[Feature request] Support for CGG1 possible?

[MacSass]

Hello, great firmware / solution you have build. Works perfectly - love it on my LYWSD03MMC.
Incredible what is possible and how a commercial product can be made so much better! Thank you!

I´m wondering if it was possible to add the CGG1 model. It seems to use the same type of encrypted advertisement in recent FW, but has a very nice e-paper display with low energy consumption.
Link to respective model here: www.aliexpress.com/item/1000008051178.html

Would love to see that supported. Thanks again for making and documenting all this for us.

Regards - MacSass

[pvvx]

Hi
There were like 2 models in round cases? And there is already enough trash ... :)

[atc1441]

@MacSass as you kind of see in these FCC pictures https://fccid.io/2AQ3F-CGG1/Internal-Photos/Internal-Photos-3990168 the CGG1 uses an nRF52832 as SOC, that would mean a custom rom is a complete new project.
This also counts for other versions of the Xiaomi devices.

One other device i know that has an tlsr is the mosquito repellend

[pvvx]

Various, from Xiaomi, with temperature sensors, etc:

LYWSD02MMC https://ixbt.online/live/images/original/00/94/02/2020/07/10/8cfc21dc51.jpg SOC Dialog DA14585
WSDCGQ01LM
LYWSDCGQ/01ZM https://blog.uaid.net.ua/wp-content/uploads/2020/12/MiSmart_temphum_01.jpg https://blog.uaid.net.ua/ble-temperature-sensor/#more-4386
 JN5169
https://faire-ca-soi-meme.fr/domotique/2017/02/27/hack-xiaomi-mi-smart-temperature-and-humidity-sensor/
https://i2.wp.com/faire-ca-soi-meme.fr/wp-content/uploads/2017/05/IMG_20170528_115624-e1495982583660.jpg

EFR32MG13
https://i1.wp.com/faire-ca-soi-meme.fr/wp-content/uploads/2019/07/capteur_temp_humidity_demontage.jpg
https://faire-ca-soi-meme.fr/domotique/2019/07/16/test-du-kit-zigbee-konke-smart-home

[pvvx]

.. that would mean a custom rom is a complete new project.

Everything has an SDK, datasheet, ...
If 2 people take on each type, then in a month everything from Xiaomi will be with non-standard firmware :)

[atc1441]

@pvvx Thats true.

Only some ota update method could be harder to crack, but hardware update should work on all of them

[pvvx]

Of the BLE, Xiaomi will only have these chip manufacturers:

https://iot.mi.com/new/doc/embedded-development/ble/standard.html

Nordic	51 Series	https://github.com/MiEcosystem/mijia_ble_standard/tree/nordic_legacy
Nordic	52 Series	https://github.com/MiEcosystem/mijia_ble_standard/tree/nordic
Silicon Labs	BG13	https://github.com/MiEcosystem/mijia_ble_standard/tree/silabs
Telink	TLSR825x	https://github.com/MiEcosystem/mijia_ble_standard/tree/telink
Realtek	RTL8752x / RTL8762x	https://github.com/MiEcosystem/mijia_ble_standard/tree/realtek
Dialog	DA145xx	https://github.com/MiEcosystem/mijia_ble_standard/tree/Dialog
Dialog	DA146xx	https://github.com/MiEcosystem/mijia_ble_standard/tree/da146xx

For TLSR825x from Telink https://yadi.sk/d/g5fV7WD1EaUdRQ

All have the same OTA connection coding.

[atc1441]

"All have the same OTA connection coding."

The tlsr uses the Telink ota connection coding so i doubt it?!

[pvvx]

They all use their standard options. But binding and bindkey are similar.
So there is also OTA from mi.

[pvvx]

The advertising format is also described in detail:
https://iot.mi.com/new/doc/embedded-development/ble/ble-mibeacon
BLE MiBeacon protocol:
The broadcast message with the following information in the broadcast identifier is a broadcast conforming to the MiBeacon protocol:

"Service Data" (0x16) in advertising contains Mi Service (UUID: 0xFE95)
The "Manufacturer Specific Data" (0xFF) in the scan response contains the Xiaomi company identification code (ID: 0x038F)
Note: "advertising" or "scan response" are defined in a unified format.

Field	Name	Types of	Length (byte)	Mandatory (M) / Optional (O)	Description
1	Frame Control	Bitmap	2	M	Control bit, see the specific definition in the table below
2	Product ID	U16	2	M	Product ID, unique for each type of product, pid need millet IoT Developer Platform applications
3	Frame Counter	U8	1	M	Serial number, used for de-duplication, different event or attribute reporting requires different Frame Counter
4	MAC Address	U8	6	C.1	Device Mac address
5	Capability	U8	1	C.1	Equipment capacity, see the following table definition for details
6	I/O capability	U8	2	C.2	I/O capability. This field is currently only used for high-security BLE access, and only MiBeacon v5 is supported. It is only used before binding; when the binding is completed and an event is reported (such as door opening, door closing), this field is no longer needed. See the definition in the table below for details
7	Object	U8	n (according to actual needs)	C.1	Trigger events or broadcast properties, see Mijia BLE Object protocol for details
8	Random Number	U8	3	C.1	If encrypted, it is a required field, combined with Frame Counter to become a 4-byte Counter for anti-replay
9	Message Integrity Check	U8	4	C.1	If encrypted, it is a required field, MIC four bytes

and etc...

[MacSass]

Ok guys,
I understand it is not so easy to integrate as I was hoping ... thanks for your feedback.
Xiaomi really has a huge portfolio of "smarthome" devices build up ...
Anyhow - I´ll order some more LYWSD03MMC if needed - they are cheap enough ..

Thanks - I´ll watch this to see if you cracsk come up with anything new, unfortunately I don´t consider my coding know-how advanced enough to attack those other devices ...

MacSass

[pvvx]

Anyhow - I´ll order some more LYWSD03MMC if needed - they are cheap enough ..

MHO-C401 more beautiful.
The rest - as it becomes available and in mood...
I'm waiting for Xiaomi to have PHY62x2. The nRF, EFR, Dialog, STM, Silicon Labs are boring to me.

[kelchm]

If anyone is interested in taking a look, I have some very early stage efforts for the CGG1 I'm documenting here. It hasn't made it to the wiki yet, but I have managed to at least dump the stock firmware.

PS: Thanks @pvvx for your work on the LYWSD03MMC 💯

[MacSass]

Hi @kelchm ,
thanks for the update - that is interesting progress.
From you pictures I´m really hoping it will be able to OTA those devices too - dismanteling seems to be a hard job.
Unfortunately you guys are way more advanced than me, so I´m of no real help, but for sure I will be watching your progress :-)
Thanks for the work and update ...
Regards - MacSass

[pvvx]

TLSR использует кодировку соединения Telink ota, поэтому я в этом сомневаюсь ?!

https://github.com/scooterhacking/mijia_ble_libs/tree/master/gatt_dfu
https://github.com/TuyaInc/tuya_smesh_sdk_tlsr825x_common/tree/master/includes/board/chip/telink_sig_mesh_sdk/sdk/vendor/common/mi_api/libs/gatt_dfu
...
Telink tlrs825x + mijia_ble_libs:
https://yadi.sk/d/g5fV7WD1EaUdRQ