PiotrMachowski / Xiaomi-cloud-tokens-extractor

This tool/script retrieves tokens for all devices connected to Xiaomi cloud and encryption keys for BLE devices.
MIT License
3.23k stars 333 forks source link

Invalid login or password - Windows exe #5

Closed whiney1 closed 3 years ago

whiney1 commented 3 years ago

Thanks for putting this together - looks like it will be very handy.

However, I'm not able to use the Windows exe tool due to an issue with login. Double checked on Mi Home app that login info use was correct.

image

PiotrMachowski commented 3 years ago

Can you try with user ID? (a number visible in "Profile" section in Xiaomi Home app)

whiney1 commented 3 years ago

should have mentioned, yes I tried with that too already, same result

PiotrMachowski commented 3 years ago

Ok, another idea... Have you tried python version?

roupenig commented 3 years ago

I can confirm that I'm getting the same error. I have tried with the exe on Windows 10 and python script on RPi 4. I have tried both the email and the user ID. Let me know if I can test something else.

PiotrMachowski commented 3 years ago

It might be a problem with some special characters in a password, but I don't have a way to test it

roupenig commented 3 years ago

I thought about that and changed my password to only letters and numbers, but no luck. Maybe it takes time to update, so I'll change again and wait before trying.

karl-gustav commented 3 years ago

I can also confirm that it doesn't work any more. I have tried both the python and exe version, and I even tried to create a new account with a simpler email/password combo; but still doesn't work... Can they have changed the auth requirements to circumvent this verry repo?

djungelola commented 3 years ago

python works fine for me. tested right now.

whiney1 commented 3 years ago

It might be a problem with some special characters in a password, but I don't have a way to test it

Haven't tried python but for what it's worth, I don't have any special characters. number/letters only

karl-gustav commented 3 years ago

The password I used when testing the seccond time was Password1... And I tried both python and the exe file! I even tried setting mainland china as my region when creating the new account 🤔

roupenig commented 3 years ago

I've also used a similar simple password but no luck. Could the issue be related to newer accounts? @djungelola when was your account created? It feels like you've tested it on an old account? I've created my account on Nov.25 and I'm guessing the others who have issues have recent accounts as well?

karl-gustav commented 3 years ago

My main account was created 17. october. (the new test account was created yesterday)

roupenig commented 3 years ago

Or could it be a country issue? I'm just brainstorming, I don't know how the script works. I'm in Sweden and I'm guessing karl-gustav is somewhere around here.

karl-gustav commented 3 years ago

Good guess; Norway 😄

djungelola commented 3 years ago

@roupenig yes, used an old accont

Dylan777-sudo commented 3 years ago

Just used now on windows and worked 100%

rindlerblabla commented 3 years ago

Tried now with user ID and e-mail with the exe-version. Neither did work. Account created in july or something.

rindlerblabla commented 3 years ago

(Region Sweden as well)

karl-gustav commented 3 years ago

@Dylan777-sudo

How old is your account? And what region are you in?

rindlerblabla commented 3 years ago

I installed some old apk-version through bluestacks and changed my password within the app. Then my token was found for country 'de'. Don't think it matters how old your account is, but rather what country you have choosen.

Dylan777-sudo commented 3 years ago

@Dylan777-sudo

How old is your account? And what region are you in?

Just over a year now,

South Africa, said all regions though and it found my region

Raniz85 commented 3 years ago

I've got the same issue here, account created today with Sweden as region. I've dumped the response bodies and in login2 I get:

{
  "qs": "%3Fsid%3Dxiaomiio%26_json%3Dtrue",
  "code": <same as in login1>,
  "captchaUrl": null,
  "callback": "https://sts.api.io.mi.com/sts",
  "location": "",
  "securityStatus": 0, 
  "pwd":0,
  "_sign":"<same as in login1>",
  "sid": "xiaomiio", 
  "desc":"登录验证失败"
}

The description translates to Login verification failed according to Google Translate

Raniz85 commented 3 years ago

I get the an essentially identical response if I try to sign in on https://account.xiaomi.com and if I try to reset my password there it says my account doesn't exist.

So I'm guessing this is because I don't have a Mi account but just a Roborock account.

Raniz85 commented 3 years ago

Yeah, that was the issue.

After creating an account in the Xiaomi Home app, resetting WiFi on the vacuum and adding it in Xiomi Home instead I can now run the script and see my vacuum.

whiney1 commented 3 years ago

I just re-downloaded the exe and it's working fine now - unsure if it was updated but my issue is resolved! Thank you very much Piotr.

I'll leave the issue open for a couple days to see if anyone else that was having issues, is still having issues after re-downloading the exe.

roupenig commented 3 years ago

I feel dumb. For some reason I had assumed the token would be extracted from the Roborock account, but now reading back again I see that this is for Xiaomi Home app. I switched to Xiaomi and I could extract the token. The token would be changed if switching back to Roborock app. I wonder if there is a token extractor for that.

karl-gustav commented 3 years ago

Same here! Roborock instead of xiaomi home. Worked fine now. Sorry ¯\_(ツ)_/¯

PiotrMachowski commented 3 years ago

@whiney1 it was not updated, so there has to be some magic involved :)

@roupenig @karl-gustav I have updated readme to prevent such problems in the future

Raniz85 commented 3 years ago

I feel dumb. For some reason I had assumed the token would be extracted from the Roborock account, but now reading back again I see that this is for Xiaomi Home app. I switched to Xiaomi and I could extract the token. The token would be changed if switching back to Roborock app. I wonder if there is a token extractor for that.

Looking at how similar the apps are I wouldn't be surprised if you could just point the script at another domain and have it work out of the box.