Firmware via OTA for LYWSD03MMC version 2.1.1_0159

[pvvx]

Обновление LYWSD03MMC ver2.1.1_0159

В текущем варианте требуется:

1. Зарегистрировать термометр в MiHome.
2. С помощью альтернативного ПО получить все ключи для данного термометра.
3. Запустить TelinkMiFlasher.html и соединиться с термометром.
4. Ввести "Device known id", "Mi Token", "Mi Bind Key" и выбрать "Login"
5. Выбрать прошивку "ATC_vNN" и запустить OTA.

Если это не сработало, тогда необходимо обновить оригинальную прошивку.
Выбрать предлагаемый “Original_OTA_....” и “Start Flashing”:

Текущая версия поддерживает 2 типа прошивки версии 2.1.1_0159. О существовании ещё вариантов пока не известно. Но обновление на приложенную оригинальную прошивку решает такие вопросы.

Zigbee

Шаги по установке Zigbee версии указаны в #602 (comment)

• Примечание: FW atc1441-ATC_Exploit.bin может не поддерживать прошивку прошивки Zigbee через BLE OTA. BLE и ZigBee используют разные размеры и области адресов Flash для OTA. Прошивка FW Zigbee доступна только из варианта BLE со специальной расширенной функцией OTA. Все FW BLE из этого репозитория имеют эту функцию. FW ZigbeeTlc имеют функцию адаптации к загрузке в неправильную область через BLE OTA и другие несовместимые опции с загрузчиком Zigbee от Tuya. Включено автоматическое перемещение FW в рабочую область.

---

Update LYWSD03MMC ver2.1.1_0159

The current version requires:

1. Register the thermometer in MiHome.
2. Using alternative software, get all the keys for this thermometer.
3. Run TelinkMiFlasher.html and connect to the thermometer.
4. Enter "Device known id", "Mi Token", "Mi Bind Key" and select "Login"
5. Select the firmware "ATC_vNN" and run OTA.

If this does not work, then you need to update the original firmware.
Select the suggested “Original_OTA_....” and “Start Flashing”:

The current version supports 2 types of firmware version 2.1.1_0159. The existence of other options is not yet known. But updating to the attached original firmware solves such issues.

Zigbee

• Note: FW atc1441-ATC_Exploit.bin may not support flashing Zigbee firmware via BLE OTA. BLE and ZigBee use different Flash address areas for OTA. FW Zigbee firmware is only available from the BLE variant with a special extended OTA function. All FWs BLE from this repository have this function. FW ZigbeeTlc have the function of adaptation to loading into the wrong area via BLE OTA and other incompatible options with Zigbee boot-loader from Tuya. Automatic movement of FW to the working area is enabled.

The steps for installing the Zigbee version are listed in #602 (comment)

---

Alternative options from "atc1441":

Video Demo of Full OTA update of 2.1.1_0159 aka no wires needed. https://youtu.be/NfZHh6wmTp8

Find the MiHome Token Extractor here: https://github.com/PiotrMachowski/Xiaomi-cloud-tokens-extractor

[BelgarionNL]

then I try to reconnect the display turns weird (bricks?). and I cant find it in the list. I have to remove the battery and then its back to version 0159 and I can try again.

I tried with both ATC_v49 and exploit.

[pvvx]

For unknown, different from the latest version FW 2.1.1_0159, wait for the new version (v9.1) TelinkMiFlasher.html.
Depresated, "TelinktiFlasher.html" updated. View first message.

Or:
1. Download the file https://github.com/pvvx/ATC_MiThermometer/raw/refs/heads/master/Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin
2. Run [TelinkMiFlasher.html](https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html). Connect...
3. Run "Login".
4. Without closing "TelinkMiFlasher.html", run [TelinkOTA.html](https://pvvx.github.io/ATC_MiThermometer/TelinkOTA.html)
5. In "TelinkOTA.html", select the file "Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin", Connect and run OTA.

This should install the correct original version 2.1.1_0159.

[BelgarionNL]

yep works!

[fl0rian089]

just tried this and it worked, thank you very much.

which zigbee firmware is possible after the atc exploit?

[pvvx]

which zigbee firmware is possible after the atc exploit?

None. The Zigbee firmware size may exceed the maximum OTA size for flashing via "ATC_Exploit.bin".
Also, typical BLE OTA (from SDK) can load Zigbee FW into wrong Flash area.

