Field dossier · 29–30 Aug 2026

A dead alarm,
brought back to life.

GlobalGuard's cloud went dark years ago. The panel still armed the house — but if it tripped while nobody was home, no one was ever told. Over two days we reverse-engineered its radio hub, built a local bridge on a Raspberry Pi, and wired the whole thing into Home Assistant: phone alerts, per-room zones, arm and disarm, and voice control. No cloud. No new hardware. No subscription.

Everspring HSC04 hub U-Net over UDP 5046 Home Assistant on a Pi BroadLink BLE bulbs

48 hdead → done
10alarm zones mapped
£0new hardware / fees
3–66 scommand → panel
01 · Where we started

Working, but deaf to the outside world

The GlobalGuard kit — an Everspring hub, a Friedland/Honeywell panel, PIRs, door contacts and remotes — still worked perfectly on the wall. You could arm and disarm from the keypad every day. The problem was everything past the wall.

Everspring's notification cloud (his2x.com) had gone NXDOMAIN. So the one job that mattered when you were out — telling you the alarm had tripped — silently stopped, and had for years.

The obstacles

  • Hub answered on 0 of 65,535 ports — outbound-only, no local API.
  • Its only chatter was one encrypted packet every 30 seconds.
  • Most of the smart home lived behind a second, hidden router.
  • A new alarm or a cloud that no longer exists were the only "official" fixes.
02 · The breakthrough

The hub was never dead — it was whispering every 30 seconds

A packet capture on the Pi caught what every port scan had missed. From there it was a five-step chase to make the hub talk to us instead of a cloud that no longer answered.

01

Catch the whisper

tcpdump on the Pi showed a 30.0-second beacon, clockwork, broadcasting over UDP. The hub was alive and well — it just spoke a protocol nothing had been listening for.

02

It only speaks when spoken to — its way

Cold knocks got nothing. The hub is a callback device: it dials out to whoever it believes is the app. We had to look like that app.

03

The DES key was a decoy

We decompiled the old Friedland PC software. The DES key baked inside it — 12345678 — only ever encrypts stored strings. The actual alarm link on 5046 is plain, unencrypted U-Net. Nothing to crack.

04

Make it call the Pi

The app announces itself with a 32-byte discovery broadcast carrying its own IP address. We replayed that packet with the Pi's IP — and the hub dialled straight back.

05

Ask for the log, decode the reply

A PIN handshake, then a burst request for the event log. The reply came back as 10-byte records — which we decoded, field by field, into real events.

One event, straight off the wire

EAyear
07mon
1Dday
0Bhr
32min
26sec
03status
08zone
00src
00
A2 CA … C1 072026-08-30 · 11:50:38INTRUDERKitchen (zone 08)

The year needs a quirky offset (+1792), month and day are zero-based, and byte 7 — the status — is the whole story: 03 is an intruder trip, 11/12 are arm/disarm. Everything downstream is built on this one record.

03 · How it fits together

One Raspberry Pi, standing in for a dead cloud

The panel and hub are untouched — they do exactly what they always did. The Pi simply becomes the thing the hub dials home to, then fans the events out to everywhere they need to go.

Sensors PIRs · doors keypads · remotes Panel SC412 Hub HSC04 ☁ cloud his2x.com · dead Pi bridge gg-alarm poller discovery · PIN poll · decode · send Home Assistant 📱 Phone critical alerts 🎙 Voice arm · disarm 🌐 Remote private tunnel RF U-Net dials back UDP 5046 10s poll
The red path is what broke; the amber path is what we built. The hub now dials the Pi.

04 · What changed

From a silent box to a system that talks back

● Before
  • Arms & disarms from the keypad only
  • No alert of any kind when it trips
  • No history, no state, nothing to check
  • Invisible to the rest of the smart home
  • Nothing when you're away from the house
● After
  • Critical phone alerts that punch through Do-Not-Disturb — who armed it, which zone tripped
  • Ten zones on the map, each assigned to its real room
  • Arm, day-mode & disarm from a phone, a dashboard, or your voice
  • A live event log and a hub-health heartbeat
  • Reachable anywhere through a private, outbound-only tunnel

Intruder alerts

A trip on an armed zone fires a high-priority notification on its own alarm channel — full volume, past silent mode.

