User Tools

Site Tools


projects:xiaomi-flora

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
projects:xiaomi-flora [2016/10/31 21:03] emerythprojects:xiaomi-flora [2020/02/12 16:16] (current) emeryth
Line 1: Line 1:
-====== Xiaomi Flora Flower Monitor teardown and analysis ======+{{template>:template:project 
 + | name=xiaomi-flora 
 + | status=completed 
 + | founder=[[user>emeryth]] 
 + | repo= 
 +}} 
 + 
 +====== Xiaomi Flora Plant Monitor teardown and analysis ======
  
 by [[people:emeryth:start|emeryth]] (emeryth at hackerspace.pl) by [[people:emeryth:start|emeryth]] (emeryth at hackerspace.pl)
  
 This is a teardown and analysis of the Xiaomi flower/plant monitor (it doesn't seem to have an official name). This is a teardown and analysis of the Xiaomi flower/plant monitor (it doesn't seem to have an official name).
-It is not extremely in-depth because the main goal was to figure out how to use the device without the official app.+The analysis is not extremely in-depth because the main goal was to figure out how to use the device without the official app.
  
 **Note:** While writing this down, I have found out that I am not the first to publish something about the device ( https://community.home-assistant.io/t/xiaomi-mi-plants-monitor-flower/3388 ) but everything here is my independent work. **Note:** While writing this down, I have found out that I am not the first to publish something about the device ( https://community.home-assistant.io/t/xiaomi-mi-plants-monitor-flower/3388 ) but everything here is my independent work.
Line 29: Line 36:
 {{:projects:flora_back.jpg?direct&300|}} {{:projects:flora_back.jpg?direct&300|}}
  
 +==== Pin header ====
 +
 +|2 ???|4 SW_CLK|5 SWDIO|8 GND|
 +|1 VBATT|3 ???|6 ???|7 GND|
  
 ==== Chips on the PCB ==== ==== Chips on the PCB ====
Line 34: Line 45:
   * U1 - Dialog Semiconductor DA14580 SoC with BLE http://www.dialog-semiconductor.com/products/connectivity/bluetooth-low-energy/smartbond-da14580   * U1 - Dialog Semiconductor DA14580 SoC with BLE http://www.dialog-semiconductor.com/products/connectivity/bluetooth-low-energy/smartbond-da14580
   * U2 - Unknown SOT353 chip, probably some kind of op-amp or other analog thing for the sensors   * U2 - Unknown SOT353 chip, probably some kind of op-amp or other analog thing for the sensors
-  * U5 - Unknown SON8 chip marked "5F1 A61 J1C 1", could be EEPROM/flash+  * U5 - Unknown SON8 chip marked "5F1 A61 J1G 1", could be EEPROM/flash
  
  
Line 50: Line 61:
  
 {{:projects:plates.jpg?direct&600|}} {{:projects:plates.jpg?direct&600|}}
 +
 +===== Getting data out of the device =====
 +
 +The device uses BLE GATT for communication, but the sensor values are not immediately available.
 +When the original app connects to the device, it performs an elaborate initialization, but I have found out most of it isn't required.
 +
 +Available handles:
 +
 +**0x0038** - Reading returns 7 bytes - 1 byte battery level and 6 ASCII chars of firmware version
 +
 +**0x0033** - You need to write **0xA01F** to this handle to enable real-time data reading
 +
 +**0x0035** - The actual data from the sensors, can be read only after you enable real-time data, otherwise returns zeros
 +
 +Example data frame, values are little-endian
 +
 +^f7^00^10^13^00^00^00^25^f5^04^02^1c^40^fb^34^9b^
 +| Temperature || ?? | Light intensity |||| Moisture | Fertility ||  ?? | ?? | ?? | ?? | ?? | ?? |
 +
 +Notes:
 +  * Temperature is signed 16-bit value in tenths of degrees C, so 265 means 26.5 °C
 +  * Light intensity in lux, not sure if 32-bit
 +  * Moisture in percent
 +  * Fertility in µS/cm
 +
 +**0x0036** - writing **0x0100** to this handle will subscribe you to sensor value notifications
 +
 +
 +Here is a short Python script to get all the interesting data from the device:
 +
 +<code>
 +#Read data from Xiaomi flower monitor, tested on firmware version 2.6.6 
 +
 +from gattlib import GATTRequester, GATTResponse
 +from struct import *
 +
 +address = "DE:AD:BE:EF:CA:FE"
 +requester = GATTRequester(address)
 +#Read battery and firmware version attribute
 +data=requester.read_by_handle(0x0038)[0]
 +battery, version = unpack('<B6s',data)
 +print "Battery level:",battery,"%"
 +print "Firmware version:",version
 +#Enable real-time data reading
 +requester.write_by_handle(0x0033, str(bytearray([0xa0, 0x1f])))
 +#Read plant data
 +data=requester.read_by_handle(0x0035)[0]
 +temperature, sunlight, moisture, fertility = unpack('<hxIBHxxxxxx',data)
 +print "Light intensity:",sunlight,"lux"
 +print "Temperature:",temperature/10.,"°C"
 +print "Soil moisture:",moisture,"%"
 +print "Soil fertility:",fertility,"uS/cm"
 +</code>
 +
 +==== Historical data ====
 +
 +The device stores historical data when not connected that can be later synchronized.
 +
 +I have not figured it out yet, but looking at the dumps it seems to work by writing an address to handle 0x003e and the reading data from handle 0x003c.
 +
 +
 +===== Firmware hacking =====
 +
 +I have no interest in changing the firmware, since you can already get all data you need from the original firmware.
 +
 +But if you really want to know, the device supports OTA firmware update and there is a header with SWD on the PCB, although I was unable to connect to the cpu using OpenOCD.
 +
  
projects/xiaomi-flora.1477947806.txt.gz · Last modified: 2016/10/31 21:03 by emeryth

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki