🏠 WiBox Media

Custom firmware for the Fermax WiBox intercom module — so your door entry phone answers on your phone, your tablet, and Home Assistant, with nobody else's cloud in the middle.

The Fermax WiBox is a small box an installer fits next to the intercom monitor in your hallway. Out of the box it links your door entry system to Fermax's phone app, through Fermax's servers.

This firmware replaces the software inside that box. Same hardware, same wires, but afterwards the module talks to your home instead of a company's cloud:

• 📹 you see who is at the door
• 🗣️ you talk to them
• 🚪 you open the door
• 🏡 all of it on your own network, and from outside if you set that up

Nothing leaves your house unless you make it. There is no account, no subscription, and it keeps working if a company changes its mind.

⚠️ This replaces the manufacturer's firmware. Take the backups described in Getting Started first. You can go back — the original Fermax software is still on the device and there is a factory mode to boot it — but do the backups anyway.

This is a fork, and almost none of the hard groundwork is ours. The chain:

This fork (cmos486/wibox-media) adds two-way audio over WebRTC, the VDS bus work described below, health monitoring, and a pile of fixes. The full list: About this fork.

A lot of this firmware exists because of things that were not documented anywhere and had to be found by experiment, on a bench built from a real Fermax installation — outdoor panel, original monitor and WiBox on the same wires. The findings are written up properly, because they are the difference between this working and this half-working:

• 🚪 The VDS bus, explained — how Fermax's bus works, why the module needs an address and what happens when it is wrong (spoiler: absolutely nothing happens, silently), and how to set it without the pairing dance that does not work on every monitor.
• 🤝 Sharing the bus with the original intercom — can this break the intercom the rest of the household uses? Tested properly, with the logs kept. Short answer: no, and the reason is reassuring.
• 📻 UART codes — the complete command set the stock firmware uses to talk to Fermax's microcontroller, recovered by disassembling it, checksum and all.

Getting Started covers access, backups, the first flash and the first boot. Do not skip the backups.

Which stock versions are known to work:

Treat anything newer as serial-only until somebody proves otherwise.

VERSION="v0.18.14"
wget -O wibox-media.img \
  "https://github.com/cmos486/wibox-media/releases/download/${VERSION}/wibox-media-${VERSION}.img"

💡 Run that on your computer, not on the WiBox. The stock device's wget cannot fetch GitHub's HTTPS downloads. Transfer the file across afterwards — Getting Started shows how with nc.

You do not need to build anything from source unless you are changing the code.

After the first flash the module raises its own WiFi network called IDS7938XXXX (the Device ID is printed on the label). Join it and open http://192.168.111.1/ to enter your network details. No cable needed.

To move it to a different network later, hold the WiFi button for 5 seconds. A blinking blue LED means the setup page is up again.

Settings live in one file on the device:

/mnt/mtd/sip_media.conf

For most installations only a handful of lines matter:

mqtt_host=192.168.0.203        # your Home Assistant / MQTT broker
mqtt_user=wibox
mqtt_pass=change-me
rtsp_enabled=1                 # turn on the video stream
video_enabled=1

Everything else, with defaults: Runtime configuration.

If MQTT discovery is on, the device appears by itself. Nothing to write by hand, no integration to install — it shows up with everything already wired.

🎛️ Controls — what you press. Open the door, take a snapshot, turn video and RTSP on or off, set the flat's VDS address, arm a nightly reboot.

📊 Sensors — what it tells you. Call state, health, uptime, firmware version, and the snapshot of whoever last rang.

🔔 Events — what just happened. Doorbell presses and the raw bus traffic, which is what you look at when something is not behaving.

This is the step people miss, and it is the one that breaks doorbells. The module has to know which flat it is copying, or street calls will never reach it and nothing will tell you why.

Clear the old address with five short presses of PB2, then type the number into the VDS Address entity in Home Assistant. Full explanation and how to check it: The VDS bus.

For an actual "somebody is at the door" experience — the video, a talk button and a door button, working on phones and wall tablets, at home and away — pair this firmware with the companion card:

👉 wibox-intercom-video-card

Press and hold to talk, open the door, hang up. RTC conectado in the corner means the WebRTC path is up — that is the one that carries your voice back to the panel; if it ever says MSe instead, the stream is view-only.

Setting it up end to end (go2rtc, WebRTC, remote access, talk-back): Home Assistant two-way audio.

Sooner or later you will want a USB-to-TTL adapter. It is how you get in when telnet is blocked, and how you rescue a device that will not boot. It costs very little and it is the difference between a bad afternoon and a dead module.

⚡ Use a 3.3 V adapter. A 5 V one can damage the board. Check the jumper before you plug anything in.

Three wires, and TX goes to RX:

Then, at 115200 baud:

picocom -b 115200 /dev/ttyUSB0

Where the pads are, with photos, and how to catch the bootloader: Serial TTL. If the device will not start at all: Recovery.

The module is meant to be installed and forgotten, possibly in somebody else's house, so it looks after itself:

• 🔁 Watchdog — if the daemon dies it is restarted
• 👂 Audio self-healing — a capture that goes silent is detected and restarted
• 📅 Scheduled reboot — optional, off by default, set the hour from Home Assistant
• 🕐 Correct clock — synchronised at boot, with your timezone
• 🚦 Health entities — Health and Health Detail in Home Assistant say what is wrong

Updates install over the air from Home Assistant, and the VDS address survives them (verified — the module was updated with its pairing intact), so you do not need to visit the installation to update it.

Installing and running

• Getting Started — stock device to custom firmware
• Serial TTL — wiring and bootloader access
• Recovery — when things go wrong
• Firmware Updates — over the air and from a terminal
• Runtime configuration — every setting, SIP, MQTT, metrics

Home Assistant

• Two-way audio — see, talk, open, from anywhere

The Fermax side

• The VDS bus, explained — addresses, pairing, auto switch-on
• Sharing the bus — living with the original monitor
• UART codes — the frame reference

Inside

• Architecture — boot and runtime layout
• Hardware reference — flash layout, serial devices
• D1 video capture — low-level capture notes
• Hardware resilience — watchdogs and recovery
• About this fork — what is added on top of upstream, and why

Contributing

• Development — building and releasing
• Security — RTSP, SSH and MQTT hardening

Raw reverse-engineering notes live in research/. You do not need them to install anything.

Only if you are changing the firmware.

make docker     # build the toolchain image
make build      # build the firmware
make verify     # check the result

Handy during development:

make build-media       # rebuild just the daemon and the updater
make deploy-runtime    # push the daemon to a running WiBox (volatile — lost on reboot)
make verify-device     # check runtime + MQTT against a live device
make device-status     # status and recent logs

⚠️ make deploy-runtime is for testing only. It does not survive a reboot — install a real release if you want the change to stick.

Details in Development and About this fork.