Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Firmware via OTA for LYWSD03MMC version 2.1.1_0159 #602

Open
pvvx opened this issue Jan 14, 2025 · 16 comments
Open

Firmware via OTA for LYWSD03MMC version 2.1.1_0159 #602

pvvx opened this issue Jan 14, 2025 · 16 comments
Labels
documentation Improvements or additions to documentation

Comments

@pvvx
Copy link
Owner

pvvx commented Jan 14, 2025 •
edited
Loading

Обновление LYWSD03MMC ver2.1.1_0159

В текущем варианте требуется:

  1. Зарегистрировать термометр в MiHome.
  2. С помощью альтернативного ПО получить все ключи для данного термометра.
  3. Запустить TelinkMiFlasher.html и соединиться с термометром.
  4. Ввести "Device known id", "Mi Token", "Mi Bind Key" и выбрать "Login"
  5. Выбрать прошивку "ATC_vNN" и запустить OTA.

Если это не сработало, тогда необходимо обновить оригинальную прошивку.
Выбрать предлагаемый “Original_OTA_....” и “Start Flashing”:

image

Текущая версия поддерживает 2 типа прошивки версии 2.1.1_0159. О существовании ещё вариантов пока не известно. Но обновление на приложенную оригинальную прошивку решает такие вопросы.

Шаги по установке Zigbee версии указаны в #602 (comment)

Update LYWSD03MMC ver2.1.1_0159

The current version requires:

  1. Register the thermometer in MiHome.
  2. Using alternative software, get all the keys for this thermometer.
  3. Run TelinkMiFlasher.html and connect to the thermometer.
  4. Enter "Device known id", "Mi Token", "Mi Bind Key" and select "Login"
  5. Select the firmware "ATC_vNN" and run OTA.

If this does not work, then you need to update the original firmware.
Select the suggested “Original_OTA_....” and “Start Flashing”:
image
The current version supports 2 types of firmware version 2.1.1_0159. The existence of other options is not yet known. But updating to the attached original firmware solves such issues.

The steps for installing the Zigbee version are listed in #602 (comment)

Alternative options from "atc1441":

Video Demo of Full OTA update of 2.1.1_0159 aka no wires needed. https://youtu.be/NfZHh6wmTp8

Find the MiHome Token Extractor here: https://github.com/PiotrMachowski/Xiaomi-cloud-tokens-extractor
@BelgarionNL
Copy link

BelgarionNL commented Jan 14, 2025 •
edited
Loading

1
2
3

then I try to reconnect the display turns weird (bricks?). and I cant find it in the list. I have to remove the battery and then its back to version 0159 and I can try again.

I tried with both ATC_v49 and exploit.

@pvvx
Copy link
Owner Author

pvvx commented Jan 14, 2025 •
edited
Loading

For unknown, different from the latest version FW 2.1.1_0159, wait for the new version (v9.1) TelinkMiFlasher.html.
Depresated, "TelinktiFlasher.html" updated. View first message.

Or:
1. Download the file https://github.com/pvvx/ATC_MiThermometer/raw/refs/heads/master/Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin
2. Run [TelinkMiFlasher.html](https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html). Connect...
3. Run "Login".
4. Without closing "TelinkMiFlasher.html", run [TelinkOTA.html](https://pvvx.github.io/ATC_MiThermometer/TelinkOTA.html)
5. In "TelinkOTA.html", select the file "Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin", Connect and run OTA.

This should install the correct original version 2.1.1_0159.

@pvvx pvvx mentioned this issue Jan 14, 2025
Open
@BelgarionNL
Copy link

yep works!

@fl0rian089
Copy link

just tried this and it worked, thank you very much.

which zigbee firmware is possible after the atc exploit?

@pvvx
Copy link
Owner Author

pvvx commented Jan 14, 2025 •
edited
Loading

which zigbee firmware is possible after the atc exploit?

None. The Zigbee firmware size may exceed the maximum OTA size for flashing via "ATC_Exploit.bin".
Also, typical BLE OTA (from SDK) can load Zigbee FW into wrong Flash area.

Only via the BLE version specified in TelinkMiFlasher.html (ext.OTA is used).

image

image

image

If you need to record another version of Zigbee, then copy the link to the raw file "https://...raw/.../*.zigbee" to download.

