[SOLVED] Openhab2 - Xiaomi Mi Gateway - does not respond

Add-ons Bindings
, ,
188

@Pawel_Kowalski fairly simple:

5f6e5b794a330aaf2e78eba9bb7ae39796877b6f
5f6e5b794a330aaf2e78eba9bb7ae39796877b6f.jpeg2015×1133 723 KB

I never know how to describe RX/TX so it might be otherwise. :stuck_out_tongue:

There are two ways of connecting:

To get to bootloader:

  1. Solder GND, RX and TX.
  2. Attach GND, RX and TX to UART 3.3V.
  3. You can connect all three pins, but do not connect UART to USB yet.
  4. Plug Gateway to AC.
  5. Plug UART to USB. Baudrate is 115200, 8-1, no parity and no flow control.
  6. Press enter and you’ll see a prompt from HUSH shell of bootloader.
  7. You can play here to reset root password. Look below.

To get into boot process:
1-2. As above, if haven’t done already.
3. Connect all three ping to UART and connect UART to USB.
4. Baudrate is 115200, 8-1, no parity and no flow control.
5. Plug Gateway to AC.
6. You’ll get into boot process finishing with starting mi.
7. You’ll end up in fac_test (factory test tool) that is launched at the very end of booting process (in /etc/rc.local).
8. You can exit this mode with exit_factory.
9. You’ll end up with login prompt into device and unknown root password.

To reset root password:

  1. Boot into bootloader.
  2. Enter printenv command.
  3. Find bootargs=... and copy all after bootargs= – for me it was “console=
”.
  4. Open notepad.
  5. Enter text: setenv bootargs '
  6. Paste copied text.
  7. Enter text: single rw init=/bin/bash' (whitespace before “single”!).
  8. You’ll end up with smth like setenv bootargs 'console=... someparams single rw init=/bin/bash'.
  9. Press enter. No message should show up. If anything shows – you copied smth wrong (watch out for quotes and whitespaces).
  10. Now you’re done for single-user root booting.
  11. Before you enter boot command to boot with new bootargs – prepare that you’ll have around 5s to change the root password. I don’t know why, but my prompt freezes after 5s.. You must set password that is at least long for 8 chars and contains alpfanumeric signs. Prepare password in notepad and copy it into clipboard – you’ll just paste it twice fast.
  12. Enter boot. Press enter.
  13. Now boot process will start and you’ll end up in bash# prompt.
  14. Now you have 5s.
  15. Enter passwd, press enter.
  16. Paste twice password from clipboard.
  17. You’ll end up with “root password changed”.
  18. Success!
  19. Now simply turn off AC, plug UART into USB so it will follow boot process instead of going into bootloader, turn on AC again.
  20. Wait for boot process to end, exit factory mode.
  21. In login prompt enter root and your password from notepad/clipboard.

Now you have root access to your gateway’s Linux.

What I’ve found so far:

  1. This gateway looks like supporting HomeKit – check two different /etc/rc.local.* – one for mi and one for homekit.
  2. In default “mi” mode – there are two main processes running:
    • miio_client – responsible for communication with Mi Cloud. (/lumi/app/miio)
    • miio_client_helper_nomqtt.sh – miio_client helper that uses miio_recv_line and miio_send_line to mock communication between gateway and miio_client.
    • gw – gateway binary to communicate with sensor devices.
  3. This one is interesting – you can launch SSH server on your gateway. :slight_smile: In rc.local you just need to add dropbear -p 22 just before fac_test. After this is removed my soldered pins and use gateway via SSH on port 22.

Finally

$ netstat -ulptn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:54322         0.0.0.0:*               LISTEN      368/miio_client 
tcp        0      0 127.0.0.1:54323         0.0.0.0:*               LISTEN      368/miio_client 
udp        0      0 0.0.0.0:10008           0.0.0.0:*                           5632/gw         
udp        0      0 0.0.0.0:54321           0.0.0.0:*                           368/miio_client 
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           368/miio_client

This actually shows that in case of Mija Gateway EU it’s not about “opening the ports”, because there are no actual multicast services working in the background. Nothing listens on 4321, 9898 etc.

2 Likes