And I just updated the firmware without checking in here 😞

from atc_mithermometer.

Hi, I just made the same mistake as everyone here. I bought two of these sensors and was planning to flash them and use them with a BLE Tracker on my Home Assistant. However, curious to see how it works originally I did the firmware upgrade when added to mihome app.... stupid curious...

So, after sharing my disgrace...

How hard is to get one of this USB-COM board and use it to downgrade? any link from Aliexpress? I get little confused about which board is compatible, which link should be used to do the downgrade, how is the right way to wiring... Please, can anyone share where to buy this USB-COM and a step-by-step how to downgrade the firmware ?

Hi. Downgraded using this ch340 usb to ttl rs232 converter:
https://www.aliexpress.com/item/32354359382.html?gatewayAdapt=glo2isr
Solder p14 on thermometer to txd
Solder Gnd to gnd
Solder + to 3.3V
Flash using:
https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html

from atc_mithermometer.

A hint may occur when a new version is released. When it will be possible to upgrade version 2.1.1_0159 in Mi Home to the next one.

from atc_mithermometer.

I haven't clarified the whole process yet.
There is an assumption that the OTA firmware is signed with an additional key.
The "OTA" procedure itself always works, but at the end the "OTA" code itself may not be included. Previously, for some variants of thermometers, the signature was the correct "CRC" of the OTA code.

It is quite possible that because of these "security worries" Xiaomi has changed the activation and "OTA":
https://francozappa.github.io/publication/2023/espoofer/

PS: I can't clarify because I adhere to the "user agreement" in "MiHome". It is forbidden to view their code and other manipulations with it. And no one wants to publish the binary file of the new official firmware for public access :)

from atc_mithermometer.

I'm not that familiar with soldering

@vdende No soldering necessary. I connected it like this.
I held P14 with my hand.

from atc_mithermometer.

Cp2102 usb-ttl is ok for this?

Works very well. I made a "drill a hole" edition. ;-)

from atc_mithermometer.

Are you saying that I am enough like this?

Yes

from atc_mithermometer.

Hi! Any news on LYWSD03MMC with firmware version: 2.1.1_0159?

We are waiting for the popularity of Xiaomi LYWSD03MMC to fall, sales and prices to fall. :)
Until Xiaomi deigns to provide an open OTA.

Siemens' mobile once staged a similar encryption race in an attempt to ban custom modifications. This is where the popularity of unlockable models ended. The result is known - Siemens no longer produces phones. :P
And there are many such examples over the past 40 years.
They tried to do the opposite effect in Espressif, but they could not do it properly... Although their takeoff was ensured by proactive users.

There will always be a smarter competitor.
Tuya already offers descriptions, keys and other information to all registered users.

from atc_mithermometer.

Not closed, but changed the "activation". + Changed the "advertising interval" to 2100 ms
"Login", works with known keys. OTA also works.
Set "Mi Token", "Mi Bind Key" and press "Login":

A piece of the activation log (sniffer + MiHome):
"Sent Read Request, Handle: 0x00xx" abbreviated as "Send enc_XX".
"Rcvd Read Response, Handle: 0x00xx" abbreviated as "Rcvd enc_XX".

// > Checking for transmission with MTU size
Send enc_10: a4 // Test MTU
Rcvd enc_19: 000004000612 // ?
Send enc_19: 000005000612
Rcvd enc_19: 0000040112121212121212121212121212121212
Send enc_19: 0000050112121212121212121212121212121212
// > Get Device id
Send enc_10: a2000000 // SYS_DEV_INFO_GET
Rcvd enc_19: 000000000200 // ?, 2 blks
Send enc_19: 00000101
Rcvd enc_19: 01000200000000626c742e362e316667336a736f
Rcvd enc_19: 0200726f73673030
Send enc_19: 00000100 // ACK
// ????
Send enc_10: 15000000 // REG_START_WO_PKI
Send enc_19: 000000030400 // ECC_PUBKEY?, 4 blks
Rcvd enc_19: 00000101
Send enc_19: 01003b412a2b060a1d7da21033ff4e584bf4f8f3
Send enc_19: 02001a9dee5c4dc95e198c4bc3be5953d6babfdb
Send enc_19: 0300415a9eda4e42ac53e864d1ebd6c9b4616ce5
Send enc_19: 04004c9f1e094e30fc77ce51 // 18*3+10=64 bytes
Rcvd enc_19: 00000100 // ACK
Rcvd enc_19: 000000030400 // ECC_PUBKEY?, 4 blks
Send enc_19: 00000101
Rcvd enc_19: 010025c4faa9e119108b3133915e663ee3d4d0fb
Rcvd enc_19: 02009ada216d9d91928725dea0bb88f44639f8a1
Rcvd enc_19: 0300bb69a33f849bdbb0c2be2b8910271244c5dd
Rcvd enc_19: 04006bc5edefc593dc2d8557 // 18*3+10=64 bytes
Send enc_19: 00000100 // ACK

Send enc_10: 13000000 // REG_VERIFY_SUCC
Send enc_19: 000000000600   // DEV_SHARE_INFO?, 6 blks
Rcvd enc_19: 00000101
Send enc_19: 01001904e3c44b8ab77b3e2f9b7371b4606d9a8a
Send enc_19: 0200e7c71cc8bc712b7d080af2153d8638b7701e
Send enc_19: 0300ab70d36fceb296c3f8805d4073216e542f93
Send enc_19: 0400523da93c45061966487db32dd32936159b3e
Send enc_19: 05006739aa0281d368eac3205bc87d419ebc838e
Send enc_19: 06007457 // 18*5+2=92 bytes
Rcvd enc_19: 00000100 // ACK

Send enc_19: 000000071600 // SERVER_CERT?, 22 blks 
Rcvd enc_19: 00000101
// send certificate: https://github.com/Ai-Thinker-Open/Telink_SIG_Mesh/blob/master/example/AT_Ali_Mesh/mesh/mi_api/certi/cryptography/mi_crypto.c#L46
Send enc_19: 0100308201773082011ea003020102020101300a
Send enc_19: 020006082a8648ce3d0403023022311330110603
Send enc_19: 030055040a130a4d696a696120526f6f74310b30
Send enc_19: 04000906035504061302434e3020170d31363131
Send enc_19: 050032333038323032355a180f32303636313131 
Send enc_19: 0600313038323032355a30233114301206035504
Send enc_19: 07000a0c0b4d696a696120436c6f7564310b3009
Send enc_19: 080006035504061302434e3059301306072a8648
Send enc_19: 0900ce3d020106082a8648ce3d03010703420004
Send enc_19: 0a00a752ecd44b6b3b17abc34f8300c6320f2e4c
Send enc_19: 0b00bec57a51034b5ecadf7347d745df8c3dbcfa
Send enc_19: 0c00aedb67b04cace5aff798182e43c5a444b627
Send enc_19: 0d00c2d7f361629d3f914802a3423040301f0603
Send enc_19: 0e00551d2304183016801496b7a27c39b1b96633
Send enc_19: 0f00a9f8d109b20060c8e6c511301d0603551d0e
Send enc_19: 1000041604145a29bffb2fb7500ce9c420f23d89
Send enc_19: 11009b6fe0803293300a06082a8648ce3d040302
Send enc_19: 1200034700304402205eb096d630f92f092ae39d
Send enc_19: 13001356f836c529697a355d765f4eccce785b89
Send enc_19: 14009a6d1602207e206b22aa04e6dee818c7d4c4
Send enc_19: 150080e5fabd99074bdecf45346e37f1cffd8646
Send enc_19: 160090 // 18*22+1=397 bytes
Rcvd enc_19: 00000100 // ACK
Rcvd enc_10: 11000000 // REG_SUCCESS

from atc_mithermometer.

To go back to the old version (Original_OTA_Xiaomi_LYWSD03MMC_v1.0.0_0130.bin );
To do this, you must remove your temperature sensor and connect it with the cables by following the steps below.
This is how I solved my problem.
I'm sorry for my bad english.

1. https://github.com/pvvx/ATC_MiThermometer/blob/master/Original_OTA_Xiaomi_LYWSD03MMC_v1.0.0_0130.bin download
2. https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html
3. 
4. 
5. File select Original_OTA_Xiaomi_LYWSD03MMC_v1.0.0_0130.bin
6. Write to flash

from atc_mithermometer.

The very name of the utility describes: TLSR825x USB-COM Flash Writer v0.4 (TX-SWS only!) :)

The picture is from another version of the programmer - https://github.com/pvvx/TlsrComProg825x - does not work on FTDI chips!

Are you saying that I am enough like this?

from atc_mithermometer.

Who knows what can be issue under Mac?

None of the developers of alternative firmware work on Mac.

from atc_mithermometer.

Dear Friend,

how did you do that? In my case the activation progress won't complete...

This method how to perform the OTA with 2.1.1_0159. A) Connect the device https://atc1441.github.io/TelinkFlasher.html B) Activate it C) Load the ATC 4.7 firmware D) Connect and modify settings https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html

Tested on two units HW 1.4 and FW 2.1.1._0159 successfully

Xiaomi LYWSD03MMC with firmware 2.x.x simply will not update to any OTA version.
At the moment, firmware update version 2.x.x is only available via USB-UART.
You can flash any version via USB-UART.

from atc_mithermometer.

Why didn't this method work?

https://github.com/pvvx/TlsrComSwireWriter - does not work on FTDI chips! (Only Chinese USB-COM chips)

On FTDI chips, reception is performed by checking bitwise synchronization with the removal of bad characters from the buffer with error generation, which does not allow emulating "Telink Swire".

https://github.com/pvvx/TlsrComProg825x - this programmer uses a loader that switches to work with the RX and TX chip UART pins.
It takes a lot of wires...

https://github.com/pvvx/ATC_MiThermometer#the-usb-com-adapter-writes-the-firmware-in-explorer-web-version

from atc_mithermometer.

I have also never installed MiHome (or anything else from Xiaomi), and so am not subject to any of their terms and conditions. I assume @atc1441 will provide the information that is needed far more effectively than I can, but if not give me a nudge.

from atc_mithermometer.

@rmappleby yes, the SoC can always be flashed via wires

from atc_mithermometer.

Requires chip restart/reset during "activation".
For any programmer. For Telink BDT it’s the same, but even more difficult.
How you provide it is your task.
By turning off the power, turning off all extraneous sources, or by shorting the RST pin of the TLSR825x chip itself to GND.

