Yesterday, I received a mail! By a user named : tuxuser. I thought I was alone in the world of Xiaomi Air purifier poking…
Since more people are getting involved I decided to update some more information on the web!
I dumped the ESP Flash contents using : Link (look closely and you will see that I used the air purifier to generate that content)
warning: don’t use this firmware to recover your devices if its bricked. I made some manual changes to it to remove some private info.
I will make a virgin dump that can be used for recovery purposes.
Lest do a visual analysis of the data:
Upload the Binary to https://binvis.io/
scroll through the data.. the first thing I saw was:
Lets see:
I was flabbergasted to see this… All my network information (SSID and location, passwords) in plain text..
Furthermore they save all the network data and password of previous networks as well.. don’t forget to wipe your ESP when you sell this thing secondhand…
more interesting: the PSM tokens of the device (these can be used with integration in something like Home assistant.) are located here as well.
From now on when I need someone’s WIFI password:
The following IP Addresses are hard coded in the device:
110.43.0.85
110.43.0.83
http://dlg.io.mi.com
By Blocking these IP addresses the Air purifier wont be able to call home.
Parts in this series:
Part 1 header information
Part 2 Fremont EEPROM dump
You did a great job. I think I’ll give your mod a try.
“All my network information (SSID and location, passwords) in plain text.. ”
“From now on when I need someone’s WIFI password:”
Yes. But information is already “stolen” by Xiaomi if a device is registered. All the information is sent to the cloud.
Therefore I didn’t register mine so far. Did you make some progress on ESP32 ?
My aim is to never register my 3H but be able to connect it to my smarthome to steer it and to gather sensor informations.
Regards Markus
Hi Markus and anyone else reading,
For the exact same reason I started working on replacing the stock ESP32 firmware with my own build of ESPHome. This allows me to monitor and control the purifier from Home Assistant without ever having to connect it to the internet or download weird apps. The only disadvantage is, that you have to take the purifier apart to access the header for flashing. Also you have to tie GPIO0 and GPIO2 to GND for the ESP to enter download mode.
I hope someone can benefit from my work.
Regards,
Jaro
Well of course I forgot to add the link…
So here it is: https://github.com/jaromeyer/mipurifier-esphome
This is fucking cool! Keep up the work!
I always set up these spying devices on their own Wifi network isolated from everything else. This is why.
Guys, I really need your help. I got a NTAG213 tag which i need to clone. I think it’s encrypted or password protected. Can anyone be able to clone it?
I just wonder if we could somehow modify the firmware to change the region of the devices. I have a 3H that’s for EU region and i want to add it in the China server where i have all the rest devices. I managed to pair it but it doesn’t show up in the app, although it’s linked and i can see the temp and humidity from it…..i just can’t see the filter life etc…
I’m interested in this as well. Have you made any progress?
Hey! I stopped working on this a while ago! Lost interest after the NFC stuff 😛