Home Tech Xiaomi Gateway 3: Highly hackable! Pair unsupported Zigbee & Bluetooth devices and...

Xiaomi Gateway 3: Highly hackable! Pair unsupported Zigbee & Bluetooth devices and get them into Home-Assistant!

Xiaomi Gateway 3 is Highly hackable, pair third party Zigbee and even Bluetooth devices and get them into Home-Assistant!

0

Great news! The old gateway is became very popular because of the default integrations into Home Assistant and Domoticz. The Gateway 3 is more powerful, has Zigbee 3 and has a bluetooth BLE chip on-board. Great specs, but the downside is that not every Xiaomi devices is supported yet, and third party devices/brands not at all. But this is changed thanks to AlexxIT. He made it possible to integrate the Xiaomi Gateway 3 into Home Assistant and maybe the best part: He also found a way to pair unsupported devices!

This changes everything! This way the Xiaomi Gateway 3 can be become as popular as the first gateway, and maybe even more popular.

The component works with the ZNDMWG03LM model and firmware versions v1.4.6_0012 and v1.4.6_0030. Before updating make sure that the component works with the newer firmware version!

This article was created in cooperation with AlexxIT, we got his permission to publish this! We hope we can spread the love for Home Assistant and the work of AlexxIT. This article contains affiliate links to banggood and Aliexpress so we can continue this kind of articles.


Control Zigbee devices from Home Assistant with Xiaomi Gateway 3 (ZNDMWG03LM) on original firmware. Xiaomi Gateway 3 Gateway support Zigbee 3Bluetooth Mesh and HomeKit. The method in this article does not change the device firmware. Gateway continues to work with Mi Home and HomeKit!

Important: This component does not work with:

  • Xiaomi Gateway 2 (DGNWG02LM, lumi.gateway.v3) – use this component
  • Xiaomi Gateway EU (DGNWG05LM, lumi.gateway.mieu01)

Gateway 3 is hackable!

Unlike all other gateways, the updated version has a unique feature: you can programmatically open Telnet access on it. Access opens only if you have a Mi Home token, so everything is completely secure.
This gateway contains an EFR32 series chip from Silicon Labs. Those, in turn, supply an SDK with the chip. The SDK includes an MQTT transport that provides access to the Zigbee puncture from any software installed both on the gateway and outside of it.

By default, the MQTT broker is not accessible from the outside, but we now have Telnet!

The broker has two root topics: raw Zigbee data and processed data from Xiaomi. I decided to take the processed data as a basis. There device attributes, although described by pseudocodes, are still easier to understand for a person who does not understand anything in Zigbee.

As a result, we got such a component for Home Assistant – XiaomiGateway3. It automatically enables Telnet and public MQTT using the Mi Home token.

AlexxIT, Who is he?

This article is with permissions from Alexx. A Russian developer who deserves all the credits for his hard work!

Future plans

  • In the future, AlexxIT is planning to add receiving a token from Xiaomi servers using a Mi Home account. After all, recently a working implementation of authorization in their cloud appeared on the network .
  • It is necessary to debug the operation of the hub with the entire list of officially supported Zigbee devices. Add the ability to customize “fine” parameters:
    • hub settings: for example, power (and it can be greatly increased!),
    • changing the settings of child devices: the mode of logical buttons on switches, the sensitivity of the vibration sensor and much more.
  • Adding cloud support to get a hub token and a complete list of Zigbee and Bluetooth devices.
  • Adding support for Bluetooth Mesh lamps.

And the most important thing is to add support for devices from other manufacturers. Yes it is possible. AlexxIT is able to connect and manage all the third-party devices that he had. Such devices do not appear in Mi Home and HomeKit. But they can be controlled using raw Zigbee commands (from Home Assistant).

Almost every device requires its own handler. In the case of Xiaomi Gateway 3 and officially supported devices, the role of such a handler is played by a software hub. We hope he gets help by donations, devices, and logs&debugs to continue his work!

Why integrate the Xiaomi Gateway 3 into home Assistant?

Because it’s possible! Control everything from one platform, one system to rule them all. And get rid of the dependency of the Xiaomi cloud!

How it works?

The component enables Telnet on Gateway via Miio protocol. Only this Gateway supports this command. Do not try to execute it on other Xiaomi/Aqara Gateways.

The component starts the MQTT Server on the public port of the Gateway. All the logic in the Gateway runs on top of the built-in MQTT Server. By default, access to it is closed from the outside.

ATTENTION: Telnet and MQTT work without a password! Do not use this method on public networks.

After rebooting the device, all changes will be reset. The component will launch Telnet and public MQTT every time it detects that they are disabled.

Supported Zigbee Devices

Currently supported, but not tested other Xiaomi and Aqara Zibee devices officially supported by the Gateway. This list will growing fast, now AlexxIT knows how to support other devices. He has also plans to support for Zigbee devices from other manufacturers. And will try to support ZHA.

Namemodelpicturebangood / gearbest
Aqara Bulb (ZNLDP12LM)ZNLDP12LMBanggood
Aqara Button (WXKG11LM)WXKG11LMBanggood
Aqara Cube (MFKZQ01LM)MFKZQ01LMBanggood
Aqara Curtain (ZNCLDJ11LM)ZNCLDJ11LMBanggood
Aqara Door Sensor (MCCGQ11LM)MCCGQ11LMBanggood
Aqara Double Wall Button (WXKG02LM)WXKG02LMBanggood
Aqara Motion Sensor (RTCGQ11LM)RTCGQ11LMBanggood
Aqara Opple Six Button (WXCJKG13LM)WXCJKG13LMBanggood
Aqara Relay (LLKZMK11LM)LLKZMK11LMBanggood
Aqara Roller Shade (ZNGZDJ11LM)ZNGZDJ11LMBanggood
Aqara Socket (QBCZ11LM)QBCZ11LMBanggood
Aqara Vibration Sensor (DJT11LM)DJT11LMBanggood
Aqara Wall Double Switch (QBKG03LM)QBKG03LMBanggood
Aqara Water Leak Sensor (SJCGQ11LM)SJCGQ11LMBanggood
IKEA Bulb E14  
Xiaomi Button (WXKG01LM)WXKG01LMBanggood
Xiaomi Door Sensor (MCCGQ01LM)MCCGQ01LMBanggood
Xiaomi Light Sensor (GZCGQ01LM)GZCGQ01LMBanggood
Xiaomi Motion Sensor (RTCGQ01LM)RTCGQ01LM 
Xiaomi Plug (ZNCZ02LM)ZNCZ02LM 
Xiaomi Plug EU (ZNCZ04LM)ZNCZ04LM 
Xiaomi TH Sensor (WSDCGQ01LM)WSDCGQ01LM

Supported BLE Devices

Namemodelpicturebangood link
Aqara N100 Smart Door LockBanggood
Xiaomi Door Sensor 2 (MCCGQ02HL)MCCGQ02HL 
Xiaomi Flower Monitor (HHCCJCY01)HHCCJCY01Banggood
Xiaomi TH Sensor (LYWSD03MMC)LYWSD03MMC
Xiaomi Rubik’s Cube (XMMF01JQD) – don’t sends edge info, only direction!XMMF01JQD 
Xiaomi TH Sensor (LYWSD03MMC)LYWSD03MMC 
Xiaomi TH Sensor (LYWSDCGQ/01ZM)LYWSDCGQ/01ZM 
Xiaomi TH Watch (LYWSD02MMC)LYWSD02MMC

Demo video:

Currently supported, but not tested, other Xiaomi BLE devices officially supported by the Gateway with these attributes:

temperature, humidity, motion, illuminance, moisture, conductivity, formaldehyde, mosquitto, battery

BLE devices and their attributes do not appear immediately! And don’t save their data across HA reboots! Their data is updated only when the device itself sends them. Temperature, humidity and battery may refresh at different times.

Get the Gateway 3 into Home Assistant

Install the XiaomiGateway3 custom component

You can install component with HACS custom repo:

1
AlexxIT/XiaomiGateway3

Or manually copy 
1
xiaomi_gateway3
 folder from latest release from github to 
1
custom_components
 folder in your config folder.

Config Xiaomi Gateway 3

Before you can configure the component you need to obtain the Mi Home token and know the IP adress from your gateway.
Give the gateway a fixed static IP address in you router. Getting the Token of the Xiaomi Gateway 3 can be done with several methods: This article shows all methos to obtain Mi Home token. I am using the method with Mi Home v5.4.54 for non-rooted Android. If you don’t have an Android – you can install the emulator on Windows.

Continue if you have the ip address and Mi Token

With GUI. Configuration > Integration > Xiaomi Gateway 3. And enter Gateway IP address and Mi Home token.

Advanced config

Support custom occupancy timeout for motion sensor. Default 90 seconds.

xiaomi_gateway3:
  devices:
    '0x158d00044c5dff':
      occupancy_timeout: 90  # (optional) default 90 seconds

Add and remove Zigbee devices

To enter the pairing mode, turn on the switch Xiaomi Gateway 3 Pair. Pairing lasts 60 seconds. After successfully adding the device, the Gateway will sound two long beeps. If the addition was unsuccessful, for example, an unsupported device, the Gateway will sound three short beeps. To delete a device from Hass and from Gateway – you need to rename device to delete. Just the device, not its objects!

Add third-party Zigbee devices

Video Demo:

Attention 1: Only devices similar to Xiaomi devices will work!

Attention 2: After the first pairing, Mi Home remembers the selected device model. And with the next pairings, it will show old interface, even if you change the model. Hass will take the new device model on the next pairings.

To add a custom device, you need to call the service 

1
remote.send_command
 with params:
entity_id: remote.0x680ae2fffe123456_pair  # change to your Gateway remote
command: pair
device: ikea.light.led1623g12  # change to your device model

You need to choose the most similar Xiaomi model for your device from this file.

For example, for a lamp or dimmer – choose an IKEA lamp 

1
ikea.light.led1623g12
.

Sometimes it doesn’t work the first time and you need to try pairing again.

The devices added in this way will work even after the Gateway is restarted. They will continue to work without Hass. And they can be used in Mi Home automations.

You can discuss the feature here.

Zigbee Home Automation Mode

Video Demo

Zigbee Home Automation (ZHA) is a standard Home Assistant component for managing Zigbee devices. It works with various radio modules such as CC2531, Conbee II, Tasmoted Sonoff ZBBridge and others.

Important: ZHA component is in early development stage. Don’t expect it to work well with all devices.

Attention: ZHA mode cannot work simultaneously with Mi Home!

When you turn on ZHA mode – zigbee devices in Mi Home will stop working. Bluetooth devices will continue to work.

To switch the mode – delete the old integration and configure the new one in a different mode. Zigbee devices will not migrate from Mi Home to ZHA. You will need to pair them again with ZHA.

You can change the operating mode at any time. Just remove the old integration and set up the new one. Your gateway firmware does not change! Just reboot the gateway and it is back in stock.

When switching from ZHA to Mi Home mode – restart the gateway. When switching from Mi Home to ZHA – no reboot required.

Handle Button Actions

Buttons, vibration sensor, cube, locks and other – create an action entity. The entity changes its state for a split second and returns to an empty state. The attributes contain useful data, they are not cleared after the event is triggered.

automation:
- alias: Turn off all lights
  trigger:
  - platform: state
    entity_id: sensor.0x158d0002fa99fd_action
    to: button_1_single
  action:
  - service: light.turn_off
    entity_id: all
  mode: single

Handle BLE Locks

BLE locks have an action entity, just like buttons.
The state changes to 

1
door
1
lock
1
fingerprint
,
1
 armed
 when an event occurs. Details of the event are in the entity attributes.

action: fingerprint
key_id – Key ID in full hex format
action_id: 0, message: Match successful
action_id: 1, message: Match failed
action_id: 2, message: Timeout
action_id: 3, message: Low quality
action_id: 4, message: Insufficient area
action_id: 5, message: Skin is too dry
action_id: 5, message: Skin is too wet

action: door
action_id: 0, message: Door is open
action_id: 1, message: Door is closed
action_id: 2, message: Timeout is not closed
action_id: 3, message: Knock on the door
action_id: 4, message: Breaking the door
action_id: 5, message: Door is stuck

action: lock
key_id – Key ID in short decimal format
action_id: 0, message: Unlock outside the door
action_id: 1, message: Lock
action_id: 2, message: Turn on anti-lock
action_id: 3, message: Turn off anti-lock
action_id: 4, message: Unlock inside the door
action_id: 5, message: Lock inside the door
action_id: 6, message: Turn on child lock
action_id: 7, message: Turn off child lock
method_id: 0, method: bluetooth
method_id: 1, method: password
method_id: 2, method: biological
method_id: 3, method: key
method_id: 4, method: turntable
method_id: 5, method: nfc
method_id: 6, method: one-time password
method_id: 7, method: two-step verification
method_id: 8, method: coercion
method_id: 10, method: manual
method_id: 11, method: automatic
key_id: 0xc0de0000, error: Frequent unlocking with incorrect password
key_id: 0xc0de0001, error: Frequent unlocking with wrong fingerprints
key_id: 0xc0de0002, error: Operation timeout (password input timeout)
key_id: 0xc0de0003, error: Lock picking
key_id: 0xc0de0004, error: Reset button is pressed
key_id: 0xc0de0005, error: The wrong key is frequently unlocked
key_id: 0xc0de0006, error: Foreign body in the keyhole
key_id: 0xc0de0007, error: The key has not been taken out
key_id: 0xc0de0008, error: Error NFC frequently unlocks
key_id: 0xc0de0009, error: Timeout is not locked as required
key_id: 0xc0de000a, error: Failure to unlock frequently in multiple ways
key_id: 0xc0de000b, error: Unlocking the face frequently fails
key_id: 0xc0de000c, error: Failure to unlock the vein frequently
key_id: 0xc0de000d, error: Hijacking alarm
key_id: 0xc0de000e, error: Unlock inside the door after arming
key_id: 0xc0de000f, error: Palmprints frequently fail to unlock
key_id: 0xc0de0010, error: The safe was moved
key_id: 0xc0de1000, error: The battery level is less than 10%
key_id: 0xc0de1001, error: The battery is less than 5%
key_id: 0xc0de1002, error: The fingerprint sensor is abnormal
key_id: 0xc0de1003, error: The accessory battery is low
key_id: 0xc0de1004, error: Mechanical failure

