atc1441 / atc_mithermometer Goto Github PK

Hi
First of all, thank you for you work. I would never thought someone would hack a 3$ thermometer :)

I have your firmware on 3 devices, I'm using atc_mithermometer in esphome to read values. I watch the device screen, and values from esp output logs and I can see some situations when for example:

Temp on screen is 23.5, temp I get form logs is 23.5 -->> Temp on screen increases to 23.6 and after few seconds / half a minute in logs I see message from sensor with old value 23.5

What could be the reason for this?

Thank you

I has flash device , but when connect then not display Temp/Humi

Would it be possible to add an option to turn off the LCD in the firmware?
Since many of us have these devices where there are never seen it could extend their battery life 👍

...
Log:
04:37:00: Searching for devices
04:37:03: TypeError: device.watchAdvertisements is not a function
04:37:03: Reconnect 1 from 5
04:37:05: Detected Mi Thermometer
04:37:05: Connected
04:37:21: Activating now, please wait...
04:37:25: Activation successfull
04:37:26: Received device infos are correct
04:37:26: Login successfull
...

Device known id:
blt.3.129v87p7vBATC

Mi Token:
6f6faa84c6b69c2d9c1fd0c7

Mi Bind Key:
fc683bbbc65eceeb9d0ce9dd9ec68ebd

Dont work in esphome, neither MiHome now xD

"Verification failed"

Is is possible to make
Advertising type:
0xAE = Custom
0xAF = Mi Like <- Default
?

I am using the ESP and it is not comfortable to open a web page and connect to the device to change this parameter all the time after battery change.

Would be nice to store offsets, advertising type, smiley preference etc during battery replacements.
I've failed to find flash addressing, so tried from tiny_Flash lib example:
tinyFlash_Init(0x70000,0x4000); in main, then
tinyFlash_Write(1, &temp_offset, 1); tinyFlash_Write(2, &humi_offset, 1); in cmd_parser and
tinyFlash_Read(1, &temp_offset, 1); tinyFlash_Read(2, &humi_offset, 1); in void user_init_normal(void)
but after setting humidity offset and reboot device is bricked (stuck at startup screen), will try to flash it via USB-Serial method.
@atc1441 have you worked with tiny_Flash lib?

Won't it break your concept too much, if ADV-data will be structured as for an MI-like device? I mean using 0x95, 0xFE UUID, some device identification and predefined data points?

Thanks for your work! You have some great knowledge / experience.

What I would like to know if the every minute part will drain the battery a lot more than the default implementation which does not send a lot of updates as I've seen. (looks maximum every 11 minutes if the value is different enough)

Yes, I'm aware the answer is still unclear! No problem, the issue can be left open until there is more info about it, and maybe added to the readme of this repo.

First of all, wow, this looks amazing 🎉
I didn't know that custom firmware for this device was possible, thanks to you, now I know it is 🙂

I'd like to ask if it would be possible to support other devices, like CGG1?
There are multiple issues with it. Especially the advertising time.
It would be awesome if it could be set to one min and if the device could send all three parameters each time (now the battery isn't send too often).

A custom firmware could solve all the issues.

I'm not sure what MCU is used, but maybe similar.
Here are the materials I found: https://fccid.io/2AQ3F-CGG1/Internal-Photos/Internal-Photos-3990168
I can take my sensor apart and make some detailed pictures if needed.

One thing that bothered me for a while now is that it was not possible to calibrate the sensors, even though various sources (e.g https://github.com/JsBergbau/MiTemperature2#calibration ) mention that especially the humidity is not that accurate.
It would be awesome to be able to set an offset for temperature/humidity, which is then applied to the sensor data before displaying and/or broadcasting.