Only via the BLE version specified in TelinkMiFlasher.html (ext.OTA is used).

---

---

If you need to record another version of Zigbee, then copy the link to the raw file "https://...raw/.../*.zigbee" to download.

TelinkMiFlasher.html log of all actions:

22:17:34: Searching for devices
22:17:37: Connecting to: LYWSD03MMC
22:17:50: Hardware Revision String: 0000
22:17:50: Software Revision String: 0159
22:17:50: Firmware Revision String: 2.1.1_0159
22:17:50: Detected Mi device
22:17:50: Connected
22:18:37: Send Login, please wait...
22:18:38: Received device infos are correct
22:18:38: Login successful
22:18:39: Load firmware file 'ATC_v49.bin'...
22:18:39: File: ATC_v49.bin
22:18:39: File size: 83092 bytes
22:18:40: Add signature file.
22:18:40: Count: 5516
22:19:04: Start DFU
22:19:47: Update done after 42.034 seconds
22:19:53: Disconnected.
22:21:17: Reconnect
22:21:24: NetworkError: Connection Error: Connection attempt failed.
22:21:24: Reconnect 1 from 5
22:21:29: Hardware Revision String: B1.6
22:21:29: Software Revision String: V4.9
22:21:29: Firmware Revision String: github.com/pvvx
22:21:29: Detected custom Firmware
22:21:29: Hardware Version: LYWSD03MMC B1.6, Software Version: 4.9
22:21:29: Custom config HEX string: 55871000002804a9313104b4
22:21:47: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
22:21:48: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
22:21:48: File size: 128692 bytes
22:21:48: Count: 8044
22:22:04: Start DFU
22:22:46: Update done after 41.03 seconds
22:22:50: Disconnected.

Zigbee is ready to pair...

---

[itsmepete]

Yesterday I followed your work-around with v9.0 to flash to custom ATC. That worked fine as described.
In the next step I flashed with the following file to get it zigbee ready. https://github.com/devbis/z03mmc/releases/download/1.1.0/z03mmc.bin

The log file said it was disconnected due to an unknown error and since then the screen stays off. I have tried to reset it by taking out the battery and also by shorting the RESET & GROUND without success.

But as of the latest post I saw that there is actually a newer file for the zigbee binary. I was not aware of that.

So I repeated everything following your guide above with another sensor that I have. Works for me.

Any chance I can revive the first sensor that apparently was flashed with an older .bin file?

Thanks, really appreciate the guide above with step-by-step instruction.

[adnn-alc]

Any idea what do do if device is kind of bricked? Tried UART flashing but screen is blank, only slightly visible if I look at it from the side. Help is appreciated.

[pvvx]

Yesterday I followed your work-around with v9.0 to flash to custom ATC. That worked fine as described. In the next step I flashed with the following file to get it zigbee ready. https://github.com/devbis/z03mmc/releases/download/1.1.0/z03mmc.bin

This firmware is from devbis and it is not adapted for loading via standard BLE OTA.
You will have to act as indicated on https://github.com/devbis/z03mmc/blob/master/README.md.

[mfatgt]

Hello @pvvx,

Thanks a lot for your valuable work.

on SKU: NUN4106CN

I have first flashed the original stock, then the exploit. The display showed all letters afterwards. After removing battery, it reverts back to original stock.

Edit:
11:16:32: Hardware Revision String: B1.5
11:16:32: Software Revision String: 0159
11:16:32: Firmware Revision String: 2.1.1_0159

[pvvx]

I have first flashed the original stock, then the exploit.

What other "exploit"?

[mfatgt]

Sorry, I meant the custom firmware.

[pvvx]

I have first flashed the original stock

Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin ?

[mfatgt]

Hello @pvvx ,
I was fortunately able to flash custom firmware as well as zigbee.

On #602 (comment) , the reconnect on 7. took 3 attempts to connect to the device.

1:11:08: Searching for devices
11:11:11: Get Advertising MAC (Web Experimental Features!)
11:11:11: Connecting to: LYWSD03MMC
11:12:48: Searching for devices
11:12:52: Get Advertising MAC (Web Experimental Features!)
11:12:52: Connecting to: LYWSD03MMC
11:13:54: Searching for devices
11:13:59: NotFoundError: User cancelled the requestDevice() chooser.
11:13:59: Reconnect 1 from 5
11:13:59: Searching for devices
11:14:10: NotFoundError: User cancelled the requestDevice() chooser.
11:14:10: Reconnect 1 from 5
11:14:10: NetworkError: Connection Error: Connection attempt failed.
11:14:10: Reconnect 2 from 5
11:14:11: Disconnected.
11:14:11: Searching for devices
11:14:16: NotFoundError: User cancelled the requestDevice() chooser.
11:14:16: Reconnect 1 from 5
11:14:16: Disconnected.
11:14:16: Searching for devices
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:15:40: Get Advertising MAC (Web Experimental Features!)
11:15:40: Connecting to: LYWSD03MMC
11:16:10: Reconnect
11:16:18: NetworkError: Connection Error: Connection attempt failed.
11:16:18: Reconnect 1 from 5
11:16:32: Hardware Revision String: B1.5
11:16:32: Software Revision String: 0159
11:16:32: Firmware Revision String: 2.1.1_0159
11:16:32: Detected Mi device
11:16:32: Connected
11:17:15: Send Login, please wait...
11:17:16: Received device infos are correct
11:17:16: Login successful
11:17:24: Load firmware file 'Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin'...
11:17:24: File: Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin
11:17:24: File size: 105760 bytes
11:17:24: Count: 6610
11:17:25: Start DFU
11:19:30: Update done after 124.252 seconds
11:19:41: Disconnected.
11:19:57: Reconnect
11:20:08: Hardware Revision String: B1.5
11:20:08: Software Revision String: 0159
11:20:08: Firmware Revision String: 2.1.1_0159
11:20:08: Detected Mi device
11:20:08: Connected
11:20:24: Send Login, please wait...
11:20:25: Received device infos are correct
11:20:25: Login successful
11:20:30: Load firmware file 'ATC_v49.bin'...
11:20:30: File: ATC_v49.bin
11:20:30: File size: 83092 bytes
11:20:30: Add signature file.
11:20:30: Count: 5516
11:20:31: Start DFU
11:22:15: Update done after 103.354 seconds
11:22:22: Disconnected.
11:22:27: Reconnect
11:22:35: NetworkError: Connection Error: Connection attempt failed.
11:22:35: Reconnect 1 from 5
11:22:42: NetworkError: Connection Error: Connection attempt failed.
11:22:42: Reconnect 2 from 5
11:22:50: NetworkError: Connection Error: Connection attempt failed.
11:22:50: Reconnect 3 from 5
11:22:58: NetworkError: Connection Error: Connection attempt failed.
11:22:58: Reconnect 4 from 5
11:23:06: NetworkError: Connection Error: Connection attempt failed.
11:23:06: Reconnect 5 from 5
11:23:13: NetworkError: Connection Error: Connection attempt failed.
11:23:13: Something went wrong, too many reconnects
11:23:22: Reconnect
11:23:30: NetworkError: Connection Error: Connection attempt failed.
11:23:30: Reconnect 1 from 5
11:23:41: NetworkError: Connection Error: Connection attempt failed.
11:23:41: Reconnect 2 from 5
11:23:41: Disconnected.
11:23:41: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:23:55: Reconnect
11:24:22: Hardware Revision String: B1.5
11:24:22: Software Revision String: V4.9
11:24:22: Firmware Revision String: github.com/pvvx
11:24:22: Detected custom Firmware
11:24:24: Hardware Version: LYWSD03MMC B1.5, Software Version: 4.9
11:24:24: Custom config HEX string: 55071000002804a931310ab4
11:24:44: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
11:24:44: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
11:24:44: File size: 128692 bytes
11:24:44: Count: 8044
11:24:46: Start DFU
11:24:52: Update error: NotSupportedError: GATT operation failed for unknown reason.
11:24:52: Disconnected.
11:25:02: Reconnect
11:25:25: Disconnected.
11:25:25: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:25:44: Reconnect
11:26:48: Disconnected.
11:26:48: Reconnect
11:26:52: Disconnected.
11:26:52: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:26:52: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:26:59: Reconnect
11:27:40: Disconnected.
11:27:40: Reconnect
11:27:40: Detected custom Firmware
11:27:40: TypeError: Cannot read properties of null (reading 'getPrimaryService')
11:27:40: Reconnect 1 from 5
11:27:46: Disconnected.
11:27:46: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:27:46: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:27:56: Reconnect
11:28:36: Hardware Revision String: B1.5
11:28:36: Software Revision String: V4.9
11:28:36: Firmware Revision String: github.com/pvvx
11:28:36: Detected custom Firmware
11:28:38: Hardware Version: LYWSD03MMC B1.5, Software Version: 4.9
11:28:38: Custom config HEX string: 55071000002804a931310ab4
11:28:51: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
11:28:51: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
11:28:51: File size: 128692 bytes
11:28:51: Count: 8044
11:28:53: Start DFU
11:30:29: Update done after 94.682 seconds
11:30:33: Disconnected.

