Manually Updating the Wink Hub

Let’s take a look at the steps required to manually install a firmware update to the Wink Hub.

The update works by booting into a separate linux image located on different flash partitions so that it can then download new images and flash them to the main application partitions.

So to update manually we are going to do the same thing, but first we need to root the updater before we boot into it.

Let’s mount the rootfs of the updater to /tmp/updater:

ubiattach -p /dev/mtd2
mkdir /tmp/updater
mount -t ubifs ubi2:rootfs /tmp/updater

We need to remove the root password on this image like before, copy over our ssh key, and remove the S99local script that runs the update process from /etc/init.d. Also make sure we have our wifi configuration saved properly to the database (see original root post). We may also want to save copies of other files we have modified such as from /var/www. For insurance let’s also unlock the bootloader:

fw_setenv bootdelay 5

The bootloader parameters are sometimes restored to defaults so we should also edit /database_default/u-boot.env here and each time we update the app-rootfs.

Once we are ready to boot over we can do:

echo "1" > /database/DO_UPDATE

Then we are ready to reboot.

Once we are booted into the updater image we can follow the example of the /root/platform/ script to manually download and flash the updates. So far only the application rootfs has been updated and can be downloaded from:

At this time the update is small enough that we can download it to /tmp and flash it using:

ubiformat /dev/mtd5 -f /tmp/app-rootfs.ubi

After they are in place, we will need to root again using the same process outlined above (except we are working with /dev/mtd5 now). Also pay attention to any changes that may be present in the update such as disabling the UART login (/etc/inittab), not starting dropbear, etc… And we should modify the S31platform script and block the cloud addresses again as we did in the original root post.

Once we are ready to boot back into the application we can do:

echo "0" > /database/DO_UPDATE

And reboot, fingers crossed.

PS – Let’s say we want to take a look at the rootfs before we update. To do so on a linux desktop, we can download the ubi image and:

modprobe mtdblock
modprobe ubi
modprobe nandsim first_id_byte=0x01 second_id_byte=0xf1 third_id_byte=0x00 fourth_id_byte=0x1d
dd if=app-rootfs.ubi of=/dev/mtdblock0 bs=2048
ubiattach /dev/ubi_ctrl -m 0 -O 2048
mkdir /media/ubifs
mount -t ubifs ubi0_0 /media/ubifs

The above assumes you have no other mtdblock devices on your system. It also simulates the actual flash chip used in the device which is larger than necessary for just playing with the rootfs.

23 thoughts on “Manually Updating the Wink Hub

  1. Just attempted this – ended up with the Wink just showing a steady pink light. Everything was fine up until the last reboot, very disappointing! I note they say if it can’t reconnect to wifi it should go back into configuration mode but none of the states they describe are a steady pink light. Everything seemed reasonable and none of the changes I made seemed brick-worthy.

    Either way, ordered a 3.3V to normal level RS232 adapter, so I can see what it’s spitting out. I did follow the instructions exactly, so hopefully it’s recoverable once that arrives on Monday.

    Shame, as out the box, it didn’t seem to be able to control the GE bulbs I got, only add/delete them from its database! It’d just error out when any attempt was made to control anything. I was so excited, too.


    • Sorry to hear that. So your hub is not broadcasting an available wifi AP? If you unlocked the bootloader then you should have no problem getting back into updater mode with your serial cable.


      • I got fed up waiting for the serial voltage shifter and built a makeshift adapter out of two transistors and some resistors – got in instantly! Definitely recommend setting up the bootloader 😉

        Anyway, the problem was the way I’d disabled the deletion of the wifi configuration file, I’d just placed a # at the start of the line containing the rm. This was somehow confusing the shell, when it got to the fi, and apparently it didn’t finish after that – though it still launched serial terminal/etc. and I could see it was starting up all the radio interfaces *except* wifi 😉 So I commented out the if and fi too, and it started right up and connected to wifi.

        It’s funny, as I’d edited S31platform the same way on the old firmware and it had been fine. Either way, new version installed and aprontest is actually working now, I can turn on and off my bulbs! Thanks for the tutorial, I wouldn’t have liked to tackle the upgrade shell script myself.


  2. Well,

    I commented out the if …. fi block and it appears that it has bricked on my side. Ill have to wait until Monday to grab some tools from work to see if I can de-brick it. I did enable the serial terminal and it should have a 5 second uboot delay. TBW


    • For some reason, when I set the boot delay to 5, it wouldn’t boot at all. (Green light was lit constantly, even after I left it for 30 min). I had to hook it up to a UART to de-brick it. Actually, once I had the UART connected, it would boot.

      I changed the boot delay to 2, and now the thing boots fine. Weird.


  3. Based on what I’m reading and have seen myself, it seems like having a boot delay without UART connected still trips the bootloader screen, as if the RX was floating and tripping it.


  4. To save some my mistake. As of app-rootfs.ubi ver. 00.47 they removed dropbear. When you prep /dev/mtd5 be sure to copy over a copy from /dev/mtd2. Also not sure when it changed but the /etc/init.d/S50dropbear script will now overwrite your authorized_keys file if it finds one in /database.


  5. Actually, /etc/init.d/S50dropbear doesn’t overwrite your authorized_keys in /database, it checks if authorized_keys exists in /database, if it exists, create directory /root/.ssh and copy authorized_keys over.
    Dropbear was not removed. There’s a check in /etc/init.d/S50dropbear that looks for /database/ENABLE_SSH, if it exists, start dropbear, if file doesn’t exist, don’t start dropbear.
    So you just need to create a file /database/ENABLE_SSH and dropbear will start.


  6. I didn’t realized there’s a new update and followed the instruction above. SSH got disabled and I forgot to copy the exploited set_dev_value.php file over. Is there any way i can force it to boot to the updater partition?


  7. so I’ve done the update and the hub is up and running, but I think there was a file that needed to be set in order to identify the firmware version. The android app is reading the firmware version as 0 and I think its tripping the “firmware update need” flag which is preventing me from adding any lights through the phone app. Anyone know where firmware version number is?


    • nevermind, figured it out. Followed the instructions on xda-developers and did the update again but with the upgrade script, just removing the part where the device reboots. Did the upgrade from rootfs first in order to upgrade the updaterfs, then did the upgrade from updaterfs for rootfs. Had to reroot after each step. I’m pretty sure a persistent root script could be added to both partitions so that they handled all of the rerooting steps, and just appended themselves to the new partition once it had been upgraded and before the device reboots.


  8. Can anyone help me out? I accidentally deleted my /etc/init.d/S41wireless and didn’t get a chance to back it up.
    Could someone post theirs? (Can’t get my network back)


    • Here you go….
      # Start the wireless network….

      case “$1” in
      if [ -f /database/wpa_supplicant.conf ]; then
      echo “Starting wifi network…”
      set_rgb 127 127 0 0 0 0 flash 250000
      lsmod | grep dhd
      if [ $? -eq 1 ]; then
      insmod /root/wifi/dhd.ko firmware_path=”/root/wifi/fw_prod.bin” nvram_path=”/root/wifi/nvram.conf” iface_name=wlan0 dhd_sdiod_drive_strength=8
      sleep 2
      /root/wifi/wl mpc 0
      /root/wifi/wl up
      /usr/sbin/wpa_supplicant -iwlan0 -Dwext -c/database/wpa_supplicant.conf &
      sleep 1
      /usr/sbin/wpa_cli -iwlan0 -p/var/run/wpa_supplicant -a/root/wifi/ &
      #Launch the connection checker here…
      /root/wifi/ &
      echo -n “Stopping wifi network…”
      /usr/sbin/wpa_cli -p/var/run/wpa_supplicant terminate
      /usr/sbin/wpa_cli -p/var/run/wpa_supplicant quit
      “$0” stop
      sleep 1
      “$0” start
      echo “Usage: $0 {start|stop|restart}”
      exit 1

      exit $?


  9. Anyone know a place to get previous versions of images. Looks like I have an old hub and my tmp filesystem is 29.7MB approx and the latest version is 31MB. it downloads about 96% from the amazon site and complains of fs full.


      • *NOTE* You’ll most likely have to remount the /tmp directory with more than 30M. The safest way to do that is to edit /etc/fstab and append the a size option “mode=1777,size=41M” and reboot


  10. Thank you!! had the hub up and running for a while then i encountered 2 more blank files and it went into a boot loop :S
    Could you post 2 more files?
    1) /opt/local_control/aau/http.js ??
    2) and I believe “monitcs” or something like that…not sure where it lives. but it had “localhost” line in there and I went back in and it was blank. then hub went into reboot loop before I could fix it.. :S


    • I do not have http.js on my wink hub.
      found /etc/monitrc pasted below….

      # Quick and dirty monit config for apron

      # check services at 1-minute intervals
      set daemon 15

      check process hub
      matching “hub$”
      start program = “/etc/rc.d/init.d/wink start”
      stop program = “/etc/rc.d/init.d/wink stop”
      depends on aprond

      check process aprond
      matching “aprond”
      start program = “/etc/rc.d/init.d/apron start”
      stop program = “/etc/rc.d/init.d/apron stop”
      depends on lutron-core
      depends on ZigBeeHACoord

      check process lutron-core with pidfile /var/run/
      start program = “/etc/rc.d/init.d/lutron-core start”
      stop program = “/etc/rc.d/init.d/lutron-core stop”

      check process ZigBeeHACoord
      matching “ZigBeeHACoord”
      start program = “/etc/rc.d/init.d/zigbee start”
      stop program = “/etc/rc.d/init.d/zigbee stop”

      and /etc/rc.d/init.d/monit

      case “${1}” in
      echo -n “Starting monit…”
      chmod 600 /etc/monitrc

      echo -n “Stopping monit…”
      /usr/bin/monit stop

      ${0} stop
      sleep 1
      ${0} start

      echo “Usage: $0 [start|stop|restart]”


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s