I just successfully flashed a bunch of thermometers with the custom firmware, but now I can't connect to them with the web tool to update the settings:

Log:
21:39:09: Searching for devices
21:39:18: Connecting to: ATC_8A6105
21:39:28: NotFoundError: No Services matching UUID 00010203-0405-0607-0809-0a0b0c0d1912 found in Device.
21:39:28: Reconnect 1 from 5
21:39:28: NotFoundError: No Services matching UUID 00010203-0405-0607-0809-0a0b0c0d1912 found in Device.
21:39:28: Reconnect 2 from 5
21:39:28: NotFoundError: No Services matching UUID 00010203-0405-0607-0809-0a0b0c0d1912 found in Device.
21:39:28: Reconnect 3 from 5
21:39:28: NotFoundError: No Services matching UUID 00010203-0405-0607-0809-0a0b0c0d1912 found in Device.
21:39:28: Reconnect 4 from 5
21:39:28: NotFoundError: No Services matching UUID 00010203-0405-0607-0809-0a0b0c0d1912 found in Device.
21:39:28: Reconnect 5 from 5
21:39:28: NotFoundError: No Services matching UUID 00010203-0405-0607-0809-0a0b0c0d1912 found in Device.
21:39:28: Something went wrong, to many reconnect's

They seem to be working fine otherwise, switching between displaying temperature/humidity and temperature/battery and advertising their values over BLE.
Is there another way to update the settings, besides the web tool?

Hi,

I try to flash LYWSD03MMC with following firmware: ATC_Thermometer_custom.bin. However after some time (like 60 seconds) LCD is going off - it is still possible to connect/send firmware using TelinkFlasher.

With ATC_Thermometer LCD is on only on "bootup" process then it goes off and doesn't show temperature.

With stock firmware LCD is on and shows temperature all the time...

Please advise.

Best Regards

I noticed that the .bin has been updated since my first installation last week.
Is it possible to create a firmware changelog so I can understand what are the new bugfixes and features

Thanks for your time

As I understand measuring the battery is the thing that drains it the most, is it possible to only do these measurements like once a day or at least once a hour?

Any chance for command line implementation of OTA flasher?
I'd love to see that happen, as I'm currently running your firmware on 12 devices (another 8 are on the way;) and updating that swarm using web flasher is serious pain in the ass;)
Command line version would allow much more flexibility (automation).

HA says 100% using official firmware, while custom firmware shows minimal battery icon on LCD

The custom firmware has been updated by @atc1441 to support "Mi like" advertising. When enabled, the LYWSD03MMC sensors work directly in ESPHome with the xiaomi_lywsd03mmc component. The bindkey is not necessary any more as the payload is not encrypted in the custom firmware. However, since the bindkey is a mandatory parameter, you still need to give it a fake one in the config file. It can be anything though, as long as it is formatted like a real one.

esphome/feature-requests#552 (comment)

Added pull request: #39

First of all - thank you for your efforts, awesome work! Please, could you make ADV-timers more flexible to reduce battery drain? For instance, if temp/humi changed more than 1 degree/ 5 percent - send data every 1 min per change, and every 10 minutes otherwise (from the last send).

Hello atc1411

just downloaded the new firmware and flashed the device, but now I get this:

Log:
17:59:01: Searching for devices
17:59:23: Connecting to: LYWSD03MMC
17:59:33: Detected Mi Thermometer
17:59:33: Connected
17:59:44: Disconnected.
17:59:44: Searching for devices
18:00:08: Connecting to: LYWSD03MMC
18:00:38: Detected Mi Thermometer
18:00:38: Connected
18:02:07: Activating now, please wait...
18:02:10: Activation successfull
18:02:11: Received device infos are correct
18:02:11: Login successfull
18:03:03: File was selected, size: 61452 bytes
18:03:03: Count: 3841
18:03:11: Start DFU
18:04:07: Update done after 55.577 seconds
18:04:14: Disconnected.
18:04:21: Searching for devices
18:04:43: Connecting to: LYWSD03MMC
18:05:06: Detected Mi Thermometer
18:05:06: NotSupportedError: GATT operation failed for unknown reason.
18:05:06: Reconnect 1 from 5
18:05:06: Detected Mi Thermometer
18:05:06: NotSupportedError: GATT operation failed for unknown reason.
18:05:06: Reconnect 2 from 5
18:05:06: Detected Mi Thermometer
18:05:06: NotSupportedError: GATT operation failed for unknown reason.
18:05:06: Reconnect 3 from 5
18:05:06: Detected Mi Thermometer
18:05:06: NotSupportedError: GATT operation failed for unknown reason.
18:05:06: Reconnect 4 from 5
18:05:06: Detected Mi Thermometer
18:05:06: NotSupportedError: GATT operation failed for unknown reason.
18:05:06: Reconnect 5 from 5
18:05:06: Detected Mi Thermometer
18:05:06: NotSupportedError: GATT operation failed for unknown reason.
18:05:06: Something went wrong, to many reconnect's

