Open Blacksli opened 2 years ago
First I checked the BLE message with the unknown object. the unknown object is 0x0002, which seems to indicate that "easy pairing" is avaiable. This probably means that you need to connect it to some other device (the light). It is indeed recognized as the YLKG07YL, so it should probably work if you can get the key.
The other error seems to be some bluepy error. I'm not sure how to solve that. Perhaps @rexbut can help us out, he came up with this script in the past.
I also got a YLYKQ-0005 (The wall dimmer) paired to a yeelight. But despite getting an encryption key from miiocli, the sensor state always shows "unknown" in HA. Only signal strength display occasionally when I put the device on pairing mode.
Here's what I got from miiocli:
Running command raw_command [{'mac': 'c2d2fd38c1a4', 'evtid': 4097, 'pid': 950, 'beaconkey': 'c0419136be0128501398c142'}]
Tried using: c0419136be0128501398c142 c0419136be018d3d3c9728501398c142
Debug Log:
2022-09-10 21:04:29.316 DEBUG (MainThread) [custom_components.ble_monitor] Initializing BLE Monitor integration (YAML): {'discovery': False, 'devices': [{'mac': 'A4:C1:38:FD:D2:C2', 'encryption_key': 'c0419136be0128501398c142', 'reset_timer': 1, 'use_median': 'default', 'restore_state': 'default', 'decimals': 'default', 'report_unknown': False, 'consider_home': 180, 'tracker_scan_interval': 20, 'track_device': False}], 'use_median': False, 'restore_state': False, 'bt_interface': ['DC:A6:32:99:B7:33'], 'hci_interface': [], 'active_scan': False, 'period': 60, 'decimals': 1, 'report_unknown': 'Off', 'log_spikes': False, 'batt_entities': True, 'bt_auto_restart': False, 'is_flow': False, 'ids_from_name': True} 2022-09-10 21:04:29.344 DEBUG (MainThread) [custom_components.ble_monitor.config_flow] async_step_import: {'discovery': False, 'devices': [{'mac': 'A4:C1:38:FD:D2:C2', 'encryption_key': 'c0419136be0128501398c142', 'reset_timer': 1, 'use_median': 'default', 'restore_state': 'default', 'decimals': 'default', 'report_unknown': False, 'consider_home': 180, 'tracker_scan_interval': 20, 'track_device': False}], 'use_median': False, 'restore_state': False, 'bt_interface': ['DC:A6:32:99:B7:33'], 'hci_interface': [], 'active_scan': False, 'period': 60, 'decimals': 1, 'report_unknown': 'Off', 'log_spikes': False, 'batt_entities': True, 'bt_auto_restart': False, 'is_flow': False, 'ids_from_name': True} 2022-09-10 21:04:29.345 DEBUG (MainThread) [custom_components.ble_monitor.config_flow] async_step_user: {'discovery': False, 'devices': '--Devices--', 'use_median': False, 'restore_state': False, 'bt_interface': ['DC:A6:32:99:B7:33'], 'hci_interface': [], 'active_scan': False, 'period': 60, 'decimals': 1, 'report_unknown': 'Off', 'log_spikes': False, 'batt_entities': True, 'bt_auto_restart': False, 'is_flow': False, 'ids_from_name': True} 2022-09-10 21:04:29.385 DEBUG (MainThread) [custom_components.ble_monitor] Initializing BLE Monitor entry (config entry): <homeassistant.config_entries.ConfigEntry object at 0x7fa2310fb0> 2022-09-10 21:04:29.387 DEBUG (MainThread) [custom_components.ble_monitor] async_setup_entry: domain {'discovery': False, 'devices': [{'mac': 'A4:C1:38:FD:D2:C2', 'encryption_key': 'c0419136be0128501398c142', 'reset_timer': 1, 'use_median': 'default', 'restore_state': 'default', 'decimals': 'default', 'report_unknown': False, 'consider_home': 180, 'tracker_scan_interval': 20, 'track_device': False}], 'use_median': False, 'restore_state': False, 'bt_interface': ['DC:A6:32:99:B7:33'], 'hci_interface': [], 'active_scan': False, 'period': 60, 'decimals': 1, 'report_unknown': 'Off', 'log_spikes': False, 'batt_entities': True, 'bt_auto_restart': False, 'is_flow': False, 'ids_from_name': True} 2022-09-10 21:04:29.387 INFO (MainThread) [custom_components.ble_monitor] Available Bluetooth interfaces for BLE monitor: ['DC:A6:32:99:B7:33 (hci0)', "Don't use Bluetooth adapter"] 2022-09-10 21:04:29.387 DEBUG (MainThread) [custom_components.ble_monitor] HCI interface is [0] 2022-09-10 21:04:29.388 DEBUG (MainThread) [custom_components.ble_monitor] async_setup_entry: {'discovery': False, 'devices': [{'mac': 'A4:C1:38:FD:D2:C2', 'encryption_key': 'c0419136be0128501398c142', 'reset_timer': 1, 'use_median': 'default', 'restore_state': 'default', 'decimals': 'default', 'report_unknown': False, 'consider_home': 180, 'tracker_scan_interval': 20, 'track_device': False}], 'use_median': False, 'restore_state': False, 'bt_interface': ['DC:A6:32:99:B7:33'], 'hci_interface': [0], 'active_scan': False, 'period': 60, 'decimals': 1, 'report_unknown': 'Off', 'log_spikes': False, 'batt_entities': True, 'bt_auto_restart': False, 'is_flow': False, 'ids_from_name': True} 2022-09-10 21:04:29.389 DEBUG (MainThread) [custom_components.ble_monitor] Spawning HCIdump thread 2022-09-10 21:04:29.389 DEBUG (MainThread) [custom_components.ble_monitor] HCIdump thread: Init 2022-09-10 21:04:29.389 DEBUG (MainThread) [custom_components.ble_monitor] 1 encryptors mac:key pairs loaded 2022-09-10 21:04:29.389 DEBUG (MainThread) [custom_components.ble_monitor] sensor whitelist: [A4:C1:38:FD:D2:C2] 2022-09-10 21:04:29.390 DEBUG (MainThread) [custom_components.ble_monitor] 1 sensor whitelist item(s) loaded 2022-09-10 21:04:29.390 DEBUG (MainThread) [custom_components.ble_monitor] 0 device tracker(s) being monitored 2022-09-10 21:04:29.396 DEBUG (Thread-2) [custom_components.ble_monitor] HCIdump thread: Run 2022-09-10 21:04:29.409 DEBUG (Thread-2) [custom_components.ble_monitor] HCIdump thread: BLEScanRequester._initialized is True for hci0, waiting for connection... 2022-09-10 21:04:29.410 DEBUG (Thread-2) [custom_components.ble_monitor] HCIdump thread: connected to hci0 2022-09-10 21:04:29.412 DEBUG (Thread-2) [custom_components.ble_monitor] HCIdump thread: BLEScanRequester._initialized is True for hci0, connection established, send_scan_request succeeded. 2022-09-10 21:04:29.412 DEBUG (Thread-2) [custom_components.ble_monitor] HCIdump thread: start main event_loop 2022-09-10 21:04:29.478 DEBUG (MainThread) [custom_components.ble_monitor.binary_sensor] Starting binary sensor entry startup 2022-09-10 21:04:29.478 DEBUG (MainThread) [custom_components.ble_monitor.binary_sensor] BLE binary sensors updater initialization 2022-09-10 21:04:29.478 DEBUG (MainThread) [custom_components.ble_monitor.binary_sensor] BLE binary sensors updater initialized 2022-09-10 21:04:29.478 DEBUG (MainThread) [custom_components.ble_monitor.binary_sensor] Binary sensor entry setup finished 2022-09-10 21:04:29.478 DEBUG (MainThread) [custom_components.ble_monitor.sensor] Starting measuring sensor entry startup 2022-09-10 21:04:29.479 DEBUG (MainThread) [custom_components.ble_monitor.sensor] BLE sensors updater initialization 2022-09-10 21:04:29.479 DEBUG (MainThread) [custom_components.ble_monitor.sensor] BLE sensors updater initialized 2022-09-10 21:04:29.479 DEBUG (MainThread) [custom_components.ble_monitor.sensor] Measuring sensor entry setup finished 2022-09-10 21:04:29.492 DEBUG (MainThread) [custom_components.ble_monitor.binary_sensor] Binary entities updater loop started! 2022-09-10 21:04:29.493 DEBUG (MainThread) [custom_components.ble_monitor.sensor] Entities updater loop started! 2022-09-10 21:04:30.470 DEBUG (MainThread) [custom_components.ble_monitor.sensor] Sensor device with mac_address A4:C1:38:FD:D2:C2 has the following settings. Name: A4C138FDD2C2. Temperature unit: °C. Decimals: 1. Use Median: False. Restore state: False. Reset Timer: 1 2022-09-10 21:04:30.470 DEBUG (MainThread) [custom_components.ble_monitor.sensor] Sensor device with mac_address A4:C1:38:FD:D2:C2 has the following settings. Name: A4C138FDD2C2. Temperature unit: °C. Decimals: 1. Use Median: False. Restore state: False. Reset Timer: 1 2022-09-10 21:04:30.579 DEBUG (MainThread) [custom_components.ble_monitor.device_tracker] Starting device tracker entry startup 2022-09-10 21:04:30.580 DEBUG (MainThread) [custom_components.ble_monitor.device_tracker] BLE device tracker updater initialization 2022-09-10 21:04:30.580 DEBUG (MainThread) [custom_components.ble_monitor.device_tracker] BLE device tracker updater initialized 2022-09-10 21:04:30.580 DEBUG (MainThread) [custom_components.ble_monitor.device_tracker] Device Tracker entry setup finished 2022-09-10 21:04:30.636 DEBUG (MainThread) [custom_components.ble_monitor.device_tracker] Device tracker updater loop started! 2022-09-10 21:04:30.641 DEBUG (MainThread) [custom_components.ble_monitor.sensor] async_added_to_hass called for ble rssi A4C138FDD2C2 2022-09-10 21:04:30.642 DEBUG (MainThread) [custom_components.ble_monitor.sensor] async_added_to_hass called for ble dimmer A4C138FDD2C2 . . . 2022-09-10 21:07:24.553 ERROR (Thread-2) [custom_components.ble_monitor.ble_parser.xiaomi] Encryption key should be 16 bytes (32 characters) long 2022-09-10 21:07:24.559 DEBUG (MainThread) [custom_components.ble_monitor.sensor] Data measuring sensor received: {'rssi': -60, 'mac': 'A4C138FDD2C2', 'type': 'YLKG07YL/YLKG08YL', 'packet': 214, 'firmware': 'Xiaomi (MiBeacon V5 encrypted)', 'data': False} . . .
