projects:xiaomi-flora
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
projects:xiaomi-flora [2016/10/31 20:41] – emeryth | projects:xiaomi-flora [2016/10/31 22:12] – emeryth | ||
---|---|---|---|
Line 5: | Line 5: | ||
This is a teardown and analysis of the Xiaomi flower/ | This is a teardown and analysis of the Xiaomi flower/ | ||
It is not extremely in-depth because the main goal was to figure out how to use the device without the official app. | It is not extremely in-depth because the main goal was to figure out how to use the device without the official app. | ||
+ | |||
+ | **Note:** While writing this down, I have found out that I am not the first to publish something about the device ( https:// | ||
===== What is it ===== | ===== What is it ===== | ||
Line 27: | Line 29: | ||
{{: | {{: | ||
+ | ==== Pin header ==== | ||
+ | |||
+ | |2 ???|4 SW_CLK|5 SWDIO|8 GND| | ||
+ | |1 VBATT|3 ???|6 ???|7 GND| | ||
==== Chips on the PCB ==== | ==== Chips on the PCB ==== | ||
Line 32: | Line 38: | ||
* U1 - Dialog Semiconductor DA14580 SoC with BLE http:// | * U1 - Dialog Semiconductor DA14580 SoC with BLE http:// | ||
* U2 - Unknown SOT353 chip, probably some kind of op-amp or other analog thing for the sensors | * U2 - Unknown SOT353 chip, probably some kind of op-amp or other analog thing for the sensors | ||
- | * U5 - Unknown SON8 chip marked "5F1 A61 J1C 1", could be EEPROM/ | + | * U5 - Unknown SON8 chip marked "5F1 A61 J1G 1", could be EEPROM/ |
+ | |||
+ | |||
+ | {{: | ||
+ | {{: | ||
+ | |||
+ | ==== Sensors ==== | ||
+ | |||
+ | The light and temperature sensors are placed on the top of the device. | ||
+ | |||
+ | {{: | ||
+ | |||
+ | The legs end with metal studs that are used to measure soil fertility via electrical conductance. | ||
+ | Hidden inside the legs are two traces that end in plates, probably a capacitive method to measure soil moisture. | ||
+ | |||
+ | {{: | ||
+ | |||
+ | ===== Getting data out of the device ===== | ||
+ | |||
+ | The device uses BLE GATT for communication, | ||
+ | When the original app connects to the device, it performs an elaborate initialization, | ||
+ | |||
+ | Available handles: | ||
+ | |||
+ | **0x0038** - Reading returns 7 bytes - 1 byte battery level and 6 ASCII chars of firmware version | ||
+ | |||
+ | **0x0033** - You need to write **0xA01F** to this handle to enable real-time data reading | ||
+ | |||
+ | **0x0035** - The actual data from the sensors, can be read only after you enable real-time data, otherwise returns zeros | ||
+ | |||
+ | Example data frame, values are little-endian | ||
+ | |||
+ | ^f7^00^10^13^00^00^00^25^f5^04^02^1c^40^fb^34^9b^ | ||
+ | | Temperature || ?? | Light intensity |||| Moisture | Fertility || ?? | ?? | ?? | ?? | ?? | ?? | | ||
+ | |||
+ | Notes: | ||
+ | * Temperature is signed 16-bit value in tenths of degrees C, so 265 means 26.5 °C | ||
+ | * Light intensity in lux, not sure if 32-bit | ||
+ | * Moisture in percent | ||
+ | * Fertility in µS/cm | ||
+ | |||
+ | **0x0036** - writing **0x0100** to this handle will subscribe you to sensor value notifications | ||
+ | |||
+ | |||
+ | Here is a short Python script to get all the interesting data from the device: | ||
+ | |||
+ | < | ||
+ | #Read data from Xiaomi flower monitor, tested on firmware version 2.6.6 | ||
+ | |||
+ | from gattlib import GATTRequester, | ||
+ | from struct import * | ||
+ | |||
+ | address = " | ||
+ | requester = GATTRequester(address) | ||
+ | #Read battery and firmware version attribute | ||
+ | data=requester.read_by_handle(0x0038)[0] | ||
+ | battery, version = unpack('< | ||
+ | print " | ||
+ | print " | ||
+ | #Enable real-time data reading | ||
+ | requester.write_by_handle(0x0033, | ||
+ | #Read plant data | ||
+ | data=requester.read_by_handle(0x0035)[0] | ||
+ | temperature, | ||
+ | print "Light intensity:", | ||
+ | print " | ||
+ | print "Soil moisture:", | ||
+ | print "Soil fertility:", | ||
+ | </ | ||
+ | |||
+ | ===== Firmware hacking ===== | ||
+ | |||
+ | I have no interest in changing the firmware, since you can already get all data you need from the original firmware. | ||
+ | |||
+ | But if you really want to know, the device supports OTA firmware update and there is a header with SWD on the PCB, although I was unable to connect with the cpu using OpenOCD. | ||
projects/xiaomi-flora.txt · Last modified: 2020/02/12 16:16 by emeryth