Back in 2020, we first brought you word of the Xiaomi LYWSD03MMC — a Bluetooth Low Energy (BLE) temperature and humidity sensor that could be had from the usual sources for just a few dollars each. Capable of being powered by a single CR2032 battery for up to a year, the devices looked extremely promising for DIY smart home projects. There was only one problem, you needed to use Xiaomi’s app to read the data off of the things.
Enter [Aaron Christophel], who created an open source firmware for these units that could easily be flashed using a web-based tool from a smartphone in BLE range and opened up all sorts of advanced features. The firmware started getting popular, and a community developed around it. Everyone was happy. So naturally, years later, Xiaomi wants to put a stop to it.
Readers may recall when we first covered the $5 Xiaomi LYWSD03MMC temperature and humidity sensor back in 2020. Prolific hacker [Aaron Christophel] wrote a custom firmware for the affordable gadget that was so capable and well implemented that it kicked off a whole new community.
It’s recently been brought to our attention that the Xiaomi thermometer has become so popular that clones have started popping up. Often sold under the Tuya brand, these versions look very similar to Xiaomi’s offering but can be had for as little as $1 each from the usual Chinese importers. Even better, they’ve got their very own open-source custom firmware.
The firmware comes from [pvvx], who also helms the most active fork of [Aaron]’s original firmware for the Xiaomi thermometer. Doing a bit of spot-checking between the repositories, it’s not immediately clear that any meaningful code is shared between the two projects. However, once installed, they offer similar capabilities to the user, such as integration with Home Assistant. Perhaps the most significant difference between the two projects is that, at least for the initial flash, you need to hook the Tuya units up to your computer with a USB serial adapter. Considering that one of the highlights of the Xiaomi custom firmware was its exceptionally easy wireless installation, this is a considerable step backward.
Below is a video from a few months back that [Maker’s Fun Duck] put together, where he takes apart one of these clones and shows the installation process for the custom firmware. Our overall impression is that it’s probably worth the few extra dollars to get the original Xiaomi hardware, although the display on the clone seems much brighter. In any event, we’re always happy to see the community coming up with free and open-source firmware for an otherwise locked-down gadget.
Electric scooters have long been a hacker’s friend, Xiaomi ones in particular – starting with M365, the Xiaomi scooter family has expanded a fair bit. They do have a weak spot, like many other devices – the battery, something you expect to wear out.
Let’s say, one day the scooter’s diagnostics app shows one section of the battery going way below 3 volts. Was it a sudden failure of one of the cells that brought the whole stage down? Or perhaps, water damage after a hastily assembled scooter? Now, what if you measure the stages with a multimeter and it turns out they are perfectly fine?
Turns out, it might just be a single capacitor’s fault. In a YouTube video, [darieee] tells us all about debugging a Xiaomi M365 battery with such a fault – a BQ76930 controller being responsible for measuring battery voltages. The BMS (Battery Management System) board has capacitors in parallel with the cells, and it appears that some of these capacitors can go faulty.
Are you experiencing this particular fault? It’s easy to check – measure the battery stages and see if the information checks out with the readings in your scooter monitoring app of choice. Could this be a mechanical failure mode for this poor MLCC? Or maybe, a bad batch of capacitors? One thing is clear, this case is worth learning from, adding this kind of failure to your collection of fun LiIon pack tidbits. This pack seems pretty hacker-friendly – other packs lock up when anything is amiss, like the Ryobi batteries do, overdue for someone to really spill their secrets!
With the increase in popularity of Internet of Things (IoT) devices and their need to communicate wirelessly, there’s been a corresponding explosion of wireless protocols to chose from. Of course there’s Wi-Fi and Bluetooth, but for more specialized applications there are some other options like Z-Wave, LoRa, Sigfox, and Thread. There’s a decent amount of overlap in their capabilities too, so when [SHS] was investigating some low-cost Xiaomi sensors it was discovered that it is possible to convert them from their general purpose Bluetooth protocol over to the more IoT-specialized Zigbee protocol instead.
These combination temperature and humidity sensors have already been explored by [Aaron Christophel] who found that it’s possible to flash these devices with custom firmware. With that background, converting them from Bluetooth to Zigbee is not a huge leap. All that’s needed is the Zigbee firmware from [Ivan Belokobylskiy] aka [devbis] and to follow the steps put together by [SHS] which include a process for flashing the firmware using an over-the-air update and another using UART if the wireless updates go awry. Then it’s just a short process to pair the new Zigbee device to the network and the sensor is back up and running.
Converting from one wireless protocol to another might not seem that necessary, but using Bluetooth as an IoT network often requires proxy nodes as support devices, whereas Zigbee can communicate directly from the sensor to a hub like Home Assistant. Other Zigbee devices themselves can also act as a mesh network of sorts without needing proxy nodes. The only downside of this upgrade is that once the Bluetooth firmware has been replaced, the devices no longer has any Bluetooth functionality.
Scooter hacking is wonderful – you get to create a better scooter from a pre-made scooter platform, and sometimes you can do that purely through firmware modifications. Typically, hackers have been uploading firmware using Bluetooth OTA methods, and at some point, we’ve seen the always-popular Xiaomi scooters starting to get locked down. Today, we see [Daljeet Nandha] from [RoboCoffee] continue the research of the new Xiaomi scooter realities, where he finds that SWD flashing is way more of a viable avenue that we might’ve expected. Continue reading “Xiaomi Scooter Firmware Hacking Gets Hands-On”→
[Flamingo-tech]’s Xiaomi air purifier has a neat safety feature: it will refuse to run if a filter needs replacement. Of course, by “neat” we mean “annoying”. Especially when the purifier sure seems to judge a filter to be useless much earlier than it should. Is your environment relatively clean, and the filter still has legs? Are you using a secondary pre-filter to extend the actual filter’s life? Tough! Time’s up. Not only is this inefficient, but it’s wasteful.
Every Xiaomi filter contains an NTAG213 NFC tag with a unique ID and uses a unique password for communications, but how this password was generated (and therefore how to generate new ones) was not known. This meant that compatible tags recognized by the purifier could not be created. Until now, that is. [Flamingo-tech] has shared the discovery of how Xiaomi generates the password for communication between filter and purifier.
A small NFC sticker is now all it takes to have the purifier recognize a filter as new.
[Flamingo-tech] has long been a proponent of fooling Xiaomi purifiers into acting differently. In the past, this meant installing a modchip to hijack the DRM process. That’s a classic method of getting around nonsense DRM on things like label printers and dishwashers, but in this case, reverse-engineering efforts paid off.
It’s now possible to create simple NFC stickers that play by all the right rules. Is a filter’s time up according to the NFC sticker, but it’s clearly still good? Just peel that NFC sticker off and slap on a new one, and as far as the purifier is concerned, it’s a new filter!
If you’re interested in the reverse-engineering journey, there’s a GitHub repository with all the data. And for those interested in purchasing compatible NFC stickers, [Flamingo-tech] has some available for sale.
The “razor and blades model” probably set a lot of young hackers on their current trajectory. If we buy a widget, we want to pick our widget refills instead of going back to the manufacturer for their name-brand option. [Flamingo-Tech] was having none of it when they needed a new filter for their Xiaomi air purifier so they set out to fool it into thinking there was a genuine replacement fresh from the box. Unlike a razor handle, the air purifier can refuse to work if it is not happy, so the best option was to make a “mod-chip.”
The manufacturer’s filters have a Near-Field Communication (NFC) chip and antenna which talk to the base station. The controller receives the filter data via I2C, but the mod-chip replaces that transmitter and reassures the controller that everything is peachy in filter town. On top of the obvious hack here, [Flamingo-Tech] shows us how to extend filter life with inexpensive wraps, so that’s a twofer. You can create your own mod-chip from the open-source files or grab one from [Flamingo-Tech’s] Tindie store.
