zvldz/soft_hack.md

Last active March 20, 2025 16:04

Star (135) You must be signed in to star a gist
Fork (19) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/zvldz/1bd6b21539f84339c218f9427e022709.js"></script>
Save zvldz/1bd6b21539f84339c218f9427e022709 to your computer and use it in GitHub Desktop.

Download ZIP

soft_hack.md

Raw

soft_hack.md

Soft hack to open telnet

You need gateway 3(mgl03) connected to MiHome. And also ip and gateway token.

1 way (recommended)

Via XiaomiGateway3 component.

You must input in the 'Open Telnet command' field(as it is without changing anything):

{"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}

2 way (recommended if not using Home Assistant)

php-miio (https://github.com/skysilver-lab/php-miio)

You may need to change id.

php miio-cli.php --ip GW_IP --token GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}'

3 way (maybe problem with sequence id)

python-miio (https://github.com/rytilahti/python-miio)

miiocli device --ip GW_IP --token GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'

Password is empty

After opening telnet, it is better to install custom firmware (only for Xiaomi Gateway 3 mgl03).

Read here: https://github.com/zvldz/mgl03_fw/tree/main/firmware#the-easy-way

Open telnet command should also work with:

lumi.gateway.mgl03 - Mi Smart Home Hub
lumi.gateway.acn01 - Aqara Hub M1S CN
lumi.gateway.aeu01 - Aqara Hub M1S EU
lumi.aircondition.acn05 - Aqara Air Conditioning Controller P3
lumi.gateway.sacn01 - Smart USB Wall Outlet Hub

Aqara Hub E1 (ZHWG16LM usb stick)

You need gateway E1 connected to MiHome. And also ip and gateway token.

1 way (recommended)

Via XiaomiGateway3 component, version 2+.

You must input in the 'Open Telnet command' field(as it is without changing anything):

{"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; /bin/riu_w 101e 53 3012; telnetd"}}

2 way (recommended if not using Home Assistant)

php-miio (https://github.com/skysilver-lab/php-miio)

You may need to change id.

php miio-cli.php --ip GW_IP --token GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; /bin/riu_w 101e 53 3012; telnetd"}}'

3 way (maybe problem with sequence id)

python-miio (https://github.com/rytilahti/python-miio)

miiocli device --ip GW_IP --token GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ;  /bin/riu_w 101e 53 3012 ; telnetd"}'

Password is empty

I am not author, I just tested and improved and published.

Enable telnet on Aqara G3 hub

vinter-wu commented May 9, 2022

What is the reason?
PS C:\Users\Administrator\Desktop\python-miio-master> miiocli device --ip 192.168.2.174 --token 455155476f71697552 raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
Traceback (most recent call last):
File "C:\Users\Administrator\AppData\Local\pypoetry\Cache\virtualenvs\python-miio-6Z4gUOLp-py3.8\Scripts\miiocli", line 5, in
create_cli()
File "C:\Users\Administrator\Desktop\python-miio-master\miio\cli.py", line 63, in create_cli
return cli(auto_envvar_prefix="MIIO")
File "C:\Users\Administrator\Desktop\python-miio-master\miio\click_common.py", line 51, in call
return self.main(*args, **kwargs)
File "C:\Users\Administrator\AppData\Local\pypoetry\Cache\virtualenvs\python-miio-6Z4gUOLp-py3.8\lib\site-packages\click\core.py", line 1055, in main
rv = self.invoke(ctx)
File "C:\Users\Administrator\AppData\Local\pypoetry\Cache\virtualenvs\python-miio-6Z4gUOLp-py3.8\lib\site-packages\click\core.py", line 1657, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
File "C:\Users\Administrator\AppData\Local\pypoetry\Cache\virtualenvs\python-miio-6Z4gUOLp-py3.8\lib\site-packages\click\core.py", line 1655, in invoke
sub_ctx = cmd.make_context(cmd_name, args, parent=ctx)
File "C:\Users\Administrator\AppData\Local\pypoetry\Cache\virtualenvs\python-miio-6Z4gUOLp-py3.8\lib\site-packages\click\core.py", line 920, in make_context
self.parse_args(ctx, args)
File "C:\Users\Administrator\AppData\Local\pypoetry\Cache\virtualenvs\python-miio-6Z4gUOLp-py3.8\lib\site-packages\click\core.py", line 1378, in parse_args
value, args = param.handle_parse_result(ctx, opts, args)
File "C:\Users\Administrator\AppData\Local\pypoetry\Cache\virtualenvs\python-miio-6Z4gUOLp-py3.8\lib\site-packages\click\core.py", line 2360, in handle_parse_result
value = self.process_value(ctx, value)
File "C:\Users\Administrator\AppData\Local\pypoetry\Cache\virtualenvs\python-miio-6Z4gUOLp-py3.8\lib\site-packages\click\core.py", line 2316, in process_value
value = self.type_cast_value(ctx, value)
File "C:\Users\Administrator\AppData\Local\pypoetry\Cache\virtualenvs\python-miio-6Z4gUOLp-py3.8\lib\site-packages\click\core.py", line 2304, in type_cast_value
return convert(value)
File "C:\Users\Administrator\AppData\Local\pypoetry\Cache\virtualenvs\python-miio-6Z4gUOLp-py3.8\lib\site-packages\click\types.py", line 82, in call
return self.convert(value, param, ctx)
File "C:\Users\Administrator\Desktop\python-miio-master\miio\click_common.py", line 99, in convert
return ast.literal_eval(value)
File "c:\users\administrator\appdata\local\programs\python\python38-32\lib\ast.py", line 59, in literal_eval
node_or_string = parse(node_or_string, mode='eval')
File "c:\users\administrator\appdata\local\programs\python\python38-32\lib\ast.py", line 47, in parse
return compile(source, filename, mode, flags,
File "", line 1
{ssid:"",pswd:123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd}
^
SyntaxError: invalid syntax
PS C:\Users\Administrator\Desktop\python-miio-master> miiocli device --ip 192.168.2.174 --token 45515547626143726f5a736f71697552 info
Model: lumi.gateway.acn01
Hardware version: Linux
Firmware version: 4.0.1_0026