[pvvx]

On some BT adapters, a reset is required after each reflashing. Otherwise, the adapter remembers the old version of the previous firmware headers.
If it is USB-BT, then reconnect the adapter to the USB port.
In other cases, you need to restart your computer and/or Explorer. Reset cache.

[dasrohr]

Thank you, guys.
Thank you for your persistence and all the work you put into this project

I just bought a bunch of these thermometers which came with the new firmware from the factory.
Luckily, you already worked out how to flash those without UART.

Can confirm that the new method is indeed working. Flashed 10 Decices with Custom Firmware and converted them to Zigbee.

thanks again, and keep up this incredible work.

[Andurilll]

amazing how you fixed this problem with the newest firmware! Thank you!

[mackva]

Привет @pvvx , спасибо за работу!

Я обновил прошивку на ATC_v49. Как написано в первом сообщение. На днях заметил что дисплей показывет старые данные, по блютузу шлются актуальные. Если вытащить батарейку, то дисплей тухнет, но датчик работает и шлёт данные.

Если перепрошить ещё раз дисплей начинает работать, но через 1-2 дня зависает.

Software Revision String: V4.9
Hardware Revision String: B1.5

[pvvx]

Кто-то включает опцию "отключение экрана"?
На B1.5 именно так это работает.

[griga123456]

Hi! Zigbee'd mine, but now I have a question...
Why is the smiley face always sad? My room temp is 24C, humidity is 34%. Well within the limits that are set in the manual. Is it because of the hack?
*also, it doesn't seem to send new data... it sent a couple of new readings and then stopped. I have to constantly re-pair it with my hub

[pvvx]

My room temp is 24C, humidity is 34%.

Default: 20..25C, 40..60%.

README

Google: The ideal average (office) room temperature varies between 20 and 23 °C and from 40 and 60 % relative humidity.

Depending on the level of humidity, the following room modes are distinguished: dry (less than 40%), normal (40÷50%), humid (50÷60%) or wet (over 60%).

I have to constantly re-pair it with my hub

Replace the hub with a normal one that supports Zigbee 3.0. A normal modern hub has a better reception level, which affects the communication distance.

The Zigbee network always crashes when the hub is disconnected. In this case, various devices often fall off. Install a standalone Zigbee router. The time before throwing out an unresponsive device is set in the settings. In ZHA, this is written in the code and is 55 minutes.

[griga123456]

Yandex Station Midi supports Zigbee 3.0, it's in the documentation. I don't want to use a standalone router, that defies the reason why i bought the little dingus. Plus the Speaker-hub is literally less than a meter away from each other.
The most frequently-polled data is the humidity, which, according to the graphs, was polled almost every minute, but for some reason the entire night was practically empty. Temperature is bad: no updates for over 6 hours at this point. Battery reports have the same time stamps as temperature. What could be wrong?
*the bluetooth icon does not appear (which, if i understand correctly, signalizes connection loss)

[pvvx]

Yandex Station Midi supports Zigbee 3.0, it's in the documentation.

Learn Zigbee 3.0 and set the correct Binding Clusters and Reporting parameters in Yandex Station Midi.

README: Support for Zigbee firmware is in the ZigbeeTLc repository.

[mackva]

Кто-то включает опцию "отключение экрана"? На B1.5 именно так это работает.

Hello, @pvvx !

i don't understand my case. i have 3 sensors (two with B1.5 hardware revision and one 1.2 hardware revision).

One senser with 1.5 has problem described above. After your answer i flashed different firmwares.

it broke. i took out the battery for a week. on the weekend i decided to connect it and it came back to life and now it works well.

it looks like some kind of hardware error

Thank you!

