Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Meawow MHO-C122 (2AWMOMHOC122) support #339

Open
4 tasks done
FaBjE opened this issue May 13, 2023 · 69 comments
Open
4 tasks done

Meawow MHO-C122 (2AWMOMHOC122) support #339

FaBjE opened this issue May 13, 2023 · 69 comments

Comments

@FaBjE
Copy link

FaBjE commented May 13, 2023

Introduction

Recently I acquired a few of the Meawow MHO-C122 (2AWMOMHOC122) sensors for a bargain price.
Hoping I was able to scrape the sensor data from the advertisement or basic readout of some characteristics.
Long story short, with the default firmware: Data is not advertised, Readout is only on a proprietary protocol, you can only connect over Bluetooth when you just inserted the battery.

I tried if the OTA update page of this project had any luck but unfortunately not. The published characteristics are nowhere near what the default Xiaomi units publish.

4:11:00 PM: Searching for devices
4:11:02 PM: Connecting to: C121
4:11:13 PM: Not found Telink OTA service!
4:11:13 PM: Disconnected.

Opening up the unit I saw the PCB with almost identical setup/components as the Xiaomi units.
No wonder as these are produced by the same company (I believe)
Giving me the Idea if with maybe some minor tweaks the software of this project can be run on those units as well.
This issue will be my little blog/progress report. Feel free to help out if you have anything to add.

Meawow MHO-C122 (2AWMOMHOC122)

https://meawow.com/product/thermo-hygrometer/mho-c122/

Exteriour

The unit LCD/casing is identical to the MHO-C101

Interiour

I took the following pictures of the PCB
Front:
pcb front
Back:
pcb back

On that we can see the (familiar)
MCU: TLSR8251F512ET24
LCD: IST3055NA0
Sensor: (Probably) SHTV3

Software

The default software gives the following log when connecting with the nRF Connect app.
meawow connection log.txt

ToDo List

  • Establish UART connection
  • Retrieve original firmware
  • Program with custom firmware + test
  • Fix LCD layout
@AvA1970
Copy link

AvA1970 commented May 13, 2023

I have purged also 5 of these. Would be nice to flash firmware or to advertise ble so HA could pick these up.

I will follow this topic with interest.

@killabeenl
Copy link

I have also a couple of these and it would be nice if we can flash them to use with HA

@NH-Networks
Copy link

same here! hope someone can figure this out..

@ZekiZico
Copy link

I'm interested in this too, can't get them connected to HA

@FaBjE
Copy link
Author

FaBjE commented May 20, 2023

I've made some progress. I have made a little programmer jig with a CH340 I'm able to readout the flash contents of the MCU.
I should be able to program the unit with new firmware, But I haven't tried (yet).
You only need the three connection pads on the right of the PCB.

Original_Firmware_MHO_C122.zip

Using this schematic/instruction:
https://github.com/pvvx/TlsrComSwireWriter#telink-swire-simulation-on-a-com-port

  • VCC is connected to the RTS to be able reset the MCU
  • The PCB is clamped between a dual-row header (and some cardboard stuff) This provides exact spacing and does not require soldering to the PCB.

programmer setup

Things I have learned

  • The silkscreen labels on the PCB can be deceiving. Reset is not the MCU reset, but just an IO pin.
  • You cant use the programmer scripts from a Virtual machine, WSL or a docker container. The timing becomes too unstable.
  • A full readout on the flash takes about 15 minutes. (for 512KB) But hey, I'm glad it works without buying an expensive programmer.
  • This command worked best for me: \python.exe TLSR825xComFlasher.py -p COM23 -t 70 rf 0 0x80000 firmware_download.bin

@ZekiZico
Copy link

Good job!

@NH-Networks
Copy link

NH-Networks commented May 20, 2023 via email

@FaBjE
Copy link
Author

FaBjE commented May 21, 2023

Some progress was made. I managed to flash the ATC_v42.bin. and the good news is that bluetooth works.
The sensor and battery readout seems to work fine.
But the LCD is messed up. It seems to work, but the segment layout is different, so you get really weird data displayed.

I tried some other firmwares and these are the results:

  • ATC_v42.bin: LCD Seems to work messed up segments, BT Temp/Humidity OK
  • MHO_C401_v42: No LCD, BT Temp/Humidity OK
  • MHO_C401N_v42.bin: No LCD, BT Temp/Humidity OK

Things I Learned

  • My programming jig is really temperamental. So don't recommend copying it. I suspect the power from the RTS pin is not sufficient.

@pvvx Is there a way to easily identify the LCD segment layout? Like flash each segment one by one?

