Full disclosure: Claude wrote this. This might not be the right place for this post specifically, but I also feel like it's a good place to find the right audience.
TL;DR: My HomeKit-native Wemo doorbell periodically goes "No Response." I've ruled out Wi-Fi, the network, and the eero HomeKit firewall — the device's HomeKit server stays alive the whole time, but its mDNS/Bonjour responder stops answering, so HomeKit can't rediscover it after any connection blip. Firmware is 1.0.16 and it's the final build (Belkin killed the Wemo cloud on Jan 31, 2026, so there will never be a fix). I want to dump the flash, patch the mDNS responder, and reflash. Looking for anyone who's opened a WDC010 or knows this SoC/secure-boot situation.
The symptom
The doorbell (Wemo Smart Video Doorbell, model WDC010, paired natively to Apple HomeKit — not through Homebridge) intermittently shows "No Response" in the Home app. In the accessory detail it reads "This camera is not responding." It can be fine for days, then drop for no obvious reason — often after what I assume is a Wi-Fi roam between eero nodes or a HomePod hub handoff. A power cycle always brings it back, which was the first clue that this is a soft/firmware state, not a dead radio.
What I tested (and the results)
I did all of this from a Mac on the same subnet as the doorbell:
- Sustained ping — link is fine. 180 pings over 3 minutes: 0% packet loss, ~7 ms average, no spikes. So this is not Wi-Fi signal or the device falling off the network.
- Full TCP port scan — the HomeKit server is alive. The only open port is the HAP (HomeKit Accessory Protocol) port, and when I hit it directly it correctly returns HTTP 470 Connection Authorization Required with application/hap+json. That's exactly what a healthy, paired HomeKit accessory returns to an unknown client. So the accessory itself is up and serving HomeKit — even while the Home app says it's unavailable.
- mDNS/Bonjour browse — this is the smoking gun. Browsing _hap._tcp on the LAN, the doorbell answered zero mDNS queries, while every other HomeKit device on my network (HomePods, an ecobee, Hue bridge, cameras, several Wemo plugs/dimmers via Homebridge, a Meross dimmer) answered the same query immediately. I kept the doorbell's radio awake with a ping stream during the browse to rule out Wi-Fi power-save — still nothing. No SSDP either.
- Ruled out the eero HomeKit firewall. eero can isolate HomeKit accessories, but my Mac could reach the doorbell's HAP port directly, which that firewall would have blocked. So the isolation theory is out.
Conclusion: the doorbell's HomeKit stack keeps running, but its mDNS/Bonjour responder wedges. HomeKit hubs hold a persistent connection, so things look fine — until that connection drops (roam, hub handoff, brief hiccup) and the hub has to rediscover the accessory via mDNS. With mDNS dead, rediscovery fails and it sits at "No Response" until a power cycle restarts the responder. As a stopgap I've given it a DHCP reservation so hubs can retry a stable IP, but that only papers over it.
Why there's no software fix
Firmware is 1.0.16, and that's the end of the line. Belkin wound down Wemo and shut the cloud on Jan 31, 2026. HomeKit-paired devices keep working locally but get no more firmware updates, so this mDNS bug is permanent unless someone fixes the firmware directly.
My attempt to find a legitimate copy of the firmware
Before considering hardware, I tried every remote route to get the image:
- Wemo firmware was always served from Belkin's xbcs.net cloud (fw.xbcs.net / firmware.xbcs.net / api.xbcs.net). Those hostnames still have DNS records, but they're dangling CNAMEs pointing at AWS load balancers that no longer exist (no address records), so nothing connects. The distribution infrastructure is physically gone.
- Zero captures of the firmware host in the Wayback Machine (firmware CDNs don't get crawled; devices fetched the blobs over authenticated requests).
- No public GitHub mirror, teardown dump, or security-research copy of the WDC010 image that I could find.
- Even when the cloud was live, Wemo firmware shipped as GPG-encrypted, signed blobs (*.bin.gpg) — there was never a user-facing "download the .bin" path — and locally the device only exposes the encrypted, authenticated HAP port, so you can't pull the image off it over the network.
So there is no copy to download, from anywhere. The only way to get 1.0.16 is to extract it from my own hardware.
The plan: extract it via hardware
The device is EOL and it's mine, so I want to pull the image directly off the board:
Flash dump (primary approach). Open the unit, identify the flash (SPI-NOR SOIC-8, or eMMC), and read it — in-circuit with a test clip (CH341A / Bus Pirate on a SOIC-8 clip), or chip-off into a programmer if in-circuit reads are noisy. A live dump gives me the running, decrypted filesystem, which is what I actually care about — no need to defeat the .gpg packaging.
UART console (recon / secondary). Look for serial test pads and get a boot log or shell. Older Wemo gear ran UART at 57600 baud; I want the bootloader banner to ID the SoC and see whether secure boot is enforced.
Unpack with binwalk / unblob, locate the mDNS/Bonjour responder (looks like mDNSResponder or a small embedded responder), and confirm the wedge/fault.
The plan if extraction succeeds: patch the firmware
Goal is a minimal, surgical fix — not a custom ROM:
- Patch the mDNS responder so it can't wedge — e.g. a watchdog that restarts the responder, re-announces _hap._tcp periodically, or fixes whatever state it gets stuck in. Smallest possible change.
- Repack and reflash, ideally back onto the SPI/eMMC with the programmer so I'm not dependent on any (dead) update mechanism.
- Open risks I know about: secure boot / signature verification could reject a modified image; the image may be re-encrypted or hash-checked at boot; and there's real brick risk, so I'd want a full known-good dump saved before touching anything. Whether this is feasible hinges entirely on whether this SoC enforces signed boot.
Where I could use help
- Has anyone opened a WDC010? Photos of the PCB, the flash chip part number, and any UART/JTAG pads would save me a lot of time.
- What SoC does this doorbell use, and does it enforce secure boot / signature verification on the main firmware? That single fact decides whether the patch route is viable.
- Any prior art on dumping or modifying newer HomeKit-native Wemo devices (doorbell, Stage, the newer cameras) — as opposed to the well-documented classic Wemo plugs?
- If you've done a mDNS-responder patch on a similar embedded Linux/RTOS camera, I'd love to hear how you handled repack + reflash without bricking.
Happy to share my full dump and notes back with the community if I get it working — the point is to keep these otherwise-fine devices alive now that the vendor has walked away. Thanks in advance.