Custom Firmware For Cheap Bluetooth Thermometers

The Xiaomi LYWSD03MMC temperature and humidity sensor is ridiculously cheap. If you’re buying a few at a time, you can expect to pay as little as $5 USD a pop for these handy Bluetooth Low Energy environmental sensors. Unfortunately, that low price tag comes with a bit of a catch: you can only read the data with the official Xiaomi smartphone application or by linking it to one of the company’s smart home hubs. Or at least, that used to be the case.

Over the past year, [Aaron Christophel] has been working on a replacement firmware for these Xiomi sensors that unlocks the data so you can use it however you see fit. In addition, it allows the user to tweak various features and settings that were previously unavailable. For example, you can disable the little ASCII-art smiley face that usually shows on the LCD to indicate the relative comfort level of the room.

The new firmware publishes the temperature, humidity, and battery level every minute through a BLE advertisement broadcast. In other words, that means client devices can read data from the sensor without having to be paired. Scraping this data is quite simple, and the GitHub page includes a breakdown of what each byte in the broadcast message means. Avoiding direct connections not only makes it easier to quickly read the values from multiple thermometers, but should keep the device’s CR2032 battery going for longer.

But perhaps the most impressive part of this project is how you get the custom firmware installed. You don’t need to crack the case or solder up a programmer. Just load the flasher page on a computer and browser combo that supports Web Bluetooth (a smartphone is probably the best bet), point it to the MAC address of the thermometer you want to flash, and hit the button. [Aaron] is no stranger to developing user-friendly OTA installers for his firmware projects, but even for him, it’s quite impressive.

27 thoughts on “Custom Firmware For Cheap Bluetooth Thermometers

    1. Hey, this will work the same, it will most likely be needed to open the device once to flash the telink ota protocol if its not used on stock firmware.
      If it uses a different ota protocoll that could also be “hacked”
      Most of the TLSR8266 or 8251 watches have no OTA enabled

  1. Was trying to understand what CPU architecture this is using.
    The datasheet for the telink only calls it 32 bit risc.
    The makefile compiles the firmware with “tc32-elf-gcc”. Is this some custome architecture? Do anyone know about it?

  2. Nice , thanks a lot ! If program space is available , a nice future hack could be an indoor / outdoor temperature display set with two sensors ! First sensor could transmit actual outdoors temp data to a second sensor (inside ) displaying received data / indoor temp . ( First sensor advertising outdoor temp , second sensor displaying advertised data )

    1. Communication between two low power devices is hard. You need super tight sync, or else longer listen intervals that you want.

      High power to low power is easy, just listen for the beacon that says the LP device is awake.

  3. Interesting. First time I’ve heard of Telink TC32.

    I use RuuviTags for this exact application: indoor, outdoor, fridge, garage and greenhouse temperature and humidity monitoring. No display and they’re not price competitive with these Xiaomi devices due to economies of scale, but they’re open source, run an ARM Cortex M4 core (512 kB flash, 64 kB RAM) and have temperature, humidity, pressure and accelerometer sensors built in. Might be a better fit for some of the commenters here.

    https://ruuvi.com

  4. I don’t get the point of these. You can see the temperature on the display and also on your phone if you are standing within a few meters of it? Maybe you can log changes over time?

    Would seem to be more useful if it had wifi, e.g. it was ESP32 based.

    1. The point is they are small and battery powered for upwards of a year on a coin cell battery. ESP8266/ESP32 or any other wifi sensor will be way too power hungry for this – even using sleep and waking only every 5-10 minutes they would still need a large battery pack just to make it a month or so.

      Individually they aren’t all that useful, but as a component in a more comprehensive smarthome system, they can be a great addition, for a cheap price.

      I saw this on Youtube a few weeks back, and ordered up 8 to try out. Just got them reprogrammed and integrated into HomeAssistant. Each one broadcasts out a Bluetooth packet containing Temp/Humidity/Battery once per minute. I have a single ESP32 in my network closet running ESPHome that captures the readings and forwards them onto HA, where they are logged/graphed, and can trigger automations. A couple of my sensors are 30-50 ft from the ESP32, through several walls and still receiving just fine.

      For example, I’ve got one in our bathroom. It can sense when someone is showering because the humidity spikes from ~55% to ~70%. I’ll be setting up an automaton to trigger the bathroom fan to run for 10 minutes when this sensor spikes more than 10% above the other ones in the house.

      I can also use them as auxiliary sensors to influence how our HVAC operates – if upstairs sensors are more than maybe 5-6°F above the downstairs sensors, I could trigger the furnace fan to run and recirculate.

      Or if I had a whole-house fan, I could trigger it to run in the summers when the outdoor temperature drops below indoor overnight. Instead we usually use a box fan in the window, but I can still setup an alert to tell me it’s time to open up.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.