@pvvx
Copy link
Owner

pvvx commented May 21, 2023

Control function ID when connected

ID Command
0x60 Get/Set LCD buffer

image

TelinkMiFlasher.html.

6001020304...
60 - command
01020304... - lcd buffer

Creates a bit-map similar to the one shown here - epd_mho_c401n.c

@pvvx
Copy link
Owner

pvvx commented May 22, 2023

Original_Firmware_MHO_C122.zip

Cut OTA file (CRC ok) -> https://github.com/pvvx/ATC_MiThermometer/blob/master/Original_OTA_MHO_C122_tuya.bin

This OTA file has a size of more than 128 kilobytes.
Typical Telink BLE firmware does not support OTA sizes larger than 128 kilobytes.
For this firmware, you will have to change the source code, approximately as done for MJWSD05MMC.

@pvvx
Copy link
Owner

pvvx commented May 23, 2023

The latest versions of Tuya BLE transmission of advertising packages with sensor data.
Also in Tuya BLE there is a download OTA with a key signature. Some of the codes can be found on the Tuya Cloud.

"LocalTuya integration" in the "HA" misleads users by not indicating that BLE is not supported.

@FaBjE
Copy link
Author

FaBjE commented May 26, 2023

I've made an LCD segment map. I'll try to cook up a lcd driver for it.
lcd_segment_map
Apologies for the mix between 0 indexed (bytes) and 1 indexed (bits), I guess I wasn't fully awake yet....

@pvvx
Copy link
Owner

pvvx commented May 27, 2023

ATC_v42.bin: LCD Seems to work messed up segments, BT Temp/Humidity OK

What is the address of the LCD controller?

And how are things with Tuya OTA?

@pvvx
Copy link
Owner

pvvx commented May 28, 2023

I recorded the firmware MHO-C122 in Xiaomi LYWSD03MMC (HW: B1.4).

Registered in "Smart Life":

image

image

Average Power:

image

nRFConnect (advertising):
image
Data is transmitted from the sensor.
image

https://iot.tuya.com/ (Registration in the cloud is free for all your devices registered in "Smart Life". All encryption keys are available.)
Device Management -> Get device details:

{
  "result": {
    "active_time": 1685239585,
    "biz_type": 18,
    "category": "wsdcg",
    "create_time": 1685239585,
    "icon": "smart/icon/bay1607936793441YbTx/03baef663c3c1a2149c7fbf98110e134.png",
    "id": "bf7xxxxxxxxhrn",
    "ip": "",
    "lat": "xx.9400",
    "local_key": "d+xxxxxxxxxxxxxx9-^",
    "lon": "xx.1000",
    "model": "MHO-C121",
    "name": "Temperature Humidity Sensor",
    "online": false,
    "owner_id": "47xxxx61",
    "product_id": "3nxxxxw6",
    "product_name": "Temperature Humidity Sensor",
    "status": [
      {
        "code": "va_temperature",
        "value": 223
      },
      {
        "code": "va_humidity",
        "value": 39
      },
      {
        "code": "battery_percentage",
        "value": 100
      },
      {
        "code": "temp_sampling",
        "value": 6
      },
      {
        "code": "temp_unit_convert",
        "value": "c"
      }
    ],
    "sub": false,
    "time_zone": "+03:00",
    "uid": "eu164xxxxxxxxxxxx5HE",
    "update_time": 1685239587,
    "uuid": "15xxxxxxxxxxx9c9"
  },
  "success": true,
  "t": 1685xxxxx7614,
  "tid": "78xxxxxxxxxxxxxxxxxxxxxxxxxxxx2a"
}
  • The data-keys has been changed (replaced with "xxxxx").

OTA is present. I haven't figured out how to program and where the keys are in the cloud yet...
There is a Telink SDK - ble_sdk_multimode_tuya. The old version. The SDK has OTA sources (ble_sdk_multimode_tuya\tuya_components\tlsr\tuya_ota.c).

@pvvx
Copy link
Owner

pvvx commented May 28, 2023

Apologies for the mix between 0 indexed (bytes) and 1 indexed (bits), I guess I wasn't fully awake yet....

image

/*
 *  MHO-C122 LCD buffer:  byte.bit

         --0.4--         --1.4--            --2.4--
  |    |         |     |         |        |         |
  |   0.0       0.5   1.0       1.5      2.0       2.5
  |    |         |     |         |        |         |      o 3.0
 0.3     --0.1--         --1.1--            --2.1--          +--- 3.0
  |    |         |     |         |        |         |     3.0|
  |   0.2       0.6   1.2       1.6      2.2       2.6       ---- 3.1
  |    |         |     |         |        |         |     3.0|
         --0.7--         --1.7--     *      --2.7--          ---- 3.2
                                    2.3
           --5.3--         --4.3--              1.3      1.3            
 (|)     |         |     |         |            / \      / \      
 3.7    5.6       5.2   4.6       4.2     1.3(  ___  3.6 ___  )1.3
         |         |     |         |            1.3  / \ 1.3      
 BLE       --5.5--         --4.5--                   ___          
 4.7     |         |     |         |                 3.5          
        5.4       5.1   4.4       4.1     	
 BAT     |         |     |         |                  %
 5.7       --5.0--         --4.0--                   3.4

None: 3.3 ?

*/

@pvvx
Copy link
Owner

pvvx commented May 28, 2023

Added a test version of MHO-C122.
So far, flash programming is only via hardware - SWS.
TelinkMiFlasher.html does not work with the original MHO-C122. With firmware MHO_C122_v43.bin something will work...
Check if everything is correct with the display.

@FaBjE
Copy link
Author

FaBjE commented May 28, 2023

What is the address of the LCD controller?

12:30:06 PM: Settings 02 was send successful
12:30:07 PM: Sensor: I2C addres 0x70, LCD driver: I2C addres 0x3C

And how are things with Tuya OTA?
Could not tell you. I tried an OTA in the app, but there was "no update available".

image

Whoops. I guess i was really still sleeping...
I checked and yes your correction is right.

Check if everything is correct with the display.

Thanks so much! I just can't find the time...
I will test this right now and report back.

@FaBjE
Copy link
Author

FaBjE commented May 28, 2023

@pvvx
I tested the LCD driver, it had some issues unfortunately.
But I manged to find them and submit a pull request with fixes: #344
Afaik it works good now, It's on my desk and I will monitor it.

@pvvx
Copy link
Owner

pvvx commented May 28, 2023

To complete work with MHO-C122(C121), an OTA is required.
This is not the first thermometer with TUYA BLE PROTOCOL VERSION 4.
I haven't seen any solutions for the Tuya BLE (new version) OTA.
Also, there is no integration local BLE Tuya in "HA".

@pvvx
Copy link
Owner

pvvx commented May 29, 2023

The description of the OTA protocol is in the cloud.

But you need to register.

https://developer.tuya.com/en/docs/iot-device-dev/OTA_BLE

image

It seems to give out all the keys.


image

It remains to understand the encryption method.

@FaBjE
Copy link
Author

FaBjE commented May 29, 2023

https://developer.tuya.com/en/docs/iot-device-dev/OTA_BLE?id=Kawer1ehuv8si seems freely available to me.
The example document at the bottom: https://images.tuyacn.com/smart/docs/OTA-update-sample.docx seems to list an example how to implement the tuya way in the MCU.
Maybe this helps you to implement it in the TelinkFlasher page?

@pvvx
Copy link
Owner

pvvx commented May 30, 2023

Screenshot_tuya2

Full sample of Telink SDK Tuya.
https://github.com/pvvx/pvvx.github.io/blob/master/MHO_C122/bin/ble_sdk_multimode_tuya.zip

log_tuya_demo

Screenshot_tuya1

But this is an old version of Tuya. Was available on Telink official website earlier.
It is assembled in Telink IDE, works, registers in applications on a smartphone...

@pvvx
Copy link
Owner

pvvx commented May 30, 2023

Maybe this helps you to implement it in the TelinkFlasher page?

There is still a lot to figure out.

  1. Add to the firmware the initial correction of the OTA download to another area.
  2. Restoring Tuya firmware.
  3. Request keys from the user or from the cloud
    But the main thing is how to establish a connection with the cipher.

I didn't find anyone doing this. Disassembled the old version and with Wi-Fi. I haven't seen anyone who could handle the new version of Tuya.

PS: And for the whole summer I usually take a break from working at computers...

@pvvx
Copy link
Owner

pvvx commented May 30, 2023

I found the source package tuya_ble_sdk_Demo_Project_tlsr8253 in the archive.
In the SDK, libs Tuya on most ARM:

libtuya_ble_sdk_lib_tlsr825x.a
tuya_ble_sdk_lib_arm_m0.lib
tuya_ble_sdk_lib_arm_m3.lib
tuya_ble_sdk_lib_arm_m4.lib
tuya_ble_sdk_lib_arm_m4f.lib
tuya_ble_sdk_lib_arm9e-s_little_endian.lib

@FaBjE
Copy link
Author

FaBjE commented May 30, 2023

Maybe this helps you to implement it in the TelinkFlasher page?

There is still a lot to figure out.

1. Add to the firmware the initial correction of the OTA download to another area.

2. Restoring Tuya firmware.

3. Request keys from the user or from the cloud
   But the main thing is how to establish a connection with the cipher.

I didn't find anyone doing this. Disassembled the old version and with Wi-Fi. I haven't seen anyone who could handle the new version of Tuya.

I think the most beneficial one is to "update" from stock tuya firmware to "atc firmware"
Going back to Tuya firmware would be a "nice to have" imho. But I don't think it will be a much used feature.

PS: And for the whole summer I usually take a break from working at computers...

You should definitely do that too :)

@FaBjE
Copy link
Author

FaBjE commented Jun 10, 2023

I've been running this firmware: https://github.com/pvvx/ATC_MiThermometer/raw/20a087dcc2c234f48790ee618d7273444288a2b9/MHO_C122_v43.bin on three units now for two weeks.
Without any problems. So I'm declaring this "finished/stable"

For the initial firmware update a programmer is needed.
After the initial 'convert' the updates can be done over BLE using the telink flasher page.

@cardshare007
Copy link

Thanks mate, will try with a battery and let you know the results

@pvvx
Copy link
Owner

pvvx commented Jun 17, 2023

USBCOMFlashTx is the easiest option when there is nothing more....

  1. USBCOMFlashTx.html has no feedback. Perhaps the firmware will be executed unsuccessfully. In this case, repetition is required.
  2. And the second problem is that the chip may be in sleep mode. For reliable programming, it is necessary to turn on the power during activation (ATime) or use a reset signal from the chip.
  3. After such programming, it is necessary to make a new OTA, since there is no guarantee of correct firmware using 'USBCOMFlashTx'.

@NH-Networks
Copy link

Tried on breadboard yesterday with ch340 of wittyboard gnd sws and rst connected, but cant seem to flash new firmware.. do i need to set it in flash mode somehow? Every try i did it still had original firmware afterwards

@cardshare007
Copy link

16870845526513953134994304684833

@cardshare007
Copy link

What I did:

  1. tried with a battery and only connect SWS and GND: nothing happens
  2. see the picture: I also tried to connect the VCC on the 3.3: no result
  3. I don't use FTDI but a wchusbserial1420

Still nothing seems to happen - please let me know if there are any further ideas. Thanks a lot for your support!

@cardshare007
Copy link

@FaBjE you didn't use the html page to flash, but how did you flash the thermometer? I saw in one of your first posts that you used python script ?

I use the https://github.com/pvvx/TlsrComSwireWriter from the repository. But I think you also need to connect the RX for that. Using a resistor https://github.com/pvvx/TlsrComSwireWriter#telink-swire-simulation-on-a-com-port

but I think the middle is the sws or am I missing something?

Yes middle connection pad, but his lower wire.

What I didn't do is use the battery to power it. Is this necessary?

Yes, see pvvx his explanation.

If RX. if FTDI is used, it checks the bit frame, but it does not match the 1-wire Telink

Thanks for explaining

I was struggling a bit to get this to work since I think python on my Mac is giving some troubles. Also, I see a different way of connecting the devices, I havn't been using resistors and not sure how to do this. Let me know if this is absolutely a necessity and I will check this direction...

@FaBjE
Copy link
Author

FaBjE commented Jun 18, 2023

do i need to set it in flash mode somehow

Yes, programming mode is achieved by sending a "magic sequence" on the SWS line.
This must be done directly after power-up. Therefore I / the script uses the "RTS" line to switch power on the right moment.
You can either switch the power yourself and tune with the "activation time" or let the script do it for you using the RTS line.
My USB > UART converter was able to supply enough current over this line to power the programming circuit, but there is no guarantee.
I only used the script from the repository:
\python.exe TLSR825xComFlasher.py -p COM24 -t 50 wf 0 .\ATC_Thermometer.bin

Let me know if this is absolutely a necessity and I will check this direction...

Well it is not an absolute necessity, but the "TX only" method, is a bit risky.
The resistor is used to make from a 1 signal wire "uart" (The SWS protocol), a two-wire signal for a normal USB->UART converter.
When only the TX is connected the webpage/script just sends the data hoping the microcontroller accepts it. (Having no clue if it does or not)

With the resistor (and the RX line connected) the Python script from this repository is able to receive the reply from the micro-controller and check if it has accepted the data or not.

To all of you, I had a lot of struggles getting this to work either. It is simulating a (expensive) programmer on cheap hardware. So it is all a bit "tongue at the right angle" and hoping it works stuff.
Sometimes I just have reconnect the USB device and re-run the script and it does work for some magic reason.

