ESPHome  2024.3.2
xiaomi_ble.cpp
Go to the documentation of this file.
1 #include "xiaomi_ble.h"
2 #include "esphome/core/helpers.h"
3 #include "esphome/core/log.h"
4 
5 #ifdef USE_ESP32
6 
7 #include <vector>
8 #include "mbedtls/ccm.h"
9 
10 namespace esphome {
11 namespace xiaomi_ble {
12 
13 static const char *const TAG = "xiaomi_ble";
14 
15 bool parse_xiaomi_value(uint16_t value_type, const uint8_t *data, uint8_t value_length, XiaomiParseResult &result) {
16  // button pressed, 3 bytes, only byte 3 is used for supported devices so far
17  if ((value_type == 0x1001) && (value_length == 3)) {
18  result.button_press = data[2] == 0;
19  return true;
20  }
21  // motion detection, 1 byte, 8-bit unsigned integer
22  else if ((value_type == 0x0003) && (value_length == 1)) {
23  result.has_motion = data[0];
24  }
25  // temperature, 2 bytes, 16-bit signed integer (LE), 0.1 °C
26  else if ((value_type == 0x1004) && (value_length == 2)) {
27  const int16_t temperature = encode_uint16(data[1], data[0]);
28  result.temperature = temperature / 10.0f;
29  }
30  // humidity, 2 bytes, 16-bit signed integer (LE), 0.1 %
31  else if ((value_type == 0x1006) && (value_length == 2)) {
32  const int16_t humidity = encode_uint16(data[1], data[0]);
33  result.humidity = humidity / 10.0f;
34  }
35  // illuminance (+ motion), 3 bytes, 24-bit unsigned integer (LE), 1 lx
36  else if (((value_type == 0x1007) || (value_type == 0x000F)) && (value_length == 3)) {
37  const uint32_t illuminance = encode_uint24(data[2], data[1], data[0]);
38  result.illuminance = illuminance;
39  result.is_light = illuminance >= 100;
40  if (value_type == 0x0F)
41  result.has_motion = true;
42  }
43  // soil moisture, 1 byte, 8-bit unsigned integer, 1 %
44  else if ((value_type == 0x1008) && (value_length == 1)) {
45  result.moisture = data[0];
46  }
47  // conductivity, 2 bytes, 16-bit unsigned integer (LE), 1 µS/cm
48  else if ((value_type == 0x1009) && (value_length == 2)) {
49  const uint16_t conductivity = encode_uint16(data[1], data[0]);
50  result.conductivity = conductivity;
51  }
52  // battery, 1 byte, 8-bit unsigned integer, 1 %
53  else if ((value_type == 0x100A) && (value_length == 1)) {
54  result.battery_level = data[0];
55  }
56  // temperature + humidity, 4 bytes, 16-bit signed integer (LE) each, 0.1 °C, 0.1 %
57  else if ((value_type == 0x100D) && (value_length == 4)) {
58  const int16_t temperature = encode_uint16(data[1], data[0]);
59  const int16_t humidity = encode_uint16(data[3], data[2]);
60  result.temperature = temperature / 10.0f;
61  result.humidity = humidity / 10.0f;
62  }
63  // formaldehyde, 2 bytes, 16-bit unsigned integer (LE), 0.01 mg / m3
64  else if ((value_type == 0x1010) && (value_length == 2)) {
65  const uint16_t formaldehyde = encode_uint16(data[1], data[0]);
66  result.formaldehyde = formaldehyde / 100.0f;
67  }
68  // on/off state, 1 byte, 8-bit unsigned integer
69  else if ((value_type == 0x1012) && (value_length == 1)) {
70  result.is_active = data[0];
71  }
72  // mosquito tablet, 1 byte, 8-bit unsigned integer, 1 %
73  else if ((value_type == 0x1013) && (value_length == 1)) {
74  result.tablet = data[0];
75  }
76  // idle time since last motion, 4 byte, 32-bit unsigned integer, 1 min
77  else if ((value_type == 0x1017) && (value_length == 4)) {