The chip should start while sending the “Activation” code.

In other cases, the chip can be in sleep mode and powered from any source (including all its pins) with currents of 1 µA. And in “sleep” mode, the chip has all interfaces disabled and does not perceive anything.

In addition, if you have recorded something unknown, then the SWS chip output can be disabled in this program.
But will always be connected for a short time after restarting/resetting the chip.

from atc_mithermometer.

Thank you all very much! I successfully downgraded the firmware without soldering! I ordered a cheap USB-TTL converter.
I used left hand to hold steadily VCC and TX pin (near P14/P10 hole on the PCB), it took me a minute practice to stabilise it. Then I set the flash timer to have 8 seconds delay, I clicked flash and then within 8 seconds I grabbed my right hand and holded GND pin :-D
After 42 seconds holding hands steadily I was able to finish flashing successfully. No soldering needed guys!
I think even if you screw the flashing you can start over and reflash from a broken software, but someone would need to confirm it :)

from atc_mithermometer.

After flashing The Xiaomi with OTA, the display does not show and the thermometer does not announce itself even after shorting pins. Does it mean that the XIaomu is bricked?

Can I use any USB-TTL adapter to flash the device?

from atc_mithermometer.

@gjesch - Download the files correctly:
ATC_v38.bin - there is no such file.
ATC_v46.bin - 82612 bytes
CGDK2_v46.bin - 82708 bytes
Original_OTA_Xiaomi_LYWSD03MMC_v1.0.0_0130.bin - 92868 bytes

To flash Xiaomi LYWSD03MMC in BLE, in the file selection menu, paste the line:

https://github.com/pvvx/ATC_MiThermometer/raw/master/ATC_v46.bin

from atc_mithermometer.

Привет!
Есть новости по LYWSD03MMC с версией прошивки: 2.1.1_0159?

from atc_mithermometer.

Use FTL232 flasher it works... I have a blank display ...after buy an ftl232 red flasher , i solder pin16,ground,v+ and reset ... And go on windows pc and tadaaaa downgrade sucessfull....

from atc_mithermometer.

I have buy it from german ebay... Ch340G dosnt work....

from atc_mithermometer.

Please correct me if I'm wrong :
To sum up, to install Custom firmware on LYWSD03MMC

• if one receives a Xiaomi LYWSD03MMC in firmware 2.X.X one has to dowgrade it to 1.X found one @pvvx's Github using serial.
  Only after downgraded to 1.X one is able to send custom firmware OTA.

from atc_mithermometer.

Xiaomi LYWSD03MMC with firmware 2.x.x simply will not update to any OTA version.

At the moment, firmware update version 2.x.x is only available via USB-UART.

You can flash any version via USB-UART.

from atc_mithermometer.

@Macsim51 You can use any usb-uart dongle. For the image above there is a usb-ttl converter (square one). Potentially, you can short EN-GND to disable the chip and use tx0/rx0 as UART pins. This approach works for arduino boards and could work for your board.

from atc_mithermometer.

Guys, just successfully downgraded using ch340g (no jumper, or resistor. just 2 wires).
Connected

• gnd to gnd
• tx to P14
• with battery inserted.
  
  
  

UPD
works with v1.4
tried v1.5 - failed

UPD 2
nope, flashed rev 1.5 the same way
tried to flash with OTA 1.0.0_0130 straightaway. But worked the same way, after first try - blank screen, after second - flashed ok

Step-by-step

1. Connect gnd under battery, tx to p14 and insert battery
2. Choose 460800 and Atime: 3sec
3. Flash OTA 1.0.0_0130
4. DO NOT MOVE :) DO NOT DISCONNECT ANYTHING!
5. Change baud to 115200
6. Flash the same firmware again
7. Now your device is dead
8. Disconnect everything (ch340g too)
9. Update page
10. Connect everything the same way
11. Choose 460800 and Atime: 3sec
12. Flash OTA 1.0.0_0130
13. ...
14. PROFIT

from atc_mithermometer.

do your "Step-by-step" work for rev 1.5 ?

Guys, just successfully downgraded using ch340g (no jumper, or resistor. just 2 wires). Connected

