Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cannot add back to mihome after flashing #73

Closed
xjustbmw opened this issue Mar 10, 2021 · 15 comments
Closed

cannot add back to mihome after flashing #73

xjustbmw opened this issue Mar 10, 2021 · 15 comments

Comments

@xjustbmw
Copy link

is it possible to have the sensor work again also in mihome ?
i first flashed the initial firmware (by atc1441) and then your version
Im getting couldn't verify in mihome app (-28) error

If i click 'show all my keys' i get no midevid, no mitoken and nomibindkey!

PS. I made a screenshot of the midevid mitoken and mibind key while flashing first atc firmware

@pvvx
Copy link
Owner

pvvx commented Mar 11, 2021

The atc1441 firmware removes all keys.
Mi-Home has additional registration keys. The Mi-Home user agreement prohibits third party use and any reverse-engineering.

The current firmware uses information from publicly available sources. "Bindkey" allows you to encrypt ad packets, but not register with Mi-Home / Xiaomi cloud.

@xjustbmw
Copy link
Author

cool. not that im really interested. but in this case, after restoring to back to original firmware , it still works with mihome ?

anybody using an old android phone as a daemon for these sensors ?

@pvvx
Copy link
Owner

pvvx commented Mar 11, 2021

If the registration was made on the original firmware and the keys restored in custom-fw, plus "Advertising type: mi" and "Encrypted Mi beacon - enable" - Xiaomi Gateway 3 works, but unstable.

Xiaomi Cloud stores one measurement point per hour.

@xjustbmw
Copy link
Author

is there any way to manually restore the keys ? i have them (as picture) but they're not on the device :)

@pvvx
Copy link
Owner

pvvx commented Mar 11, 2021

Binding and re-registering will not take place without the original firmware.

@atc1441
Copy link

atc1441 commented Mar 11, 2021

You can delete the thermometer in MiHome and re add it with the stock firmware

@serhat-ozkara
Copy link

Subscribing, exactly what i'm going through. What's the update interval on stock firmware? It's lagging a lot on stock firmware with gateway 3. That's why i'm looking for a custom firmware..

@pvvx
Copy link
Owner

pvvx commented Mar 12, 2021

What's the update interval on stock firmware?

About 10 minutes.

It's lagging a lot on stock firmware with gateway 3.

Updating data in the cloud through a gateway - 1 hour.
Updating data on a smartphone when it is connected to the sensor. Each connection of the smartphone to the sensor checks the registration of the sensor and sends the data to the cloud.

@pvvx
Copy link
Owner

pvvx commented Mar 12, 2021

Registration procedures and examples of algorithms from mijia are in mi_api.
There are even headlines in Tuya:
https://github.com/TuyaInc/tuya_smesh_sdk_tlsr825x_light
"tuya_smesh_sdk_tlsr825x_light \ includes \ board \ chip \ telink_sig_mesh_sdk \ sdk \ vendor \ common \ mi_api"
The mi_api procedure code can be found on the Telink website and other mijia members.
The encryption library itself from mijia is private.
Registration requires encryption keys associated with each type of mijia device:
certificate[>400 bytes] и dev_cert_pri[32 bytes]

The Mi-Home user license prohibits any reverse engineering. Copying keys and using the cloud is prohibited.

To prevent users from violating licenses, you are required to publish key certificates in the public domain. Then they can be built into alternative firmware, but the problem with the cloud will not be solved. ... Demand termination of the "user agreement" in Mi-Home :)

@serhat-ozkara
Copy link

serhat-ozkara commented Mar 12, 2021

@pvvx I think there's an issue with send encrypted option. If i select mi advertisement along with encrypted checked, neither mi app nor passive ble integration on hass can see the device. I have actual registered beaconkey and secret installed on device.

But, i found a really good workaround while tinkering:
If I use original Device name "LYWSD03MMC" AND mi advertising without encryption, device gets connected to gateway3 and gateway3 starts reporting really really quickly on HASS (locally). Passive BLE integration also works but i don't prefer it because Rpi bluetooth is unstable.
Some debug info on the logs:
Process BLE Fix {'did': 'blt.1.160qml0ft4g00', 'eid': 4109, 'edata': 'e6005301', 'pdid': 1371, 'seq': 237}
2021-03-12 13:23:39 DEBUG gateway3 192.168.155.100 | MQTT | ble/blt.1.160qml0ft4g00 b'{"temperature":23.0,"humidity":33.9}'

@xjustbmw
Copy link
Author

mijiatemp apk seems to be stable enough
since i have a phone lieing around doing other things,i'll parse the notification's temperature/humidity through tasker every x minutes

@pvvx
Copy link
Owner

pvvx commented Mar 12, 2021

@pvvx I think there's an issue with send encrypted option. If i select mi advertisement along with encrypted checked, neither mi app nor passive ble integration on hass can see the device. I have actual registered beaconkey and secret installed on device.

If you register a device with official firmware in mi-home, and then flash an alternative firmware and restore bindkey, then gateway 3 sees and logs the device in the cloud.
https://github.com/pvvx/ATC_MiThermometer/blob/master/test_adv_key.py
https://github.com/pvvx/ATC_MiThermometer/blob/master/src/mi_beacon.c#L110
This continues as long as Bluetooth is disabled in the smartphone.

@pvvx
Copy link
Owner

pvvx commented Mar 12, 2021

mijiatemp apk seems to be stable enough
since i have a phone lieing around doing other things,i'll parse the notification's temperature/humidity through tasker every x minutes

mijiatemp uses the connection and shows open UUIDs.
JsBergbau/MiTemperature2#36 (comment)
Xiaomi LYWSD03MMC is not secure from connection, but registration is limited.


In the connection mode with the original Xiaomi LYWSD03MMC firmware, if the program does not adjust the connection intervals, the sensor will remove 10 times more energy than in the advertising mode.
Advertising mode - an interval of approximately 1700 ms and a TX packet for each of the 3 channels.
Connection mode - interval 25..50 ms, delay 0, timeout 1000. 50-60 TX packets per second.
Examples of consumption measurements:
https://pvvx.github.io/ATC_MiThermometer/OriginalPower.html
+
https://pvvx.github.io/MHO_C401/power_original.html
https://pvvx.github.io/MHO_C401/power_altfw.html

https://pvvx.github.io/ATC_MiThermometer/CustPower.html

In BLE, the connection intervals are set by the client - the BT adapter. The settings described in the device are sometimes ignored. Depends on BT adapter. Once connected, the device may ask you to change the intervals. Acceptance of new settings depends on the BT adapter.

@xjustbmw
Copy link
Author

is there a maximum working limit for the advertising interval ?
can i set it to something like 180000ms ?
still possible to connect to the sensor after that and change the settings ?

thanks

@pvvx
Copy link
Owner

pvvx commented Mar 26, 2021

is there a maximum working limit for the advertising interval ?
can i set it to something like 180000ms ?

image

@pvvx pvvx closed this as completed May 1, 2022
FaBjE pushed a commit to FaBjE/ATC_MiThermometer that referenced this issue May 28, 2023
FaBjE pushed a commit to FaBjE/ATC_MiThermometer that referenced this issue May 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants