Firmware via OTA for version 2.1.1_0159

[pvvx]

Обновление ver2.1.1_0159

В текущем варианте требуется:

1. Зарегистрировать термометр в MiHome.
2. С помощью альтернативного ПО получить все ключи для данного термометра.
3. Запустить TelinkMiFlasher.html и соединиться с термометром.
4. Ввести "Device known id", "Mi Token", "Mi Bind Key" и выбрать "Login"
5. Выбрать прошивку "ATC_vNN" и запустить OTA.
   Если это не сработало, тогда необходимо обновить оригинальную прошивку.

(!) Для вариантов LYWSD03MMC с HW: B1.5/B1.6 выпущенных с 03.2025 следует изначально прошить предлагаемый “Original_OTA_....” (!)
Выбрать предлагаемый “Original_OTA_....” и “Start Flashing”:

Текущая версия поддерживает 2 типа прошивки версии 2.1.1_0159. О существовании ещё вариантов пока не известно. Но обновление на приложенную оригинальную прошивку решает такие вопросы.

• Внимание:
  После промежуточной прошивки OTA с оригинальной версией 2.1.1_0159 на LYWSD03MMC с новым HW: B1.5/B1.6 экран не работает. Но Bluetooth (TelinkMiFlasher) будет работать. И далее следует действовать снова с пп.3, но уже не обновляя на оригинальную версию прошивки Xiaomi.

Zigbee

Шаги по установке Zigbee версии указаны в #602 (comment)

• Примечание: OTA в вариант Zigbee не работает на macOS по причине отсутствия поддержки стандартов Bluetooth SIG в данной OS.

• Примечание: FW atc1441-ATC_Exploit.bin может не поддерживать прошивку прошивки Zigbee через BLE OTA. BLE и ZigBee используют разные размеры и области адресов Flash для OTA. Прошивка FW Zigbee доступна только из варианта BLE со специальной расширенной функцией OTA. Все FW BLE из этого репозитория имеют эту функцию. FW ZigbeeTlc имеют функцию адаптации к загрузке в неправильную область через BLE OTA и другие несовместимые опции с загрузчиком Zigbee от Tuya. Включено автоматическое перемещение FW в рабочую область.

---

Update ver2.1.1_0159

The current version requires:

1. Register the thermometer in MiHome.
2. Using alternative software, get all the keys for this thermometer.
3. Run TelinkMiFlasher.html and connect to the thermometer.
4. Enter "Device known id", "Mi Token", "Mi Bind Key" and select "Login"
5. Select the firmware "ATC_vNN" and run OTA. If this does not work, then you need to update the original firmware.

• (!) For LYWSD03MMC variants with HW: B1.5/B1.6 released since 03.2025, you should initially flash the suggested “Original_OTA_....” (!)

Select the suggested “Original_OTA_....” and “Start Flashing”:

The current version supports 2 types of firmware version 2.1.1_0159. The existence of other options is not yet known. But updating to the attached original firmware solves such issues.

• Warning:
  After an intermediate OTA with the original version 2.1.1_0159 on LYWSD03MMC with the new HW: B1.5/B1.6, the screen will not work. However, Bluetooth (TelinkMiFlasher) will work. And then you should repeat the steps from step 3, but without updating to the original Xiaomi firmware version.

Zigbee

• Note: OTA to Zigbee option does not work on macOS due to lack of support for Bluetooth SIG standards in this OS.

• Note: FW atc1441-ATC_Exploit.bin may not support flashing Zigbee firmware via BLE OTA. BLE and ZigBee use different Flash address areas for OTA. FW Zigbee firmware is only available from the BLE variant with a special extended OTA function. All FWs BLE from this repository have this function. FW ZigbeeTlc have the function of adaptation to loading into the wrong area via BLE OTA and other incompatible options with Zigbee boot-loader from Tuya. Automatic movement of FW to the working area is enabled.

No other FW and third-party BLE OTA programmer, except TelinkMiFlasher, has special functions for loading current Zigbee firmware. Only BLE firmware ATC_xxxx.bin specified in TelinkMiFlasher can do this and only when loading the " *.zigbee" file, not " *.bin"!

