I guess this is dead now? Logitech has shut down the harmonyremote.com server.

[neurozero]

Has anyone tried reverse engineering the binary blobs to see if they can be recreated?

[Craig-Powell]

After Logi had announced they were going to stop updating, long before they actually warned and have since shut down the servers, I had been doing some digging around to find out if anyone was doing this exact thing. I believe I had found some info, possibly from one of the original Harmony devs before Logi bought them, but unfortunately don't seem to have bookmarked it. Would defintely like to know how to build the binary files to keep my remotes (2x 880s and 1x 659, plus many spares for parts) up to date as I replace equipment. It's amazing to me that a remote I bought over 20 years ago is still being used with my much more modern gear. But that is the issue... I log ago paid for the remote and because the programming wasn't subscription based it wasn't cost effective for Logi to keep the servers running. Compared to everything else they have served out I'm sure it was just a drop in the bucket but I understand from the IT infrastructure side the desire to have less systems to manage.

We don't need the communication software (their EXEs) to be released, but if they could publicly release the accumulated remote database and how to build the binary blobs the community could run with it and keep our remotes going so long as the hardware holds out.

EDIT: I'm going to check on the computers I previously used to flash my remotes and see if I still have any of those blob files around. Might be useful to hang onto them for reverse engineering tasks since we will no longer be able to pull new ones down from Logi.

[Craig-Powell]

Found a handful of EZHex files and stored them. The connectivity files probably aren't very useful, but the update files may be. Don't know where to go from here.

[neurozero]

Having some EZHex files is a good start, but reverse engineering would be easier if there was some info around what configuration they represented and being able to create different files with only small changes.

I wish I had known this shutdown was going to happen - I only found out because I randomly wanted to tweak a couple of controls for a device that isn't in the database and is completely programmed manually. I wish they would have at least made a way for us to keep that functionality.

[glenharris]

Hi Craig, neurozero.

I got messaged by someone a few weeks ago about this, so I may as well repost my thoughts here in case they are useful. Please take them all with a grain of salt - it was 20 years ago!

I will message the person who corresponded with me, and direct them here.

Hi, is this the same Glen Harris that worked on the Logitech Harmony
remote when it was called the EasyZapper? I'm writing to ask if you
still have any information on the EZHex format for its configuration, as
Logitech is finally pulling the plug on the first generation remotes,
and I quite like my Harmony 880.

Hi XXX,

Yes it is (good detective work!)

Unfortunately, I don't have any technical documentation (I left about 20 years ago), and even if I did, that would be covered under an NDA, so I wouldn't be able to help anyway.

On the other hand, I can probably remember a fair bit about the architecture (rather than the specific details), so I can probably give you an informal overview, or if you have any specific questions I am happy to try to give some educated guesses.

If you are talking to Logitech, you should ask for the 880 firmware header files (or ask for the firmware source files if you can get them). Those headers will let you reconstruct the file format with much less pain and misery.

There was an open source project (concordance?), however I am pretty sure that it would just transfer an EzHex file to the remote, but wouldnt create a configuration file. The originators of that project might have found some useful information or guesses about the file format though... (I am pretty sure that was one of the goals of the project).

Hope this helps,

Glen.

Do you know anything about how the configuration files for the remote were generated? Are they in any particular format? Also, what kind of tools could be potentially used to disassemble the remote's firmware?

Yeah, I designed the whole thing :-)

It is going to be very hard to reverse engineer it - particularly if you dont have the ability to test your configuration format assumptions against multiple EzHex files (and I am assuming that you cannot generate files from the Logitech site any more).

The remote controls have very limited resources, so the format is designed to be very easy for the remote to interpret (and 'execute'), which means that it is more complex to generate the configuration file. The bulk of the configuration file is a binary file that is stored directly into flash on the device. At the beginning of the file will be some header information (target device, version, created timestamp etc), then a big pointer table. That table will have one pointer per 'subsystem' (e.g. IR, menu, state etc).

The actual configuration file is designed so that the remote control acts as a Von-Neumann style computing device, with a 16 bit instruction (but the instructions are remote-control specific, not general purpose CPU style instructions). The breakdown of the instruction set will be quite hard to reconstruct. Typical instructions might be:
Send IR code 3 to device 2
Show menu 38 (which might trigger entry or exit instructions)
Select menu item 4 (and execute the associated instructions)
Set state variable 5 to value 27 (and execute any instructions that this state change triggers)
etc
The individual subsystems are responsible for decoding their instructions, and then acting on them.
For example, the IR subsystem will look at the configuration file to know that device 2 code 3 is a 55kHz IR code, with certain data modulation, one toggle bit, and should be followed by a 300ms silence after sending each command.

I strongly suggest you dont go down this route unless you can get some technical data from Logitech (or elsewhere).

Glen.

I did ask Logitech about open sourcing, but a support rep said they don't believe Logitech has any current plans to open source anything. It really sucks, because if they don't, it's just going to create a mountain of e-waste.

