GlobalGuard's cloud went dark years ago. The panel still armed the house — but if it tripped while nobody was home, no one was ever told. Over two days we reverse-engineered its radio hub, built a local bridge on a Raspberry Pi, and wired the whole thing into Home Assistant: phone alerts, per-room zones, arm and disarm, and voice control. No cloud. No new hardware. No subscription.
The GlobalGuard kit — an Everspring hub, a Friedland/Honeywell panel, PIRs, door contacts and remotes — still worked perfectly on the wall. You could arm and disarm from the keypad every day. The problem was everything past the wall.
Everspring's notification cloud (his2x.com) had gone NXDOMAIN. So the one job that mattered when you were out — telling you the alarm had tripped — silently stopped, and had for years.
The obstacles
A packet capture on the Pi caught what every port scan had missed. From there it was a five-step chase to make the hub talk to us instead of a cloud that no longer answered.
tcpdump on the Pi showed a 30.0-second beacon, clockwork, broadcasting over UDP. The hub was alive and well — it just spoke a protocol nothing had been listening for.
Cold knocks got nothing. The hub is a callback device: it dials out to whoever it believes is the app. We had to look like that app.
We decompiled the old Friedland PC software. The DES key baked inside it — 12345678 — only ever encrypts stored strings. The actual alarm link on 5046 is plain, unencrypted U-Net. Nothing to crack.
The app announces itself with a 32-byte discovery broadcast carrying its own IP address. We replayed that packet with the Pi's IP — and the hub dialled straight back.
A PIN handshake, then a burst request for the event log. The reply came back as 10-byte records — which we decoded, field by field, into real events.
One event, straight off the wire
The year needs a quirky offset (+1792), month and day are zero-based, and byte 7 — the status — is the whole story: 03 is an intruder trip, 11/12 are arm/disarm. Everything downstream is built on this one record.
The panel and hub are untouched — they do exactly what they always did. The Pi simply becomes the thing the hub dials home to, then fans the events out to everywhere they need to go.
A trip on an armed zone fires a high-priority notification on its own alarm channel — full volume, past silent mode.
Ten sensors surface as proper HA entities — including three remotes tucked in the van, so a break-in there trips the house alarm.
Full arm, day-mode part-arm, and PIN-guarded disarm — spoken, tapped, or scheduled, running entirely on your own kit.
The 30-second beacon that gave the game away now doubles as a liveness check — if the hub goes quiet, you hear about it.
The whole dashboard travels with you over an outbound-only tunnel — no open ports on the home router, nothing exposed.
Commands confirm against the panel and quietly re-send if the radio was mid-cycle — reliable arming without a wall of beeps.
Half the work was in the surprises — an alarm mode wearing a disguise, a redirect that quietly ate every command, a cloud assistant that lied about failure.
0x3D), not the PARM1 0x35 the label implies.0x3D; the panel armed and reported straight back as part-armed.> that was meant to write the command file was treated as plain text. Nothing was ever written.A phone alert is easy to miss. So we went further — reverse-engineered the BroadLink BLE bulbs the same way, and wired the trip into a full sensory response. Break in while it's armed and every bulb throbs red, the lights flash, and the speakers say so out loud, on a loop. Still no cloud; all of it on the same Pi. Try it below.
⚠ Contains flashing lights and sound. Audio is kept low — use "Sound on/off" to watch silently. Browsers set to reduced motion get a steady red glow instead of the strobe.
The BroadLink FastCon BLE mesh, reverse-engineered — a lifted broadcast key, raw Bluetooth advertising straight off the Pi. On a trip all five bulbs pulse red; the landing and hall lights also stand in as a status lamp — dull red armed, a green pulse the moment you disarm.
Every switchable light plus the Nanoleaf snap into a randomised flash the instant a zone trips — a scene nobody outside can miss — then restore to exactly how they were.
The speakers announce — on repeat, at full volume — that the intruder is being recorded and the police notified, then hand every speaker back the volume it was at before.
The panel and remotes work exactly as before — nobody had to learn anything new. But now the house tells you when it's armed, when it trips, and which room did it; you can arm it on the way out and disarm it with a word on the way in; and none of it depends on a company's server that stopped answering years ago. And when it trips, nobody can miss it — every bulb turns red, the lights flash, and the house says so out loud. Everything runs on one Raspberry Pi that was already on the network.