brainb203 commented May 18, 2022

SyntaxError: invalid decimal literal

can any body help?

aminhusni commented Jun 30, 2022

Anybody has an idea on how do I set or change password for Telnet?
Feels insecure when there is no password at all.

niceboygithub commented Sep 11, 2022 •

edited

Loading

Mi Smart Hub 2 Pro (ZHWG16LM, Multimode Gateway 2)
You need multimode gateway 2 connected to MiHome. And also ip and gateway token.

1 way (recommended)
Via XiaomiGateway3 component, version 2+.

You must input in the 'Open Telnet command' field(as it is without changing anything):

{"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d root; /bin/riu_w 101e 53 3012; telnetd"}}

2 way (recommended if not using Home Assistant)
php-miio (https://github.com/skysilver-lab/php-miio)

You may need to change id.

php miio-cli.php --ip GW_IP --token GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d root; /bin/riu_w 101e 53 3012; telnetd"}}'

3 way (maybe problem with sequence id)
python-miio (https://github.com/rytilahti/python-miio)

miiocli device --ip GW_IP --token GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ;  passwd -d root; /bin/riu_w 101e 53 3012 ; telnetd"}'

Password is empty

Djeloan commented Sep 13, 2022 •

edited

Loading

After typing command:
miiocli device --ip GW_IP --token GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'

I get this error:

Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

Im trying it on lumi.gateway.acn01 (M1S)

y306702588 commented Sep 21, 2022

After typing command:
miiocli device --ip 192.168.124.20 --token GW_TOKEN raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'

I get this error:

C:>miiocli device --ip 192.168.124.20 --token 514fxxxx6779396xxxx943393xxxx04b
info
Model: lumi.gateway.acn01
Hardware version: Linux
Firmware version: 3.1.3_0002

C:>miiocli device --ip 192.168.124.20 --token 514fxxxx6779396xxxx943393xxxx04b
raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; passwd -d admin ; echo
enable > /sys/class/tty/tty/enable; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: timed out
Error: No response from the device

C:>

Pedrocomp commented Nov 7, 2022

Hello, I'm having trouble adding my gateway, I can not open Telnet, can anyone help

mcdona1d commented Nov 28, 2022

Hello, I'm having trouble adding my gateway, I can not open Telnet, can anyone help

same issue, firmware:3.4.8

log:
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}

mcdona1d commented Nov 28, 2022

Good News !

2 Way is work for 3.4.8 !

lowo56 commented Dec 3, 2022

Is there a way to reverse the firmware lock on Chinese Gateway ZNDMWG03LM?
Reason is i want to give the gateway to someone else who doesn't uses Home Assistant.
I own several of these gateways and can spare one for a friend but he want the gateway te be able to update the firmware.

btw: using the slider in HA doesn't reverse the gatewaylock on my gateways!

xorxorxorxor commented Jan 13, 2023

Error Infomation

Error: No response from the device

Device Information

Model: lumi.gateway.acn01
Hardware version: Linux
Firmware version: 4.0.1_0002

How it happens?

use miiocli to open the telnetd.
miiocli -d device --ip 192.168.2.105 --token TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
the result is below:

INFO:miio.cli:Debug mode active
Running command raw_command
DEBUG:miio.click_common:Unknown model, trying autodetection. None None
DEBUG:miio.miioprotocol:Got a response: Container:
data = Container:
data = b'' (total 0)
value = b'' (total 0)
offset1 = 32
offset2 = 32
length = 0
header = Container:
data = b'!1\x00 \x00\x00\x00\x00\x1d\xbd\xc7\xe1c\xc0\n\xbd' (total 16)
value = Container:
length = 32
unknown = 0
device_id = unhexlify('1dbdc7e1')
ts = 2023-01-12 13:27:25
offset1 = 0
offset2 = 16
length = 16
checksum = b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff' (total 16)
DEBUG:miio.miioprotocol:Discovered 1dbdc7e1 with ts: 2023-01-12 13:27:25, token: b'ffffffffffffffffffffffffffffffff'
DEBUG:miio.miioprotocol:192.168.2.105:54321 >>: {'id': 1, 'method': 'miIO.info', 'params': []}
DEBUG:miio.miioprotocol:Retrying with incremented id, retries left: 3
DEBUG:miio.miioprotocol:Got a response: Container:
data = Container:
data = b'' (total 0)
value = b'' (total 0)
offset1 = 32
offset2 = 32
length = 0
header = Container:
data = b'!1\x00 \x00\x00\x00\x00\x1d\xbd\xc7\xe1c\xc0\n\xc2' (total 16)
value = Container:
length = 32
unknown = 0
device_id = unhexlify('1dbdc7e1')
ts = 2023-01-12 13:27:30
offset1 = 0
offset2 = 16
length = 16
checksum = b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff' (total 16)
DEBUG:miio.miioprotocol:Discovered 1dbdc7e1 with ts: 2023-01-12 13:27:30, token: b'ffffffffffffffffffffffffffffffff'
DEBUG:miio.miioprotocol:192.168.2.105:54321 >>: {'id': 102, 'method': 'miIO.info', 'params': []}
DEBUG:miio.miioprotocol:Retrying with incremented id, retries left: 2
DEBUG:miio.miioprotocol:Got a response: Container:
data = Container:
data = b'' (total 0)
value = b'' (total 0)
offset1 = 32
offset2 = 32
length = 0
header = Container:
data = b'!1\x00 \x00\x00\x00\x00\x1d\xbd\xc7\xe1c\xc0\n\xc7' (total 16)
value = Container:
length = 32
unknown = 0
device_id = unhexlify('1dbdc7e1')
ts = 2023-01-12 13:27:35
offset1 = 0
offset2 = 16
length = 16
checksum = b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff' (total 16)
DEBUG:miio.miioprotocol:Discovered 1dbdc7e1 with ts: 2023-01-12 13:27:35, token: b'ffffffffffffffffffffffffffffffff'
DEBUG:miio.miioprotocol:192.168.2.105:54321 >>: {'id': 203, 'method': 'miIO.info', 'params': []}
DEBUG:miio.miioprotocol:192.168.2.105:54321 (ts: 2023-01-12 13:27:35, id: 203) << {'partner_id': '', 'id': 203, 'code': 0, 'message': 'ok', 'result': {'hw_ver': 'Linux', 'fw_ver': '4.0.1_0002', 'mcu_fw_ver': '0616', 'ap': {'ssid': 'TP-LINK_774A', 'bssid': '60:45:3b:68:4a:93', 'rssi': '-32', 'freq': '2432'}, 'netif': {'localIp': '192.168.2.105', 'mask': '255.255.255.0', 'gw': '192.168.2.1'}, 'model': 'lumi.gateway.acn01', 'mac': '54:EF:43:40:D5:13', 'token': 'TOKEN', 'life': 4473}}
DEBUG:miio.device:Detected model lumi.gateway.acn01
DEBUG:miio.miioprotocol:192.168.2.105:54321 >>: {'id': 204, 'method': 'set_ip_info', 'params': '{ssid:"",pswd:123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd}'}
DEBUG:miio.miioprotocol:Retrying with incremented id, retries left: 3
DEBUG:miio.miioprotocol:Got a response: Container:
data = Container:
data = b'' (total 0)
value = b'' (total 0)
offset1 = 32
offset2 = 32
length = 0
header = Container:
data = b'!1\x00 \x00\x00\x00\x00\x1d\xbd\xc7\xe1c\xc0\n\xcc' (total 16)
value = Container:
length = 32
unknown = 0
device_id = unhexlify('1dbdc7e1')
ts = 2023-01-12 13:27:40
offset1 = 0
offset2 = 16
length = 16
checksum = b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff' (total 16)
DEBUG:miio.miioprotocol:Discovered 1dbdc7e1 with ts: 2023-01-12 13:27:40, token: b'ffffffffffffffffffffffffffffffff'
DEBUG:miio.miioprotocol:192.168.2.105:54321 >>: {'id': 305, 'method': 'set_ip_info', 'params': '{ssid:"",pswd:123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd}'}
DEBUG:miio.miioprotocol:Retrying with incremented id, retries left: 2
DEBUG:miio.miioprotocol:Got a response: Container:
data = Container:
data = b'' (total 0)
value = b'' (total 0)
offset1 = 32
offset2 = 32
length = 0
header = Container:
data = b'!1\x00 \x00\x00\x00\x00\x1d\xbd\xc7\xe1c\xc0\n\xd1' (total 16)
value = Container:
length = 32
unknown = 0
device_id = unhexlify('1dbdc7e1')
ts = 2023-01-12 13:27:45
offset1 = 0
offset2 = 16
length = 16
checksum = b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff' (total 16)
DEBUG:miio.miioprotocol:Discovered 1dbdc7e1 with ts: 2023-01-12 13:27:45, token: b'ffffffffffffffffffffffffffffffff'
DEBUG:miio.miioprotocol:192.168.2.105:54321 >>: {'id': 406, 'method': 'set_ip_info', 'params': '{ssid:"",pswd:123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd}'}
DEBUG:miio.miioprotocol:Retrying with incremented id, retries left: 1
DEBUG:miio.miioprotocol:Got a response: Container:
data = Container:
data = b'' (total 0)
value = b'' (total 0)
offset1 = 32
offset2 = 32
length = 0
header = Container:
data = b'!1\x00 \x00\x00\x00\x00\x1d\xbd\xc7\xe1c\xc0\n\xd6' (total 16)
value = Container:
length = 32
unknown = 0
device_id = unhexlify('1dbdc7e1')
ts = 2023-01-12 13:27:50
offset1 = 0
offset2 = 16
length = 16
checksum = b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff' (total 16)
DEBUG:miio.miioprotocol:Discovered 1dbdc7e1 with ts: 2023-01-12 13:27:50, token: b'ffffffffffffffffffffffffffffffff'
DEBUG:miio.miioprotocol:192.168.2.105:54321 >>: {'id': 507, 'method': 'set_ip_info', 'params': '{ssid:"",pswd:123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd}'}
ERROR:miio.miioprotocol:Got error when receiving: timed out
DEBUG:miio.click_common:Exception: No response from the device
Traceback (most recent call last):
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\miioprotocol.py", line 193, in send
data, addr = s.recvfrom(4096)
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\miioprotocol.py", line 193, in send
data, addr = s.recvfrom(4096)
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\miioprotocol.py", line 193, in send
data, addr = s.recvfrom(4096)
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\miioprotocol.py", line 193, in send
data, addr = s.recvfrom(4096)
socket.timeout: timed out