"Regrettably, we haven't received any update yet if Logitech have any plans to open source the Logitech Harmony Remote Software for the first generation Harmony remotes after the discontinuation. I don't wanna set your hopes up, but I'm also hopefully that they will. We understand this decision affects your experience, and we apologize for any inconvenience caused."

Logitech also has their monstrously huge IR database, which is understandable if they can't release that, but it'd be nice if they could release some technical information or the server code belonging to the legacy remotes. On a different note, do you have any notable experiences to share from the time you were working on the Harmony remotes? (Anything humorous, some cool prototypes, or programming nightmares? That sort of thing.)

Hi XXX,

Sorry, I cant help with persuading Logitech to release any information, but I wish you luck. Also, no luck with notable experiences - I think that my PTSD has blanked them all out :-)

Glen.

Do you happen to know if the firmware is compressed? Trying to disassemble it in Ghidra for the PIC-18 results in 1 single function.

Unlikely to be compressed, I am sure it was easier just to have the whole EzHex file compressed/decompressed by the browser/client software.

For the firmware, I seem to remember that the EzUpgrade file contained instructions to tell the client software where to write the data. In other words, I think the EzUpgrade file is XML, and different sections will write different data to different offsets within the main flash memory (or on-chip flash). I am pretty sure the write offset was explicit in the file.

Glen.

[nitrate92]

i was the person who contacted glen, looking forward to any and all updates on this issue! if anyone is brave enough to dive into this, hmu if you need any example configurations i backed up from my harmony 880. it would be really awesome to see the legacy harmony products work again, and i'd be more than happy to contribute to that cause where i can.

[nitrate92]

i also asked logitech directly about open sourcing, but i never heard anything back. that's very much a long shot but it seemed worth a try

[Craig-Powell]

And I may have been the one to get Glen linked to this GitHub issue. Having read his comments to nitrate92 and this issue, part of the response I had to Glen follows.

It seems like the only hope the community has is if we collectively kindly ask Logitech to consider releasing proprietary data that they're holding. Your comment about e-waste is spot on. The reduce and re-use parts of the "reduce, re-use, recycle" path are all too often ignored. While it doesn't directly line up with his main right-to-repair advocacy, I may reach out to Louis Rossman to see if he might be able to offer any guidance in trying to work with a large entity like Logitech.

If we can't get something to keep this old hardware going at least you and Justin provided an excellent design to inspire future and open-source remote designs. The OMOTE was one I was watching (https://hackaday.io/project/191752-omote-diy-universal-remote) along with the project to modernize the mainboard of the 880 to run from an ESP32 module. (https://hackaday.io/project/185926-modernize-harmony-880)

So if you guys weren't already aware of those two hackaday.io projects I believe it would be worth throwing in assistance there. Outside of nicely prodding Logitech to release data it is looking like efforts here will be up against a very difficult challenge. Human ingenuity constantly surprises me though, so...

[neurozero]

I read somewhere that Logitech said they wouldn't open source it because of licensing issues - but that is now 3rd or 4th hand knowledge.

[rockguitarbandhero0192]

so anything?

[Craig-Powell]

I tried via the chat app as it was something I was able to do on a side screen while on other tasks. No ability I could find to just email in to Logitech. Unfortunately along the way I did get a little snippy but I think I already had reached the end of this rope.

James L.:
Hello Craig, thank you for contacting Logitech! This is James. How are you doing today?

Craig:
Hi James, I'm well. I have a longshot question regarding the now unsupported Harmony remotes. 
(https://members.harmonyremote.com/) I understand Logitech's decision to shut down the 
servers that were used to store the IR database and program the remotes.

James L.:
I see that you have question with Harmony products. Let me check that for you.

Craig:
But the community is resourceful, and we're hoping that Logitech might see it worth to 
provide some instruction on how we might take over and be able to continue updating our old 
devices.
We wouldn't need software but just instruction on how to build the file that gets uploaded to 
the remote. https://github.com/jaymzh/concordance/issues/66
I'm looking to get in touch with someone on the Harmony Remote product team with whom I could 
discuss the situation.
It would be a one time ask that the community receives this instruction. It would then be on 
the community to source our own IR codes and build rules to go into the files to upload.

James L.:
I understand that you still wanted to use your legacy remotes even with discontinued of the 
software.

Craig:
My 880s (and an older 655 maybe?) have been my best purchases I've ever made for my 
entertainment center.

James L.:
Unfortunately, we cannot provide any data or information. Kindly understand that this is 
decision from Logitech to discontinued the legacy software.

Craig:
No one would be willing to provide instruction for the community to build our own files. 
You're relegating all these devices to electronic waste.
That's the position?
This is not an ask to turn back on servers, open the IR database, or release source code. 
Just enough information so the global community can take a stab at not letting these go to 
landfill.

James L.:
Sadly yes that we cannot provide any information or data.

Craig:
Why can you not?

James L.:
I believe this is a company information and data.
As of the moment is there anything else I can assist you with?

Craig:
Unless you could get me in touch with someone on the Harmony team that could better explain 
why instruction on building a remote update file is not an option, then no I guess that's it.

James L.:
Understood. Thank you! I appreciate your time today.

Craig:
If you have any ability to get the github URL to them and allow them to chime in on why this 
is a dead end it would be appreciated. https://github.com/jaymzh/concordance/issues/66

James L.:
Got it. Thank you. Your ticket number (removed) will be sent to your email. After your ticket 
has been solved, you will receive a survey in regard to your support experience with Logitech. 
I encourage you to take a moment to provide your opinion so we can continue to improve your 
experience. Again thank you for contacting Logitech. Have a lovely day!

Unless there is some encryption key that is utilized in the file build I have a hard time seeing where sharing this information would be something that Logitech could not do. We're not looking for software, just methods. I would think someone spending an afternoon writing some instruction and examples for the community would go a long way (at least with me) in showing the commitment to their devices. Yes, they kept the web servers running supporting these older devices for a very long time and at a cost, big props for that. But they certainly had some idea that people were still using them up to the day of shutdown. I know it was only months ago that I last logged in. To close this server up without saying "here's some tools (in the form of documentation only) that you'll need to do this on your own, good luck!" is very disappointing.

I've got hope that this chat wasn't entirely a dead end, but that light is very, very dim.

[Craig-Powell]

I had mentioned Louis Rossman and his work on right-to-repair earlier. Last night I started looking into the Consumer Rights Wiki that he's created, and this morning chatted on the associated Discord server to see if the loss of support for programming our remotes fits in with that movement. Staff I talked with feel it does and encourage me to start up a page in the wiki. I'll try and work on that this weekend and will share the link here when published. I'll probably also put it out in other visible areas (Reddit being a good start, probably places like AVS Forum too) to try and get more momentum behind it.

I've also created a hackaday.io account to jump in on the Modernize Harmony 880 project and possibly the OMOTE one in order to hedge my bets. Those both look to have stalled a bit (no updates in the last year) but maybe now is the time for them to really shine.

[HammyHavoc]

I had mentioned Louis Rossman and his work on right-to-repair earlier. Last night I started looking into the Consumer Rights Wiki that he's created, and this morning chatted on the associated Discord server to see if the loss of support for programming our remotes fits in with that movement. Staff I talked with feel it does and encourage me to start up a page in the wiki. I'll try and work on that this weekend and will share the link here when published. I'll probably also put it out in other visible areas (Reddit being a good start, probably places like AVS Forum too) to try and get more momentum behind it.

I've also created a hackaday.io account to jump in on the Modernize Harmony 880 project and possibly the OMOTE one in order to hedge my bets. Those both look to have stalled a bit (no updates in the last year) but maybe now is the time for them to really shine.

I'll be the first to upvote any shares of it on Reddit! Think it's an absolutely tragic amount of e-waste being created by deprecating this hardware.

Got a new-to-me TV today and went to configure my Harmony H659 via USB only to discover I can't even manually feed it hex or anything, which is when I stumbled onto this Issue on the repo. Very sad about the servers being critical to functionality! Harmony is great hardware, but the consequence is that I'm not likely to buy another Harmony of any kind, and it puts me off of Logitech products in general (amassed a lot of them over the years too).

Logitech Media Server got handed over to the community when Logitech felt there was no remaining commercial potential, so I was hoping the same might happen for Harmony, but doesn't seem likely to happen.

I understand proprietary stuff being a pain, but like you said in a previous comment, a method would be nicer than being given the finger. Brand loyalty is won over time and very difficult to regain. The Pixel 6a battery debacle (https://support.google.com/pixelphone/answer/16340779?hl=en) bit me yesterday, so I'm now soured on anything Google in terms of hardware. The right to repair and maintain ongoing use of something you've paid for that shouldn't rely on third-party servers is ethical, sensible and beneficial for the planet, IMO.

Just wanted to show my appreciation for your time and energy in researching this and keeping us in the loop with what you've found. :- ) Thank you.

[guyman70718]

If it would assist anyone trying to work on reverse engineering, I have 3 EZHex files that I generated on the same day about 10 minutes apart from each other last year... I assume I made some sort of minor changes between the 3, though i'm not sure what exactly. I have a harmony 880.

[neurozero]

If it would assist anyone trying to work on reverse engineering, I have 3 EZHex files that I generated on the same day about 10 minutes apart from each other last year... I assume I made some sort of minor changes between the 3, though i'm not sure what exactly. I have a harmony 880.

I think that would be helpful. At the very least it can show the structure of the file.

[guyman70718]

I think that would be helpful. At the very least it can show the structure of the file.

EZHex Samples.zip

Here is 4 of them I found scattered on my HDD (I hope these don't contain PII lol).

The ones labelled 1, 2, and 3 were the ones made 10 minutes apart from each other. The structure seems to just be XML with a binary at the end.