Firmware via OTA for LYWSD03MMC version 2.1.1_0159

[pvvx]

Обновление LYWSD03MMC ver2.1.1_0159

В текущем варианте требуется:

1. Зарегистрировать термометр в MiHome.
2. С помощью альтернативного ПО получить все ключи для данного термометра.
3. Запустить TelinkMiFlasher.html и соединиться с термометром.
4. Ввести "Device known id", "Mi Token", "Mi Bind Key" и выбрать "Login"
5. Выбрать прошивку "ATC_vNN" и запустить OTA.

Если это не сработало, тогда необходимо обновить оригинальную прошивку.
Выбрать предлагаемый “Original_OTA_....” и “Start Flashing”:

Текущая версия поддерживает 2 типа прошивки версии 2.1.1_0159. О существовании ещё вариантов пока не известно. Но обновление на приложенную оригинальную прошивку решает такие вопросы.

Шаги по установке Zigbee версии указаны в #602 (comment)

---

Update LYWSD03MMC ver2.1.1_0159

The current version requires:

1. Register the thermometer in MiHome.
2. Using alternative software, get all the keys for this thermometer.
3. Run TelinkMiFlasher.html and connect to the thermometer.
4. Enter "Device known id", "Mi Token", "Mi Bind Key" and select "Login"
5. Select the firmware "ATC_vNN" and run OTA.

If this does not work, then you need to update the original firmware.
Select the suggested “Original_OTA_....” and “Start Flashing”:

The current version supports 2 types of firmware version 2.1.1_0159. The existence of other options is not yet known. But updating to the attached original firmware solves such issues.

The steps for installing the Zigbee version are listed in #602 (comment)

---

Alternative options from "atc1441":

Video Demo of Full OTA update of 2.1.1_0159 aka no wires needed. https://youtu.be/NfZHh6wmTp8

Find the MiHome Token Extractor here: https://github.com/PiotrMachowski/Xiaomi-cloud-tokens-extractor

[BelgarionNL]

then I try to reconnect the display turns weird (bricks?). and I cant find it in the list. I have to remove the battery and then its back to version 0159 and I can try again.

I tried with both ATC_v49 and exploit.

[pvvx]

For unknown, different from the latest version FW 2.1.1_0159, wait for the new version (v9.1) TelinkMiFlasher.html.
Depresated, "TelinktiFlasher.html" updated. View first message.

Or:
1. Download the file https://github.com/pvvx/ATC_MiThermometer/raw/refs/heads/master/Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin
2. Run [TelinkMiFlasher.html](https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html). Connect...
3. Run "Login".
4. Without closing "TelinkMiFlasher.html", run [TelinkOTA.html](https://pvvx.github.io/ATC_MiThermometer/TelinkOTA.html)
5. In "TelinkOTA.html", select the file "Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin", Connect and run OTA.

This should install the correct original version 2.1.1_0159.

[BelgarionNL]

yep works!

[fl0rian089]

just tried this and it worked, thank you very much.

which zigbee firmware is possible after the atc exploit?

[pvvx]

which zigbee firmware is possible after the atc exploit?

None. The Zigbee firmware size may exceed the maximum OTA size for flashing via "ATC_Exploit.bin".
Also, typical BLE OTA (from SDK) can load Zigbee FW into wrong Flash area.

Only via the BLE version specified in TelinkMiFlasher.html (ext.OTA is used).

---

---

If you need to record another version of Zigbee, then copy the link to the raw file "https://...raw/.../*.zigbee" to download.

