MHO-C401 new revision - display frozen

[evlo]

Hi, on MHO-C401 display is frozen, even for the not Azarton verison

all display segments on

https://pvvx.github.io/MHO_C401/

display seems same as in https://github.com/znanev/MHO-C401

related #114

https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html says Hardware Version: LYWSD03MMC B1.6, Software Version: 3.9, Sensor: SHTC3 so now I'm a bit confussed, isn't LYWSD03MMC the small lcd one?

[cgernert]

I also ordered four new Mijia Miaomiaoce MMC, but inside the box are the Azarton ones, with Azarton display. Box comes with Chinese text, owl and all 😁
Seems they switched some things up.

[evlo]

Altrough even with this https://github.com/pvvx/ATC_MiThermometer/blob/master/Original_OTA_Azarton_MHO_C401_v1.0.0_0016.bin firmware screen is stuck.
Flashing Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin got the screen unstuck, so that is even more confusing to me, I wonder if anyone with _MHO_C401 has the screen not stuck with this firmware.

On your photos board has text 21 15 and 2021 03
on mine it is 20 21 and 2020 05 same as the OG MHO-C401

With the stock firmware it says
I wanted to try read the stock firmware with https://pvvx.github.io/CGPR1/TLSR825xOTA_Hacker.html and I do get
NotFoundError: No Services matching UUID 00001f10-0000-1000-8000-00805f9b34fb found in Device.
after connecting

So trying to follow #114 (comment) and I just do not understand how can I export the original firmware

You can see the owl on the stand here https://pvvx.github.io/MHO_C401/ too :D

BTW this https://atc1441.github.io/TelinkFlasher.html can connect too, but I do not thing it means anything useful, just another observation

I have also tried flashing MHO_C401_v33.bin to see what will happen, but it will not even show in BT devices after that and display is stuck, so I guess I will attempt serial flshing now.

[pvvx]

Seems they switched some things up.

[cgernert]

Maybe there will be a future display version with the top icon, I don't know.

But I did not want to distract from evlo's issue.
Perhaps it is another controller for the display, but why the original firmware is working then? Very strange.
The screwdriver marks on the PCB can't be unseen. Luckily, there seems to be nothing under it. You really wanted that battery out of there, hm? 😂

[evlo]

pvvx/TlsrComSwireWriter#6

I don't get it, I think one is just bricked, others seem to have succeeded with that tool

I think the marks on pcb are from the factory sticker under battery

I think there is no chance I can solder the reset with my skills anyway

[pvvx]

https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html says Hardware Version: LYWSD03MMC B1.6, Software Version: 3.9, Sensor: SHTC3 so now I'm a bit confussed, isn't LYWSD03MMC the small lcd one?

Why did you write firmware from Xiaomi LYWSD03MMC into it?

pvvx/TlsrComSwireWriter#6

This is a read script, not a write script...

[evlo]

I dunno, it is what the https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html put on the device, i noticed it to late, but whenever i tried after that it showed correct firmware as the original, maybe because before i was flashing firmware on actual LYWSD03MMC device or maybe some stupid oversight on my side like with the read instead of write script

[pvvx]

Firmware from Xiaomi LYWSD03MMC will work in MHO-C401. Works even on an empty chip from the TLSR825x series. But will not display on the display. OTA will work and you can flash any other firmware.
It is impossible to flash firmware from MHO-C401 or CGG1 to other options. Nothing will work. This is due to waiting for signals from the E-Ink controller...

[evlo]

I have tried building https://github.com/kloemi/ATC_MiThermometer and flashing it to the device, that also results in frozen display, so probably really even different than Azarton

But I also do not know if I did build it correctly ... I did only run make, I left app_config.h as it is in kloemi's repo (DEVICE_AZARTON, ...) and then took ATC_Thermometer.bin

[kloemi]

That's how it should work. Strange that display controller was updated again ...

[cgernert]

Seems they switched some things up.

Boom, there it is. I also built and flashed kloemi's firmware.
I don't know if this symbol is present on all regular Azartons

[evlo]

So for you display updates with kloemi's fork?

[cgernert]

So for you display updates with kloemi's fork?

Yes, it does. But the hardware of the devices' I got seems to be Azarton or related. (X-battery on photos)
#276 (comment)

[pvvx]

To support Azarton, you need a read original full flash and a description of all E-Ink segments.

Samples description of all E-Ink segments.

The command to output to the E-ink screen buffer is
60b0b1b2...b13
where b0 is byte0, b1 is byte1, ...

Sample (TelinkMiFlasher.html):

= Set Byte0, bit0

[evlo]

So for you display updates with kloemi's fork?

Yes, it does. But the hardware of the devices' I got seems to be Azarton or related. (X-battery on photos) #276 (comment)

Oh right i finally get the X thing, I was super confused by it but now I see that mine has flash or something instead of X.

Also I noticed on the box on mine it says manufacture date 2020.05 and yours says 2022.11

I bought it on https://www.aliexpress.com/store/2096053 "Homesway E-Life Store" - i dunno why not on some normal more mi store, probably shipping to EU

---

BTW it does not even activate in Mi Home with region CN - it connects, but does not "verify" - it would be fun if somebody was doing fake version of these.

