search

atc1441 / atc1441.github.io

46 stars 40 forks source link

Door Sensors #10

Open btsimonh opened 3 years ago

btsimonh commented 3 years ago

Hi atc1441,

I have three MI door sensors, and I'm using your universal version. It got the keys for the first one no problem, but the other two just stall at activation.

Any clues?

s

console log:

Found GATT server
12:17:34.539 Temp_universal_mi_activate.html:309 Services: 0000fe95-0000-1000-8000-00805f9b34fb
12:17:34.539 Temp_universal_mi_activate.html:386 Status: Detected Mi Thermometer
12:17:34.539 Temp_universal_mi_activate.html:386 Found Main service
12:17:34.540 Temp_universal_mi_activate.html:386 Found enc_10 char
12:17:34.540 Temp_universal_mi_activate.html:386 Found enc_19 char
12:17:34.662 Temp_universal_mi_activate.html:386 Status: Connected, you can now Do the Activation to either get the Token or flash a new Firmware
12:17:36.857 Temp_universal_mi_activate.html:386 Send: a2000000
12:17:36.968 Temp_universal_mi_activate.html:386 Enc_19: 000000000100
12:17:36.968 Temp_universal_mi_activate.html:386 Send: 00000101
12:17:37.028 Temp_universal_mi_activate.html:386 Enc_19: 010001000000
12:17:37.028 Temp_universal_mi_activate.html:386 Send: 00000100
12:17:37.029 Temp_universal_mi_activate.html:386 Send: 15000000
12:17:37.032
atc1441 commented 3 years ago

Are they all the same? Maybe different software version ?

btsimonh commented 3 years ago

they came in one package... but how to tell...

majsi commented 3 years ago

implementation of flasher is not complete. xiaomi uses 2 command formats. Some time ago I makeed implementation for scooters (kotlin for android). If you have any questions you can contact me.

btsimonh commented 3 years ago

@majsi - you have a repo with a modified version? I can try it and see?...

btsimonh commented 3 years ago

ok, I think it's two things. 1/ doGenerate() should wait until the key is made - if can make the key after sending. tested with 'stupid' code:

    doGenerate();

    setTimeout(()=>{
      mainCharSend("a2000000", enc_10);
    }, 1000);

2/ these devices have a pairing button; It seems this may need to have been 'long pressed' before connect, and that activation must happen within a few seconds of the long press.

Now got my next key, will try the third device.

s

btsimonh commented 3 years ago

yes so for device MCCGQ02HL: go to universal flashing page. Long press the button on the device (3 quick flashes of LED), quickly connect, then activate. The above is a bug in the page - but probably has little effect as i'd expect the key to be ready before it's needed, but it's not guaranteed.

majsi commented 3 years ago

@btsimonh can you try this app? https://drive.google.com/drive/folders/18yTESidmA5bGY7Xrf20H8avtT2PguaBN?usp=sharing

btsimonh commented 3 years ago

they work fine as long as you long-press before trying (and then do it quickly). Of course, in a browser we can't yet hear adverts - there is info in there which would tell us when to connect and activate, but we can't see it at the moment.

What I really need now is a firmware update? Mine don't send regularly, and mi home does not see them either (not in the supported list - may be geographic :( ).

valpackett commented 3 years ago

The door sensors worked fine for me, but I couldn't get motion sensors (RTCGQ02LM) to activate at all.

valpackett commented 3 years ago

Looking at the log, the motion sensor got stuck after one more step, after 15000000 it also sends 000000030400 and then nothing.

The code received no incoming message in the state == 1 condition, so I just did the stupidest thing imaginable and added a little setTimeout "as if that thing arrived" i.e. for the state = 2; mainCharSend("0100" + own_public_key.substring… these nested 0200 0300 0400 things) code, right when it sets state = 1 (line 198, i.e. the second send of 000000030400).

Somehow that worked. For one device anyway. Trying to do that on a second identical RTCGQ02LM did not work. What even was that?

dnandha commented 2 years ago

I had the same problem with my Mi scooter getting stuck after key exchange, but I got it figured out. Yes, a button (power button) has to be pressed, but was not enough to press it before running the authorization. A 100% reliable way to do it is:

  1. After key exchange (->15000000) disconnect (receive timeout)
  2. Press button after disconnect (beep)
  3. Reconnect and restart the authorization process from the beginning - this time it will go through

You can find my Python package for Mi authentication here: https://github.com/dnandha/miauth. Would be interesting to know if it also works for door and motion sensors, because then this logic could also be adapted for the TeLink Flasher and other projects.