TelinkMiFlasher.html log of all actions:

22:17:34: Searching for devices
22:17:37: Connecting to: LYWSD03MMC
22:17:50: Hardware Revision String: 0000
22:17:50: Software Revision String: 0159
22:17:50: Firmware Revision String: 2.1.1_0159
22:17:50: Detected Mi device
22:17:50: Connected
22:18:37: Send Login, please wait...
22:18:38: Received device infos are correct
22:18:38: Login successful
22:18:39: Load firmware file 'ATC_v49.bin'...
22:18:39: File: ATC_v49.bin
22:18:39: File size: 83092 bytes
22:18:40: Add signature file.
22:18:40: Count: 5516
22:19:04: Start DFU
22:19:47: Update done after 42.034 seconds
22:19:53: Disconnected.
22:21:17: Reconnect
22:21:24: NetworkError: Connection Error: Connection attempt failed.
22:21:24: Reconnect 1 from 5
22:21:29: Hardware Revision String: B1.6
22:21:29: Software Revision String: V4.9
22:21:29: Firmware Revision String: github.com/pvvx
22:21:29: Detected custom Firmware
22:21:29: Hardware Version: LYWSD03MMC B1.6, Software Version: 4.9
22:21:29: Custom config HEX string: 55871000002804a9313104b4
22:21:47: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
22:21:48: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
22:21:48: File size: 128692 bytes
22:21:48: Count: 8044
22:22:04: Start DFU
22:22:46: Update done after 41.03 seconds
22:22:50: Disconnected.

Zigbee is ready to pair...

---

[itsmepete]

Yesterday I followed your work-around with v9.0 to flash to custom ATC. That worked fine as described.
In the next step I flashed with the following file to get it zigbee ready. https://github.com/devbis/z03mmc/releases/download/1.1.0/z03mmc.bin

The log file said it was disconnected due to an unknown error and since then the screen stays off. I have tried to reset it by taking out the battery and also by shorting the RESET & GROUND without success.

But as of the latest post I saw that there is actually a newer file for the zigbee binary. I was not aware of that.

So I repeated everything following your guide above with another sensor that I have. Works for me.

Any chance I can revive the first sensor that apparently was flashed with an older .bin file?

Thanks, really appreciate the guide above with step-by-step instruction.

[adnn-alc]

Any idea what do do if device is kind of bricked? Tried UART flashing but screen is blank, only slightly visible if I look at it from the side. Help is appreciated.

[pvvx]

Yesterday I followed your work-around with v9.0 to flash to custom ATC. That worked fine as described. In the next step I flashed with the following file to get it zigbee ready. https://github.com/devbis/z03mmc/releases/download/1.1.0/z03mmc.bin

This firmware is from devbis and it is not adapted for loading via standard BLE OTA.
You will have to act as indicated on https://github.com/devbis/z03mmc/blob/master/README.md.

[mfatgt]

Hello @pvvx,

Thanks a lot for your valuable work.

on SKU: NUN4106CN

I have first flashed the original stock, then the exploit. The display showed all letters afterwards. After removing battery, it reverts back to original stock.

Edit:
11:16:32: Hardware Revision String: B1.5
11:16:32: Software Revision String: 0159
11:16:32: Firmware Revision String: 2.1.1_0159

[pvvx]

I have first flashed the original stock, then the exploit.

What other "exploit"?

[mfatgt]

Sorry, I meant the custom firmware.

[pvvx]

I have first flashed the original stock

Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin ?

[mfatgt]

Hello @pvvx ,
I was fortunately able to flash custom firmware as well as zigbee.

On #602 (comment) , the reconnect on 7. took 3 attempts to connect to the device.

1:11:08: Searching for devices
11:11:11: Get Advertising MAC (Web Experimental Features!)
11:11:11: Connecting to: LYWSD03MMC
11:12:48: Searching for devices
11:12:52: Get Advertising MAC (Web Experimental Features!)
11:12:52: Connecting to: LYWSD03MMC
11:13:54: Searching for devices
11:13:59: NotFoundError: User cancelled the requestDevice() chooser.
11:13:59: Reconnect 1 from 5
11:13:59: Searching for devices
11:14:10: NotFoundError: User cancelled the requestDevice() chooser.
11:14:10: Reconnect 1 from 5
11:14:10: NetworkError: Connection Error: Connection attempt failed.
11:14:10: Reconnect 2 from 5
11:14:11: Disconnected.
11:14:11: Searching for devices
11:14:16: NotFoundError: User cancelled the requestDevice() chooser.
11:14:16: Reconnect 1 from 5
11:14:16: Disconnected.
11:14:16: Searching for devices
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:15:40: Get Advertising MAC (Web Experimental Features!)
11:15:40: Connecting to: LYWSD03MMC
11:16:10: Reconnect
11:16:18: NetworkError: Connection Error: Connection attempt failed.
11:16:18: Reconnect 1 from 5
11:16:32: Hardware Revision String: B1.5
11:16:32: Software Revision String: 0159
11:16:32: Firmware Revision String: 2.1.1_0159
11:16:32: Detected Mi device
11:16:32: Connected
11:17:15: Send Login, please wait...
11:17:16: Received device infos are correct
11:17:16: Login successful
11:17:24: Load firmware file 'Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin'...
11:17:24: File: Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin
11:17:24: File size: 105760 bytes
11:17:24: Count: 6610
11:17:25: Start DFU
11:19:30: Update done after 124.252 seconds
11:19:41: Disconnected.
11:19:57: Reconnect
11:20:08: Hardware Revision String: B1.5
11:20:08: Software Revision String: 0159
11:20:08: Firmware Revision String: 2.1.1_0159
11:20:08: Detected Mi device
11:20:08: Connected
11:20:24: Send Login, please wait...
11:20:25: Received device infos are correct
11:20:25: Login successful
11:20:30: Load firmware file 'ATC_v49.bin'...
11:20:30: File: ATC_v49.bin
11:20:30: File size: 83092 bytes
11:20:30: Add signature file.
11:20:30: Count: 5516
11:20:31: Start DFU
11:22:15: Update done after 103.354 seconds
11:22:22: Disconnected.
11:22:27: Reconnect
11:22:35: NetworkError: Connection Error: Connection attempt failed.
11:22:35: Reconnect 1 from 5
11:22:42: NetworkError: Connection Error: Connection attempt failed.
11:22:42: Reconnect 2 from 5
11:22:50: NetworkError: Connection Error: Connection attempt failed.
11:22:50: Reconnect 3 from 5
11:22:58: NetworkError: Connection Error: Connection attempt failed.
11:22:58: Reconnect 4 from 5
11:23:06: NetworkError: Connection Error: Connection attempt failed.
11:23:06: Reconnect 5 from 5
11:23:13: NetworkError: Connection Error: Connection attempt failed.
11:23:13: Something went wrong, too many reconnects
11:23:22: Reconnect
11:23:30: NetworkError: Connection Error: Connection attempt failed.
11:23:30: Reconnect 1 from 5
11:23:41: NetworkError: Connection Error: Connection attempt failed.
11:23:41: Reconnect 2 from 5
11:23:41: Disconnected.
11:23:41: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:23:55: Reconnect
11:24:22: Hardware Revision String: B1.5
11:24:22: Software Revision String: V4.9
11:24:22: Firmware Revision String: github.com/pvvx
11:24:22: Detected custom Firmware
11:24:24: Hardware Version: LYWSD03MMC B1.5, Software Version: 4.9
11:24:24: Custom config HEX string: 55071000002804a931310ab4
11:24:44: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
11:24:44: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
11:24:44: File size: 128692 bytes
11:24:44: Count: 8044
11:24:46: Start DFU
11:24:52: Update error: NotSupportedError: GATT operation failed for unknown reason.
11:24:52: Disconnected.
11:25:02: Reconnect
11:25:25: Disconnected.
11:25:25: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:25:44: Reconnect
11:26:48: Disconnected.
11:26:48: Reconnect
11:26:52: Disconnected.
11:26:52: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:26:52: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:26:59: Reconnect
11:27:40: Disconnected.
11:27:40: Reconnect
11:27:40: Detected custom Firmware
11:27:40: TypeError: Cannot read properties of null (reading 'getPrimaryService')
11:27:40: Reconnect 1 from 5
11:27:46: Disconnected.
11:27:46: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:27:46: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:27:56: Reconnect
11:28:36: Hardware Revision String: B1.5
11:28:36: Software Revision String: V4.9
11:28:36: Firmware Revision String: github.com/pvvx
11:28:36: Detected custom Firmware
11:28:38: Hardware Version: LYWSD03MMC B1.5, Software Version: 4.9
11:28:38: Custom config HEX string: 55071000002804a931310ab4
11:28:51: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
11:28:51: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
11:28:51: File size: 128692 bytes
11:28:51: Count: 8044
11:28:53: Start DFU
11:30:29: Update done after 94.682 seconds
11:30:33: Disconnected.

[pvvx]

On some BT adapters, a reset is required after each reflashing. Otherwise, the adapter remembers the old version of the previous firmware headers.
If it is USB-BT, then reconnect the adapter to the USB port.
In other cases, you need to restart your computer and/or Explorer. Reset cache.

[dasrohr]

Thank you, guys.
Thank you for your persistence and all the work you put into this project

I just bought a bunch of these thermometers which came with the new firmware from the factory.
Luckily, you already worked out how to flash those without UART.

Can confirm that the new method is indeed working. Flashed 10 Decices with Custom Firmware and converted them to Zigbee.

thanks again, and keep up this incredible work.

[Andurilll]

amazing how you fixed this problem with the newest firmware! Thank you!

[mackva]

Привет @pvvx , спасибо за работу!

Я обновил прошивку на ATC_v49. Как написано в первом сообщение. На днях заметил что дисплей показывет старые данные, по блютузу шлются актуальные. Если вытащить батарейку, то дисплей тухнет, но датчик работает и шлёт данные.

Если перепрошить ещё раз дисплей начинает работать, но через 1-2 дня зависает.

Software Revision String: V4.9
Hardware Revision String: B1.5

[pvvx]

Кто-то включает опцию "отключение экрана"?
На B1.5 именно так это работает.

[griga123456]

Hi! Zigbee'd mine, but now I have a question...
Why is the smiley face always sad? My room temp is 24C, humidity is 34%. Well within the limits that are set in the manual. Is it because of the hack?
*also, it doesn't seem to send new data... it sent a couple of new readings and then stopped. I have to constantly re-pair it with my hub

[pvvx]

My room temp is 24C, humidity is 34%.

Default: 20..25C, 40..60%.

README

Google: The ideal average (office) room temperature varies between 20 and 23 °C and from 40 and 60 % relative humidity.

Depending on the level of humidity, the following room modes are distinguished: dry (less than 40%), normal (40÷50%), humid (50÷60%) or wet (over 60%).

I have to constantly re-pair it with my hub

Replace the hub with a normal one that supports Zigbee 3.0. A normal modern hub has a better reception level, which affects the communication distance.

The Zigbee network always crashes when the hub is disconnected. In this case, various devices often fall off. Install a standalone Zigbee router. The time before throwing out an unresponsive device is set in the settings. In ZHA, this is written in the code and is 55 minutes.

[griga123456]

Yandex Station Midi supports Zigbee 3.0, it's in the documentation. I don't want to use a standalone router, that defies the reason why i bought the little dingus. Plus the Speaker-hub is literally less than a meter away from each other.
The most frequently-polled data is the humidity, which, according to the graphs, was polled almost every minute, but for some reason the entire night was practically empty. Temperature is bad: no updates for over 6 hours at this point. Battery reports have the same time stamps as temperature. What could be wrong?
*the bluetooth icon does not appear (which, if i understand correctly, signalizes connection loss)

[pvvx]

Yandex Station Midi supports Zigbee 3.0, it's in the documentation.

Learn Zigbee 3.0 and set the correct Binding Clusters and Reporting parameters in Yandex Station Midi.

README: Support for Zigbee firmware is in the ZigbeeTLc repository.