@cardshare007
Copy link

Thanks mate, seems a bit more complex than I initially thought. I will give it another shot next weekend, but for now I'll leave it. I also hope the OTA will appear in a few months, seems to be my best bet ;-)

@rpvandoorn
Copy link

Hi all,

Just for my understanding. Can I already use the BLE updater for the C122 ?

Thanks all for you efforts on this project.

@pvvx
Copy link
Owner

pvvx commented Jul 11, 2023

I will start considering the OTA option (firmware update via Bluetooth) only after the end of summer, when we run out of warm weather.
And it is desirable that by that time someone has support for receiving advertising the "Tuya" format. Otherwise, support for BLE advertising in the "Tuya" format will never appear in anyone's open-source.

@TrevorVr
Copy link

I will start considering the OTA option (firmware update via Bluetooth) only after the end of summer, when we run out of warm weather. And it is desirable that by that time someone has support for receiving advertising the "Tuya" format. Otherwise, support for BLE advertising in the "Tuya" format will never appear in anyone's open-source.

Hi! It's been pretty chilly lately, any chance of a Ota update for these? :)

@pvvx
Copy link
Owner

pvvx commented Nov 28, 2023

You forgot about the second point of the conditions.
Nobody wants to deal with Tuya.
Closed rospogrigio/localtuya#1166 as completed.
custom-components/ble_monitor#1063
...

@christiaandouma
Copy link

christiaandouma commented Dec 1, 2023

Nice work so far. I got two of c122 flashed. They work and can connect with smart life from tuya! After a minute or two they go offline and don't report their status anymore untill i remove the battery and readd them in the app.

Just wondering if we can expect zigbee because that is something thats not dependend on the smart life app and online access. Next to that it would be easy to integrate into home assistant.

Was looking at https://github.com/pvvx/ZigbeeTLc but don't seem to get it to work

Anyway thanks so far!

@pvvx
Copy link
Owner

pvvx commented Dec 1, 2023

Was looking at https://github.com/pvvx/ZigbeeTLc but don't seem to get it to work

What didn't work?
I don’t have an MHO-С122 and have nothing to test it on.
And there is an even more exotic option - https://github.com/pvvx/BZdevice
https://github.com/pvvx/BZdevice/raw/master/bin/1141-020b-01113001-ZMHOC122.zigbee
But there are still problems with BLE OTA...

@christiaandouma
Copy link

@pvvx I was able to flash with https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html and the tuya binary. I couldnt flash the zigbee binary using the same url. How should I flash with the zigbee version ?

@Monacoslo
Copy link

This is for TH05?

@pvvx
Copy link
Owner

pvvx commented Dec 4, 2023

This is for TH05?

MHO-С122

pvvx/ZigbeeTLc#22

TH05 - > SoC: PHY6222QC-W04I - Doesn't have an SDK for GCC. Only commercial version of the compiler.

@almirus
Copy link

almirus commented Dec 15, 2023

@pvvx это не оно? https://github.com/SoCXin/PHY6222

@pvvx
Copy link
Owner

pvvx commented Dec 15, 2023

No. This is the SDK from the PHY website shown earlier in the link.
But http://wiki.phyplusinc.com/ is not available.

https://github.com/SoCXin/PHY6222 использует Keil_v5\UV4\UV4.exe
https://developer.arm.com/documentation/101454/0103/License-Agreements-and-Terminologies/License-Agreement-MDK-v5-39-and-above

@almirus
Copy link

almirus commented Dec 16, 2023

@christiaandouma
Copy link

christiaandouma commented Dec 23, 2023

@pvvx @FaBjE I was able to flash with https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html and the tuya binary. I couldnt flash the zigbee binary using the same url. How should I flash with the zigbee version ?

Hi @pvvx I am a bit lost of the flasher pages give me a
00:03:06: Searching for devices
00:03:10: Connecting to: C121
00:03:11: Not found Telink OTA service!

What am I doing wrong (am I doing something wrong?)
I did manage to usb flash it using https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html but there is no Zigbee binary to flash from this website.

@pvvx
Copy link
Owner

pvvx commented Dec 23, 2023

@christiaandouma
Copy link

@pvvx same issue. Give a

Not found Telink OTA service!

@pvvx
Copy link
Owner

pvvx commented Dec 24, 2023

TelinkMiFlasher does not work with the original Meawow MHO-C122 firmware. Firmware is carried out using wires...
Further OTA will work in TelinkMiFlasher.

@christiaandouma
Copy link

christiaandouma commented Dec 24, 2023 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests