Help build binding for Paradox Alarm Panel with IP150

Tags: #<Tag:0x00007fe05d9af9a8> #<Tag:0x00007fe05d9af4f8> #<Tag:0x00007fe05d9af2a0>

(Angelos) #182

You mean firmware for the main unit?
If yes: The latest firmware released for the EVOHD is: version 6.86.000 (published on February 8, 2018). I can give you a copy of EVOHD_V6_86_000.PUF if you would like.

Regarding the documentation (EVO_UDSProtocol.pdf): I can’t find anything newer on the Paradox website :frowning:

I see the following:

all of the product docs are public on
@Jean_Henning : I can’t see any of the protocol manuals on their website (even with Distri access)… it seems that these are protected with NDA and they are given only to software developers :frowning:

(Jean Henning) #183

Guys I have started a new document to combine all the EVO info I’ve found so far. This includes info from the official documents (with some mistakes corrected) as well as through self discovery. This is very much a work in progress and I’ll continue to add to this document as I find more info. Please feel to contribute to this if you have more info or discover mistakes. My email address is in the document on the first sheet.

Filename: EVO_Technical_Info_v1_0_0.xlsx

(Jean Henning) #184

The process of reading labels isnt that difficult. First thing you need to do is to determine where the labels are stored in EEPROM. RAM stores info about the panel, like current open zones, doors, etc. EEPROM stores all panel settings (typically anything you can change via the keypad).

For labels, see the document EVO_Technical_Info_v1_0_0.xlsx I posted further down. The sheet “EEPROM Map” shows you the address of each label. E.g. Zone Label 001 is at EEPROM address 0x00430 and it’s 16 bytes long (since a label has 16 characters max).

To read this in code, make sure you are logged into the IP150 module. I’m assuming you are this far at least? My sheet “IP150 Login-Logout Sequence” sequence gives more info on this.

Once you are successfully logged in you need to issue command 0x5. Messages to the IP150 has a 16 byte header followed by the serial protocol command. So to read zone label 0x00430 you need to issue this command:

Header: 0xAA, 0x08, 0x00, 0x04, 0x08, 0x00, 0x00, 0x14, 0xEE, 0xEE, 0xEE, 0xEE, 0xEE, 0xEE, 0xEE, 0xEE (this was found through tracing Winload packets)
Serial Message: 0x50 0x08 0x00 0x00 0x04 0x30 0x10 0x?? (last byte is the checksum)

Of course you send the header and message as one long byte sequence.

The serial message is explained as follows;
0x50 = Command 0x5, Block number 0x0
0x08 = The serial message has 8 bytes total.
0x00 = Control byte. Bit 7 ON = RAM, Bit 7 OFF = EEPROM. Bit 0 & 1 is the EEPROM memory address’ bit 16 & 17 if the address exceeds 0x0FFFF. In our example we dont exceed it.
0x00 = Bus address = 00 (panel)
0x04 = Memory address HIGH
0x30 = Memory address LOW
0x10 = Bytes to read = 16 (length of a label)
0x?? = You need to calculate the checksum of the serial message’s bytes by summing bytes 00-06.

Once you issue this command you’ll get the 0x5 response message. It looks very similar. It will have a 16 byte header that’s returned and the serial message. Bytes 06-21 in the serial message response contains the 16 bytes of data you requested (the label). Convert the bytes to ASCII.

If you are NOT using the IP150 the process should be relatively similar, except you will not have the 16 byte header as that seems to be IP150 specific. Your login sequence might also be slightly different as you would have to ignore the IP150 module login part, but you’d have to still follow the rest of the commands to establish a connection (but I cant verify this as I work with the IP150 only).

(Ingrid Jardillier) #185


@Dim No, sorry, I’m talking about Babyware tool. I have the version 2.43.11 but there is probably a newer version… ?


(Jean Henning) #186

There is indeed a newer version. I think I have version 5 somewhere. Will check tomorrow when I’m at my laptop again.

(Jean Henning) #187

Here’s the latest version of Babyware (5.1):

(Jean Henning) #188

While we are on the topic of BabyWare, does anybody know how you disable that IP encryption on BabyWare? Doesn’t seem like you can. Winload has it in one of the config files but BabyWare just has some levels on security but none of them look like a complete shutoff of IP encryption.

(Ingrid Jardillier) #189

@Jean_Henning Thanks, I thought I can’t download it without a login / pass on paradox site. I never found it before on their website…
When you go in “Communication / Settings” menu, you have an Encryption tab, with 3 levels for encryption. i have selected the normal one. I found nothing else for encryption.

(Jean Henning) #190

I checked this out too. Unfortunately even the normal encryption setting is encrypting the packets. Doesnt seem like there’s any other way of turning encryption off on Babyware.

(Jean Henning) #191

If you are interested in C# code to communicate with the IP150 & EVO panels, take a look at a repo I created:

(Ingrid Jardillier) #192

Thank you, I’ll try this tonight.

(nezmogus) #193


can you share InField 4.9.10 software files (installation files if you have or just copy and zip from Paradox in program files)?

Thank you

(nezmogus) #194

One more file to your collection

(Jean Henning) #195

Hi there,

Thanks, however this is actually an old document. This is V2.6 of the Paradox API. The latest version I have is V2.18 released in November 2016. Sadly it doesnt seem like there’s any more updates or the download link I have has changed.


(Jean Henning) #196

I zipped the In-Field version from the latest BabyWare. That In-Field version however is V5.0.11. Hope that’s ok? It’s in my share:

(nezmogus) #197

Hello, thanks for InField, but i need v4.9.10.

I’m not sure, but looks like this version can directly (using IP) communicate with firmware version 3.X and firmware version 4.x. Later InField version refuses communicate with firmware V4 directly, only trough Paradox servers using panel serial number. Earlier InField versions do not understand communication protocols of firmware V4.x…

Now i’m stuck somewhere in a middle. I can connect to IP150 using almost any InField version, but they shows firmware version “none” and if i’m trying to update to any firmware version, i’m getting communication error. How i see in Youtube link, InField 4.9.10 can communicate with IP150 with firmware version “none” but without result. But this can be used for protocol analysis. This is why i need exactly this version :slight_smile: All others i have, but this one is missing


(nezmogus) #198

write me email at

(Jean Henning) #200

I’ve uploaded version 4.9.10. I found it :slight_smile:

(Psyciknz) #201

Anyone feeling like carrying on with this or is it dead since a firmware upgrade? I’m trying ot carry on with @Tertius_Hyman’s work on Github with the python based interface.

It’s working, but I’m trying to figure out the keepalive messages and control - specifically for the SP range.

(Angelos) #202

I still use and it’s working fine for me. No issues at all.

Are you thinking to develop a 2.x binding @psyciknz ?

By the way: which firmware is problematic?
I am running an IP150v2 with 1.39.02 firmware connected to a SP7000 with 5.18 firmware and it works fine.