Differences

This shows you the differences between two versions of the page.

--- projects:xiaomi-flora [2016/10/31 21:19] – emeryth
+++ projects:xiaomi-flora [2016/11/02 19:35] – emeryth
@@ Line 1: / Line 1: @@
-====== Xiaomi Flora Flower Monitor teardown and analysis ======
+====== Xiaomi Flora Plant Monitor teardown and analysis ======
 by [[people:emeryth:start|emeryth]] (emeryth at hackerspace.pl)
@@ Line 29: / Line 29: @@
 {{:projects:flora_back.jpg?direct&300|}}
+==== Pin header ====
+|2 ???|4 SW_CLK|5 SWDIO|8 GND|
+|1 VBATT|3 ???|6 ???|7 GND|
 ==== Chips on the PCB ====
@@ Line 56: / Line 60: @@
 When the original app connects to the device, it performs an elaborate initialization, but I have found out most of it isn't required.
+Available handles:
+**0x0038** - Reading returns 7 bytes - 1 byte battery level and 6 ASCII chars of firmware version
+**0x0033** - You need to write **0xA01F** to this handle to enable real-time data reading
+**0x0035** - The actual data from the sensors, can be read only after you enable real-time data, otherwise returns zeros
+Example data frame, values are little-endian
+^f7^00^10^13^00^00^00^25^f5^04^02^1c^40^fb^34^9b^
+| Temperature || ?? | Light intensity |||| Moisture | Fertility ||  ?? | ?? | ?? | ?? | ?? | ?? |
+Notes:
+  * Temperature is signed 16-bit value in tenths of degrees C, so 265 means 26.5 °C
+  * Light intensity in lux, not sure if 32-bit
+  * Moisture in percent
+  * Fertility in µS/cm
+**0x0036** - writing **0x0100** to this handle will subscribe you to sensor value notifications
 Here is a short Python script to get all the interesting data from the device:
-<code python>
+<code>
 #Read data from Xiaomi flower monitor, tested on firmware version 2.6.6
-import time
 from gattlib import GATTRequester, GATTResponse
 from struct import *
-address = "C4:7C:8D:60:95:7A"
+address = "DE:AD:BE:EF:CA:FE"
 requester = GATTRequester(address)
 #Read battery and firmware version attribute
@@ Line 84: / Line 107: @@
 print "Soil fertility:",fertility,"uS/cm"
 </code>
+===== Firmware hacking =====
+I have no interest in changing the firmware, since you can already get all data you need from the original firmware.
+But if you really want to know, the device supports OTA firmware update and there is a header with SWD on the PCB, although I was unable to connect with the cpu using OpenOCD.