The Xiaomi LYWSD03MMC temperature and humidity sensor is ridiculously cheap. If you’re buying a few at a time, you can expect to pay as little as $5 USD a pop for these handy Bluetooth Low Energy environmental sensors. Unfortunately, that low price tag comes with a bit of a catch: you can only read the data with the official Xiaomi smartphone application or by linking it to one of the company’s smart home hubs. Or at least, that used to be the case.
Over the past year, [Aaron Christophel] has been working on a replacement firmware for these Xiomi sensors that unlocks the data so you can use it however you see fit. In addition, it allows the user to tweak various features and settings that were previously unavailable. For example, you can disable the little ASCII-art smiley face that usually shows on the LCD to indicate the relative comfort level of the room.
The new firmware publishes the temperature, humidity, and battery level every minute through a BLE advertisement broadcast. In other words, that means client devices can read data from the sensor without having to be paired. Scraping this data is quite simple, and the GitHub page includes a breakdown of what each byte in the broadcast message means. Avoiding direct connections not only makes it easier to quickly read the values from multiple thermometers, but should keep the device’s CR2032 battery going for longer.
But perhaps the most impressive part of this project is how you get the custom firmware installed. You don’t need to crack the case or solder up a programmer. Just load the flasher page on a computer and browser combo that supports Web Bluetooth (a smartphone is probably the best bet), point it to the MAC address of the thermometer you want to flash, and hit the button. [Aaron] is no stranger to developing user-friendly OTA installers for his firmware projects, but even for him, it’s quite impressive.
That escalated quickly. Another 12 € spend on aliex.
Usually this escalates into item not being in stock, so good choice.
Banggood has them for $4.99 US
Aliex had three for 12 €.
Or four for ~13 EUR. I have no idea what I need 4 of them for but it’s too late now…
Haben ist besser als brauchen.
(Old German proverb)
Yeah, just spend 21 $ for 8 of these, my GF as been pestering me about something prettier than the raw dht22+esp combo, and she approved these at this price.
That MCU looks interesting.
Would the same OTA technique work on a cheap smartwatch with the TLSR8251 such as https://www.cellmost.com/details/sx16-1-3-inch-tft-color-screen-health-monitoring-ip67-waterproof-smart-watch-black-sku841100728a.html ?
Hey, this will work the same, it will most likely be needed to open the device once to flash the telink ota protocol if its not used on stock firmware.
If it uses a different ota protocoll that could also be “hacked”
Most of the TLSR8266 or 8251 watches have no OTA enabled
looking at the photo of the PCB, it seems there aren’t many spare MCU pins… can someone confirm this?
https://hackaday.com/wp-content/uploads/2020/11/atc_pcb.jpg
I have been unable to find a circuit diagram.
Was trying to understand what CPU architecture this is using.
The datasheet for the telink only calls it 32 bit risc.
The makefile compiles the firmware with “tc32-elf-gcc”. Is this some custome architecture? Do anyone know about it?
Telink TC32
http://wiki.telink-semi.cn/doc/ds/PB_TLSR8251-E_Product%20Brief%20for%20Telink%20BLE%20SoC%20TLSR8251.pdf
According to the tc32 Ghidra plugin it is heavily modeled after arm thumb:
“The TC32 is essentially a clone of the 16-bit ARM9 Thumb instruction set.”
https://github.com/rgov/Ghidra_TELink_TC32
Hmm it sounds interesting.
I am wondering if the flash layout would allow to store some temperature data for later query via BLE.
Usually it’s better to store in RAM, costs way less.
32kB aint so bad after-all (while leaving some for the system), you probably could store few days at 1sample per minute without event compression.
Don’t, most low cost micro do not have high flash endurance level
Nice job!
I have feature request…
Can you add 2-3 external buttons please? It’s possible to create advanced room thermostat then ;)
Thats is definitely possible without big problems :)
Awesome work. Really useful.
Nice , thanks a lot ! If program space is available , a nice future hack could be an indoor / outdoor temperature display set with two sensors ! First sensor could transmit actual outdoors temp data to a second sensor (inside ) displaying received data / indoor temp . ( First sensor advertising outdoor temp , second sensor displaying advertised data )
Communication between two low power devices is hard. You need super tight sync, or else longer listen intervals that you want.
High power to low power is easy, just listen for the beacon that says the LP device is awake.
awesome to see. an option to display the time would be a nice to have. i always felt like that these missed that, but i supose it would impact battery life.
Interesting. First time I’ve heard of Telink TC32.
I use RuuviTags for this exact application: indoor, outdoor, fridge, garage and greenhouse temperature and humidity monitoring. No display and they’re not price competitive with these Xiaomi devices due to economies of scale, but they’re open source, run an ARM Cortex M4 core (512 kB flash, 64 kB RAM) and have temperature, humidity, pressure and accelerometer sensors built in. Might be a better fit for some of the commenters here.
https://ruuvi.com
I don’t get the point of these. You can see the temperature on the display and also on your phone if you are standing within a few meters of it? Maybe you can log changes over time?
Would seem to be more useful if it had wifi, e.g. it was ESP32 based.
The point is they are small and battery powered for upwards of a year on a coin cell battery. ESP8266/ESP32 or any other wifi sensor will be way too power hungry for this – even using sleep and waking only every 5-10 minutes they would still need a large battery pack just to make it a month or so.
Individually they aren’t all that useful, but as a component in a more comprehensive smarthome system, they can be a great addition, for a cheap price.
I saw this on Youtube a few weeks back, and ordered up 8 to try out. Just got them reprogrammed and integrated into HomeAssistant. Each one broadcasts out a Bluetooth packet containing Temp/Humidity/Battery once per minute. I have a single ESP32 in my network closet running ESPHome that captures the readings and forwards them onto HA, where they are logged/graphed, and can trigger automations. A couple of my sensors are 30-50 ft from the ESP32, through several walls and still receiving just fine.
For example, I’ve got one in our bathroom. It can sense when someone is showering because the humidity spikes from ~55% to ~70%. I’ll be setting up an automaton to trigger the bathroom fan to run for 10 minutes when this sensor spikes more than 10% above the other ones in the house.
I can also use them as auxiliary sensors to influence how our HVAC operates – if upstairs sensors are more than maybe 5-6°F above the downstairs sensors, I could trigger the furnace fan to run and recirculate.
Or if I had a whole-house fan, I could trigger it to run in the summers when the outdoor temperature drops below indoor overnight. Instead we usually use a box fan in the window, but I can still setup an alert to tell me it’s time to open up.
Yeah – these things once reflashed could be very useful. I’m thinking about replacing some old programmable thermostats with these. Nice work, Aaron!
… aaaand I just ordered 6. Black Friday, y’all.
Does anyone know of a similarly hackable BLE push button?
Great project, Aaron. Many thanks!
How can I use a raspberry i to receive the broadcasted BLE signals?
https://github.com/JsBergbau/MiTemperature2
Hi, thank you for your work, very interesting.
A question: thermometer send values below 0° C ? I’m planning to put one outside my house and another one inside to measure difference.
A bit off topic but … related nonetheless :-).
Keen to do the Firmware update ended up buying about a dozen sensors. Because, you know, it is sooo much cheaper …
Unfortunately couldn’t connect with any sensor. Not even listed as a Bluetooth device.
Maybe an iPhone is not the best Firmware updating tool.
HOWEVER … as I had sooo many sensors I turned on many of them and put them side to side, next to each other.
Then I noticed temperature and humidity varies QUITE A LOT between sensors.
Sometimes more than a degree and a half Centigrade.
Same with percentage of humidity.
That make me think: Am I the only one expecting better accuracy? Like no more than 0.2 of a degree of difference for the temperature?
Curious to know if someone else had the same experience and accuracy disappointment.
Hey, I decided to give this a try and it is indeed very interesting. I found two problems, tough, that limit usability in my particular setup. One, I don’t seem to be able to view the decoded T and H values in the data streams from an iphone BLE scanner app. The other, more important, is that once the devices are flashed with the custom firm it is impossible to pair them with the Xiaomi IOS app (the devices are detected but the pairing results in error code 102). The second problem is quite limiting for me.
Aaron has said clearly in his youtube video that the original firmware is advertising encrypted data and uses a bind key . Original xiaomi app uses this bind key to decrypt the encrypted advertised data . So, if you need the xiaomi app you use the original firmware …
If you use Aaron’s hacked firmware , there is no need for bind key , encryption etc and you can read data from sniffing advertised unencrypted temperature/humidity/battery data using an ordinary BLE sniffer . So if you need a generic sniffer , you use Aaron’s firmware ! However , xiaomi app cannot use these data , anymore. Aaron explains how you can flash back the original firmware if you insist on using xiaomi app!
Whats the app used on the preview picture?
ditto, I have seen this in at least on other post on hackaday and am interested. I found LighdBlue, which is great, but don’t thing that is it.
I think that Aaron responded to this question in one of the comments on the youtube channel.
found it https://www.youtube.com/watch?v=NXKzFG61lNs&lc=UgxEro_NASrsk6tHrl54AaABAg
nrfconnect
I have three of these, and I can not get anything to connect to them, aside from the xiaomi app.
Trying a Raspberry PI4, hcitool lescan sees it, and 2 different iphones, that can connect to the devices with the xiaomi app . But I can never get the Telink Flasher Website to connect. Any help, please?
There were reports in the comments on youtube about which OSs and browsers work. I think there were problems with iPhones.
Not sure it this was intended, but I flashed per the author’s suggestion to Victor’s version for power management. Subsequent attempts to use the author’s site with the cool buttons to change C/F, reporting interval, etc. appeared ineffective. I then flashed the author’s version, and all that stuff worked fine. Since I’m not a coder, I’ll stick with ease-of-use, even if that means less optimal battery life.
I ran into a situation where the web application of a different for a different firmware didh’t appear to work. It is important to use the web based tool with the matching firmware. https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html is the configuration URL for firmwares from https://github.com/pvvx/ATC_MiThermometer. That is different than the links in the article (orig firmware https://github.com/atc1441/ATC_MiThermometer).
Hey. I am using this firmware with few sensors, but I have one problem – screen refresh is very slow with custom firmware (c.a. minute or more in custm vs 7 seconds in stock). Any way to handle this?
damn, the new Model 2021 won’t work … do they changed anything ?
try posting a picture of the disassembled device and we can do a comparison.
When minus Temperature in Celcius, it seems like the “-” is missing?
Great work, got 6 of these for 30€ (from Bangood), flashed them with your firmware and by using nodejs and noble module (https://github.com/abandonware/noble) on a RPi 2 Model B with USB Bluetooth adapter, I manage to read and store temperature, humidity and battery levels.
However, I have one question about the performance and battery life of the sensors. I start BLE devices discovery (only for UUID 181A), and I get the data in the onDiscover event. After some time (e.g. 10 seconds) I stop devices discovery and after 5 minutes I start again. And that’s how I get data from my sensors every 5 minutes.
Is this OK or I should connect to each device individualy and listen for advertisements? I ask this because some sensors droped battery level from 100% to 96% in just 24 hours, I can’t see how these would last for 6 months.
Thanks anyway, amazing job!
Great video,
I think I will use some of these for temperature control in my house. But on additional question. does the device log the temperature if it is not connected to bluetooth? I have one case where I the sensor will be mobile and should export all temperatures of the day when connected in the evening.
If this is not possible, does anyone know a flashable sensor that ist capable of logging data?
https://github.com/pvvx/ATC_MiThermometer variant supports a cyclical log storing thousands of readings. Timestamping the readings can be tricky if the device is missing an RTC.
I successfully flashed a couple of devices but now the OTA flasher won’t pair. It just says “Detected custom Firmware” and stops. (Sorry if this is already answered.)
Same here