It looks like these new devices use the V5 encryption, so we should be looking for a 16 bytes (32 char) encryption key.
The old YLKG07YL/YLKG08YL use a 12 byte (24 char) encryption key. The strange thing is that they apparently didn't change the two bytes that indicate the device type
. That is why it is still recognized as a YLKG07YL/YLKG08YL. Nevertheless, a 16 byte encryption key should work, so you should try method 1 till 4 in the FAQ instead.
It looks like these new devices use the V5 encryption, so we should be looking for a 16 bytes (32 char) encryption key. The old YLKG07YL/YLKG08YL use a 12 byte (24 char) encryption key. The strange thing is that they apparently didn't change the two bytes that indicate the
device type
. That is why it is still recognized as a YLKG07YL/YLKG08YL. Nevertheless, a 16 byte encryption key should work, so you should try method 1 till 4 in the FAQ instead.
The dimmers are not supported in Mi home yet. So cloud token extraction and sniffing the Mi home app is out of the equation for now. What's left are web Telink flasher and modded mi app. I got the Telink flasher to connect to the dimmer, but it won't activate, tried it on serval devices. The dimmer does show up and pairs with the modded mi home app, but once I exit the pairing screen, the app shows an error prompt, nothing was logged. Maybe the issue with my device as I only got 1 android device on hand. This is the furthest I got, didn't manage to make it to work.
8d3d3c97
in the middle of the 12-byte key to make it 16-byte. Did some search and can't found any reason behind for adding those 4 bytes, would be great if someone can shed me some light on this:
https://github.com/mgerasika/home-assistant/blob/131067c8da7b74d249e429ebfa12798e61ed0b4f/custom_components/ble_monitor/ble_parser/xiaomi.pyThese bytes are also added by BLE monitor if the device is using the legacy MiBeacon V2/V3 Beacon key (12 bytes key)
This 12 bytes key is a format that was used by Xiaomi in the past for some devices. In the sensor attributes you can check this, if it says "MiBeacon V2/V3 (encrypted), it will use the 12 byte key, if it says MiBeacon V4/V5, it will use the 16 byte key. There is a version flag in the BLE monitor to tell MiHome (and BLE monitor) which version is being used.
The YLKG07YL / YLKG08YL use V2/V3, the new models YLYKQ-0004 / -0005 use V4/V5.
So, in short, adding these 4 bytes is NOT the way to get/create the 16 bytes key.
You might ask the developer of modded mi home app if he can create something similar for the new YLYKQ-0004 / -0005.
Sorry guys, I gave you some wrong info. It looks like it isn't even encrypted at all.
The data from @Blacksli 141695fe7030b6032c60f06a412d100d0200020110
can be parsed, but it reports as a motion sensor in V3 MiBeacon without encryption.
{'rssi': -36, 'mac': '102D416AF060', 'type': 'YLKG07YL/YLKG08YL', 'packet': 44, 'firmware': 'Xiaomi (MiBeacon V3)', 'data': True, 'motion': 1, 'motion timer': 1}
But the message from @GhostStone seems to indicate that his dimmer is reporting as MiBeacon V5 encryption.
2022-09-10 21:07:24.553 ERROR (Thread-2) [custom_components.ble_monitor.ble_parser.xiaomi] Encryption key should be 16 bytes (32 characters) long
2022-09-10 21:07:24.559 DEBUG (MainThread) [custom_components.ble_monitor.sensor] Data measuring sensor received: {'rssi': -60, 'mac': 'A4C138FDD2C2', 'type': 'YLKG07YL/YLKG08YL', 'packet': 214, 'firmware': 'Xiaomi (MiBeacon V5 encrypted)', 'data': False}
Now I'm really confused
@GhostStone can you make some logs for this device, by enabling the report_unknown
option?