Every room, named

Ten sensors surface as proper HA entities — including three remotes tucked in the van, so a break-in there trips the house alarm.

Voice & app control

Full arm, day-mode part-arm, and PIN-guarded disarm — spoken, tapped, or scheduled, running entirely on your own kit.

Hub heartbeat

The 30-second beacon that gave the game away now doubles as a liveness check — if the hub goes quiet, you hear about it.

Remote access

The whole dashboard travels with you over an outbound-only tunnel — no open ports on the home router, nothing exposed.

Self-healing sends

Commands confirm against the panel and quietly re-send if the radio was mid-cycle — reliable arming without a wall of beeps.

05 · Hard-won fixes

The bugs that fought back

Half the work was in the surprises — an alarm mode wearing a disguise, a redirect that quietly ate every command, a cloud assistant that lied about failure.

#1 The day mode was hiding as "Sleep"

Symptom
The part-arm we use every day did nothing when sent the obvious way.
Cause
On this panel, "Part Arm 1" is really the Sleep profile — a different command (0x3D), not the PARM1 0x35 the label implies.
Fix
Pointed the daytime button at 0x3D; the panel armed and reported straight back as part-armed.

#2 Every command silently vanished

Symptom
Voice said "arming", the dashboard agreed — the panel never moved.
Cause
Home Assistant runs shell commands without a shell, so the > that was meant to write the command file was treated as plain text. Nothing was ever written.
Fix
Routed the write through a one-line shell script. Commands started landing immediately — this one fix unblocked all of voice control.

#3 "Something went wrong with the alarm"

Symptom
The command actually worked — Google still reported failure.
Cause
The panel takes seconds to respond, so HA's instant reply still carried the old state. Google reads that mismatch as an error.
Fix
Report the target state optimistically the moment a command is sent, then reconcile with the panel's real state a beat later.

#4 A chorus of disarm beeps

Symptom
One "disarm" produced three or four tones from the panel.
Cause
A retry loop re-sent the command every few seconds — faster than the poll could confirm the first one had landed.
Fix
Poll every two seconds to confirm fast, and only re-send after 75 — past the panel's slow window. One tone, still self-healing.
06 · When it trips

Now the whole house answers back

A phone alert is easy to miss. So we went further — reverse-engineered the BroadLink BLE bulbs the same way, and wired the trip into a full sensory response. Break in while it's armed and every bulb throbs red, the lights flash, and the speakers say so out loud, on a loop. Still no cloud; all of it on the same Pi. Try it below.

⚠ Contains flashing lights and sound. Audio is kept low — use "Sound on/off" to watch silently. Browsers set to reduced motion get a steady red glow instead of the strobe.

Every bulb, blood red

The BroadLink FastCon BLE mesh, reverse-engineered — a lifted broadcast key, raw Bluetooth advertising straight off the Pi. On a trip all five bulbs pulse red; the landing and hall lights also stand in as a status lamp — dull red armed, a green pulse the moment you disarm.

The house lights up

Every switchable light plus the Nanoleaf snap into a randomised flash the instant a zone trips — a scene nobody outside can miss — then restore to exactly how they were.

A voice in the dark

The speakers announce — on repeat, at full volume — that the intruder is being recorded and the police notified, then hand every speaker back the volume it was at before.

The system today

A cloud-dead alarm, now local, private, and fully in the loop.

The panel and remotes work exactly as before — nobody had to learn anything new. But now the house tells you when it's armed, when it trips, and which room did it; you can arm it on the way out and disarm it with a word on the way in; and none of it depends on a company's server that stopped answering years ago. And when it trips, nobody can miss it — every bulb turns red, the lights flash, and the house says so out loud. Everything runs on one Raspberry Pi that was already on the network.

gg-alarm · gg-heartbeat · brmesh-bridge — all live·built 29–30 Aug · sensory layer 31 Aug 2026