The steps for installing the Zigbee version are listed in #602 (comment)

The same situation with all new versions 2.1.1_xxxx from Xiaomi, and is duplicated here: #636

---

Alternative options from "atc1441":

Video Demo of Full OTA update of 2.1.1_0159 aka no wires needed. https://youtu.be/NfZHh6wmTp8

Find the MiHome Token Extractor here: https://github.com/PiotrMachowski/Xiaomi-cloud-tokens-extractor

[BelgarionNL]

then I try to reconnect the display turns weird (bricks?). and I cant find it in the list. I have to remove the battery and then its back to version 0159 and I can try again.

I tried with both ATC_v49 and exploit.

[pvvx]

For unknown, different from the latest version FW 2.1.1_0159, wait for the new version (v9.1) TelinkMiFlasher.html.
Depresated, "TelinktiFlasher.html" updated. View first message.

Or:
1. Download the file https://github.com/pvvx/ATC_MiThermometer/raw/refs/heads/master/Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin
2. Run [TelinkMiFlasher.html](https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html). Connect...
3. Run "Login".
4. Without closing "TelinkMiFlasher.html", run [TelinkOTA.html](https://pvvx.github.io/ATC_MiThermometer/TelinkOTA.html)
5. In "TelinkOTA.html", select the file "Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin", Connect and run OTA.

This should install the correct original version 2.1.1_0159.

[BelgarionNL]

yep works!

[fl0rian089]

just tried this and it worked, thank you very much.

which zigbee firmware is possible after the atc exploit?

[pvvx]

which zigbee firmware is possible after the atc exploit?

None. The Zigbee firmware size may exceed the maximum OTA size for flashing via "ATC_Exploit.bin".
Also, typical BLE OTA (from SDK) can load Zigbee FW into wrong Flash area.

Only via the BLE version specified in TelinkMiFlasher.html (ext.OTA is used).

---

---

• Step 1 is optional.

If you need to record another version of Zigbee, then copy the link to the raw file "https://...raw/.../*.zigbee" to download.

TelinkMiFlasher.html log of all actions:

22:17:34: Searching for devices
22:17:37: Connecting to: LYWSD03MMC
22:17:50: Hardware Revision String: 0000
22:17:50: Software Revision String: 0159
22:17:50: Firmware Revision String: 2.1.1_0159
22:17:50: Detected Mi device
22:17:50: Connected
22:18:37: Send Login, please wait...
22:18:38: Received device infos are correct
22:18:38: Login successful
22:18:39: Load firmware file 'ATC_v49.bin'...
22:18:39: File: ATC_v49.bin
22:18:39: File size: 83092 bytes
22:18:40: Add signature file.
22:18:40: Count: 5516
22:19:04: Start DFU
22:19:47: Update done after 42.034 seconds
22:19:53: Disconnected.
22:21:17: Reconnect
22:21:24: NetworkError: Connection Error: Connection attempt failed.
22:21:24: Reconnect 1 from 5
22:21:29: Hardware Revision String: B1.6
22:21:29: Software Revision String: V4.9
22:21:29: Firmware Revision String: github.com/pvvx
22:21:29: Detected custom Firmware
22:21:29: Hardware Version: LYWSD03MMC B1.6, Software Version: 4.9
22:21:29: Custom config HEX string: 55871000002804a9313104b4
22:21:47: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
22:21:48: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
22:21:48: File size: 128692 bytes
22:21:48: Count: 8044
22:22:04: Start DFU
22:22:46: Update done after 41.03 seconds
22:22:50: Disconnected.

Zigbee is ready to pair...

---

[itsmepete]

Yesterday I followed your work-around with v9.0 to flash to custom ATC. That worked fine as described.
In the next step I flashed with the following file to get it zigbee ready. https://github.com/devbis/z03mmc/releases/download/1.1.0/z03mmc.bin

The log file said it was disconnected due to an unknown error and since then the screen stays off. I have tried to reset it by taking out the battery and also by shorting the RESET & GROUND without success.

But as of the latest post I saw that there is actually a newer file for the zigbee binary. I was not aware of that.

So I repeated everything following your guide above with another sensor that I have. Works for me.

Any chance I can revive the first sensor that apparently was flashed with an older .bin file?

Thanks, really appreciate the guide above with step-by-step instruction.

[pvvx]

Yesterday I followed your work-around with v9.0 to flash to custom ATC. That worked fine as described. In the next step I flashed with the following file to get it zigbee ready. https://github.com/devbis/z03mmc/releases/download/1.1.0/z03mmc.bin

This firmware is from devbis and it is not adapted for loading via standard BLE OTA.
You will have to act as indicated on https://github.com/devbis/z03mmc/blob/master/README.md.

[mfatgt]

Hello @pvvx,

Thanks a lot for your valuable work.

on SKU: NUN4106CN

I have first flashed the original stock, then the exploit. The display showed all letters afterwards. After removing battery, it reverts back to original stock.

Edit:
11:16:32: Hardware Revision String: B1.5
11:16:32: Software Revision String: 0159
11:16:32: Firmware Revision String: 2.1.1_0159

[pvvx]

I have first flashed the original stock, then the exploit.

What other "exploit"?

[mfatgt]

Sorry, I meant the custom firmware.

[pvvx]

I have first flashed the original stock

Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin ?

[mfatgt]

Hello @pvvx ,
I was fortunately able to flash custom firmware as well as zigbee.

On #602 (comment) , the reconnect on 7. took 3 attempts to connect to the device.

1:11:08: Searching for devices
11:11:11: Get Advertising MAC (Web Experimental Features!)
11:11:11: Connecting to: LYWSD03MMC
11:12:48: Searching for devices
11:12:52: Get Advertising MAC (Web Experimental Features!)
11:12:52: Connecting to: LYWSD03MMC
11:13:54: Searching for devices
11:13:59: NotFoundError: User cancelled the requestDevice() chooser.
11:13:59: Reconnect 1 from 5
11:13:59: Searching for devices
11:14:10: NotFoundError: User cancelled the requestDevice() chooser.
11:14:10: Reconnect 1 from 5
11:14:10: NetworkError: Connection Error: Connection attempt failed.
11:14:10: Reconnect 2 from 5
11:14:11: Disconnected.
11:14:11: Searching for devices
11:14:16: NotFoundError: User cancelled the requestDevice() chooser.
11:14:16: Reconnect 1 from 5
11:14:16: Disconnected.
11:14:16: Searching for devices
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:14:20: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:15:40: Get Advertising MAC (Web Experimental Features!)
11:15:40: Connecting to: LYWSD03MMC
11:16:10: Reconnect
11:16:18: NetworkError: Connection Error: Connection attempt failed.
11:16:18: Reconnect 1 from 5
11:16:32: Hardware Revision String: B1.5
11:16:32: Software Revision String: 0159
11:16:32: Firmware Revision String: 2.1.1_0159
11:16:32: Detected Mi device
11:16:32: Connected
11:17:15: Send Login, please wait...
11:17:16: Received device infos are correct
11:17:16: Login successful
11:17:24: Load firmware file 'Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin'...
11:17:24: File: Original_OTA_Xiaomi_LYWSD03MMC_v2.1.1_0159c.bin
11:17:24: File size: 105760 bytes
11:17:24: Count: 6610
11:17:25: Start DFU
11:19:30: Update done after 124.252 seconds
11:19:41: Disconnected.
11:19:57: Reconnect
11:20:08: Hardware Revision String: B1.5
11:20:08: Software Revision String: 0159
11:20:08: Firmware Revision String: 2.1.1_0159
11:20:08: Detected Mi device
11:20:08: Connected
11:20:24: Send Login, please wait...
11:20:25: Received device infos are correct
11:20:25: Login successful
11:20:30: Load firmware file 'ATC_v49.bin'...
11:20:30: File: ATC_v49.bin
11:20:30: File size: 83092 bytes
11:20:30: Add signature file.
11:20:30: Count: 5516
11:20:31: Start DFU
11:22:15: Update done after 103.354 seconds
11:22:22: Disconnected.
11:22:27: Reconnect
11:22:35: NetworkError: Connection Error: Connection attempt failed.
11:22:35: Reconnect 1 from 5
11:22:42: NetworkError: Connection Error: Connection attempt failed.
11:22:42: Reconnect 2 from 5
11:22:50: NetworkError: Connection Error: Connection attempt failed.
11:22:50: Reconnect 3 from 5
11:22:58: NetworkError: Connection Error: Connection attempt failed.
11:22:58: Reconnect 4 from 5
11:23:06: NetworkError: Connection Error: Connection attempt failed.
11:23:06: Reconnect 5 from 5
11:23:13: NetworkError: Connection Error: Connection attempt failed.
11:23:13: Something went wrong, too many reconnects
11:23:22: Reconnect
11:23:30: NetworkError: Connection Error: Connection attempt failed.
11:23:30: Reconnect 1 from 5
11:23:41: NetworkError: Connection Error: Connection attempt failed.
11:23:41: Reconnect 2 from 5
11:23:41: Disconnected.
11:23:41: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:23:55: Reconnect
11:24:22: Hardware Revision String: B1.5
11:24:22: Software Revision String: V4.9
11:24:22: Firmware Revision String: github.com/pvvx
11:24:22: Detected custom Firmware
11:24:24: Hardware Version: LYWSD03MMC B1.5, Software Version: 4.9
11:24:24: Custom config HEX string: 55071000002804a931310ab4
11:24:44: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
11:24:44: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
11:24:44: File size: 128692 bytes
11:24:44: Count: 8044
11:24:46: Start DFU
11:24:52: Update error: NotSupportedError: GATT operation failed for unknown reason.
11:24:52: Disconnected.
11:25:02: Reconnect
11:25:25: Disconnected.
11:25:25: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:25:44: Reconnect
11:26:48: Disconnected.
11:26:48: Reconnect
11:26:52: Disconnected.
11:26:52: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:26:52: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:26:59: Reconnect
11:27:40: Disconnected.
11:27:40: Reconnect
11:27:40: Detected custom Firmware
11:27:40: TypeError: Cannot read properties of null (reading 'getPrimaryService')
11:27:40: Reconnect 1 from 5
11:27:46: Disconnected.
11:27:46: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:27:46: NetworkError: GATT Server is disconnected. Cannot retrieve services. (Re)connect first with device.gatt.connect.
11:27:56: Reconnect
11:28:36: Hardware Revision String: B1.5
11:28:36: Software Revision String: V4.9
11:28:36: Firmware Revision String: github.com/pvvx
11:28:36: Detected custom Firmware
11:28:38: Hardware Version: LYWSD03MMC B1.5, Software Version: 4.9
11:28:38: Custom config HEX string: 55071000002804a931310ab4
11:28:51: Load firmware file 'https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin'...
11:28:51: File: https://raw.githubusercontent.com/pvvx/ZigbeeTLc/master/bin/Z03MMC_v0123.bin
11:28:51: File size: 128692 bytes
11:28:51: Count: 8044
11:28:53: Start DFU
11:30:29: Update done after 94.682 seconds
11:30:33: Disconnected.

[pvvx]

On some BT adapters, a reset is required after each reflashing. Otherwise, the adapter remembers the old version of the previous firmware headers.
If it is USB-BT, then reconnect the adapter to the USB port.
In other cases, you need to restart your computer and/or Explorer. Reset cache.

[dasrohr]

Thank you, guys.
Thank you for your persistence and all the work you put into this project

I just bought a bunch of these thermometers which came with the new firmware from the factory.
Luckily, you already worked out how to flash those without UART.

Can confirm that the new method is indeed working. Flashed 10 Decices with Custom Firmware and converted them to Zigbee.

thanks again, and keep up this incredible work.