78  const uint32_t idle_time = encode_uint32(data[3], data[2], data[1], data[0]);
79  result.idle_time = idle_time / 60.0f;
80  result.has_motion = !idle_time;
81  } else if ((value_type == 0x1018) && (value_length == 1)) {
82  result.is_light = data[0];
83  } else {
84  return false;
85  }
86 
87  return true;
88 }
89 
90 bool parse_xiaomi_message(const std::vector<uint8_t> &message, XiaomiParseResult &result) {
91  result.has_encryption = message[0] & 0x08; // update encryption status
92  if (result.has_encryption) {
93  ESP_LOGVV(TAG, "parse_xiaomi_message(): payload is encrypted, stop reading message.");
94  return false;
95  }
96 
97  // Data point specs
98  // Byte 0: type
99  // Byte 1: fixed 0x10
100  // Byte 2: length
101  // Byte 3..3+len-1: data point value
102 
103  const uint8_t *payload = message.data() + result.raw_offset;
104  uint8_t payload_length = message.size() - result.raw_offset;
105  uint8_t payload_offset = 0;
106  bool success = false;
107 
108  if (payload_length < 4) {
109  ESP_LOGVV(TAG, "parse_xiaomi_message(): payload has wrong size (%d)!", payload_length);
110  return false;
111  }
112 
113  while (payload_length > 3) {
114  if (payload[payload_offset + 1] != 0x10 && payload[payload_offset + 1] != 0x00) {
115  ESP_LOGVV(TAG, "parse_xiaomi_message(): fixed byte not found, stop parsing residual data.");
116  break;
117  }
118 
119  const uint8_t value_length = payload[payload_offset + 2];
120  if ((value_length < 1) || (value_length > 4) || (payload_length < (3 + value_length))) {
121  ESP_LOGVV(TAG, "parse_xiaomi_message(): value has wrong size (%d)!", value_length);
122  break;
123  }
124 
125  const uint16_t value_type = encode_uint16(payload[payload_offset + 1], payload[payload_offset + 0]);
126  const uint8_t *data = &payload[payload_offset + 3];
127 
128  if (parse_xiaomi_value(value_type, data, value_length, result))
129  success = true;
130 
131  payload_length -= 3 + value_length;
132  payload_offset += 3 + value_length;
133  }
134 
135  return success;
136 }
137 
139  XiaomiParseResult result;
140  if (!service_data.uuid.contains(0x95, 0xFE)) {
141  ESP_LOGVV(TAG, "parse_xiaomi_header(): no service data UUID magic bytes.");
142  return {};
143  }
144 
145  auto raw = service_data.data;
146  result.has_data = raw[0] & 0x40;
147  result.has_capability = raw[0] & 0x20;
148  result.has_encryption = raw[0] & 0x08;
149 
150  if (!result.has_data) {
151  ESP_LOGVV(TAG, "parse_xiaomi_header(): service data has no DATA flag.");
152  return {};
153  }
154 
155  static uint8_t last_frame_count = 0;
156  if (last_frame_count == raw[4]) {
157  ESP_LOGVV(TAG, "parse_xiaomi_header(): duplicate data packet received (%d).", static_cast<int>(last_frame_count));
158  result.is_duplicate = true;
159  return {};
160  }
161  last_frame_count = raw[4];
162  result.is_duplicate = false;
163  result.raw_offset = result.has_capability ? 12 : 11;
164 
165  const uint16_t device_uuid = encode_uint16(raw[3], raw[2]);
166 
167  if (device_uuid == 0x0098) { // MiFlora
169  result.name = "HHCCJCY01";
170  } else if (device_uuid == 0x01aa) { // round body, segment LCD
172  result.name = "LYWSDCGQ";
173  } else if (device_uuid == 0x015d) { // FlowerPot, RoPot
175  result.name = "HHCCPOT002";
176  } else if (device_uuid == 0x02df) { // Xiaomi (Honeywell) formaldehyde sensor, OLED display
178  result.name = "JQJCY01YM";
179  } else if (device_uuid == 0x03dd) { // Philips/Xiaomi BLE nightlight
181  result.name = "MUE4094RT";
182  result.raw_offset -= 6;
183  } else if (device_uuid == 0x0347 || // ClearGrass-branded, round body, e-ink display
184  device_uuid == 0x0B48) { // Qingping-branded, round body, e-ink display — with bindkeys
186  result.name = "CGG1";
187  } else if (device_uuid == 0x03bc) { // VegTrug Grow Care Garden
189  result.name = "GCLS002";
190  } else if (device_uuid == 0x045b) { // rectangular body, e-ink display
192  result.name = "LYWSD02";
193  } else if (device_uuid == 0x040a) { // Mosquito Repellent Smart Version
195  result.name = "WX08ZM";
196  } else if (device_uuid == 0x0576) { // Cleargrass (Qingping) alarm clock, segment LCD
198  result.name = "CGD1";
199  } else if (device_uuid == 0x066F) { // Cleargrass (Qingping) Temp & RH Lite
201  result.name = "CGDK2";
202  } else if (device_uuid == 0x055b) { // small square body, segment LCD, encrypted
204  result.name = "LYWSD03MMC";
205  } else if (device_uuid == 0x07f6) { // Xiaomi-Yeelight BLE nightlight
207  result.name = "MJYD02YLA";
208  if (raw.size() == 19)
209  result.raw_offset -= 6;
210  } else if (device_uuid == 0x06d3) { // rectangular body, e-ink display with alarm
212  result.name = "MHOC303";
213  } else if (device_uuid == 0x0387) { // square body, e-ink display
215  result.name = "MHOC401";
216  } else if (device_uuid == 0x0A83) { // Qingping-branded, motion & ambient light sensor
218  result.name = "CGPR1";
219  if (raw.size() == 19)
220  result.raw_offset -= 6;
221  } else if (device_uuid == 0x0A8D) { // Xiaomi Mi Motion Sensor 2
223  result.name = "RTCGQ02LM";
224  if (raw.size() == 19)
225  result.raw_offset -= 6;
226  } else {
227  ESP_LOGVV(TAG, "parse_xiaomi_header(): unknown device, no magic bytes.");
228  return {};
229  }
230 
231  return result;
232 }
233 
234 bool decrypt_xiaomi_payload(std::vector<uint8_t> &raw, const uint8_t *bindkey, const uint64_t &address) {
235  if (!((raw.size() == 19) || ((raw.size() >= 22) && (raw.size() <= 24)))) {
236  ESP_LOGVV(TAG, "decrypt_xiaomi_payload(): data packet has wrong size (%d)!", raw.size());
237  ESP_LOGVV(TAG, " Packet : %s", format_hex_pretty(raw.data(), raw.size()).c_str());
238  return false;
239  }
240 
241  uint8_t mac_reverse[6] = {0};
242  mac_reverse[5] = (uint8_t) (address >> 40);
243  mac_reverse[4] = (uint8_t) (address >> 32);
244  mac_reverse[3] = (uint8_t) (address >> 24);
245  mac_reverse[2] = (uint8_t) (address >> 16);
246  mac_reverse[1] = (uint8_t) (address >> 8);
247  mac_reverse[0] = (uint8_t) (address >> 0);
248 
249  XiaomiAESVector vector{.key = {0},
250  .plaintext = {0},
251  .ciphertext = {0},
252  .authdata = {0x11},
253  .iv = {0},
254  .tag = {0},
255  .keysize = 16,
256  .authsize = 1,
257  .datasize = 0,
258  .tagsize = 4,
259  .ivsize = 12};
260 
261  vector.datasize = (raw.size() == 19) ? raw.size() - 12 : raw.size() - 18;
262  int cipher_pos = (raw.size() == 19) ? 5 : 11;
263 
264  const uint8_t *v = raw.data();
265 
266  memcpy(vector.key, bindkey, vector.keysize);
267  memcpy(vector.ciphertext, v + cipher_pos, vector.datasize);
268  memcpy(vector.tag, v + raw.size() - vector.tagsize, vector.tagsize);