Great that you implemented the new features to calibrate, but how can these be set, what kind of application is required, or di I misunderstood something here and it need to be set in the firmware (which I do not believe):

Settings in custom firmware:
The following settings can be send to the RxTx Characteristics 0x1F10/0x1f1f These settings will not get saved on power loss, maybe that will change in future but normaly the battery will be in there for a while

Change display to °F or °C:
0xFF = Lcd in °F

0xCC = Lcd in °C <- Default

Blinking smiley:
0xA0 = Smiley off

0xA1 = Smiley happy

0xA2 = Smiley sad

0xAB = Smiley bliking <- Default

Advertising interval
byte0 0xFE

byte1 0x06 - value times 10 seconds = interval 60 seconds default.

Temp and Humi offset
byte0 0xFA = Temp offset

byte0 0xFB = Humi offset

byte1 as an int8_t

so Temp = range -12,5 - + 12,5 °C offset Humi = range -50 - +50 % offset

The offset will be parsed as int_8 so an 0x80 would be -12,5°C something.

I find it quite a lengthy process to identify the MAC address, when trying to add a new sensor to ESPHome.

Mu mobile is an iPhone and lamptop is running Windows 10. Neither of which seem to make it easy to ID the
sensor.

Would you kindly add a box to display the MAC address of the connected device in the Telink Flasher please?

At first, thanks for amazing work on this flasher & custom firmware! :)

I have 6 devices flashed with the newest https://github.com/atc1441/ATC_MiThermometer/blob/master/ATC_Thermometer.bin. It seems that despite specifying the advertising interval to 1 minutes, I seem to be getting advertisements quite often (every 1-20 seconds). Is there something I'm missing?

I just tried to implement a parser for the native adv. format, but I noticed that the data first 4 bytes seem to be missing. The payload starts with the mac address right away. Firmware version was the latest from this morning.

https://www.w3schools.com/css/css_rwd_viewport.asp

Kia ora, Aaron, from NZ 👋

Just a random question, which is not specifically related to this code (for which, many thanks!). What is the app you use on your phone for seeing the BLE details? I couldn't work it out from your video, but it looks really useful.

Cheers!
Jon

1 minute is cool for most common use, but maybe it's a good idea to implement adjustability for this parameter via Bluetooth, the same way as it was done for C/F setting? Also, it would be nice to have an adjustable parameter for smiley enabled/disabled/blink state ;)

Can you tell me what the differences are between these two screens?


Both got the same temperature. The display without the smiley is/should be humidity. What is the other?

Quick question, does the new custom firmware also save and record measured values ?

How can they be accessed and retrieved ?

According to the README of https://github.com/JsBergbau/MiTemperature2 the sensor supports negative temperatures down to -9.9°C, but I think the code as-is doesn't work properly if that is the case.

I can offer to test with a freezer.

Hi,

how to understand the "Advertising interval:"?

I have changed it via web flasher, but cannot see a difference - advertising values will be received every minute about.

Then have changed in code (app.c):
RAM uint8_t advertising_interval = 6;//multiply by 10 for value

to

RAM uint8_t advertising_interval = 36;//multiply by 10 for value

but no difference too (other values like smiley, battery will be accepted in code and web flasher as expected)

I want to change the enable sensor time for saving battery, as sample to 3 minutes.

Thanks!
Michael

Hi there,

thanks for this tool. But I made a mistake. I flashed the zip-file, not the extracted bin.
I'm trying to flash through UART through a USB-Adapter. It seems to write and finish, but the device is still dead.
I've tried with RX and TX, but both with no luck. Also the stock- and your .bin
Some other ideas?

I would like to report that after flashing custom firmware humidity reading are 4-5 % lower than on stock firmware. I tested it on 3 pcs and each had this issue.
Is this intentional behaviour or bug?

Great work you did, but after flashing the firmware I do not see the device anymore under Windows 10 device lists.
If I open your TelinkFlasher page the browser is able to find the device, but I'm not able to press DoActivation, I guess this could only be pressed once, right ?

Do I have to made a note of the TOKEN and BIND KEY ?

Where do you get the original firmware ? Is it possible to get an original firmware read from the device as well over a webpage ?

Thanks

First of all, thanks for your awesome work - this is amazing.
I have two LYWSD03MMC sensors - both flashed with your provided .bin build in master branch. I am using it in combination with the OpenMQTTGateway project on an ESP32. One sensor is behaving perfectly fine. The other one only works if it is placed within a circle with an radius of approximately 1.5m centered at the ESP32. I tried flashing the sensor over and over again, rebooted it by taking out the battery, replaced the battery, switched the batteries among both devices, turning one device off while the other one is on, placing them in the same room, placing them in different rooms with the same distance to the ESP32 - it makes no difference. I don't think that this is a problem with OpenMQTTGateway, because the problem also occurs when the working sensor is turned off. Does anyone have a clue what the problem is?

First of all, thanks for your awesome work!

Would be nice to add automatic changing smileys like in stock firmware in reference to temperature and humidity.
Right now default option with blinking smiley require stay few second and wait when smile will appear.
Thank you in advance.

I got very interested in this project as I have 4 of these Xiaomi devices and would like to integrate them in my home automation system. So I downloaded the firmware and used the Chrome app to got the TelinkFlasher page and started scanning and then nothing... The log says Searching Devices. I read that this can take some time but after half an hour I gave up. I checked with a BLE scanner on my iPhone and all 4 devices show up. I then used my iPad and laptop (running Ubuntu 20.04), results are consistent, nothing happens. I noticed in the video that hitting the Connect button opens a Bluetooth connection screen but that doesn't happen in my case. On iOS devices Chrome doesn't throw a Bluetooth access dialog and I can't find a way to do this manually in settings. Can someone enlighten me how to set this up on iOS 13 (or Ubuntu) or is this Android only?

Hi, is it possible to run a local hosted version of https://atc1441.github.io/TelinkFlasher.html ?
Tried with python simple server, and that did not work.

Hello,

thank you for the great project!

Do I understand correctly, that the MiThermometers with original or custom FW can be flashed (or bricked) via OTA by anybody within the BTLE range? Same goes for the "Custom firmware Settings" (temp / humidity offset...)?

Is there any option to disable the OTA / Custom firmware setting? For example after 1min after inserting the battery or by HW modification to the MiThermometer (shorting some "program-disable" pin on the PCB)?

Lastly, is there an option how to prevent spoofing of the MiThermometers data? For example by implementing encryption/signing data with bindkey, so we can verify validity of received data?

Just trying to have secure home automation and credible environmental data for central heating control.

This doesn't feel like expected behaviour.

Today i can't do activation (stuck) of stock firmware device, can't flash stock and custom firmware devices (even reflashed yesterday) and can't send parameters to custom firmware. Also i CAN connect to device.

Yesterday everything was fine. But till today t seems that something broken in script.

Tried on 3 devices and on MAC, PC and Android 10 pixel 4. Nothing.

Screenshots attached below.

Any ideas what happening?

Before today everything worked fine.

I am setting these sensors up in home assistant using the blue HACS add in. It expects the sensors to broadcast using the Mi Like format. I can change the sensors to transmit using the Mi Like format but this will reset to the custom format when I change the battery. Can you consider making the Mi Like format the default? Thank you for your excellent work.

Hi @atc1441,

First I'd like to thank you for the impressive work that you've done reverse engineering the flashing protocol and giving us mortals the possibility to flash custom firmware via OTA :)

I own some of the other Mi BLE sensors - LYWSD02, CGG1 and MHO-C401. Inspired by your work, yesterday I opened the latest sensor in my collection - MHO-C401 (greyish square body with e-ink display) , and I just confirmed my suspicions that its built around TLSR8251 too:

So, I'd like to start experimenting with it, but not having the hardware flashing tool, I'd have to rely on USB to UART flashing and OTA. But first I'd like to be able to dump its original firmware, so that I have a predictable starting point should anything breaks.

Is it possible to make the ATCtelink.py script dump the firmware of the attached device into a file?

I have managed to flash one of my sensor with the custom firmware all worked
But now I can't reconnect to it.
I can't see it but when I select it it end up saying in the log:

17:47:17: Searching for devices
17:47:29: TypeError: device.watchAdvertisements is not a function
17:47:29: Reconnect 1 from 5
17:47:34: NetworkError: Connection failed for unknown reason.
17:47:34: Reconnect 2 from 5
17:47:40: NetworkError: Connection failed for unknown reason.
17:47:40: Reconnect 3 from 5
17:47:46: NetworkError: Connection failed for unknown reason.
17:47:46: Reconnect 4 from 5
17:47:51: NetworkError: Connection failed for unknown reason.
17:47:51: Reconnect 5 from 5
17:47:56: NetworkError: Connection failed for unknown reason.
17:47:56: Something went wrong, to many reconnect's

I have no issue with another sensor that has not been flash yet. I don't dare flashing it :)

Hi
Do you know whether the flasher works from iOS?
when I push the connect button on mig iphone, it writes "searching for devices” in the log and nothing more happens.

Hello,

I have two type of devices with inc screen:

• clear glass CGG1
• xiaomi MHO-C401

and I wonder if any work/progress/plans to have custom fw for this devices?

also can I activate/get token using web flash of this devices?

thanks

Thanks to your efforts, this device became absolutely perfect, imo! One more suggestion: please implement the immediate message sending in case of temp/humi change hit some threshold in a certain period of time. I mean, something like this: if temp changed for 0.5C (adjustable by user), or humi changed for 5% (adjustable too) since the last sensor read - ADV-message buffer updates immediately, regardless of the timer state. I know that it could be done easily with ESPHome in conjunction with a pretty short set timer, but maybe other smart home system integrations can't do this, so internal hardware implementation would be useful.

I pushed the FC01 value to my device, but I can't see any difference when reading values from home assistant.
The value seems to update every 5 minutes even if there is 0.1° change in temperature
Can you help me?

Hi, thanks for the great work.

I installed the custom firmware, it shows correctly on the device, when i try to connect to it, i get this:

Log:
00:51:04: Searching for devices
00:51:14: TypeError: device.watchAdvertisements is not a function
00:51:14: Reconnect 1 from 5
00:51:18: Detected custom Firmware

And that's it. No temp or humidity indications or other.
Any idea what can cause this?

Hi,

thanks for the very good job!
Sensors are nice, but battery life time is short if make a request every 10 minutes....
So I hope will be much better with advertising only.

regarding the blinking smiley - is it possible to go back to the default setting, that smiley is permanent available (even by default)?
Maybe same for battery could be useful.

Or maybe create a second such firmware file? ;)

Thanks!
Michael

I received my Xiaomi sensors today. I flashed the first device with help of the YouTube video. After flashing the device itself presented its MAC address, but when I connect from the TelinkFlasher the log said "TypeError: device.watchAdvertisements is not a function". After that it will try to reconnect. It also detects the custom firmware. The flasher page does not show any Temp/Humi data anymore

Did i made a mistake? I tried flashing it again, same procedure with the same result.

Also, my OpenMQTTGateway ESP32 doesn't pick up a temperature and humidity. It does get detected with
{"id":"a4:c1:38:90:29:62","rssi":-85,"distance":15.12852,"servicedata":"a4c13890296201052c570bb001","servicedatauuid":"0000181a-0000-1000-8000-00805f9b34fb"}

Web flasher shows
In log:

Searching for devices
06:49:47: TypeError: device.watchAdvertisements is not a function