If display does work with the https://github.com/pvvx/ATC_MiThermometer/blob/master/Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin firmware is it really necesary to do the dump? I'm very bad with soldering, that is why I'm asking.

[kloemi]

I'm wondering that it works although the FPC is the same as in the old MH0_C401.
Regarding the bluetooth symbols:
Azarton has both as shown in the documents, but I decided to use only the first at connected state.

And as mentioned before the display buffer seems not to contain a bit for the battery sign and the degree sign. No idea how to set them.

[evlo]

This is ff.bin out of https://1drv.ms/u/s!Ard77GaIVWRslMhz2DMrELpMZVXkBQ?e=z87vNX my divice if it is any help

This is how I did extract it

1. connected to device with original FW using https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html
2. do activation
3. flashed BLE hacker ono the device
4. connected to device with now BLE hacker flashed using https://pvvx.github.io/CGPR1/TLSR825xOTA_Hacker.html
5. device name is BLE_873E67
6. read full flash
7. Status: Read 524288 bytes done after 26.814 seconds
8. save to file ff.bin
   Hopefully this does not just get the ble_hacker.bin

When I then tried sending custom commands using https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html
6010000000000000000000000000 or 6010000000000000000000000000 or 6011111111111111111111111111 or 60ffffffffffffffffffffffffffffffff nothing on the display changes

This is with ble_hacker.bin still flashed on the device

[pvvx]

This is with ble_hacker.bin still flashed on the device

Be careful with ble_hacker - it is designed to read and write Flash, as well as a one-time delete function with a old firmware startup restore.

device name is BLE_873E67

At startup, a random MAC is assigned.
This firmware does not know where and in what format the MAC of the previous firmware is written.
To determine how and where MAC is stored, FullFlash is needed.

This is ff.bin out of https://1drv.ms/u/s!Ard77GaIVWRslMhz2DMrELpMZVXkBQ?e=z87vNX my divice if it is any help

This is FullFlash with Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin

I have such models and works with MHO_vXX.

[pvvx]

And as mentioned before the display buffer seems not to contain a bit for the battery sign and the degree sign. No idea how to set them.

Is the buffer size correct?

The command to output to the E-ink screen buffer is
60b0b1b2...b13
where b0 is byte0, b1 is byte1, ...
#276 (comment)

60FFFFFFFFFFFFFFFFFFFFFFFFFFFF..... All On
600000000000000000000000000000.... All Off

The E-Ink controller is similar in operation to the CGG1. The configuration commands are almost the same.
Need to know if the display itself needs to be refreshed periodically or not?
Some new E-Inks do not need to be updated (refresh).
On the first versions of the MHO's, the display without a refresh becomes unusable. The segments turn gray and never recover again.

[evlo]

I have such models and works with MHO_vXX.

I have tried flashing MHO_C401_v38.bin onto the one I extracted that FW from and it works flawlessly, i thought i received both same units, but clearly not, would be helpful to extract firmware from the one where the display freezes after flashing it with MHO_C401_v38.bin, but is working after flashing it with Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin using BLE_hacker or it would just basically get Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin again?

Anyway after flashing it, it does now not even show as ATC_* so probably messed up, i will try to flash custom fw using wires, but with original firmware it works, if it didn't it would al make sense to me

[pvvx]

I don't really understand what you are describing. BLE_hacker has the option to restore the launch of the previous firmware. But this button should be selected only once and disconnect the connection - disconnect... The device will reboot with the old firmware. Everything will be restored to the state before the BLE_hacker firmware.
There is also an OTA option. You can download other firmware.

3. Restore original firmware boot: "Change Start Boot" key. (Do it once!)

[kloemi]

Is the buffer size correct?

Hmm you're right. Don't understand why I reduced it to 14 byte but in my recordings it seems to have 16 byte. Going to test.

[evlo]

Hmmm, i thought the files would be identical, but there are some differences between FF exports from the problematic and non problematic MHO-C401.
Problematic FF export https://1drv.ms/u/s!Ard77GaIVWRslMh15PZUTwMyzcdNkQ?e=FHuISp

what do you think? Just different setting?

---

I have bought two MHO-C401 to try out

one is the one giving me issues, that i can flash using wired connection (if it feels like getting flashed) - it is very particular and even likes one ch340 flasher better then other (maybe i could try lowering baud rate) - I have fixed all my soldering. But I have tried soldering the RST pin, impossible for me, mayb ei have messed up something in the process.

from the non problematic one i uploaded extracted firmware from it in the post #276 (comment)

problematic one works with Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin firmware, but i can't connect it to mi app even - again, I could have messed up some soldering etc.

With Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin firmware it connects with [Telink Flasher v4.7](https://pvvx.github.io/ATC_MiThermometer/TelinkMiFlasher.html) , i have uploaded BLE_hacker to it, then connected using [Telink OTA Hacker](https://pvvx.github.io/CGPR1/TLSR825xOTA_Hacker.html) - that I think would only restore Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin I flashed to it that before, but the two files are not exactly the same - maybe just different tokens etc.

Honestly I now think that it is just MHO C401 with HW defect from the start, no new version or anything, now I even have issues flashing it when I soldered wires nicely and using different usb uart adapters.

I'm curious if the extract is the same or not, especially since i flashed Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin onto it before. Maybe i do not understand how the flashing works in this case

Weirdly flashing work whether whichever way i connect rx and tx - rx to rx or rx to tx with 1k ohm resistor in the way

[pvvx]

In azarton_mho-c410_ff.bin, the fw firmware is only 87332 bytes from the start of Flash. And in the posted azarton_mho-c410_ff.bin, the firmware is intact and has not changed (Original_OTA_Azarton_MHO_C401_v1.0.0_0016.bin).

https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html (works from Windows Chrome) has no feedback. Connects only TX to SWS.
It is not desirable to change the UART speed. There is not UART protocol, but everything is much more complicated - Telink SWire simulates. There will be no correct cyclogram according to the Telink SWire protocol.

[evlo]

I don't understand, again :D

ff (problematic).bin from url https://1drv.ms/u/s!Ard77GaIVWRslMh15PZUTwMyzcdNkQ?e=FHuISp is the same firmware as Original_OTA_Azarton_MHO_C401_v1.0.0_0016.bin and NOT Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin ?
That does not really make sense to me as the device display updates with Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin firmware on it.

[pvvx]

I made a mistake: compared one, wrote another:

> fc /b "ff (problematic).bin" Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin 
Comparison files ff (problematic).bin and ORIGINAL_OTA_XIAOMI_MHO_C401_V1.0.0_0010.BIN
FC: ff (problematic).bin is longer than ORIGINAL_OTA_XIAOMI_MHO_C401_V1.0.0_0010.BIN

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fc

[kloemi]

Increased buffer size to 16 did not fix it :-(

Until now I did not do a display refresh, and they still look fine.

[cgernert]

Increased buffer size to 16 did not fix it :-(

Non-Azarton has 18, right? But Azarton has additional symbols compared to Non-Azarton.
Could you also please enable issues on your repo? Or should we create a new Issue on this repo, because this issue is originally based on evlo's Non-Azarzon freezing unit.

[evlo]

Please do, or continue this one #114 ?

If i understand correctly that one MHO-C401 does indeed have different firmware even when flash ORIGINAL_OTA_XIAOMI_MHO_C401_V1.0.0_0010.BIN onto it, so at this point mixing Azarton issues with it is really confusing.

But for that device I have that is having these issues, it is most likely not really worth investigating, until more turn out ...

[MattXcz]

Hi, I received 3 from Aliexpress today - all with new display version.

[juskalalie]

I also ordered four new Mijia Miaomiaoce MMC, but inside the box are the Azarton ones, with Azarton display. Box comes with Chinese text, owl and all 😁 Seems they switched some things up.

Got 4 copies exactly like yours after ordering from the Mijia SmartHome Store on AliExpress
https://www.aliexpress.com/store/2185008

[MattXcz]

Mine was from "M-i M-ijia 18 Store"

[pvvx]

Got 4 copies exactly like yours after ordering from the Mijia SmartHome Store on AliExpress
https://www.aliexpress.com/store/2185008

I ordered several to break and throw away, waiting for delivery (3 weeks) ...

[juskalalie]

Just to check, I flashed them with custom firmware -> screen got stuck but everything else worked. Was able to unstuck screen when flashing back to the original Azarton firmware available here.

[pvvx]

Several MHO-C401s (2022.11) have arrived.

[cgernert]

nice!

[pvvx]

Added support ver MHO-C401 (2022.11).
Azarton has no signatures. But the official fw Original_OTA_Xiaomi_MHO_C401_v1.0.0_0016.bin is the same.
(The official firmware Original_OTA_Xiaomi_MHO_C401_v1.0.0_0016.bin does not work on the old MHO-C401 version.)
Released beta version 4.2. Tested - all ok.
"Open/Close" type button, if "Switch" option is enabled, works in HA (set advertising option to "BTHome").

---

Auto-detection of the new version according to the official firmware (Software string > '0015').
Refresh your browser cache.
Old and third-party firmware versions are not auto-detected. Use the MHO-C401N_vX.X firmware file download.

[juskalalie]

Wow that was blazing fast!!
Many thanks for your efforts! 👍

[pvvx]

The opportunity to make it faster was created thanks to @kloemi. He found how the signals from the SoC are distributed to the E-Ink driver chip. I did not even have to open the device, and I put the code from the CGG1 driver. The only thing I had to do was create a map of the E-Ink segments.

[MattXcz]

Hello @pvvx - I updated it to 4.2 beta, but sadly it still not update numbers on the display

[cgernert]

Hello @pvvx - I updated it to 4.2 beta, but sadly it still not update numbers on the display

Try the MHO_C401N_v42.bin

[MattXcz]

Hello @pvvx - I updated it to 4.2 beta, but sadly it still not update numbers on the display

Try the MHO_C401N_v42.bin

Yes. That did it. Now it works :) thank you !