Custom Firmware For Cheap Bluetooth Thermometers

The Xiaomi LYWSD03MMC temperature and humidity sensor is ridiculously cheap. If you’re buying a few at a time, you can expect to pay as little as $5 USD a pop for these handy Bluetooth Low Energy environmental sensors. Unfortunately, that low price tag comes with a bit of a catch: you can only read the data with the official Xiaomi smartphone application or by linking it to one of the company’s smart home hubs. Or at least, that used to be the case.

Over the past year, [Aaron Christophel] has been working on a replacement firmware for these Xiomi sensors that unlocks the data so you can use it however you see fit. In addition, it allows the user to tweak various features and settings that were previously unavailable. For example, you can disable the little ASCII-art smiley face that usually shows on the LCD to indicate the relative comfort level of the room.

The new firmware publishes the temperature, humidity, and battery level every minute through a BLE advertisement broadcast. In other words, that means client devices can read data from the sensor without having to be paired. Scraping this data is quite simple, and the GitHub page includes a breakdown of what each byte in the broadcast message means. Avoiding direct connections not only makes it easier to quickly read the values from multiple thermometers, but should keep the device’s CR2032 battery going for longer.

But perhaps the most impressive part of this project is how you get the custom firmware installed. You don’t need to crack the case or solder up a programmer. Just load the flasher page on a computer and browser combo that supports Web Bluetooth (a smartphone is probably the best bet), point it to the MAC address of the thermometer you want to flash, and hit the button. [Aaron] is no stranger to developing user-friendly OTA installers for his firmware projects, but even for him, it’s quite impressive.

52 thoughts on “Custom Firmware For Cheap Bluetooth Thermometers

    1. Hey, this will work the same, it will most likely be needed to open the device once to flash the telink ota protocol if its not used on stock firmware.
      If it uses a different ota protocoll that could also be “hacked”
      Most of the TLSR8266 or 8251 watches have no OTA enabled

  1. Was trying to understand what CPU architecture this is using.
    The datasheet for the telink only calls it 32 bit risc.
    The makefile compiles the firmware with “tc32-elf-gcc”. Is this some custome architecture? Do anyone know about it?

  2. Nice , thanks a lot ! If program space is available , a nice future hack could be an indoor / outdoor temperature display set with two sensors ! First sensor could transmit actual outdoors temp data to a second sensor (inside ) displaying received data / indoor temp . ( First sensor advertising outdoor temp , second sensor displaying advertised data )

    1. Communication between two low power devices is hard. You need super tight sync, or else longer listen intervals that you want.

      High power to low power is easy, just listen for the beacon that says the LP device is awake.

  3. Interesting. First time I’ve heard of Telink TC32.

    I use RuuviTags for this exact application: indoor, outdoor, fridge, garage and greenhouse temperature and humidity monitoring. No display and they’re not price competitive with these Xiaomi devices due to economies of scale, but they’re open source, run an ARM Cortex M4 core (512 kB flash, 64 kB RAM) and have temperature, humidity, pressure and accelerometer sensors built in. Might be a better fit for some of the commenters here.

    https://ruuvi.com

  4. I don’t get the point of these. You can see the temperature on the display and also on your phone if you are standing within a few meters of it? Maybe you can log changes over time?

    Would seem to be more useful if it had wifi, e.g. it was ESP32 based.

    1. The point is they are small and battery powered for upwards of a year on a coin cell battery. ESP8266/ESP32 or any other wifi sensor will be way too power hungry for this – even using sleep and waking only every 5-10 minutes they would still need a large battery pack just to make it a month or so.

      Individually they aren’t all that useful, but as a component in a more comprehensive smarthome system, they can be a great addition, for a cheap price.

      I saw this on Youtube a few weeks back, and ordered up 8 to try out. Just got them reprogrammed and integrated into HomeAssistant. Each one broadcasts out a Bluetooth packet containing Temp/Humidity/Battery once per minute. I have a single ESP32 in my network closet running ESPHome that captures the readings and forwards them onto HA, where they are logged/graphed, and can trigger automations. A couple of my sensors are 30-50 ft from the ESP32, through several walls and still receiving just fine.

      For example, I’ve got one in our bathroom. It can sense when someone is showering because the humidity spikes from ~55% to ~70%. I’ll be setting up an automaton to trigger the bathroom fan to run for 10 minutes when this sensor spikes more than 10% above the other ones in the house.

      I can also use them as auxiliary sensors to influence how our HVAC operates – if upstairs sensors are more than maybe 5-6°F above the downstairs sensors, I could trigger the furnace fan to run and recirculate.

      Or if I had a whole-house fan, I could trigger it to run in the summers when the outdoor temperature drops below indoor overnight. Instead we usually use a box fan in the window, but I can still setup an alert to tell me it’s time to open up.

  5. Hi, thank you for your work, very interesting.

    A question: thermometer send values below 0° C ? I’m planning to put one outside my house and another one inside to measure difference.

  6. A bit off topic but … related nonetheless :-).

    Keen to do the Firmware update ended up buying about a dozen sensors. Because, you know, it is sooo much cheaper …

    Unfortunately couldn’t connect with any sensor. Not even listed as a Bluetooth device.
    Maybe an iPhone is not the best Firmware updating tool.

    HOWEVER … as I had sooo many sensors I turned on many of them and put them side to side, next to each other.

    Then I noticed temperature and humidity varies QUITE A LOT between sensors.
    Sometimes more than a degree and a half Centigrade.
    Same with percentage of humidity.

    That make me think: Am I the only one expecting better accuracy? Like no more than 0.2 of a degree of difference for the temperature?

    Curious to know if someone else had the same experience and accuracy disappointment.

  7. Hey, I decided to give this a try and it is indeed very interesting. I found two problems, tough, that limit usability in my particular setup. One, I don’t seem to be able to view the decoded T and H values in the data streams from an iphone BLE scanner app. The other, more important, is that once the devices are flashed with the custom firm it is impossible to pair them with the Xiaomi IOS app (the devices are detected but the pairing results in error code 102). The second problem is quite limiting for me.

    1. Aaron has said clearly in his youtube video that the original firmware is advertising encrypted data and uses a bind key . Original xiaomi app uses this bind key to decrypt the encrypted advertised data . So, if you need the xiaomi app you use the original firmware …

      If you use Aaron’s hacked firmware , there is no need for bind key , encryption etc and you can read data from sniffing advertised unencrypted temperature/humidity/battery data using an ordinary BLE sniffer . So if you need a generic sniffer , you use Aaron’s firmware ! However , xiaomi app cannot use these data , anymore. Aaron explains how you can flash back the original firmware if you insist on using xiaomi app!

  8. I have three of these, and I can not get anything to connect to them, aside from the xiaomi app.
    Trying a Raspberry PI4, hcitool lescan sees it, and 2 different iphones, that can connect to the devices with the xiaomi app . But I can never get the Telink Flasher Website to connect. Any help, please?

  9. Not sure it this was intended, but I flashed per the author’s suggestion to Victor’s version for power management. Subsequent attempts to use the author’s site with the cool buttons to change C/F, reporting interval, etc. appeared ineffective. I then flashed the author’s version, and all that stuff worked fine. Since I’m not a coder, I’ll stick with ease-of-use, even if that means less optimal battery life.

    1. I ran into a situation where the web application of a different for a different firmware didh’t appear to work. It is important to use the web based tool with the matching firmware. https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html is the configuration URL for firmwares from https://github.com/pvvx/ATC_MiThermometer. That is different than the links in the article (orig firmware https://github.com/atc1441/ATC_MiThermometer).

  10. Hey. I am using this firmware with few sensors, but I have one problem – screen refresh is very slow with custom firmware (c.a. minute or more in custm vs 7 seconds in stock). Any way to handle this?

  11. Great work, got 6 of these for 30€ (from Bangood), flashed them with your firmware and by using nodejs and noble module (https://github.com/abandonware/noble) on a RPi 2 Model B with USB Bluetooth adapter, I manage to read and store temperature, humidity and battery levels.

    However, I have one question about the performance and battery life of the sensors. I start BLE devices discovery (only for UUID 181A), and I get the data in the onDiscover event. After some time (e.g. 10 seconds) I stop devices discovery and after 5 minutes I start again. And that’s how I get data from my sensors every 5 minutes.

    Is this OK or I should connect to each device individualy and listen for advertisements? I ask this because some sensors droped battery level from 100% to 96% in just 24 hours, I can’t see how these would last for 6 months.

    Thanks anyway, amazing job!

  12. Great video,
    I think I will use some of these for temperature control in my house. But on additional question. does the device log the temperature if it is not connected to bluetooth? I have one case where I the sensor will be mobile and should export all temperatures of the day when connected in the evening.
    If this is not possible, does anyone know a flashable sensor that ist capable of logging data?

  13. I successfully flashed a couple of devices but now the OTA flasher won’t pair. It just says “Detected custom Firmware” and stops. (Sorry if this is already answered.)

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.