Tell AlexxIT if the values are not correct he translated it from the Chinese documentation.

Example of several automations:

automation:
- alias: Doorbell
  trigger:
    platform: state
    entity_id: sensor.ble_1010274797_action
    to: door
  condition:
    condition: template
    value_template: "{{ trigger.to_state.attributes['action_id'] == 3 }}"
  action:
    service: persistent_notification.create
    data_template:
      title: Doorbell
      message: The doorbell is ringing

- alias: Lock Error
  trigger:
    platform: state
    entity_id: sensor.ble_1010274797_action
    to: lock
  condition:
    condition: template
    value_template: "{{ trigger.to_state.attributes['error'] }}"
  action:
    service: persistent_notification.create
    data_template:
      title: Lock ERROR
      message: "{{ trigger.to_state.attributes['error'] }}"

- alias: Open lock
  trigger:
    platform: state
    entity_id: sensor.ble_1010274797_action
    to: lock
  condition:
    condition: template
    value_template: "{{ trigger.to_state.attributes['action_id'] == 0 }}"
  action:
    service: persistent_notification.create
    data_template:
      title: Lock is open
      message: |
        Opening method: {{ trigger.to_state.attributes['method'] }}
        User ID: {{ trigger.to_state.attributes['key_id'] }}

Debug mode the Xiaomi Gateway 3 component

Component support debug mode. Shows only component logs. The link to the logs is always random. Demo video of another component of AlexxIT, but the idea is the same:

With 

1
debug: bluetooth
 or debug 
1
debug: mqtt
 option you will get advanced log for raw BLE and MQTT data.
With 
1
debug: true
 option you will get usual component logs
xiaomi_gateway3: debug: true # you will get HA notification with a link to the logs page

You can filter data in the logs and enable auto refresh (in seconds).


1
http://yourip:8123/c4e99cfc-0c83-4a39-b7f0-278b0e719bd1?q=ble_event&r=2

How you can help the xiaomi gateway 3 project

Test, code, post issues and help each other at:
The official github place: https://github.com/AlexxIT/XiaomiGateway3
Home assistant topic: https://community.home-assistant.io/t/xiaomi-mijia-smart-multi-mode-gateway-zndmwg03lm-support/159586
Donate to AlexxIT: https://www.buymeacoffee.com/AlexxIT

Xiaomi Mijia Smart Multi-Mode Gateway 3 (ZNDMWG03LM) Zigbee 3 and BLE
  • Design
    (4.5)
  • Quality
    (4.5)
  • Usability
    (4.5)
  • Home-Automation compatibility
    (4.5)
  • Price
    (5)
4.6

Summary

An affordable price for such a good product. It’s a shame that not all the devices that were compatible with the previous gateway are not included in the new one yet. Technical it’s possible to add various third party zigbee devices, but with a custom component from a open-source home assistant project. Xiaomi had made this possible by default, that would be great!

Pros

  • Zigbee 3
  • Bluetooth BLE
  • Homekit compatible
  • Affordable
  • USB charger
  • EU version
  • Still hackable

Cons

  • No LED light
  • External devices are not compatible right out of the box
  • Not all xiaomi devices are yet available

Where to buy the Xiaomi Gateway 3?

Zigbee2mqtt as alternative

This is the start of something beautiful! It would become easier and more devices become supported, but we can’t tell how long it takes on forehand. An alternative is the Zigbee2mqtt project, a huge list of already supported devices, software that is growed mature and a great community. The Price of the xiaomi gateway is almost the same. Check our zigbee articles about zigbee2mqtt.

https://gadget-freakz.com/tag/zigbee/

Exit mobile version