projects:xiaomi-flora
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
projects:xiaomi-flora [2016/10/31 21:03] – emeryth | projects:xiaomi-flora [2020/02/12 16:16] (current) – emeryth | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== Xiaomi Flora Flower | + | {{template>: |
+ | | name=xiaomi-flora | ||
+ | | status=completed | ||
+ | | founder=[[user> | ||
+ | | repo= | ||
+ | }} | ||
+ | |||
+ | ====== Xiaomi Flora Plant Monitor teardown and analysis ====== | ||
by [[people: | by [[people: | ||
This is a teardown and analysis of the Xiaomi flower/ | This is a teardown and analysis of the Xiaomi flower/ | ||
- | It is not extremely in-depth because the main goal was to figure out how to use the device without the official app. | + | The analysis |
**Note:** While writing this down, I have found out that I am not the first to publish something about the device ( https:// | **Note:** While writing this down, I have found out that I am not the first to publish something about the device ( https:// | ||
Line 29: | Line 36: | ||
{{: | {{: | ||
+ | ==== Pin header ==== | ||
+ | |||
+ | |2 ???|4 SW_CLK|5 SWDIO|8 GND| | ||
+ | |1 VBATT|3 ???|6 ???|7 GND| | ||
==== Chips on the PCB ==== | ==== Chips on the PCB ==== | ||
Line 34: | Line 45: | ||
* U1 - Dialog Semiconductor DA14580 SoC with BLE http:// | * U1 - Dialog Semiconductor DA14580 SoC with BLE http:// | ||
* U2 - Unknown SOT353 chip, probably some kind of op-amp or other analog thing for the sensors | * U2 - Unknown SOT353 chip, probably some kind of op-amp or other analog thing for the sensors | ||
- | * U5 - Unknown SON8 chip marked "5F1 A61 J1C 1", could be EEPROM/ | + | * U5 - Unknown SON8 chip marked "5F1 A61 J1G 1", could be EEPROM/ |
Line 50: | Line 61: | ||
{{: | {{: | ||
+ | |||
+ | ===== Getting data out of the device ===== | ||
+ | |||
+ | The device uses BLE GATT for communication, | ||
+ | When the original app connects to the device, it performs an elaborate initialization, | ||
+ | |||
+ | Available handles: | ||
+ | |||
+ | **0x0038** - Reading returns 7 bytes - 1 byte battery level and 6 ASCII chars of firmware version | ||
+ | |||
+ | **0x0033** - You need to write **0xA01F** to this handle to enable real-time data reading | ||
+ | |||
+ | **0x0035** - The actual data from the sensors, can be read only after you enable real-time data, otherwise returns zeros | ||
+ | |||
+ | Example data frame, values are little-endian | ||
+ | |||
+ | ^f7^00^10^13^00^00^00^25^f5^04^02^1c^40^fb^34^9b^ | ||
+ | | Temperature || ?? | Light intensity |||| Moisture | Fertility || ?? | ?? | ?? | ?? | ?? | ?? | | ||
+ | |||
+ | Notes: | ||
+ | * Temperature is signed 16-bit value in tenths of degrees C, so 265 means 26.5 °C | ||
+ | * Light intensity in lux, not sure if 32-bit | ||
+ | * Moisture in percent | ||
+ | * Fertility in µS/cm | ||
+ | |||
+ | **0x0036** - writing **0x0100** to this handle will subscribe you to sensor value notifications | ||
+ | |||
+ | |||
+ | Here is a short Python script to get all the interesting data from the device: | ||
+ | |||
+ | < | ||
+ | #Read data from Xiaomi flower monitor, tested on firmware version 2.6.6 | ||
+ | |||
+ | from gattlib import GATTRequester, | ||
+ | from struct import * | ||
+ | |||
+ | address = " | ||
+ | requester = GATTRequester(address) | ||
+ | #Read battery and firmware version attribute | ||
+ | data=requester.read_by_handle(0x0038)[0] | ||
+ | battery, version = unpack('< | ||
+ | print " | ||
+ | print " | ||
+ | #Enable real-time data reading | ||
+ | requester.write_by_handle(0x0033, | ||
+ | #Read plant data | ||
+ | data=requester.read_by_handle(0x0035)[0] | ||
+ | temperature, | ||
+ | print "Light intensity:", | ||
+ | print " | ||
+ | print "Soil moisture:", | ||
+ | print "Soil fertility:", | ||
+ | </ | ||
+ | |||
+ | ==== Historical data ==== | ||
+ | |||
+ | The device stores historical data when not connected that can be later synchronized. | ||
+ | |||
+ | I have not figured it out yet, but looking at the dumps it seems to work by writing an address to handle 0x003e and the reading data from handle 0x003c. | ||
+ | |||
+ | |||
+ | ===== Firmware hacking ===== | ||
+ | |||
+ | I have no interest in changing the firmware, since you can already get all data you need from the original firmware. | ||
+ | |||
+ | But if you really want to know, the device supports OTA firmware update and there is a header with SWD on the PCB, although I was unable to connect to the cpu using OpenOCD. | ||
+ | |||
projects/xiaomi-flora.txt · Last modified: 2020/02/12 16:16 by emeryth