Can I somehow collect more debugging information for analysis?
Yes, you can enable report unknown BLE advertisements in the HA log
in the BLE monitor options, and enable debug logging for BLE monitor. see this page for more explanation.
https://custom-components.github.io/ble_monitor/sensor_request
If you can send some logs, I can analyze it further, such that at least we understand what kind of encryption it uses. There seems to be a difference between you and @GhostStone
Yes, you can enable
report unknown BLE advertisements in the HA log
in the BLE monitor options, and enable debug logging for BLE monitor. see this page for more explanation.https://custom-components.github.io/ble_monitor/sensor_request
If you can send some logs, I can analyze it further, such that at least we understand what kind of encryption it uses. There seems to be a difference between you and @GhostStone
@Ernst79 I think you're right about it not using encryption.
The 7th byte of the service data seems to be the knob position. Incrementing from a5->ac
while I'm twisting it.
May not be enough to figure out what the other bytes do. If needed, I will record some more elaborate log later, looks promising for now.
Pairing: service data: [b'\x14\x16\x95\xfep0\xb6\x03\xa4U\x1a~8\xc1\xa4\r\x02\x00\x02\x01\x10']
Rotation: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xa5\xea\xcc\x91\x8f\xf3\xb0\x0e\x00\x00\x8d\x91\x12(']
Clicking: service data: [b"\x15\x16\x95\xfeHP\xb6\x03\xad\x98Bpevw\x0e\x00\x00\xaa'\x9f\x83"]
click
2022-09-13 22:15:02.079 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\x02^\xf9P{n\x1f|\x00\x00\r\xe3\x8b\xd4']manufacturer specific data: []local name: UUID16: None,UUID128: None
double click
2022-09-13 22:18:10.478 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\x05\x93\x03\x1b~7u|\x00\x00\xdd\xad<\t']manufacturer specific data: []local name: UUID16: None,UUID128: None
triple click
2022-09-13 22:19:25.463 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\x06\xe73_\x8e\x14\xff|\x00\x00a\x13\x13\x0e']manufacturer specific data: []local name: UUID16: None,UUID128: None
long hold
2022-09-13 22:20:34.464 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\n\x1f=\xc1\xd0L/|\x00\x00\xb5o\x82e']manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:20:34.989 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\n\x1f=\xc1\xd0L/|\x00\x00\xb5o\x82e']manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:20:35.014 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\x0b\xa1p\xe4]{\xd9|\x00\x00\x008ux']manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:20:35.037 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\x0b\xa1p\xe4]{\xd9|\x00\x00\x008ux']manufacturer specific data: []local name: UUID16: None,UUID128: None
rotate right 1 step
2022-09-13 22:34:10.841 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b"\x15\x16\x95\xfeHP\xb6\x03%\xbd\x964\xd8+'|\x00\x00:P3\x08"]manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:34:12.222 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03&3\xc9\xd1a\xa0\xdb|\x00\x00\xce\xf1\x8fm']manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:34:13.570 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b"\x15\x16\x95\xfeHP\xb6\x03'X\x07h\xd4\xc9Q|\x00\x00\xef\xa0\xdf\xb9"]manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:34:14.598 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03(\t\xd9\x9ew[\x91|\x00\x00\xc9\xe3\x83\x9a']manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:34:16.997 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03)W\x89\x05zf\xfc|\x00\x00}11\xaa']manufacturer specific data: []local name: UUID16: None,UUID128: None
rotate right 3 step
2022-09-13 22:24:29.677 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\x11\xe3\x04\x8b\xd3T\xfe|\x00\x00\xd2\x97\xf3C']manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:24:29.698 ERROR (Thread-13) [custom_components.ble_monitor.ble_parser.xiaomi] No encryption key found for device with MAC 10:2D:41:6A:F0:60
2022-09-13 22:24:29.699 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\x12\xa2\xf0w\xf0\xbf\n|\x00\x00\xbcPs\xc8']manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:24:29.997 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\x13\r\\\xbd\x7f=]|\x00\x00\xdcQK\xa7']manufacturer specific data: []local name: UUID16: None,UUID128: None
rotate left
2022-09-13 22:27:36.846 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\x1e\xb7D\x99d\xc9\xee|\x00\x00T\xca{4']manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:27:36.633 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\x1d\xdb\xc8\xd5\x90\xb4\xb8|\x00\x00A\x01!\x16']manufacturer specific data: []local name: UUID16: None,UUID128: None
press and rotate right
2022-09-13 22:30:03.092 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b"\x15\x16\x95\xfeHP\xb6\x03\x1f\xc5P'\xbegr|\x00\x00\xd13\x9f7"]manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:30:03.116 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03 \xb1@\xceq_\xca|\x00\x00%\xa6\xed\xf7']manufacturer specific data: []local name: UUID16: None,UUID128: None
press and rotate left
2022-09-13 22:33:02.694 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03"`%1\xc0\x88_|\x00\x00d\x9al\'']manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:33:03.312 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03#E*\x8e\xf0\xe5Q|\x00\x00\xc97\xca&']manufacturer specific data: []local name: UUID16: None,UUID128: None
2022-09-13 22:33:03.555 INFO (Thread-13) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 102d416af060: service data: [b'\x15\x16\x95\xfeHP\xb6\x03$\xed\xe3\xc9O\xceK|\x00\x00\x91\x1a\xd1\xab']manufacturer specific data: []local name: UUID16: None,UUID128: None
The data by @Blacksli is definetely encrypted with a 16 byte MiBeacon V5 encryption key
MiVer: 5, DevID: 0x3b6 : YLKG07YL/YLKG08YL, FnCnt: 2, Not bound, Old version certification, Encryption
Xiaomi (MiBeacon V5 encrypted)
the data by @GhostStone is also encrypted with a 16 byte MiBeacon V5 encryption key
MiVer: 5, DevID: 0x3b6 : YLKG07YL/YLKG08YL, FnCnt: 165, Not bound, Old version certification, Encryption
Xiaomi (MiBeacon V5 encrypted)
Only the data which @GhostStone gave at "pairing" isn't encrypted and is strangely enough still in MiBeacon v3 format
MiVer: 3, DevID: 0x3b6 : YLKG07YL/YLKG08YL, FnCnt: 164, Not bound, Old version certification, Capability: 0xd, No encryption
giving the following result
({'rssi': -36, 'mac': '102D416AF060', 'type': 'YLKG07YL/YLKG08YL', 'packet': 164, 'firmware': 'Xiaomi (MiBeacon V3)', 'data': True, 'easy pairing': 1}, None)
So, to conclude: we definitely need a 16 byte encryption key.
@GhostStone does it work when paired to yeelight light? can you check with miio if key changes when you delete dimmer from light (mi home should have ui for this) and pair again?
@GhostStone does it work when paired to yeelight light? can you check with miio if key changes when you delete dimmer from light (mi home should have ui for this) and pair again?
The previous comment that I made was done while the dimmer is paired to the light. The dimmer works as usual, advertises to both HA and the light at the same time. And no, deleting the dimmer in the Mi Home app doesn't change the "beacon key", only a great reset does.
paired with light
>>> miiocli device --ip 192.168.1.4 --token f29bd6cd65a6cf575a40f7988dd58ba5 raw_command ble_dbg_tbl_dump '{\"table\":\"evtRuleTbl\"}'
Running command raw_command
[{'mac': '551a7e38c1a4', 'evtid': 4097, 'pid': 950, 'beaconkey': '6c6649c588b11290888af200'}]
Deleting the dimmer in the Modded Mi Home App
>>> miiocli device --ip 192.168.1.4 --token f29bd6cd65a6cf575a40f7988dd58ba5 raw_command ble_dbg_tbl_dump '{\"table\":\"evtRuleTbl\"}'
Running command raw_command
[]
Re-pair
>>> miiocli device --ip 192.168.1.4 --token f29bd6cd65a6cf575a40f7988dd58ba5 raw_command ble_dbg_tbl_dump '{\"table\":\"evtRuleTbl\"}'
Running command raw_command
[{'mac': '551a7e38c1a4', 'evtid': 4097, 'pid': 950, 'beaconkey': '6c6649c588b11290888af200'}]
Great reset (pressing the pairing button for >20 sec), and pair with light afterwards
>>> miiocli device --ip 192.168.1.4 --token f29bd6cd65a6cf575a40f7988dd58ba5 raw_command ble_dbg_tbl_dump '{\"table\":\"evtRuleTbl\"}'
Running command raw_command
[{'mac': '551a7e38c1a4', 'evtid': 4097, 'pid': 950, 'beaconkey': '6c6649c588b11290888af200'}, {'mac': 'fee05638c1a4', 'evtid': 4097, 'pid': 950, 'beaconkey': 'bb322fd3686d108a6e04c775'}]
@rezmus, about the Modded Mi Home dimmer version: It shows up as "Yeelight dimmer", and it went throght the pairing process just fine, even showing the successful pairing screen. But after pressing done, was greeted with "couldn't complete action, please try again later" Nothing was added to the device list, nor anything useful I am able to find in log :(
i saw some app <> cloud logs from new dimmer pair and it looks like app fails to do proper auth. it does not even request virtual ble did from the cloud and does not send ble bind to cloud. which light model you use for the bind and fw version?
i saw some app <> cloud logs from new dimmer pair and it looks like app fails to do proper auth. it does not even request virtual ble did from the cloud and does not send ble bind to cloud. which light model you use for the bind and fw version?
https://home.miot-spec.com/s/yeelink.light.ceiling14 DID: 116931957 Firmware: 2.0.6_0019
I have the same problem. still no solution?
Same problem here, any possible solution
No, I'm still waiting for someone who can give me the BLE Advertisements of this device with an encryption key. But, from what I understand from the above is that it isn't possibly to get this encryption key?
Good morning,
I received two YLYKQ-0004 drives because I saw that in the FAQ no comments about it not working they seemed to be supported by BLE Monitor :(
I extracted the Mi-beacon key with the miiocli tool (this is the only method that worked) but Home Assitant asks me for a 32 character key while the extracted key is only 24 characters :(
And if I enter the key directly in BLE Monitor I get this error
Détails du journal (ERREUR)
Cette erreur provient d'une intégration personnalisée
Logger: custom_components.ble_monitor.ble_parser.xiaomi
Source: custom_components/ble_monitor/ble_parser/xiaomi.py:1195
Integration: Passive BLE monitor ([documentation](https://github.com/custom-components/ble_monitor), [issues](https://github.com/custom-components/ble_monitor/issues))
First occurred: 14:13:51 (11 occurrences)
Last logged: 14:14:08
Encryption key should be 16 bytes (32 characters) long
Suddenly, while searching I came across post and I discovered that this product is not supported, Grrrr (it would be wise to indicate it in red in the FAQ).
How can I get it to work?
Logs :
2023-02-21 15:17:04.212 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xc1\xeee"\n\xd1I\x00\x00\x00V\xfdd\xf7']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:04.726 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xc2,\x11\x80\xd9L3\x00\x00\x00\x1e\\\x03\xba']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:05.132 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xc3\x8e5\xc8\xb7\x1b\xde\x00\x00\x00\xdc[e\xc7']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:05.402 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xc4+\x18\x86\xc5\\O\x00\x00\x00\xaaPN\x9c']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:05.784 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xc5\x19\t\x1e1\xcd\xb7\x00\x00\x00\x82*\xb9\xe0']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:06.332 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xc6\x80\x9b[\x96F\xac\x00\x00\x00\xed\x06\xbaV']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:06.616 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xc7\xcf\x04\xf4d\x07\xe1\x00\x00\x00Z\xf26\xaf']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:07.298 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xc84\xe1\x8a\xda\xae\xf9\x00\x00\x00\xf6\xc0K\xa7']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:07.864 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xc9\xe6B\x8f\xd8#\x8f\x00\x00\x00\x89;\xb5g']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:08.443 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xca\x8b6\xac+\x8f\xed\x00\x00\x00\x82;"\x1d']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:08.911 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xcb5\x82U\xc0p\xdd\x00\x00\x00\x1ay\xc5C']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:09.643 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xcc\xa4\xf7\x9ab\xbc\xce\x00\x00\x00\xad\x9c&\x86']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:12.328 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xcd\x8b\x10\xdd: \xb0\x00\x00\x00\x84_\xfb\xa7']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:14.608 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xcee\x98@tJ\xca\x00\x00\x00\xd8\x02\x03\x9a']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:15.410 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xcf\xf6\xeb\xa3\x16yl\x00\x00\x00i\xbd\x00\xdc']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:16.012 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID 18ef3aedca20: service data: [b'\x15\x16\x95\xfeHP\xb6\x03\xd0\xfa^qT\xa2\x0b\x00\x00\x00n\xa5i]']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-02-21 15:17:16.010 ERROR (Thread-15) [custom_components.ble_monitor.ble_parser.xiaomi] Encryption key should be 16 bytes (32 characters) long
Thanks
You will need to find the 32 chatacter long key. Try any of the methods for v4/v5 encryption Keys. If you are alle to find it, post it here and i will try to add the device.
24 character key is not enough by modifying home assistant requirement?
I don't understand here :
https://github.com/custom-components/ble_monitor/releases/tag/2.1.3
it is indicated to pass in key of 24 characters, but home assistant asks for 32 characters.
24 character Keys are for MiBeacon V2 and V3. 32 character Keys are for MiBeacon V4 and V5.
The old YLKG07YL / YLKG08YL is using MiBeacon V3. The new model YLYKQ-0004 is using V5. So you need a 32 character key. And i need to add this device in BLE monitor, for which I need some BLE data + key first.
ok,
i tested 👍
No BindKey on my ceiling lights, the remotes do not appear and yet I have many different ceiling lights and different remotes, they are all up to date)
Once connected and after clicking (Do Activation), no Mi Bind Key and it disconnects
Log:
17:13:57: Searching for devices
17:13:59: Connecting to: yeelink.remote.seesaw
17:14:01: Detected Mi Thermometer
17:14:01: Connected
17:14:07: Activating now, please wait...
5:14:30 PM: Disconnected.
I get a 24-character key also even after a total reset of the switch (reset 20s) and a new association, the MAC address changes but the key is still 24 characters.
Method 3 (vevs dimmer):
After adding, message "unable to complete the action" and the logs are empty
Too long and complicated for the moment...
Are we sure it wouldn't work with a 24 character key by forcing home assistant to accept it?
I don't see what I can do now...
Im afraid that there is nothing more you can do. We need someone who is able to find a method to get the key. Im pretty sure it wont accept the 24 character key, but if you post it here. I can do some checks next week.
Here are the two keys and the MAC addresses of my two switches.
A4:C1:38:07:86:87 0a009d2a56963085590a4658
18:EF:3A:ED:D2:86 c63117bfd48456d7560e6f39
(After a complete reset of 20s the keys and the MAC address change)
Thanks
Im afraid that there is nothing more you can do. We need someone who is able to find a method to get the key. Im pretty sure it wont accept the 24 character key, but if you post it here. I can do some checks next week.
News ? Thanks
Sorry, missed your response. Can you post an encryption key + Mac (again) and also some logs that are collected after the same time. I need a key that matches with the data and MAC address, so if you change it, it won’t match anymore.
Hello, no problem, here is the MAC address and the key extracted right now :
MAC : A4:C1:38:0F:06:DA
BEACONKEY : fe7e72e46d923bac97f2583c
Thanks
Hi can I ask how you managed to extract the Key
Thanks
Il mar 21 feb 2023, 21:16 xekil @.***> ha scritto:
Here are the two keys and the MAC addresses of my two switches.
A4:C1:38:07:86:87 0a009d2a56963085590a4658 18:EF:3A:ED:D2:86 c63117bfd48456d7560e6f39
(After a complete reset of 20s the keys and the MAC address change)
Thanks
— Reply to this email directly, view it on GitHub https://github.com/custom-components/ble_monitor/issues/999#issuecomment-1439039877, or unsubscribe https://github.com/notifications/unsubscribe-auth/AEBGHU4FLS7FQW6ANYKKRH3WYUPBHANCNFSM5766CCZA . You are receiving this because you are subscribed to this thread.Message ID: @.***>
I understood, thanks. Although for me this method is not good as I don't have ceiling light.
Il dom 2 apr 2023, 13:52 xekil @.***> ha scritto:
Method 6 (miiocli tool) -> FAQ https://home-is-where-you-hang-your-hack.github.io/ble_monitor/faq
— Reply to this email directly, view it on GitHub https://github.com/custom-components/ble_monitor/issues/999#issuecomment-1493310425, or unsubscribe https://github.com/notifications/unsubscribe-auth/AEBGHU6EVXDNMR2C5PVMVJLW7FR7XANCNFSM5766CCZA . You are receiving this because you are subscribed to this thread.Message ID: @.***>
Hello, no problem, here is the MAC address and the key extracted right now :
MAC : A4:C1:38:0F:06:DA BEACONKEY : fe7e72e46d923bac97f2583c
Thanks
@Ernst79 if you need something else don't hesitate
yeah, I also need a new log with BLE data, like you did in this post. https://github.com/custom-components/ble_monitor/issues/999#issuecomment-1438534381
As you changed the Beacon key, I cannot use that logs. I need a matching beacon key + data.
@Ernst79, here are the new logs, thanks
2023-04-04 09:00:03.032 ERROR (Thread-15) [custom_components.ble_monitor.ble_parser.xiaomi] Encryption key should be 16 bytes (32 characters) long
2023-04-04 09:00:03.033 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b'\x15\x16\x95\xfeHP\xb6\x03I\xe5a3\x8dZ\xda\x1e\x00\x00\xfb\xb7b\xad']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-04-04 09:00:05.118 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b'\x15\x16\x95\xfeHP\xb6\x03J\xa6Yjz\xf15\x1e\x00\x00L\\-r']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-04-04 09:00:07.583 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b'\x15\x16\x95\xfeHP\xb6\x03K\xb8n\x02SRa\x1e\x00\x00]y\xfaQ']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-04-04 09:00:10.881 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b'\x15\x16\x95\xfeHP\xb6\x03L)Z\xfa\xc8\x8f&\x1e\x00\x00\xf7@03']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-04-04 09:00:14.375 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b'\x15\x16\x95\xfeHP\xb6\x03M\x99Fs\x11\xaaU\x1e\x00\x00\x1e\xe99\xd5']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-04-04 09:00:17.979 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b"\x15\x16\x95\xfeHP\xb6\x03N\x84\xec4\xb2\xff\xed\x1e\x00\x00t\xbbm'"]manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-04-04 09:00:18.297 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b'\x15\x16\x95\xfeHP\xb6\x03O\x05l\x14\xb68"\x1e\x00\x00(\xd7\n\xc4']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-04-04 09:00:20.646 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b'\x15\x16\x95\xfeHP\xb6\x03P\x92OC\xac\xd4\xc4\x1e\x00\x00\x086\xd0\xe8']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-04-04 09:00:23.932 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b'\x15\x16\x95\xfeHP\xb6\x03Q}(\x93\xd1m\xec\x1e\x00\x00\xf1M\xce\xae']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-04-04 09:00:26.490 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b'\x15\x16\x95\xfeHP\xb6\x03R\xec\xa0-\x9e\xe7(\x1e\x00\x00\xf0\x03Rc']manufacturer specific data: []local name: UUID16: None,UUID128: None
2023-04-04 09:00:26.781 INFO (Thread-15) [custom_components.ble_monitor.ble_parser] BLE advertisement received from MAC/UUID a4c1380f06da: service data: [b'\x15\x16\x95\xfeHP\xb6\x03S\xffA\xfc\x15%p\x1e\x00\x00C\xa5\x1b\xf5']manufacturer specific data: []local name: UUID16: None,UUID128: None
@Ernst79 do you have everything you need?
Yes, I have all the info I need. I was able to decrypt the data, by forcing it to use the old encryption format.
In more detail: There are two types of encryption for Xiaomi sensors, lets call them "legacy encryption" (V2/V3) and V4/V5 encryption. There is one byte in the data that tells the version. In your data, it says it is version V5.
'firmware': 'Xiaomi (MiBeacon V5 encrypted)'
V2/V3 uses 12 bytes encryption key (24 characters) (and adds 4 bytes in the code). V4/V5 uses 16 bytes encryption key (32 characters)
The strange thing is that all of you get a 24 character key, while it uses a V5 version firmware.
So, I modified the code a bit (locally), such that it uses the V2/V3 decryption process, and it succeeded decrypting the data.
I use the first 5 message in your log, then I get as result
decryption succeeded: 96541ad37cf367650c
decryption succeeded: 073d0cfd8bdf879fff
decryption succeeded: 4ed5982f76aa456364
decryption succeeded: 0c4aa9a2f9dc43265f
decryption succeeded: 75021365ae148a8d10
So, the good thing, I can decrypt the data. However, the problem is that this doesn't look at all as useful data. It certainly isn't MiBeacon format.
oh, what can i do to help you?
To be honest, I don't know. The encryption key is correct and accepted during the decryption (when using the legacy decryption). It decodes the data, but the decrypted data doesn't make any sense.....
ok i understand, too bad :( there would not be a way to flash them with another firmware for example?
Not that I know. But we keep this issue open, hopefully someone with more knowledge can figure this out…..
ok, thank you for your work :)
@xekil @Ernst79 Same issue here. I was wondering, could it be possible to add the Yeelight dimmer switch to Mijia, and then access it using "Xiaomi Gateway 3" integration in HA? (Given there is a Xiaomi Gateway somewhere, I have the Multimode v2 in my case).
Mijia doesn't find the device in my case:
Thanks for your input!
I dont know, i think the xiaomi gateway integration is accessing the data via the gateway, White ble monitor tries to access the BLE data directie. But we can try to see if we can read your data. If you make a log with BLE data via the report unknowndata fuction of ble monitor and if you send me the encryption jey, i can try it again.
Yes, the xiaomi gateway integration (https://github.com/AlexxIT/XiaomiGateway3) is accessing the devices through the gateway (acting as a proxy?).
I currently don't know how to trigger the pairing between the physical gateway (I have this model: https://fr.aliexpress.com/item/1005004408311471.html?gatewayAdapt=gloMsite2fraPcglo2fra with details here https://github.com/AlexxIT/Blog/issues/1) and the dimmer switch. Didn't have much time to test for the time being.
Also, in case I succeed to pair these, I don't know how to get the BLE logs....
Will keep updated If I make progress
no luck?
To be honest, I don't know. The encryption key is correct and accepted during the decryption (when using the legacy decryption). It decodes the data, but the decrypted data doesn't make any sense.....
@Ernst79 Hello, do you have any news on this problem? Thanks in advance
There hasn't been any developments on this for months, it's nearly impossible without using another device like a ceiling lamp to connect with it. Otherwise, directly is impossible and nobody managed to.
ok, thank you :(
Sensor Description
yeelight dimmer YLKG07YL / YLKG08YL model YLYKQ-0004
Additional information
I ordered a yeelight dimmer on aliexpress on batteries YLKG07YL / YLKG08YL
The seller sent some new version
On the body of the inscription YLYKQ-0004
I don't have a yeelight lamp, I just needed a dimmer.
When paired with BLE Monitor, it is defined as YLKG07YL / YLKG08YL but there is no data:
Method for obtaining a key by a script:
Method for obtaining a key through a modified mihome (dimmer):
The device finds, loads the plugin, but then an error will appear.
There is nothing in the log folder.
Windows 10 sees the device as: yeelink.remote.seesaw
Is there any way to search for a key without a lamp and add support?
I will collect any information / dumps dump.txt
BLE advertisements
No response