Bonjour, la question est dans le titre…
est-ce que quelqu’un a réussi a intégrer la Bouilloire connectée Xiaomi Mijia 1.5L bluetooth 4.0 https://fr.aliexpress.com/item/32813568917.html
si oui est-elle exploitable ?
si non pourquoi ne l’est-elle pas ?
You will need some variables and functions to start:
reversedMac is your kettle’s address but reversed, 6 bytes. For example, reversedMac for AA:BB:CC:DD:EE:FF is 0xFF, 0xEE, 0xDD, 0xCC, 0xBB, 0xAA.
productID is always 131 I guess.
token is the… token used to authenticate your kettle, 12 bytes! You can generate random token every auth, no matter. If you want to use Mi Home too, then pair Mi Home with your kettle and use the token from it.
cipher, mixA, mixB are functions from Xiaomi native library. They are common for lots of devices and used to cipher auth packets. I have a Go implementation.
Send 0x90, 0xCA, 0x85, 0xDE bytes to authInitCharacteristic.
Subscribe authCharacteristic.
Send cipher(mixA(reversedMac, productID), token) to authCharacteristic.
Now you’ll get a notification on authCharacteristic. You must wait for this notification before proceeding to next step. The notification data can be ignored or used to check an integrity, this is optional. If you want to perform a check, compare cipher(mixB(reversedMac, productID), cipher(mixA(reversedMac, productID), res)) where res is received payload with your token, they must equal.
Send 0x92, 0xAB, 0x54, 0xFA to authCharacteristic.
Read from verCharacteristics. You can ignore the response data, you just have to perform a read to complete authentication process.