269  memcpy(vector.iv, mac_reverse, 6); // MAC address reverse
270  memcpy(vector.iv + 6, v + 2, 3); // sensor type (2) + packet id (1)
271  memcpy(vector.iv + 9, v + raw.size() - 7, 3); // payload counter
272 
273  mbedtls_ccm_context ctx;
274  mbedtls_ccm_init(&ctx);
275 
276  int ret = mbedtls_ccm_setkey(&ctx, MBEDTLS_CIPHER_ID_AES, vector.key, vector.keysize * 8);
277  if (ret) {
278  ESP_LOGVV(TAG, "decrypt_xiaomi_payload(): mbedtls_ccm_setkey() failed.");
279  mbedtls_ccm_free(&ctx);
280  return false;
281  }
282 
283  ret = mbedtls_ccm_auth_decrypt(&ctx, vector.datasize, vector.iv, vector.ivsize, vector.authdata, vector.authsize,
284  vector.ciphertext, vector.plaintext, vector.tag, vector.tagsize);
285  if (ret) {
286  uint8_t mac_address[6] = {0};
287  memcpy(mac_address, mac_reverse + 5, 1);
288  memcpy(mac_address + 1, mac_reverse + 4, 1);
289  memcpy(mac_address + 2, mac_reverse + 3, 1);
290  memcpy(mac_address + 3, mac_reverse + 2, 1);
291  memcpy(mac_address + 4, mac_reverse + 1, 1);
292  memcpy(mac_address + 5, mac_reverse, 1);
293  ESP_LOGVV(TAG, "decrypt_xiaomi_payload(): authenticated decryption failed.");
294  ESP_LOGVV(TAG, " MAC address : %s", format_hex_pretty(mac_address, 6).c_str());
295  ESP_LOGVV(TAG, " Packet : %s", format_hex_pretty(raw.data(), raw.size()).c_str());
296  ESP_LOGVV(TAG, " Key : %s", format_hex_pretty(vector.key, vector.keysize).c_str());
297  ESP_LOGVV(TAG, " Iv : %s", format_hex_pretty(vector.iv, vector.ivsize).c_str());
298  ESP_LOGVV(TAG, " Cipher : %s", format_hex_pretty(vector.ciphertext, vector.datasize).c_str());
299  ESP_LOGVV(TAG, " Tag : %s", format_hex_pretty(vector.tag, vector.tagsize).c_str());
300  mbedtls_ccm_free(&ctx);
301  return false;
302  }
303 
304  // replace encrypted payload with plaintext
305  uint8_t *p = vector.plaintext;
306  for (std::vector<uint8_t>::iterator it = raw.begin() + cipher_pos; it != raw.begin() + cipher_pos + vector.datasize;
307  ++it) {
308  *it = *(p++);
309  }
310 
311  // clear encrypted flag
312  raw[0] &= ~0x08;
313 
314  ESP_LOGVV(TAG, "decrypt_xiaomi_payload(): authenticated decryption passed.");
315  ESP_LOGVV(TAG, " Plaintext : %s, Packet : %d", format_hex_pretty(raw.data() + cipher_pos, vector.datasize).c_str(),
316  static_cast<int>(raw[4]));
317 
318  mbedtls_ccm_free(&ctx);
319  return true;
320 }
321 
322 bool report_xiaomi_results(const optional<XiaomiParseResult> &result, const std::string &address) {
323  if (!result.has_value()) {
324  ESP_LOGVV(TAG, "report_xiaomi_results(): no results available.");
325  return false;
326  }
327 
328  ESP_LOGD(TAG, "Got Xiaomi %s (%s):", result->name.c_str(), address.c_str());
329 
330  if (result->temperature.has_value()) {
331  ESP_LOGD(TAG, " Temperature: %.1f°C", *result->temperature);
332  }
333  if (result->humidity.has_value()) {
334  ESP_LOGD(TAG, " Humidity: %.1f%%", *result->humidity);
335  }
336  if (result->battery_level.has_value()) {
337  ESP_LOGD(TAG, " Battery Level: %.0f%%", *result->battery_level);
338  }
339  if (result->conductivity.has_value()) {
340  ESP_LOGD(TAG, " Conductivity: %.0fµS/cm", *result->conductivity);
341  }
342  if (result->illuminance.has_value()) {
343  ESP_LOGD(TAG, " Illuminance: %.0flx", *result->illuminance);
344  }
345  if (result->moisture.has_value()) {
346  ESP_LOGD(TAG, " Moisture: %.0f%%", *result->moisture);
347  }
348  if (result->tablet.has_value()) {
349  ESP_LOGD(TAG, " Mosquito tablet: %.0f%%", *result->tablet);
350  }
351  if (result->is_active.has_value()) {
352  ESP_LOGD(TAG, " Repellent: %s", (*result->is_active) ? "on" : "off");
353  }
354  if (result->has_motion.has_value()) {
355  ESP_LOGD(TAG, " Motion: %s", (*result->has_motion) ? "yes" : "no");
356  }
357  if (result->is_light.has_value()) {
358  ESP_LOGD(TAG, " Light: %s", (*result->is_light) ? "on" : "off");
359  }
360  if (result->button_press.has_value()) {
361  ESP_LOGD(TAG, " Button: %s", (*result->button_press) ? "pressed" : "");
362  }
363 
364  return true;
365 }
366 
368  // Previously the message was parsed twice per packet, once by XiaomiListener::parse_device()
369  // and then again by the respective device class's parse_device() function. Parsing the header
370  // here and then for each device seems to be unnecessary and complicates the duplicate packet filtering.
371  // Hence I disabled the call to parse_xiaomi_header() here and the message parsing is done entirely
372  // in the respective device instance. The XiaomiListener class is defined in __init__.py and I was not
373  // able to remove it entirely.
374 
375  return false; // with true it's not showing device scans
376 }
377 
378 } // namespace xiaomi_ble
379 } // namespace esphome
380 
381 #endif
uint8_t raw[35]
Definition: bl0939.h:19
std::string format_hex_pretty(const uint8_t *data, size_t length)
Format the byte array data of length len in pretty-printed, human-readable hex.
Definition: helpers.cpp:361
bool parse_xiaomi_value(uint16_t value_type, const uint8_t *data, uint8_t value_length, XiaomiParseResult &result)
Definition: xiaomi_ble.cpp:15
constexpr uint32_t encode_uint32(uint8_t byte1, uint8_t byte2, uint8_t byte3, uint8_t byte4)
Encode a 32-bit value given four bytes in most to least significant byte order.
Definition: helpers.h:186
float temperature
Definition: qmp6988.h:71
bool has_value() const
Definition: optional.h:87
enum esphome::xiaomi_ble::XiaomiParseResult::@113 type
bool decrypt_xiaomi_payload(std::vector< uint8_t > &raw, const uint8_t *bindkey, const uint64_t &address)
Definition: xiaomi_ble.cpp:234
constexpr uint32_t encode_uint24(uint8_t byte1, uint8_t byte2, uint8_t byte3)
Encode a 24-bit value given three bytes in most to least significant byte order.
Definition: helpers.h:191
bool parse_device(const esp32_ble_tracker::ESPBTDevice &device) override
Definition: xiaomi_ble.cpp:367
constexpr uint16_t encode_uint16(uint8_t msb, uint8_t lsb)
Encode a 16-bit value given the most and least significant byte.
Definition: helpers.h:182
bool parse_xiaomi_message(const std::vector< uint8_t > &message, XiaomiParseResult &result)
Definition: xiaomi_ble.cpp:90
optional< XiaomiParseResult > parse_xiaomi_header(const esp32_ble_tracker::ServiceData &service_data)
Definition: xiaomi_ble.cpp:138
bool report_xiaomi_results(const optional< XiaomiParseResult > &result, const std::string &address)
Definition: xiaomi_ble.cpp:322
bool contains(uint8_t data1, uint8_t data2) const
Definition: ble_uuid.cpp:119
This is a workaround until we can figure out a way to get the tflite-micro idf component code availab...
Definition: a01nyub.cpp:7