* gnd to gnd

* tx to P14

* with battery inserted.
  ![image](https://private-user-images.githubusercontent.com/60361408/319551166-7180b4ba-4498-4d20-9e96-727306fef7b0.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTI1OTkxMDYsIm5iZiI6MTcxMjU5ODgwNiwicGF0aCI6Ii82MDM2MTQwOC8zMTk1NTExNjYtNzE4MGI0YmEtNDQ5OC00ZDIwLTllOTYtNzI3MzA2ZmVmN2IwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA0MDglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNDA4VDE3NTMyNlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWFkYWY4ODRkYzE5YmM2MjBmYzNiY2MxM2E2MWYwMmU5ODg1ZmVlOTMyZTc3ZWJhN2M5YTc4NWU4MWI2ZDQyZTAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.il3nMfTJHI3U6_3oMnQvtJi0CI8vQQg5nASMS5muvxI)
  ![image](https://private-user-images.githubusercontent.com/60361408/319550527-f57c381b-d2e1-498a-9ae6-e715a90e329f.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTI1OTkxMDYsIm5iZiI6MTcxMjU5ODgwNiwicGF0aCI6Ii82MDM2MTQwOC8zMTk1NTA1MjctZjU3YzM4MWItZDJlMS00OThhLTlhZTYtZTcxNWE5MGUzMjlmLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA0MDglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNDA4VDE3NTMyNlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWFmYzgwYWRiN2NmZGNkOGM2NmI2NTY4MzU4ZmZlMjNlY2ZiYWMxOGRkN2Q1Yjk3MGJiNjkwMzFiNTQ3NThhMjYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.x0rh1iBo7yOa8HGiU03E3SU0IuY1mXNbAsfA4fQw7mY)
  ![image](https://private-user-images.githubusercontent.com/60361408/319550282-18cea4f3-c728-404d-a580-a68567a2f959.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTI1OTkxMDYsIm5iZiI6MTcxMjU5ODgwNiwicGF0aCI6Ii82MDM2MTQwOC8zMTk1NTAyODItMThjZWE0ZjMtYzcyOC00MDRkLWE1ODAtYTY4NTY3YTJmOTU5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA0MDglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNDA4VDE3NTMyNlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWM5YTYwYzM1YTdiOWY4YTk3ZDZlYzE5YTg4Mzc1YjZhMWIwZTc4MTdlZTg2NWYyOTZkZjI2ODdmOGJhMzNiZTImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.D0DeVlFGcy97eA7MgRLN3Dz4EHk7FYkOfJylaXKex78)

UPD works with v1.4 tried v1.5 - failed

UPD 2 nope, flashed rev 1.5 the same way tried to flash with OTA 1.0.0_0130 straightaway. But worked the same way, after first try - blank screen, after second - flashed ok

Step-by-step

1. Connect gnd under battery, tx to p14 and insert battery

2. Choose 460800 and Atime: 3sec

3. Flash OTA 1.0.0_0130

4. DO NOT MOVE :) DO NOT DISCONNECT ANYTHING!

5. Change baud to 115200

6. Flash the same firmware again

7. Now your device is dead

8. Disconnect everything (ch340g too)

9. Update page

10. Connect everything the same way

11. Choose 460800 and Atime: 3sec

12. Flash OTA 1.0.0_0130

13. ...

14. PROFIT

from atc_mithermometer.

Thank you for the hint.
That really reads like they closed it

from atc_mithermometer.

Thanks Victor,
So the activation part is not cracked right now, and you need to currently get the set key first from the app etc. to OTA ?

I would expect them to sign the activation on the server side with an unknown private key but lets hope not

from atc_mithermometer.

Can i downgrade via Uart? With correct key/token cannot downgrade or change fw. Even if login is correct and OTA seems to work, it doesn't .

from atc_mithermometer.

is this going to get fixed please? thank you

from atc_mithermometer.

I've made the same mistake by updating to the latest firmware. Hope this will be fixed soon.
Thanks guys for all the hard work!

from atc_mithermometer.

So for those of us who updated to the latest firmware, is there any way to downgrade when the flasher does not connect due to being on unsupported firmware? Catch 22 situation!

from atc_mithermometer.

I also can't flat on 2.1.1_0159 version, let me know please it if possible or not. Thanks!

from atc_mithermometer.

At the moment, you can only write another firmware using a hardware programmer.

from atc_mithermometer.

At the moment, you can only write another firmware using a hardware programmer.

How would I go about doing that?

from atc_mithermometer.

damn, got it with the new firmware so cant install the custom also :(
Is there a hope to get the upgrade soon ?

from atc_mithermometer.

@VonalOrdu

1. The contact on the PCB marked as "reset" is not an RST signal for the TLSR825x SoC !
2. https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html - does not use RX pin, resistor and connection RX is not needed !

from atc_mithermometer.

@VonalOrdu

1. The contact on the PCB marked as "reset" is not an RST signal for the TLSR825x SoC !
2. https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html - does not use RX pin, resistor and connection RX is not needed !

I have no idea about this.
I succeeded by doing this.
Maybe it will happen if you do as you say.
I used the suggestion below.

https://github.com/atc1441/ATC_MiThermometer/blob/master/Mi_SWS_Connection.jpg

from atc_mithermometer.

The very name of the utility describes: TLSR825x USB-COM Flash Writer v0.4 (TX-SWS only!) :)

The picture is from another version of the programmer - https://github.com/pvvx/TlsrComSwireWriter - does not work on FTDI chips!

Comment edited: Fixed a link error.

from atc_mithermometer.

Are you saying that I am enough like this?

Yes

python.exe TLSR825xComFlasher.py -p COM3 -t 70 wf 0 Original_full_flash_Xiaomi_LYWSD03MMC.bin

Why didn't this method work?
"Chip sleep? -> Use reset chip (RTS-RST): see option --tact"
It was giving error.

https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html

This method worked. Thank you very much for your sharing.

from atc_mithermometer.

Hi,
I just made the same mistake as everyone here.
I bought two of these sensors and was planning to flash them and use them with a BLE Tracker on my Home Assistant.
However, curious to see how it works originally I did the firmware upgrade when added to mihome app.... stupid curious...

So, after sharing my disgrace...

How hard is to get one of this USB-COM board and use it to downgrade? any link from Aliexpress?
I get little confused about which board is compatible, which link should be used to do the downgrade, how is the right way to wiring...
Please, can anyone share where to buy this USB-COM and a step-by-step how to downgrade the firmware ?

from atc_mithermometer.

Maybe I can't differently, but flash by site only works on Windows "machine". On MacBook I bricked by flash. On Windows "machine" I recovery firmware without problems :)

from atc_mithermometer.

Hi. Downgraded using this ch340 usb to ttl rs232 converter: https://www.aliexpress.com/item/32354359382.html?gatewayAdapt=glo2isr Solder p14 on thermometer to txd Solder Gnd to gnd Solder + to 3.3V Flash using: https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html

Hi Guys,
Just giving an feedback, I just flashed and downgraded my sensor successfully!!!

However I didn't used the board referenced by @tharzo, I got with a Friend the FTDI 232 and followed the steps passed by tarzho.

I did the downgrade of my firmware from v2 to v1 and then flashed it with the custom firmware v4.5 successfully!!
Very , very happy :)
Thanks all for the support.
Now , let's try to setup it on my Home Assistant using a ESP32 as BLE Tracker...

from atc_mithermometer.

I'm not that familiar with soldering and boards, so I decided to buy a new one from Ali, from the same shop as my previous one. It was shipped very fast and fortunately the firmware version of the new device was still on v1.0.
So for this one I was able to flash it with the custom v4.5, set it to BTHome and configured it in HomeAssistant.

from atc_mithermometer.

Is there any expected date when soft 2.1.1 will be supported by Telink Mi Flasher? I was not able to downgrade by Serial

from atc_mithermometer.

So far no one is doing this or it is unknown.
I'm waiting for the next version to come out.
This will make it possible to understand how to update version 2.1.1.

Disassembling or otherwise viewing codes from Xiaomi is prohibited in the MiHome user agreement. For this reason, other methods that are not prohibited will be used. And this requires the next new version of OTA from MiHome.

from atc_mithermometer.

While i dont know 100% i am veeery sure they added a signing to the update which can not be bypassed without any exploit

So ota is unlikely.

Just my assumption

from atc_mithermometer.

While i dont know 100% i am veeery sure they added a signing to the update which can not be bypassed without any exploit

They could also add key reading to their cloud for a registered user.
Tuya BLE has had all this for a long time, but no one is interested...

from atc_mithermometer.

Disassembling or otherwise viewing codes from Xiaomi is prohibited in the MiHome user agreement. For this reason, other methods that are not prohibited will be used. And this requires the next new version of OTA from MiHome.

I did never agree to anything like that so no problem with disassambly ^^

from atc_mithermometer.

Using information from open sources is not prohibited... -> Need a publication :)

from atc_mithermometer.

it looks they are now using signed ota. same protection been there since 2020 for some wifi devices (robots, cams, hubs), but first time i see it for ble.

https://pastebin.com/raw/5AR7JNVp

from atc_mithermometer.

Yep thats a singed OTA :(

from atc_mithermometer.

But there's still nothing to stop us flashing your custom firmware using wires and an FTDI converter, I assume?

from atc_mithermometer.

Original_OTA_SJWS01LM_1.1.1_0018.bin
-----BEGIN CERTIFICATE-----
MIIBhTCCASugAwIBAgIBAjAKBggqhkjOPQQDAjAiMRMwEQYDVQQKEwpNaWppYSBS
b290MQswCQYDVQQGEwJDTjAgFw0xODAxMTgwMjE5MTVaGA8yMDY4MDEwNjAyMTkx
NVowIjETMBEGA1UECgwKTWlqaWEgT3BlbjELMAkGA1UEBhMCQ04wWTATBgcqhkjO
PQIBBggqhkjOPQMBBwNCAASTPDXoepwRzEV0nVioPiILRzjKTNZo1dUSzutyn8op
V4NaQDmCwtdvGGz/UzWEqEdlgVuncnG8S8de1mVxZhzIo1AwTjAfBgNVHSMEGDAW
gBSWt6J8ObG5ZjOp+NEJsgBgyObFETAdBgNVHQ4EFgQU6ik3eeFQQohlpo7V0Ehr
wLBT+GUwDAYDVR0TBAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiEAnQyFwFhYV/Zm
n5OY0H4FG7qVarqVUMrXiNCg/cIif+ACIEW1J06zPTYNLe9SqIIaFiCBMTtvPUvM
JJHkc890sLAY
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIBlzCCAT2gAwIBAgIGAXRoWA0NMAoGCCqGSM49BAMCMCIxEzARBgNVBAoMCk1p
amlhIE9wZW4xCzAJBgNVBAYTAkNOMCAXDTIwMDkwNzExMzM1NVoYDzIxMjAwODE0
MTEzMzU1WjAcMQswCQYDVQQGEwJDTjENMAsGA1UEChMEY2VydDBZMBMGByqGSM49
AgEGCCqGSM49AwEHA0IABF1W2an4g7STG3WAPEo5GyADHqIG+78VehOcVKnj/My3
krQf6jJ6tpE9krOvI5djAi18rGbfLK5xmLRB3p6ybM6jYzBhMA4GA1UdDwEB/wQE
AwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQY
MBaAFOopN3nhUEKIZaaO1dBIa8CwU/hlMAsGA1UdEQQEMAKCADAKBggqhkjOPQQD
AgNIADBFAiAY0qwBcD9Tse8VayhUjFyMFeNOD3/4pozRP7WygCJYRgIhAMac6yq2
vh54uDyirfDu3YvLCyISIvkO1wW0ytsj2Xkp
-----END CERTIFICATE-----

