Differences

This shows you the differences between two versions of the page.

--- projects:xiaomi-flora [2016/10/31 21:19] – emeryth
+++ projects:xiaomi-flora [2020/02/12 16:16] (current) – emeryth
@@ Line 1: / Line 1: @@
-====== Xiaomi Flora Flower Monitor teardown and analysis ======
+{{template>:template:project
+ | name=xiaomi-flora
+ | status=completed
+ | founder=[[user>emeryth]]
+ | repo=
+}}
+====== Xiaomi Flora Plant Monitor teardown and analysis ======
 by [[people:emeryth:start|emeryth]] (emeryth at hackerspace.pl)
 This is a teardown and analysis of the Xiaomi flower/plant monitor (it doesn't seem to have an official name).
-It is not extremely in-depth because the main goal was to figure out how to use the device without the official app.
+The analysis is not extremely in-depth because the main goal was to figure out how to use the device without the official app.
 **Note:** While writing this down, I have found out that I am not the first to publish something about the device ( https://community.home-assistant.io/t/xiaomi-mi-plants-monitor-flower/3388 ) but everything here is my independent work.
@@ Line 29: / Line 36: @@
 {{:projects:flora_back.jpg?direct&300|}}
+==== Pin header ====
+|2 ???|4 SW_CLK|5 SWDIO|8 GND|
+|1 VBATT|3 ???|6 ???|7 GND|
 ==== Chips on the PCB ====
@@ Line 56: / Line 67: @@
 When the original app connects to the device, it performs an elaborate initialization, but I have found out most of it isn't required.
+Available handles:
+**0x0038** - Reading returns 7 bytes - 1 byte battery level and 6 ASCII chars of firmware version
+**0x0033** - You need to write **0xA01F** to this handle to enable real-time data reading
+**0x0035** - The actual data from the sensors, can be read only after you enable real-time data, otherwise returns zeros
+Example data frame, values are little-endian
+^f7^00^10^13^00^00^00^25^f5^04^02^1c^40^fb^34^9b^
+| Temperature || ?? | Light intensity |||| Moisture | Fertility ||  ?? | ?? | ?? | ?? | ?? | ?? |
+Notes:
+  * Temperature is signed 16-bit value in tenths of degrees C, so 265 means 26.5 °C
+  * Light intensity in lux, not sure if 32-bit
+  * Moisture in percent
+  * Fertility in µS/cm
+**0x0036** - writing **0x0100** to this handle will subscribe you to sensor value notifications
 Here is a short Python script to get all the interesting data from the device:
-<code python>
+<code>
 #Read data from Xiaomi flower monitor, tested on firmware version 2.6.6
-import time
 from gattlib import GATTRequester, GATTResponse
 from struct import *
-address = "C4:7C:8D:60:95:7A"
+address = "DE:AD:BE:EF:CA:FE"
 requester = GATTRequester(address)
 #Read battery and firmware version attribute
@@ Line 84: / Line 114: @@
 print "Soil fertility:",fertility,"uS/cm"
 </code>
+==== Historical data ====
+The device stores historical data when not connected that can be later synchronized.
+I have not figured it out yet, but looking at the dumps it seems to work by writing an address to handle 0x003e and the reading data from handle 0x003c.
+===== Firmware hacking =====
+I have no interest in changing the firmware, since you can already get all data you need from the original firmware.
+But if you really want to know, the device supports OTA firmware update and there is a header with SWD on the PCB, although I was unable to connect to the cpu using OpenOCD.