ahpohl / xiaomi_lywsd03mmc Goto Github PK

I am not familiar with python's hexadecimal conversion and cannot directly convert the c++ implementation
Now the question is, knowing the bind key, how do you decrypt the data?

Can you provide a copy of arduino c++ code?

Thanks

Hi @ahpohl, first of all I want to thank you for your enormous effort to decode xiaomi_lywsd03mmc and be able to read it with an ESP32.

Although I am not a good C ++ programmer, I wish to integrate multiple lywsd03mmc devices into my Blynk system using ESP32 microcontrollers.

To do this, I think I should start by understanding how to get the basic data to perform a test with your Test_MbedTLS.ino program.

At this moment I already know how to obtain the following data:
(1) name -> Free reference text string (I guess)
(2) key -> I am using the website https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html
(3) plaintext -> In my case it is what I want to obtain after decryption
(4) ciphertext -> They are the 5 encrypted bytes of the advertisement reading from positions 19 to 23(right?).
(5) authdata -> Value set to 0x11

My question is how the following two parameters are obtained
(6) iv -> ????
(7) tag -> ????
For example, I have the following advertisement for my device:
Advertised Payload_Length: 30
02 01 06 1a 16 95 fe 58 58 5b 05 01 23 4c c8 38 c1 a4 c2 1d ed 9c 13 00 00 00 c8 60 bc ad
and in TelinkMiFlasher.html I have obtained Token = 47f0a056176745d3b8368b19
and Bind Key = 0bf74b6fa1378282dd4af2fa885167ea

How can I get the missing values?

Thanks in advance

Hello,

thank you for your development so far. This is a feature request, not an issue. So apparently, except of the periodic advertisements, LYWSD03MMC has its own memory that syncs with your Xiaomi Home app/Xiaomi gateway when connected.

Is there any known way how to read this memory? Because in the app you can only view last 24 hrs (1 measurement per hour), last 30 days (highest+lowest per day) or last 6 months (highest lowest per month).

Hi,
You probably already know this, but here are the decrypted packets for the frame control 0x4859:

Decrypted : 17 10 04 78 00 00 00 -> after 0x78 = 120 seconds of "silence"
Decrypted : 17 10 04 2c 01 00 00 -> after 0x12c = 300 seconds
Decrypted : 17 10 04 58 02 00 00 -> ... 600 seconds

... did not wait longer ;)

Thanx for your work!

I'm attempting to find the bind key for the Xiaomi CGPR1 sensor.
I'm probably missing something obvious but I can't locate the bind key in the packets I grab in Wireshark.

I'm able to find the POST mentioned in the readme but not the data outlined.

Any direction is appreciated, Thanks.

I am wondering why this project need a decryption key for this sensor (and mitm ssl is not trivial) while other projects (eg https://github.com/polclota/esp32lywsd03mmc ) simply connects to the service and characteristic to read the values without the need for a decryption key.