TelinkMiFlasher.html log of all actions:

22:17:34: Searching for devices
22:17:37: Connecting to: LYWSD03MMC
22:17:50: Hardware Revision String: 0000
22:17:50: Software Revision String: 0159
22:17:50: Firmware Revision String: 2.1.1_0159
22:17:50: Detected Mi device
22:17:50: Connected
22:18:37: Send Login, please wait...
22:18:38: Received device infos are correct
22:18:38: Login successful
22:18:39: Load firmware file 'ATC_v49.bin'...
22:18:39: File: ATC_v49.bin
22:18:39: File size: 83092 bytes
22:18:40: Add signature file.
22:18:40: Count: 5516
22:19:04: Start DFU
22:19:47: Update done after 42.034 seconds
22:19:53: Disconnected.
22:21:17: Reconnect
22:21:24: NetworkError: Connection Error: Connection attempt failed.
22:21:24: Reconnect 1 from 5
22:21:29: Hardware Revision String: B1.6
22:21:29: Software Revision String: V4.9
22:21:29: Firmware Revision String: github.com/pvvx
22:21:29: Detected custom Firmware
22:21:29: Hardware Version: LYWSD03MMC B1.6, Software Version: 4.9
22:21:29: Custom config HEX string: 55871000002804a9313104b4
22:21:47: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
22:21:48: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
22:21:48: File size: 128692 bytes
22:21:48: Count: 8044
22:22:04: Start DFU
22:22:46: Update done after 41.03 seconds
22:22:50: Disconnected.

Zigbee is ready to pair...

image

image

@itsmepete
Copy link

Yesterday I followed your work-around with v9.0 to flash to custom ATC. That worked fine as described.
In the next step I flashed with the following file to get it zigbee ready. https://github.com/devbis/z03mmc/releases/download/1.1.0/z03mmc.bin

The log file said it was disconnected due to an unknown error and since then the screen stays off. I have tried to reset it by taking out the battery and also by shorting the RESET & GROUND without success.

But as of the latest post I saw that there is actually a newer file for the zigbee binary. I was not aware of that.

So I repeated everything following your guide above with another sensor that I have. Works for me.

Any chance I can revive the first sensor that apparently was flashed with an older .bin file?

Thanks, really appreciate the guide above with step-by-step instruction.

@adnn-alc
Copy link

Any idea what do do if device is kind of bricked? Tried UART flashing but screen is blank, only slightly visible if I look at it from the side. Help is appreciated.

@pvvx
Copy link
Owner Author

pvvx commented Jan 16, 2025

Yesterday I followed your work-around with v9.0 to flash to custom ATC. That worked fine as described. In the next step I flashed with the following file to get it zigbee ready. https://github.com/devbis/z03mmc/releases/download/1.1.0/z03mmc.bin

This firmware is from devbis and it is not adapted for loading via standard BLE OTA.
You will have to act as indicated on https://github.com/devbis/z03mmc/blob/master/README.md.

@mfatgt
Copy link

mfatgt commented Jan 16, 2025 •
edited
Loading

Hello @pvvx,

Thanks a lot for your valuable work.

on SKU: NUN4106CN

I have first flashed the original stock, then the exploit. The display showed all letters afterwards. After removing battery, it reverts back to original stock.

Edit:
11:16:32: Hardware Revision String: B1.5
11:16:32: Software Revision String: 0159
11:16:32: Firmware Revision String: 2.1.1_0159

@pvvx
Copy link
Owner Author

pvvx commented Jan 16, 2025

I have first flashed the original stock, then the exploit.

What other "exploit"?

@mfatgt
Copy link

mfatgt commented Jan 16, 2025

Sorry, I meant the custom firmware.

@pvvx
Copy link
Owner Author

pvvx commented Jan 16, 2025 •
edited
Loading

I have first flashed the original stock

Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin ?

@mfatgt
Copy link

mfatgt commented Jan 16, 2025 •
edited
Loading

Hello @pvvx ,
I was fortunately able to flash custom firmware as well as zigbee.

On #602 (comment) , the reconnect on 7. took 3 attempts to connect to the device.

1:11:08: Searching for devices
11:11:11: Get Advertising MAC (Web Experimental Features!)
11:11:11: Connecting to: LYWSD03MMC
11:12:48: Searching for devices
11:12:52: Get Advertising MAC (Web Experimental Features!)
11:12:52: Connecting to: LYWSD03MMC
11:13:54: Searching for devices
11:13:59: NotFoundError: User cancelled the requestDevice() chooser.
11:13:59: Reconnect 1 from 5
11:13:59: Searching for devices
11:14:10: NotFoundError: User cancelled the requestDevice() chooser.
11:14:10: Reconnect 1 from 5
11:14:10: NetworkError: Connection Error: Connection attempt failed.
11:14:10: Reconnect 2 from 5
11:14:11: Disconnected.
11:14:11: Searching for devices
11:14:16: NotFoundError: User cancelled the requestDevice() chooser.
11:14:16: Reconnect 1 from 5
11:14:16: Disconnected.
11:14:16: Searching for devices
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:15:40: Get Advertising MAC (Web Experimental Features!)
11:15:40: Connecting to: LYWSD03MMC
11:16:10: Reconnect
11:16:18: NetworkError: Connection Error: Connection attempt failed.
11:16:18: Reconnect 1 from 5
11:16:32: Hardware Revision String: B1.5
11:16:32: Software Revision String: 0159
11:16:32: Firmware Revision String: 2.1.1_0159
11:16:32: Detected Mi device
11:16:32: Connected
11:17:15: Send Login, please wait...
11:17:16: Received device infos are correct
11:17:16: Login successful
11:17:24: Load firmware file 'Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin'...
11:17:24: File: Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin
11:17:24: File size: 105760 bytes
11:17:24: Count: 6610
11:17:25: Start DFU
11:19:30: Update done after 124.252 seconds
11:19:41: Disconnected.
11:19:57: Reconnect
11:20:08: Hardware Revision String: B1.5
11:20:08: Software Revision String: 0159
11:20:08: Firmware Revision String: 2.1.1_0159
11:20:08: Detected Mi device
11:20:08: Connected
11:20:24: Send Login, please wait...
11:20:25: Received device infos are correct
11:20:25: Login successful
11:20:30: Load firmware file 'ATC_v49.bin'...
11:20:30: File: ATC_v49.bin
11:20:30: File size: 83092 bytes
11:20:30: Add signature file.
11:20:30: Count: 5516
11:20:31: Start DFU
11:22:15: Update done after 103.354 seconds
11:22:22: Disconnected.
11:22:27: Reconnect
11:22:35: NetworkError: Connection Error: Connection attempt failed.
11:22:35: Reconnect 1 from 5
11:22:42: NetworkError: Connection Error: Connection attempt failed.
11:22:42: Reconnect 2 from 5
11:22:50: NetworkError: Connection Error: Connection attempt failed.
11:22:50: Reconnect 3 from 5
11:22:58: NetworkError: Connection Error: Connection attempt failed.
11:22:58: Reconnect 4 from 5
11:23:06: NetworkError: Connection Error: Connection attempt failed.
11:23:06: Reconnect 5 from 5
11:23:13: NetworkError: Connection Error: Connection attempt failed.
11:23:13: Something went wrong, too many reconnects
11:23:22: Reconnect
11:23:30: NetworkError: Connection Error: Connection attempt failed.
11:23:30: Reconnect 1 from 5
11:23:41: NetworkError: Connection Error: Connection attempt failed.
11:23:41: Reconnect 2 from 5
11:23:41: Disconnected.
11:23:41: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:23:55: Reconnect
11:24:22: Hardware Revision String: B1.5
11:24:22: Software Revision String: V4.9
11:24:22: Firmware Revision String: github.com/pvvx
11:24:22: Detected custom Firmware
11:24:24: Hardware Version: LYWSD03MMC B1.5, Software Version: 4.9
11:24:24: Custom config HEX string: 55071000002804a931310ab4
11:24:44: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
11:24:44: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
11:24:44: File size: 128692 bytes
11:24:44: Count: 8044
11:24:46: Start DFU
11:24:52: Update error: NotSupportedError: GATT operation failed for unknown reason.
11:24:52: Disconnected.
11:25:02: Reconnect
11:25:25: Disconnected.
11:25:25: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:25:44: Reconnect
11:26:48: Disconnected.
11:26:48: Reconnect
11:26:52: Disconnected.
11:26:52: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:26:52: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:26:59: Reconnect
11:27:40: Disconnected.
11:27:40: Reconnect
11:27:40: Detected custom Firmware
11:27:40: TypeError: Cannot read properties of null (reading 'getPrimaryService')
11:27:40: Reconnect 1 from 5
11:27:46: Disconnected.
11:27:46: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:27:46: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:27:56: Reconnect
11:28:36: Hardware Revision String: B1.5
11:28:36: Software Revision String: V4.9
11:28:36: Firmware Revision String: github.com/pvvx
11:28:36: Detected custom Firmware
11:28:38: Hardware Version: LYWSD03MMC B1.5, Software Version: 4.9
11:28:38: Custom config HEX string: 55071000002804a931310ab4
11:28:51: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
11:28:51: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
11:28:51: File size: 128692 bytes
11:28:51: Count: 8044
11:28:53: Start DFU
11:30:29: Update done after 94.682 seconds
11:30:33: Disconnected.

@pvvx
Copy link
Owner Author

pvvx commented Jan 16, 2025 •
edited
Loading

On some BT adapters, a reset is required after each reflashing. Otherwise, the adapter remembers the old version of the previous firmware headers.
If it is USB-BT, then reconnect the adapter to the USB port.
In other cases, you need to restart your computer and/or Explorer. Reset cache.

@dasrohr
Copy link

dasrohr commented Jan 17, 2025

Thank you, guys.
Thank you for your persistence and all the work you put into this project

I just bought a bunch of these thermometers which came with the new firmware from the factory.
Luckily, you already worked out how to flash those without UART.

Can confirm that the new method is indeed working. Flashed 10 Decices with Custom Firmware and converted them to Zigbee.

thanks again, and keep up this incredible work.

@benswinburne benswinburne mentioned this issue Jan 17, 2025
Open
@Andurilll
Copy link

amazing how you fixed this problem with the newest firmware! Thank you!

@pvvx pvvx added the documentation Improvements or additions to documentation label Jan 20, 2025
This was referenced Jan 21, 2025
Open
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
documentation Improvements or additions to documentation
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
8 participants
@mfatgt @BelgarionNL @dasrohr @pvvx @adnn-alc @itsmepete @Andurilll @fl0rian089