[Neverhood2005]

у меня есть термометр LYWSD03MMC. На экране температура была в градуса Цельсия.Оригинальная прошивка была "Firmware Revision String: 2.1.1_0159", "Hardware Revision String: B1.5", "Software Revision String: 0159". Обновил прошивку сначала на "ATC_v50.bin", затем на прошивку "Z03MMC_v0124.bin" для использования ZigBee в умной колонке Алиса Миди.
Прибор успешно прошился, подключился к Алиса Миди, но теперь на экране вместо градусов по Цельсию (o C) информация о температуре в градусах по Фаренгейту (o F)! Это очень не удобно для меня, я понимаю температуру по Цельсию, не понимаю температуру по Фаренгейту. В Приложении "Умный дом" с Алисой данные с термометра транслируются в Цельсиях.
Как можно изменить на экране LYWSD03MMC с oF на oC?

Update!
Нашел как можно изменить Фаренгейт на Цельсий!
Нужно на несколько секунд зажать два контакта "reset" to "gnd", на экране изменятся значения. Если с первого разу не получится, то зажать на 2-4 секунды, вытащить батарейку и снова вставить. У меня получилось.
Полезную информацию по настройке нашел тут

[raspberryswirl]

Hi, as I bricked one LYWSD03MMC - here is another way to "free" them - I only do this very brief and once :
connect them via phone to bluethooth and add them to mi.home
use then the tokenextractor.
after that use the credentials here
https://atc1441.github.io/TelinkFlasher.html
do connect, then login, then flash with ATC_Exploit.bin
09:05:47: Connecting to: LYWSD03MMC 09:05:58: Detected Mi Thermometer 09:05:58: Fw_version: 2.1.1_0159 09:05:58: Connected 09:06:05: Received device infos are correct 09:06:05: Login successfull 09:06:12: File was selected, size: 69680 bytes 09:06:12: Count: 4355 09:06:17: Start DFU 09:06:53: Update done after 35.481 seconds 09:06:59: Disconnected. 09:15:24: File was selected, size: 69680 bytes 09:15:24: Count: 4355

after that use:
https://pvvx.github.io/ATC_MiThermometer/TelinkOTA.html
do connect, you find allready an ATC - falsh it with the Z003MMC for the zigbee
9:10:08 AM: Connecting to: ATC_ACE6AF 9:10:13 AM: Connected. 9:10:14 AM: Start DFU 9:11:05 AM: Update done after 50.38 seconds 9:11:09 AM: Disconnected.

then go to your zigbee portal and permit the join
after a minute you should see your thermo

HTH

[pvvx]

after that use the credentials here
https://atc1441.github.io/TelinkFlasher.html
do connect, then login, then flash with ATC_Exploit.bin

Note: FW ATC_Exploit.bin may not support flashing Zigbee firmware via BLE OTA.
Your method is not recommended for flashing FW Zigbee. You may get a non-working thermometer and will need flashing with a programmer.

[xumxum]

I flashed the atc custom firmware but there is no more flash button to flash the zigbee..what am I missing?
where is the flash button after the custom firmware was flashed?

ps: Thanks for your amazing work!!

[xumxum]

I managed to connect from mobile & then the flash options appeared, screenshot was from laptop..not sure why it gets stuck there, even though i flashed the atc_050.bin from there...

[pvvx]

You have a thermometer with firmware from atc1441.
This firmware does not support ZigBee download.

[xumxum]

nope, I had original and flashed yours! Also check the log, it says pvvx firmware !!

[pvvx]

In some equipment variants, after flashing the BLE device, it is necessary to reset the explorer cache (you can use "incognito mode") or restart the Bluetooth adapter (restart the computer). The MAC address does not change after OTA, and the system (or adapter) remembers the description of the old version of the device.
There is no function to access the browser cache from HTML or js and can only be performed by the user.

[MartijnPol95]

I followed the guide, found my devices but am now stuck as the Do the Activation button doesn't appear for me so I cannot get the values. Any ideas?

[pvvx]

Any ideas?

There are ideas. Read the first message #602

[Alkindi42]

I followed your instruction @pvvx, everything worked without problems during the procedure.

However, now the humidity level increases (every x seconds) from x to y% (more than 70). At this time, the battery indicator displays as low. Then a few seconds later the humidity level returns to normal and the low battery indicator disappears.

Is this a known issue?

[mastersf]

so the only way that this works is OTA with the app and token extractor? Can't get the physical flashing working, and I've spent almost an entire day on it