XMWSDJ04MMC (Xiaomi Electronic Thermometer and Hygrometer) not activating?

[andorardo]

Hi All,

As per the FAQ https://custom-components.github.io/ble_monitor/faq#how-to-get-the-mibeacon-v4v5-encryption-key I've had success with the LYWSD03MMC, but I'm finding that the TelinkFlasher https://atc1441.github.io/Temp_universal_mi_activate.html is hanging/timing out on the new XMWSDJ04MMC.

Anyone seen this problem?

1. I go to https://atc1441.github.io/Temp_universal_mi_activate.html
2. I click Connect, and pair with the XMWSDJ04MMC that appears in the list
3. The bluetooth icon on the XMWSDJ04MMC stops flashing, showing that it has paired
4. I click Do Activation

and then it unfortunately hangs.

the logs show:

17:47:26: Searching for devices
17:47:30: Connecting to: XMWSDJ04MMC
17:47:31: Detected Mi Thermometer
17:47:31: Connected
17:47:48: Activating now, please wait...

and the console shows:

Status: Connected, you can now Do the Activation to either get the Token or flash a new Firmware
Temp_universal_mi_activate.html:386 Send: a2000000
Temp_universal_mi_activate.html:386 Enc_19: 000000000100
Temp_universal_mi_activate.html:386 Send: 00000101
Temp_universal_mi_activate.html:386 Enc_19: 010001000000
Temp_universal_mi_activate.html:386 Send: 00000100
Temp_universal_mi_activate.html:386 Send: 15000000
Temp_universal_mi_activate.html:386 Send: 000000030400

Anyone else had luck with the XMWSDJ04MMC?

Is there any step I'm missing?

[Ernst79]

I don’t think this sensor is supported, it is not mentioned here

https://github.com/pvvx/ATC_MiThermometer#xiaomi-mijia-lywsd03mmc-hw-b14-b16-b17-b19-b20--xiaomi-miaomiaoce-mho-c401--cgg1-mijia-bluetooth-thermometer-firmware

[andorardo]

I wondered about that, yet Victor's repo has begun to have explicit support for it:
https://github.com/pvvx/pvvx.github.io/tree/master/XMWSDJ04MMC

I tried
https://pvvx.github.io/XMWSDJ04MMC/XMWSDJ04MMC_Utils.html
as well, with unfortunately similar results.

I'm wondering if there are hardware versions here as well, that might indicate why some units are working and others are not?

[Ernst79]

Ah, ok, didn't see that on the main page. I think its easier to ask on Victor's repo directly, he should be able to tell.

[pvvx]

https://pvvx.github.io/XMWSDJ04MMC/XMWSDJ04MMC_Utils.html

Before “Activating Mi”, you need to reset the binding to Mi Home by long pressing the button on the thermometer.
Otherwise, the entrance is only by the code from Mi-Home:

In this case, you need to input "Mi Token" and "Mi Bind Key".

To activate:
1. Hold the button on the device for 7 seconds.
2. Select 'connect'.
3. Briefly press the button on the device.
When doing an activation here the device is needed to be activated in the Mi app again when wanted to use there.

If the buttons on the thermometer are pressed correctly, you will get:

Then the activation button is active and you can continue:

Console log:

Found GATT server
Services: fafafa00-fafa-fafa-fafa-fafafafafafa
Services: ebe0ccb0-7a0a-4b0c-8a1a-6ff2997da3a6
Services: 0000fe95-0000-1000-8000-00805f9b34fb
Status: Detected XMWSDJ04MMC Device
Found Custom service
Found DeviceActivated characteristic
devActivated =0
Found NotifyTHV characteristic
Found ComfortParameters characteristic
NotifyTHV: f8001b01dc0c
Temp: 24.8C, Humi: 28.3%, Ubat: 3.292V
Found Mi service
Found Mi-Authentication characteristic
Found Mi-Standard characteristic
Status: Connected
Status: Activating now, please wait...
Send: a4000000
Mi-Standard(0): 0000040006f2
Send: 0000050006f2
Mi-Standard(0): 00000401f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2
tstmtublk = 240
Send: 00000501f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2
Status: Get device info ...
Send: a2000000
Mi-Standard(0): 000002000100000000626c742e332e313876666e3861386f356b3030
Send: 00000300
Status: Start Login ...
Send: 15000000
Send: 000000030100
Mi-Standard(11): 00000101
send own_public_key
Send: 0100df82b148f1309f404b8be80ac62a18c6052c8e7dcadb64045dd91ac6d3aab1e42e3e30bc332ca6c27eed7be3575d15c7b241c7363db662b7b4dd20992d5f9193
Mi-Standard(12): 00000100
Mi-Standard(13): 00000203fd18955afb6fcd91cb4920f284f13cbe0ec2397225d181028d24516e121a8f8e5c4fdeeade1fb1591b2e06249b893b179947d034bfbef721f73b62d8ae75b883
Send: 00000300
SharedKey - ok
Send: 000000000100
Mi-Standard(14): 00000101
Send: 01001c4af2f3c09a9e4e6e910690c33b8410ba1ab5d6eb637128
Mi-Standard(15): 00000100
Status: Checking registration ...
Send: 13000000
Mi-Authentication: 11000000
Status: Registration successfull
Send: 24000000
Send: 0000000b0100
Mi-Standard(0): 00000101
Send: 01006ebe85845a89b107e01481160707e7d7
Mi-Standard(1): 00000100
Mi-Standard(1): 0000020dc848e756af4448fbcbf7b5f696d83e53
Send: 00000300
Mi-Standard(12): 0000020c966910002e898f16b0553fc47cb6b5855f7ebba396230b07b07e3a04425e0ced
Send: 00000300
Send: 0000000a0100
Mi-Standard(13): 00000101
Send: 01008bcefedbbf626e1c6f836da3952cf79c3d83264c19483f6648690b4e9f9f0af2
Mi-Standard(14): 00000100
Mi-Authentication: 21000000
Status: Login successfull
NotifyTHV: f9000b01dc0c
Temp: 24.9C, Humi: 26.7%, Ubat: 3.292V
Status: Disconnected.

---

There is an assumption that XMWSDJ04MMC switches to activation mode when it receives a request for an additional scan (associated with that MAC).
Therefore, to enter the activation mode, you need to reset the old activation, and after pressing "connect", before selecting the scanned devices in the menu, press the button on the thermometer briefly. And then select the device to connect.

---

XMWSDJ04MMC uses a new mi-activation variant. Built-in support for BT4+ adapters with a large MTU.
But the version for BT4.0 is still working.
The XMWSDJ04MMC_Utils.html program uses the new default method and may not work with older BT adapters because not all options have been tested with different adapters yet.

Mi-Home, upon activation, does not check the readiness flag for activation, and there "dancing with a tambourine" and buttons for users is even more difficult.

--

The MI-OTA procedure js code is required to complete the custom firmware for XMWSDJ04MMC. Everything else is already there and tested (I flashed it through a typical debug connector from SiLabs located on the thermometer's printed circuit board).

[andorardo]

After a long delay, I tried it again.

1. I absolutely, definitely, held the button for 7+ seconds, such that the eink screen went blank and then refreshed. The bluetooth icon was flashing
2. I hit Connect on the web app
3. Pressed the button on the device for 1 second
4. Then paired with the XMWSDJ04MMC.
5. The webpage showed "Connected" but not activated. (It shows the Temp, Humi, and Ubat numbers.)
6. I click Mi Activation on the web app and the Status changes to "Start Login ..."

And that's where it hangs. The logs say:

Activating now, please wait...
Get device info...
No device known id!
Start Login ...

Is the No device known id log message normal? Could it be this XMWSDJ04MMC has something different, firmware or hardware??

[pvvx]

Item 3 didn't work.
The button must be pressed before connecting.

[andorardo]

OK, I tried this variation:

1. held the button for 7+ seconds, such that the eink screen went blank and then refreshed. The bluetooth icon was flashing
2. Pressed the button on the device for 1 second
3. hit Connect on the web app
4. paired with the XMWSDJ04MMC.

The Status says Detected XMWSDJ04MMC Device, but the logs say:

NotSupportedError: GATT operation failed for unknown reason.
Recomment 1 from 5

5 times.

The Mi Activation and Mi Login buttons remain grayed out.

I tried this three times, with the same result each time :-/

EDIT: I tried on a different Android phone, with the same results.

[pvvx]

I had similar problems in Mi-Home.
When I wrote XMWSDJ04MMC_Utils.html, I somehow got used to it.
Then XMWSDJ04MMC_Utils.html was tested on two Android phones and Windows 10 over 50 times.

[pvvx]

1. I absolutely, definitely, held the button for 7+ seconds, such that the eink screen went blank and then refreshed. The bluetooth icon was flashing

This action removes the binding to Mi-Home. Deletes the keys and the device status changes to "not registered".
Without this, a new registration is not possible.

3. Pressed the button on the device for 1 second

This action puts the device into active BLE connection mode.
Pressing the button is required during an active scan.
It is likely that the thermometer binds to the MAC address of the communication adapter during an active scan request and button press.
Upon further connection with it (if the MAC matches during scanning), registration is possible. If you have many actively scanning devices upon activation, it will be difficult to connect for enrollment.

If something described above is not done, then the registration commands will not be processed. Registration commands will remain unanswered, and the request will end with a timeout (minutes).

[pvvx]

No device known id!

An example with completely erased Flash and writing only program code to the device.
The device does not contain any "known device identifiers" and other keys.
When connected and activated, a new "known device ID" will be set.

After activation, clicked "get" "Known Device ID".

If the device has already been previously registered, then the known device ID will be the old one and the old value will be used. Reading the ID is possible with the "Get" button. But, when activated, you should not issue any commands. Otherwise, the sequence of the activation cycle is violated and activation is not possible.

[andorardo]

Thanks for the explanations. So the device id is not important in this case.

I keep getting what seems like time-outs. I've turned off all computers that have BLE scanning, so the only device doing scanning is the phone in my hand. I get a good "Connected" status, but then the "Mi Activation" times out.

If I have a good "Connected" status (including correct temperature readings) but the activation times out, what does that mean?

The only reason I brought up the hardware versions is that I remember that LYWSD03MMC had multiple hardware versions show up in the wild and I thought maybe that could be a reason for a slight difference in behavior.

BTW, at no point have I used the Mi app, which I assume is correct. But I just wanted to check.

[andorardo]

Oh my god, I switched to a fourth computer, and it worked on the first try.

The score card so far:

• Pixel 3 XL: time-out
• Pixel 6 Pro: time-out
• 2019 MBP: didn't even scan (no BLE? AFAICT)
• 2017 Samsung Chromebook Pro (caroline): worked first try

I put the bind key in the Home Assistant Passive BLE monitor integration and the thermometer is working well.

What have we learned? That not all Chrome implementations, no matter how recent, work the same? Or is it likely to be the different BLE hardware on the different devices?

Is there any sense in trying to dig a bit deeper in terms of what was causing time-out in the first two cases?

[pvvx]

XMWSDJ04MMC uses Bluetooth 5+ and implements an activation algorithm with a transmit/receive packet size of more than 250 bytes. The old version, with a small MTU, is also supported.
To determine the actual supported size of the transmission packet, a request for the reception and transmission of the buffer of the maximum length is used.

The XMWSDJ04MMC_Utils.html program uses the new default method and may not work with older BT adapters because not all options have been tested with different adapters yet.

Instability must be looked for in the MTU size negotiation on the connection.

[cvjensen]

Hi @pvvx ,

I'm experiencing the same problem as @andorardo .
I have no problem connecting to the device with my phone or laptop.
But both are stuck when I press the activate button. They get the device ID but hangs at "Start login...."
My phone is a mi lite 11 5g so it should be a newer bluetooth version.

Can you help me ?

[cvjensen]

Just for information to others reading this: I just tried successfully with a xiaomi note 8 pro.

[baramuse]

I have the same issue, tried with Windows10 machine, MBP, KLIPAD phone, all stuck at the same step :

14:34:28: Searching for devices
14:34:30: Connecting to: XMWSDJ04MMC
14:34:31: ComfortParameters: Temp: 19..27C, Humi: 20..85%
14:34:31: Connected
14:34:34: Activating now, please wait...
14:34:34: Get device info ...
14:34:34: Start Login ...

XMWSDJ04MMC_Utils.html:496 Services: fafafa00-fafa-fafa-fafa-fafafafafafa
XMWSDJ04MMC_Utils.html:496 Services: ebe0ccb0-7a0a-4b0c-8a1a-6ff2997da3a6
XMWSDJ04MMC_Utils.html:496 Services: 0000fe95-0000-1000-8000-00805f9b34fb
XMWSDJ04MMC_Utils.html:535 Status: Detected XMWSDJ04MMC Device
XMWSDJ04MMC_Utils.html:535 Found Custom service
XMWSDJ04MMC_Utils.html:535 Found DeviceActivated characteristic
XMWSDJ04MMC_Utils.html:535 devActivated =0
XMWSDJ04MMC_Utils.html:535 Found NotifyTHV characteristic
XMWSDJ04MMC_Utils.html:535 Found ComfortParameters characteristic
XMWSDJ04MMC_Utils.html:535 NotifyTHV: cf001802800c
XMWSDJ04MMC_Utils.html:535 Temp: 20.7C, Humi: 53.6%, Ubat: 3.2V
XMWSDJ04MMC_Utils.html:535 Found Mi service
XMWSDJ04MMC_Utils.html:535 Found Mi-Authentication characteristic
XMWSDJ04MMC_Utils.html:535 Found Mi-Standard characteristic
XMWSDJ04MMC_Utils.html:535 Status: Connected
Status: Activating now, please wait...
XMWSDJ04MMC_Utils.html:535 Send: a4000000
XMWSDJ04MMC_Utils.html:535 Mi-Standard(0): 0000040006f2
XMWSDJ04MMC_Utils.html:535 Send: 0000050006f2
XMWSDJ04MMC_Utils.html:535 Mi-Standard(0): 00000401f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2
XMWSDJ04MMC_Utils.html:535 tstmtublk = 240
XMWSDJ04MMC_Utils.html:535 Send: 00000501f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2
XMWSDJ04MMC_Utils.html:535 Status: Get device info ...
XMWSDJ04MMC_Utils.html:535 Send: a2000000
XMWSDJ04MMC_Utils.html:535 Mi-Standard(0): 000002000100000000626c742e332e31636961616f65646f35733030
XMWSDJ04MMC_Utils.html:535 Send: 00000300
XMWSDJ04MMC_Utils.html:535 Status: Start Login ...
XMWSDJ04MMC_Utils.html:535 Send: 15000000
XMWSDJ04MMC_Utils.html:535 Send: 000000030100

Got issues trying to activate it via the MiHome app as well, getting stuck at various steps.
Really don't know what to try now...

[baramuse]

And on the second device, I do the exact same steps with the MiHome app, and still get stuck at the "failed to bind" screen I posted before, so there must be some weird leftovers in the flash, or defective hardware on this sensor...

[baramuse]

And I tried a third unit, can bind it with MiApp, stuck same step with activation tool.
I'll try the two working units with another android phone / bt adapter

[baramuse]

So !
I tried with a modern Android phone, and all I got were 5 GATT server errors, quickly, so I could not even properly connect.
All the 5 other devices got binded via the MiHome app without trouble, I got the bindkeys back with the python script.

What I have noticed in the MiHome app workflow : first it discovers the device (if the device is announcing - blinking BT symbol) then it asks you to press the button and automatically gets to the binding part from there.
The BT only is "connected" (BT symbol steady on) during the binding phase, not while waiting the button press whereas in your util, when waiting for the button to be pressed - ie after clicking on connect and choosing the device from the bt list - the BT is connected (steady on bt symbol), so the workflow seem to differ.

I'd really like to have custom firmware for those too, you were saying it would take you too much time, maybe I can help with some time, I'm a sw engineer..

cheers

[pvvx]

5 GATT server errors

The Chrome API for BLE has many limitations and is still in beta testing.

I'd really like to have custom firmware for those too, you were saying it would take you too much time, maybe I can help with some time, I'm a sw engineer..

1. The SoC used has OTA protection (signed encryption).
2. Silicon Labs EFR32BG22C224HG OTA implementation is terrible (several steps) and not secure. There will be many complaints from users.

[baramuse]

5 GATT server errors

The Chrome API for BLE has many limitations and is still in beta testing.

I'd really like to have custom firmware for those too, you were saying it would take you too much time, maybe I can help with some time, I'm a sw engineer..

1. The SoC used has OTA protection (signed encryption).
2. Silicon Labs EFR32BG22C224HG OTA implementation is terrible (several steps) and not secure. There will be many complaints from users.

We'll stick to stock firmware then, you know better :)

[mariusproibu]

Hello all,

I just purchased a XMWSDJ04MMC sensor and wanted to add it to home assistant. I was hoping to install a custom firmware like on the old ones that I have, remove the encription key and perhaps use BTHome, but I have some issues understanding what to do.

In the begining I started with telink flasher (https://atc1441.github.io/Temp_universal_mi_activate.html)... but got no where as the activation is not happening.
After this I got the understanding that in order to be able to activate there I have to do something in the XMWSDJ04MMC Utils (https://pvvx.github.io/XMWSDJ04MMC/XMWSDJ04MMC_Utils.html)
First of all - is my understanding correct? Is there a more detailed documentation of the steps?

For the XMWSDJ04MMC Utils, I kept the button pressed for 7 seconds, released, after display reset. I once again press the button for one or 2 seconds and after this press connect. It connects but then what?

• if I click on get -- nothing happends
• the same if I click on Mi activation or Mi login!....
  Can someone provide more details on the steps please!

thank you

[Ernst79]

The firmware flasher you refer to is only for LYWSD03MMC, not LYWSD04MMC

Pvvx has support for more sensors, but again not for LYWSD04MMC
https://github.com/pvvx/ATC_MiThermometer

so, afaik, there is no custom firmware for your sensor

[mariusproibu]

Thank you for the quick replay,

A bit disappointed as I really like how it looks over the old models.
what are my options than to use it as part of home assistant?

[Ernst79]

At the moment, you can only use it with stock firmware in BLE monitor and/or the core xiaomi-ble integration without any problems. You only need to get the encryption key, e.g. xiaomi cloud token extractor ( if connected to MiHome). For other ways, see the faq.

[pvvx]

Without using "MiHome", it is only possible to create new bind keys for Home Assistant.
#674 (comment)

[mariusproibu]

I got it working. I used the linux token_extractor and got the bind key!
thank you for your help.

The nice question now would be if there are any plans to make a custom firmware for this device! that would be nice actually! :)

[cvjensen]

I just sold my old phone that worked with the telinkflasher and realized that was really stupid when I just bought 8 new sensors for the rest of the house . Luckily your comment saved me. thanks alot!

[pvvx]

The chip manufacturer (Silicon Labs) and Mijia uses a cryptographic signature for the OTA firmware.
As a result, they do not want users to modify something.
Firmware is only possible via JTAG, which greatly limits the capabilities of users.