052117_1850_TinkeringTu1.jpg

Tinkering Tuesday – HUEify – JN5169 Xiaomi Smart Button – Part 1 – Making a connection

This is a side project to the original HUEify series on connecting a custom light to the HUE ecosystem. On the site http://faire-ca-soi-meme.fr/ there are some articles about what’s inside the Smart Home Gadgets of Xiaomi (at the end of this I provide all the links currently available). Every single piece is taken apart and detailed pictures were taken describing all the identifiable parts. With my little bit french from school even I can read through it. But maybe Google Translator may help others.

I decided to order two pieces because they were very cheap at Gearbest at that time and they would make a perfect match to the nightpanel lights I am currently building and replace the currently used Amazon Dash button. And because they just arrived and I am waiting for PeeVeeOne to publish his solution for the Multiple Endpoint RGB lights on the JN5168, I will now try my luck with the Xiaomi button to see whether I can get it to communicate with Hue.

On faire-ca-soi-meme there are several detailed images of the button and also the pinout from the test pins. Unfortunately these are pogo pins and my tries to solder a wire to them were not very successful. I was successful though with using jumper wires to connect 3.3V and GND to the battery connector, hot-glueing two jumper wires together in the right spacing and forcing it to the pogo pin connectors for RX and TX with a soldering hand. The fifth pin that is required is only temporary and is the SPIMISO pin next to RX/TX. Just shortly connect a ground wire to it when connecting the power (even with my shaky hand that works).

If that is done right you can open the Device Info in NXP Beyond Studio (use 1000000 Baud and the correct COM Port):

I then compiled the Controller_OnOffSensor Demo app from NXP although in the documentation it is only described to work with the JN5168 demo hardware. I used the compile flag for the JN5169 and it compiled successfully. There is an error when flashing the firmware with the flash utility from BeyondStudio but this is only the validation after flashing. The reason is that the chip was read-protected from Xiaomi in order to make reengineering their firmware impossible (or not-so-easy). So the flashing was successful which can be seen from the serial monitor after rebooting:

APP: Switch Power Up...........................(several dots more)
Heap size at step 1 is 11412 bytes (start=04003fe4 end=04006c78)
APP: Watchdog timer has reset device!
Heap size at step 2a is 11412 bytes (start=04003fe4 end=04006c78)
Heap size at step 3 is 11412 bytes (start=04003fe4 end=04006c78)
Heap size at step 4 is 11412 bytes (start=04003fe4 end=04006c78)
Heap size at step 5 is 8216 bytes (start=04004c60 end=04006c78)
Heap size at step 6 is 8216 bytes (start=04004c60 end=04006c78)
Starting Touch Interface...

This ouput is repeated from the timer resetting the device. There seems to be something wrong. The last output message can be found and after that the drivers eTouchInit method is called. I added some debug output and commented out the first for loop (is this a delay or what is that for?):

This results in the following output (the BWE was added because I wanted to be sure I have the correct call):

APP: Switch Power Up...........................(several dots more)
Heap size at step 1 is 11428 bytes (start=04003fd4 end=04006c78)
APP: Watchdog timer has reset device!
Heap size at step 2a is 11428 bytes (start=04003fd4 end=04006c78)
Heap size at step 3 is 11428 bytes (start=04003fd4 end=04006c78)
Heap size at step 4 is 11428 bytes (start=04003fd4 end=04006c78)
Heap size at step 5 is 8232 bytes (start=04004c50 end=04006c78)
Heap size at step 6 is 8232 bytes (start=04004c50 end=04006c78)
Starting Touch Interface...BWE
Starting vTouchInitHardware
Stoping vTouchInitHardware

So there seems to be something wrong with the for-loop. Maybe it tries to read from a wrong pin (because it was made for the JN5168). I will have to take a closer look at the driver and see what I can do. I think I have to understand how it is working first (it is build for a remote control with several buttons so I guess a more simple solution has to be found). I also have to see which DIO pin the buttons are connected to…

In parallel there are also some comments from lucac81 on peeveeone.com about using the JN5169 and Peter also wrote that he ordered some, so maybe the master is faster than me 😀 lucac81 had trouble even installing the light firmware compiled for the JN5169 so maybe I will even try flashing that on the chip to see what happens with the button (just to see if it works, of course I will not use a button to make a light…). I also remember a comment asking about using the chip as a switch for HUE. So maybe someone else is also making progress on this end. I am open for any discussion/help/input.

To be continued sooner or later.

UPDATE

I flashed the JN5169 binary provided by Peter on the Xiaomi SmartHome button but it didn’t join. Unfortunately the debug output on that build doesn’t provide much information.
I build a new one from the demo application with all debugs enabled and the keys in place as I did with the JN5168 but I am getting the same output I had when not correctly putting the keys in place the first time with the JN5168 (see my post http://www.boriswerner.eu/tinkering-tuesday-hueify-making-the-custom-binary-and-the-demo-app-work-on-the-jn5168/):

Try To join 6a075d40c86781e on Ch 11
Try join status 00
Join failed ad

I already researched the error code „ad“ before:

ZPS_APL_APS_E_SECURITY_FAIL: An APSDE-DATA.request requesting security has resulted in an error during the corresponding security processing.

Which definitely hints to a key problem. So the general function is there and it even tries to connect to the bridge but get’s a bad response. That can’t be everything here 😉

 

Links

http://faire-ca-soi-meme.fr/domotique/2017/05/09/test-xiaomi-power-socket/

http://faire-ca-soi-meme.fr/hack/2017/04/24/hack-xiaomi-mi-smarthome-decouverte-de-clef/

http://faire-ca-soi-meme.fr/domotique/2017/04/15/test-xiaomi-mijia-6-in-1-smart-home/

http://faire-ca-soi-meme.fr/domotique/2017/04/04/detournement-capteur-de-mouvement-xiaomi/

http://faire-ca-soi-meme.fr/domotique/2017/03/13/hack-xiaomi-mi-smarthome-zigbee-sniffer/

http://faire-ca-soi-meme.fr/domotique/2017/02/27/hack-xiaomi-mi-smart-temperature-and-humidity-sensor/

JN5169 discussion on https://peeveeone.com/?p=187&

2 thoughts on “Tinkering Tuesday – HUEify – JN5169 Xiaomi Smart Button – Part 1 – Making a connection

  1. Hi Boris,
    If I read this and Peters blog, than I get the impression that until now you and others are able to flash firmware into a JN5169 of a Xiaomi, but are not able to get Hue firmware joining the Hue system. Right?

    Did you try the other form of pairing already? I do not remember the official name, but it is the „steal from another network“ approach that only functions in short range (50cm). I also know that there is a bug in the NXP demo SW for lights to join through this second approach. I solved this, but would need to check my code how I did it. If you like I could come back to this.
    SevenW

    1. Hi SevenW, sorry for the late reply. Would be great to see your solution and checking whether this is giving better results for the JN5169!
      Best, Boris

Schreib einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind markiert *