-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 "Rescuing a UniFi Cloud Key Gen2 Plus" by Colin Cogle Published Monday, October 17, 2022. ABSTRACT A non-working eBay item gets saved from the scrap heap, and I get a cheap upgrade. NOTE This article contains plenty of images to assist with disassembly. You may choose to view it on the Web, at https://colincogle.name/uck. INTRODUCTION When I found a non-working UniFi Cloud Key Gen2 Plus on eBay for 99 cents, I decided, "why not?" (This was before I heard that UniFi Network App 7.3 will drop support for the now-vintage first-generation Cloud Key.) The Cloud Key Gen2 would be sitting inside a closet, so I wasn't too concerned that this thing had been physically damaged, cracked and dented, and sold with- out the internal hard drive. Fortunately, it arrived and looked better than I expected. DISASSEMBLY To start, remove the back plastic. It's glued on, so use a spudger or guitar pick to break the adhesive. Once you've gotten that off, there are seven Phil- lips-head screws underneath to remove. To continue disassembly, we will need to remove the hard drive and the latch itself. Slide the latch over to remove the hard drive and the tray. Then, use the end of a flat-head screwdriver or metal spudger, gently press on one of the tabs to pop it loose. Hold the metal slider in position, then carefully remove the plastic tab. Now, we need to remove two screws underneath the screen. The screen is held on by adhesive, like everything else these days. Use a spudger or plastic opening tool to carefully pry it up. Note that there is an unremovable ribbon cable on the bottom edge. Take care not to sever it. (Ubiquiti does not sell spare parts. I've tried.) Next, the 13-pin connector for the Cloud Key Gen2 Rack Mount Accessory needs to be removed. There are four latches on the underside to make sure that it sits flush. This also means that removing it is next to impossible. You can try to carefully pry it up, but I had luck pushing it up from underneath. If you try that, be sure to push up on the plastic, and not on the wires themselves! Once you have all four tabs disengaged, unplug the connector. Be sure to mark it, or remember which way it goes so you can reassemble it later. Finally, the entire plastic unit can be slid out of the aluminum housing. Nor- mally, this will not be a problem. However, these batteries do seem to be de- fective, because they tend to swell up and fail, so I hear -- and now, so I see firsthand. If your battery is bad, let's grab a plastic, non-conductive tool and gently break the adhesive holding it to the plastic tray. *** Warning: Piercing a battery can cause an electric shock or start a *** fire, causing injury or death. Be careful! Ubiquiti does not sell replacement batteries, instead asking you to spend $200 on a new Cloud Key. They also refused to issue an RMA for this spicy pillow, so into the e-waste bin this little fire hazard goes. Ubiquiti gave up on trying to fix the problem, instead removing the battery entirely from the latest revi- sion of the Cloud Key Gen2 Plus. (UI-Glenn) The Cloud Key is now fully disassembled. If you were reading this to remove the battery, congratulations! You're done. Reverse these steps to put this back together (hopefully with a working battery). UNFLASHABLE FIRMWARE? In my case, this Cloud Key wouldn't boot. I booted it up in recovery mode and attempted to re-flash the firmware, but it refused to accept any firmware image; it refused to accept an image of the same version, 2.0.27, but it also refused to accept newer and older versions, too. Since I already had this thing apart, I hooked up my 3.3V TTL serial adapter to the three-pin header located at port J22. After getting the pinout right, I was greeted with a serial console! Please press Enter to activate this console. Boottime: 4.52s cloudkey-apq8053 login: ubnt Password: Login incorrect cloudkey-apq8053 login: root Password: .--.__ ______ __ .--( ) )-. __ __ | | (._____.__.___)_| | |__ _____ __ __ | ---| || _ | | | _ | <| -__| | | |______|__||_____|_____|_____|__|__|_____|___ | (c) 2018 Ubiquiti Networks, Inc. |_____| Welcome to the CloudKey Recovery! Fortunately, the default usernames (ubnt or root) and password (ubnt) are well- known. Once I logged in, I began to browse the recovery filesystem. I checked the boot messages and `dmesg` output, but found nothing of interest. However, I found an app in the filesystem called `ubnt-tool`, which has a mode called `fwupdate`. I figured it'd be worth a shot. I grabbed the URL of the latest firmware blob, downloaded it to the device, and installed it. cloudkey-apq8053# cd /tmp cloudkey-apq8053# wget https://fw-download.ubnt.com/data/unifi-cloudkey/6fac-UCKP-2.5.11-c5a57cf5d5344114a762782ab4d3a940.bin cloudkey-apq8053# ubnt-tool fwupdate 6fac-UCKP-2.5.11-c5a57cf5d5344114a762782ab4d3a940.bin There were a lot of unchanged blocks for being so many years behind on firmware updates, but one reboot later, my Cloud Key was back up and running! WORKS CITED Cogle, Colin. "UniFi Cloud Key Gen2 Plus boot messages, v2.0.27." 11 October 2022. https://colincogle.name/blog/unifi-cloud-key-rescue/UCK-G2-PLUS%20boot%20messages%20v2.0.27.txt Ubiquiti Networks. "UniFi - Login with SSH (Advanced)." Ubiquiti Support and Help Center, date unknown, https://help.ui.com/hc/en-us/articles/204909374-UniFi-Login-with-SSH-Advanced-. Accessed 15 October 2022. Ubiquiti Networks. "UniFi Network Application 7.3.69." Ubiquiti Community, 8 September 2022, https://community.ui.com/releases/UniFi-Network-Application-7-3-69/d801e00a-8d7d-4e52-b6db-d4d8d87835fb. Accessed 17 October 2022. UI-Glenn. "Could Key Gen 2+ Battery DOA." Ubiquiti Community, 28 August 2022, https://community.ui.com/questions/Could-Key-Gen-2-Battery-DOA/7ccd440a-761f-40c4-8aea-1275f235639c#answer/8cbd5ae6-dca8-4235-8a09-84b78874f40d. Accessed 17 October 2022. ========================================================================= "Rescuing a UniFi Cloud Key Gen2 Plus" by Colin Cogle is licensed under Creative Commons Attribution-ShareAlike 4.0 International CC-BY-SA. You can find this article on the web at: https://colincogle.name/uck ========================================================================= -----BEGIN PGP SIGNATURE----- iHUEARYIAB0WIQQ7NZ6ap/Bjr/sGU4FSrfh98PoTfwUCY030kwAKCRBSrfh98PoT f24HAQCiRAQuSan+nVtsoKv99a7JwBg+YDmlZS3Ie0pFsznycAD/aE+Qrgj4HYJL 6KZBC77snAANO4uR81ju1q68wtrvJAk= =Y1hr -----END PGP SIGNATURE-----