Over the years I managed to learn a little bit about programming the FCI E3 and S3 panels. Using Camworks has always been a bittersweet experience and sometimes made me want to throw my laptop into the trashcan along with the fire panel I was working on….So far I have managed restraint. There were many times I was tasked with updating the program of a fire panel but was not given the password. As frustrating as that can be I knew there had to be an easy way to get around that issue. I spent some time trying to figure it out and unintentionally learned a lot about how these panels work but, one of the things I eventually learned was that when uploading or downloading the program from the panel, Camworks seemed to be the only part of the equation that cared about what the password was.

Using software like Serial Port Monitor 7.0 by Eltima Software to monitor the raw data that is being transmitted while Camworks is uploading or downloading the program I started to notice that the fire panel didn’t care if you knew the password or not, all you needed to know were the commands to send to the panel in order to either retrieve a certain block of information or store a certain block of information. From what I gathered all of the database information is stored in blocks of data in the fire panels and Camworks simply sends commands to either retrieve those blocks or send those blocks to the panel depending on whether you’re uploading or downloading to the panel.

As long as you know the command to retrieve the block of information that stored the PASSWORD data in the panel you are golden. I realized all you have to do was ask the panel what the password is.

As time went on I started to also notice that these commands were a little different depending on which firmware version the panel was using. I started to collect commands to retrieve the password from various versions. I have shared them below.

In order to send the commands to the fire panel you’ll need to make sure you’re connected via RS-232 (Baud rate is typically 115200 8n1). I used a terminal app called Termite to send raw hex data to the fire panel. It seems to work the best for me but you can use any terminal software that will send hex data. When sending the commands to the E3 and S3 panels you’ll also want to make sure you are ONLY APPENDING A CR CHARACTER to the end of your transmissions.

Here is an example of sent and received data:

[16/06/2020 11:24:31] Written data (COM5)
18 0b 01 00 45 01 80 80 33 00 00 ad 28

[16/06/2020 11:24:31] Read data (COM5)
18 8f 02 01 65 01 80 00 90 00 00 80 33 00 00 00
00 00 00 00 00 b4 40 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 50 32 00 11
11 11 00 11 11 11 00 11 11 11 00 11 11 11 00 11
11 11 00 22 22 22 00 22 22 22 00 22 22 22 00 22
22 22 00 22 22 22 00 33 33 33 00 33 33 33 00 33
33 33 00 33 33 33 00 33 33 33 00 56 34 12 00 56
34 12 00 56 34 12 00 56 34 12 00 56 34 12 00 96
8b

Termite requires that you add a leading 0x to each hex byte before you send it so the command you would copy and paste into the terminal would be:

0x18 0x0b 0x01 0x00 0x45 0x01 0x80 0x80 0x33 0x00 0x00 0xad 0x28

When viewing the raw data in hex that is returned by the fire panel you should be able to notice a pattern pretty quickly. In this case the level 1 password is 111111 and is stored in a block of 3 bytes 11, 11, 11. In ASCII hex character 11 is DC1 or device control 1. In decimal it’s 17. In this case FCI/Gamewell decided to store the literal number 11 as the hex character 11. It might not make a whole lot of sense unless you’re weird like me. For some reason the fact that I spent countless hours programming micro-controllers in the Arduino world made it very easy to figure this one out…So it I guess it was worth it.

So, now on to the important stuff, the level 1 password in this example is easy enough, and so are the level 2 and 3 passwords because they were left the default 222222 and 333333. The level 4 password also looks easy enough to decipher except you’ll noticed the password is stored backwards….or it’s meant to be read backwards. I don’t know…maybe computers ready right to left or something. So in this example the level 4 password would be three hex bytes – 0x12 0x34 0x56 or 123456.

Now that you know what patterns to look for when you receive the raw hex data back from the panel it will make it easy to decipher whether you’ve sent the right command for the right firmware level and what the level 4 password is.

Before I list all of the commands I have, please make sure to notice the difference between sending a command to a standalone node or a node in a networked system.

Here is what it looks like to send to a standalone node:

0x18 0x0b 0x00 0x00 0x45 0x01 0x80 0x80 0x2f 0x00 0x00 0xaf 0x1e

Here is what it looks like to send to Node 1 in a networked system:

0x18 0x0b 0x01 0x00 0x45 0x01 0x80 0x80 0x2f 0x00 0x00 0xaf 0x1e

Now that you’ve seen how to send to specific nodes on the network, here are the list of commands.

ILI-MB-E3 / ILI-S-E3 Panels:

0x18 0x0b 0x0a 0x00 0x45 0x01 0x80 0x80 0x00 0x00 0x00 0x58 0xb4
0x18 0x0b 0x05 0x00 0x45 0x01 0x80 0x00 0x01 0x00 0x00 0x50 0x5e
0x18 0x0b 0x00 0x00 0x45 0x01 0x80 0x00 0x2f 0x00 0x00 0x97 0xc3
0x18 0x0b 0x00 0x00 0x45 0x01 0x80 0x80 0x2f 0x00 0x00 0xaf 0x1e
0x18 0x0b 0x00 0x00 0x45 0x01 0x80 0x80 0x29 0x00 0x00 0x0f 0xac
0x18 0x0b 0x00 0x00 0x45 0x01 0x80 0x80 0x2e 0x00 0x00 0x9f 0x29
0x18 0x0b 0x00 0x00 0x45 0x01 0x80 0x80 0x33 0x00 0x00 0xad 0x28

There are also some commands for retrieving the passwords from other nodes like an NGA (Node 4):

0x18 0x0b 0x04 0x00 0x45 0x01 0x80 0x80 0x00 0x00 0x00 0x58 0xb4

I may come across more …or if you manage to figure a new one out, please let me know!