on the home router, nothing exposed.
Every arm or disarm is checked against the panel, and the bridge presses the fob again if it didn't take — only nagging you to use the keypad if it still won't.
Half the work was in the surprises — an alarm mode wearing a disguise, a redirect that quietly ate every command, a cloud assistant that lied about failure.
0x3D), not the PARM1 0x35 the label implies.0x3D; the panel armed and reported straight back as part-armed.> that was meant to write the command file was treated as plain text. Nothing was ever written.Reading the alarm was half the job. The other half was driving it — without leaning on the panel's radio hub, which is slow to wake and can lag a spoken command by seconds.
An ESP32 and an isolated relay press the buttons of a spare, fully-enrolled key fob. Because it's a real remote, the alarm trusts it and the rolling code just works — no RF to crack.
Arming used to wait on the panel's radio hub. Now every command fires the fob in an instant — the hub is only read for status.
"Night Security", "Day Security" and "House Panic" through Google, plus a PIN-gated disarm — all landing on the fob, all local.
The full build — the isolated-relay wiring, the now-hardwired serial firmware, the confirm-and-retry failsafe and the finished photos — is on the Technical page, along with a planned tone-ACK that will let the bridge hear the panel confirm.
The Echo Show by the bed has its own Night, Day and Disarm buttons, and they take the same route to the fob (fix #6).
A phone alert is easy to miss. So we went further — reverse-engineered the BroadLink BLE bulbs the same way, and wired the trip into a full sensory response. Break in while it's armed and every bulb throbs red, the lights flash, and the speakers say so out loud, on a loop. Still no cloud; all of it on the same Pi. Try it below.
⚠ Contains flashing lights and sound. Audio is kept low — use "Sound on/off" to watch silently. Browsers set to reduced motion get a steady red glow instead of the strobe.
The BroadLink FastCon BLE mesh, reverse-engineered — a lifted broadcast key, raw Bluetooth advertising straight off the Pi. Dedicated alarm lights are the status lamp now: arming pulses red and quickens for the final seven seconds of the exit delay, then settles to a low red hold; a disarm is a slow green pulse that fades out after a minute. And on a trip, every coloured bulb in the house snaps to a hard red strobe.
Every switchable light plus the Nanoleaf snap into a randomised flash the instant a zone trips — a scene nobody outside can miss — then restore to exactly how they were.
The speakers announce — on repeat, at full volume — that the intruder is being recorded and the police notified, then hand every speaker back the volume it was at before. It plays on every speaker in the house bar the main bedroom, so a small-hours trip doesn't blast someone asleep.
The panel and remotes work exactly as before — nobody had to learn anything new. But now the house tells you when it's armed, when it trips, and which room did it; you can arm it on the way out and disarm it with a word on the way in; and none of it depends on a company's server that stopped answering years ago. And when it trips, nobody can miss it — every bulb turns red, the lights flash, and the house says so out loud. Everything runs on one Raspberry Pi that was already on the network.