And mi_api/certi/cryptography/mi_crypto.c
... https://github.com/Ai-Thinker-Open/Telink_SIG_Mesh/blob/master/example/SFS_Ali_Mesh/mesh/mi_api/certi/gatt_dfu/mible_dfu_auth.c

from atc_mithermometer.

https://pastebin.com/raw/5AR7JNVp

0b55e3f04bd1d0f0fcf3b34389514ac1_upd_miaomiaoce.sensor_ht.t2.bin ->

    uint8_t magic[] = {0x47, 0x26, 0x56, 0x82, 0x41, 0x54, 0x4F, 0x46,
                       0x54, 0xEF, 0x49, 0x4D, 0x00, 0x00, 0x00, 0x00};

https://github.com/Ai-Thinker-Open/Telink_SIG_Mesh/blob/master/example/SFS_Ali_Mesh/mesh/mi_api/certi/gatt_dfu/mible_dfu_auth.c#L220C1-L221

signed_001f1cd2ac16030abc7c8c53f62993c0_upd_miaomiaoce.sensor_ht.t2.bin -> At the end of this file there is some kind of certificate... Same as file SJWS01LM_1.1.1_0018.bin.

from atc_mithermometer.

Using instruction from @thazro with CH340C I've successfully downgraded firmware, but only under Windows as @kimol88 mentioned. Take this into consideration. Who knows what can be issue under Mac?

from atc_mithermometer.

What did I do wrong when flashing? Nothing is shown on the display after I used https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html to flash.

My connection from the UART-TTL USB Adapter to the thermostat was like this.
TX -> P14
GND -> GND
3V3 -> V+

I tried several times to flash the original firmware but also the zigbee version. Erase all Flash didn't help either

from atc_mithermometer.

I had similar symptoms when tried to flash on Mac. Which OS are you using to flash?

from atc_mithermometer.

I had similar symptoms when tried to flash on Mac. Which OS are you using to flash?

I am using macos,i have tried it on a window vm with no success. I'll try it with a windows computer.

from atc_mithermometer.

MacOS doesn't work. I've successfully flashed from Windows run under Parallels Desktop.

from atc_mithermometer.

MacOS doesn't work. I've successfully flashed from Windows run under Parallels Desktop.

Can you pls tell me how you wired it. Like me ?
TX -> P14
GND -> GND
3V3 -> V+

TX without resistor ?

from atc_mithermometer.

Programmers attempting to emulate the Telink Swire hardware protocol on a UART chip:

The USBCOMFlashTx.html program does not require any resistors.
https://github.com/pvvx/ATC_MiThermometer#the-usb-com-adapter-writes-the-firmware-in-explorer-web-version

This programmer has no feedback - it does not read or receive information about what is happening.

For other programs, use as described is required:
https://github.com/pvvx/TlsrComSwireWriter
https://github.com/pvvx/TlsrComProg825x - programmer with transition to UART connection.
Chinese clone copy of the programmer https://github.com/pvvx/TlsrComProg825x from Ai-Thinker

Complete programmer, with hardware implementation of Telink SWire:
https://github.com/pvvx/TLSRPGM

Telink BDT
https://aliexpress.com/item/1005003712968248.html

from atc_mithermometer.

Can you pls tell me how you wired it. Like me ?

https://github.com/pvvx/ATC_MiThermometer#the-usb-com-adapter-writes-the-firmware-in-explorer-web-version

USBCOMFlashTx.html
The USB-COM adapter writes the firmware in explorer. Web version.
Connect only TX-SWS and GND wires.

In difficult cases, when the chip contains an unknown FW, it is necessary to use a chip reset or power supply during "activation".

At the same time, take into account that the chip can be powered from the TX output.

This is solved by connecting TX and +Vbat during "activation".

from atc_mithermometer.

Can you pls tell me how you wired it. Like me ?

https://github.com/pvvx/ATC_MiThermometer#the-usb-com-adapter-writes-the-firmware-in-explorer-web-version

USBCOMFlashTx.html The USB-COM adapter writes the firmware in explorer. Web version. Connect only TX-SWS and GND wires.

In difficult cases, when the chip contains an unknown FW, it is necessary to use a chip reset or power supply during "activation".

At the same time, take into account that the chip can be powered from the TX output.

This is solved by connecting TX and +Vbat during "activation".

GND and TX-SWS only. And 3.3V not ?

from atc_mithermometer.

Hi!
Any news on LYWSD03MMC with firmware version: 2.1.1_0159?
I just can't connect. Pop up message says: "couldn't find any compatible device".
Thanks in advance for your help.

from atc_mithermometer.

Thanks for replying @pvvx
Any good tutorials on how to roll back to a previous firmware version?
I'm pretty much a newbie.
Thanks in advance.

from atc_mithermometer.

I think even if you screw the flashing you can start over and reflash from a broken software, but someone would need to confirm it

Reprogramming can be launched a thousand times. This will not even reduce the Flash resource, since the manufacturer guarantees more than 100 thousand rewritings.

My trials of various programs on one of the Xiaomi Lywsd03mm have long exceeded a couple of thousand flash overwriters. It works and is used for debugging. A normal programmer with a hardware Telink SWire writes a firmware for a couple of seconds.

from atc_mithermometer.

After flashing The Xiaomi with OTA, the display does not show and the thermometer does not announce itself even after shorting pins. Does it mean that the XIaomu is bricked?

Firmware for OTA version 2.1.1?

from atc_mithermometer.

chiming in with the same 2.x firmware issue. Hoping everything "we" are waiting for will come out soon :-) Keep up the great work!

from atc_mithermometer.

Hi,
I have Qingping CGDK2 (round one), which was previously successfully flashed with custom firmware 4.5. Yesterday I OTA flashed it with Zigbee Firmware: ZCGDK2_v0119.bin with Telink Flasher to convert from BLE to Zigbee, and everything went ok according to the log, but now the sensor is stuck on -39°C and 100% humidity. Resetting by button or battery removal didn't help. Any ideas???

from atc_mithermometer.

Any ideas?

Flash back to BLE using Zigbee OTA.

ZCGDK2_v0119.bin

This doesn't exist yet. There is ZCGDK2_v0118.bin

from atc_mithermometer.

That was my typo. I meant 0118.bin, of course.

from atc_mithermometer.

About Zigbee OTA, see https://github.com/pvvx/ZigbeeTLc

from atc_mithermometer.

What did I do wrong when flashing? Nothing is shown on the display after I used https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html to flash.

My connection from the UART-TTL USB Adapter to the thermostat was like this. TX -> P14 GND -> GND 3V3 -> V+

I tried several times to flash the original firmware but also the zigbee version. Erase all Flash didn't help either

Same happend with me. :(

from atc_mithermometer.

I have two issues with the Xiaomi LYWSD03MM
(I ordered 4 of them plus 1 CGDK2. Unfortunately I upgraded 2 of them to 2.1.1, well ...)

(A)
I flashed with the UART method the ZigBee firmware 1.0.6 from https://github.com/devbis/z03mmc/releases to 1 device (1 out of the 4 devices). The device hardware works OK, but ZHA just updates the temperature. The humidity stays fix on 50%. I will report this on devbis/z03mmc/discussions as well: devbis/z03mmc#104 (comment). Just in case anyone has already observed such a behaviour.

(B)
I want to stay on BLE for the other 3 devices in order to compare battery life and overall experience. Therefor I have to downgrade to Original_OTA_Xiaomi_LYWSD03MMC_v1.0.0_0130.bin again, or flash ATC_v38.bin right away.

But although I see these firmware versions being used in various screenshots - also on this page - I get the message "Select file is no telink firmware .bin"

I must obviously be missing something, but what?
Thanks for any advice.

[Update:]
Soldered the wires to the CGDK2 in the meantime. I get the same message "Select file is no telink firmware .bin" for both firmware variants:

1. ZCGDK2_v0118.bin and
2. CGDK2_v46.bin

from atc_mithermometer.

@pvvx thank you for the prompt reply.

The link you provided showed me, what I did wrong.

I right-clicked the *.bin link in the main repository and chose "save link as". After the proposed filename for the download was exactly the same as the visible link, I thought this is the file. Very embarassing in the end, lack of Github knowledge on my side :-/.

Apologies.

from atc_mithermometer.

Hi, I just made the same mistake as everyone here. I bought two of these sensors and was planning to flash them and use them with a BLE Tracker on my Home Assistant. However, curious to see how it works originally I did the firmware upgrade when added to mihome app.... stupid curious...
So, after sharing my disgrace...
How hard is to get one of this USB-COM board and use it to downgrade? any link from Aliexpress? I get little confused about which board is compatible, which link should be used to do the downgrade, how is the right way to wiring... Please, can anyone share where to buy this USB-COM and a step-by-step how to downgrade the firmware ?

Hi. Downgraded using this ch340 usb to ttl rs232 converter: https://www.aliexpress.com/item/32354359382.html?gatewayAdapt=glo2isr Solder p14 on thermometer to txd Solder Gnd to gnd Solder + to 3.3V Flash using: https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html

Thank you. I have successfully downgraded Xiaomi Thermometer 2 using CH340 as you said.

from atc_mithermometer.

I am getting a blank display now as well. I used Mac OS and tried doing it on my PC and no luck. I am not getting any errors during flash.

from atc_mithermometer.

flash Ok but after Telink flasher connect it say V.2.1.1_0159 ... but i flash v1 succecfull any idea?

18:54:57: USB-COM opened.
18:55:01: File was selected, size: 92868 bytes
18:55:02: Reset DTR/RTS (100 ms)
18:55:02: Activate (3 sec)...
18:55:05: Write 92868 bytes in to Flash...
18:56:52: Done (109.597 sec).
18:56:52: Soft Reset MCU

from atc_mithermometer.

flash Ok but after Telink flasher connect it say V.2.1.1_0159 ... but i flash v1 succecfull any idea?

Same error! Hardware rev. B2.0.
Делал два раза - прошивка не меняется :(

from atc_mithermometer.

Windows PC is crusial!!! Downgrading doesn't work on Mac.

from atc_mithermometer.

Use FTL232 flasher it works... I have a blank display ...after buy an ftl232 red flasher , i solder pin16,ground,v+ and reset ... And go on windows pc and tadaaaa downgrade sucessfull....

I have CH340G USB to TTL and windows PC.
Can you give an aliexpress link? One more month to wait :(
v+ and reset?

from atc_mithermometer.

I'm flashed it with CH340G! Now I connect it to PC without USB concentrator, directly to PC and it works.

from atc_mithermometer.

I have no chance with ch340G after flash black screen ... Ftl232 works better... Nice you have luck :)

from atc_mithermometer.

I've got lucky adding it to HA.

Repro steps:
Added sensor to Xiaomi Home app.
Extracted BLE token using: Token extractor
Connected device and did activation on Telink Flasher
Added it in HA and when it asked for token I've put token from Token extractor and it was happy with it.

• I've might removed battery at some point but can't recall when exactly

from atc_mithermometer.

I've got lucky adding it to HA.

Repro steps: Added sensor to Xiaomi Home app. Extracted BLE token using: Token extractor Connected device and did activation on Telink Flasher Added it in HA and when it asked for token I've put token from Token extractor and it was happy with it.

• I've might removed battery at some point but can't recall when exactly

did you entered the BLE key in Telink flasher? i tried to enter manually values from Token Extractor, but it did not wanted to do flash because "do activation" (2.1.1)

from atc_mithermometer.

@kr3st1k no, I only have one device and when it connected to HA I didn't want it to disconnect. I am waiting for another one so I can tinker with it later.

from atc_mithermometer.

When you enter the keys from MiHome in TelinkMiFlasher.html, the login is processed. But the firmware will not work, although it will be transferred. The check occurs after transferring and recording the new firmware in Flash. The firmware verification keys are not included, but only the login is entered. After transferring and recording the new firmware, a check occurs and the compliance flag is set. But the criteria are not met and the successful OTA flag is not set.

The new flashed fw will not start, but will be erased upon startup. And version 2.xx will start

The MiHome firmware works in HA if you enter the bindkey into the MiHome integration.

from atc_mithermometer.

@pvvx i had problems with bind key from TelinkFlasher or token extractor. This was the only way it worked for me.

from atc_mithermometer.

You did not update the firmware, but simply used the integration for Xiaomi. Doesn't need a "token".

Keys can be obtained from the “Xiaomi Gateway 3” integration.

from atc_mithermometer.

Hello,

Unfortunately I made the same mistake - updating the FW right away to V 2.x...
I tried several things to downgrade, but I just can't get it done and don't understand why.
Please help :)

I use a FT232RL-based USB-COM Adapter, set to 3.3V.
HW Revision of the LYWSD03MMC is B1.5.
I connected GND to GND, VCC to Vbat and TX to P14 (w/o resistor, but tried with one as well).
(Like shown here.)

Then I flashed it using
https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html
(115200 baud, Atime 3s; on Win 11 + Chrome)

and FW file
https://github.com/pvvx/ATC_MiThermometer/blob/master/Original_OTA_Xiaomi_LYWSD03MMC_v1.0.0_0130.bin

The output looked promising:
06:07:39: USB-COM opened.
06:07:52: Reset DTR/RTS (100 ms)
06:07:52: Activate (3 sec)...
06:07:55: Write 92868 bytes in to Flash...
06:09:39: Done (107.338 sec).
06:09:39: Soft Reset MCU
06:09:53: USB-COM closed.

But when connecting to the telink flasher (or the Xiaomi app) it's showing that it still has the 2.x FW:
(https://devbis.github.io/telink-zigbee/)
06:12:48: Searching for devices
06:12:54: Hardware Revision String: B1.5
06:12:54: Software Revision String: 0159
06:12:54: Firmware Revision String: 2.1.1_0159
06:12:54: Detected Mi device
06:12:54: Connected
...

(I tried several other things as well, but I don't want to bore you :))

What am I doing wrong?

from atc_mithermometer.

It works great thanks

from atc_mithermometer.

Hi,

I don't have a CH340G but I have a ESP32 Wifi/Bluetooth/USB-C in my drawer (never used).

Can I downgrade the firmware with it ? Or I absolutely need a CH340G ?

Thx.

from atc_mithermometer.

Cp2102 usb-ttl is ok for this?

from atc_mithermometer.

This method how to perform the OTA with 2.1.1_0159.
A) Connect the device https://atc1441.github.io/TelinkFlasher.html
B) Activate it
C) Load the ATC 4.7 firmware
D) Connect and modify settings https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html

Tested on two units HW 1.4 and FW 2.1.1._0159 successfully

Xiaomi LYWSD03MMC with firmware 2.x.x simply will not update to any OTA version.

At the moment, firmware update version 2.x.x is only available via USB-UART.

You can flash any version via USB-UART.

from atc_mithermometer.

The method provided by Moaner2 does not work.
Probably only via UART this can be done.

from atc_mithermometer.

j'ai essayé connecté
gnd a gnd
txd a P14
3v3 a v+

mais après quand je rallume le thermomètre plus rien a l'écran

from atc_mithermometer.

do your "Step-by-step" work for rev 1.5 ?

Yep. Downgraded one 1.4 and four 1.5 devices

from atc_mithermometer.