I have been very fortunate to be able to buy a brand new house. The house was delivered with a heatpump system and floor heating, to my surprise the heatpump installation doesn't have any display or buttons like I was used to on a central heating system. Instead, the heatpump should be connected to a Windows computer with a special service cable. The heatpump and floor heating units all have a RJ45 jack that connects to that service cable. Without knowing this it is easy to assume that the heatpump can be simply connected with an internet cable but that isn't the case.

The service cable cost an extortionate amount, back when I was a teenager you could buy a Wii for that amount. But considering that I will use the heatpump and floor heating system for decades and I wanted to install an extra thermostat in another room it was a price I am willing to pay. I requested the floor heating maps from the builder of the house and I am happy to share that I installed 2 extra thermostats in 2 rooms that became more comfortable after installing them.

Luckily the service software was freely available from Itho Daalderop, with that application I could connect to the heatpump and floorheating using the service cable. The service tool has different levels, the higher the level the more options are available in the tool. By default on its lowest level it only allows reading values, which is already useful to see what errors the system is giving. On the bottom of the page I shared the "level 9" highest level service passwords that should give access to all the features of the tool. These codes are only shared from Itho Daalderop after following training with them.

I used ILSpy to decompile the binary, and to my suprise the binary wasn't obfuscated. Obfusicating can slow down the reverse engineering efforts. I found that the service passwords were stored in a MS Access database. But there the passwords weren't in plain-text, instead there was a hashing function that went over the password. Using different values for multiplication and modulo this code mapped to multiple passwords with different level of control.

The decompiled hash function I copied over into a fresh C# project, I tried converting the VisualBasic code into the C# equivelant. That was a mistake that gave me wrong passwords, I just left it as the code as ILSpy gave me and imported the Microsoft.VisualBasic and it worked like a charm.