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\click_common.py", line 51, in call
return self.main(*args, **kwargs)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\click\core.py", line 1055, in main
rv = self.invoke(ctx)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\click\core.py", line 1657, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\click\core.py", line 1657, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\click\core.py", line 1404, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\click\core.py", line 760, in invoke
return __callback(*args, **kwargs)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\click_common.py", line 305, in wrap
kwargs["result"] = func(*args, **kwargs)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\click\decorators.py", line 84, in new_func
return ctx.invoke(f, obj, *args, **kwargs)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\click\core.py", line 760, in invoke
return __callback(*args, **kwargs)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\click_common.py", line 270, in command_callback
return miio_command.call(miio_device, *args, **kwargs)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\click_common.py", line 217, in call
return method(*args, **kwargs)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\click_common.py", line 184, in _wrap
return func(self, *args, **kwargs)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\device.py", line 126, in raw_command
return self.send(command, parameters)
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\device.py", line 108, in send
command, parameters, retry_count, extra_parameters=extra_parameters
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\miioprotocol.py", line 237, in send
extra_parameters=extra_parameters,
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\miioprotocol.py", line 237, in send
extra_parameters=extra_parameters,
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\miioprotocol.py", line 237, in send
extra_parameters=extra_parameters,
File "D:\ProgramFiles\anaconda\envs\miio\lib\site-packages\miio\miioprotocol.py", line 241, in send
raise DeviceException("No response from the device") from ex
miio.exceptions.DeviceException: No response from the device
Error: No response from the device

aminhusni commented May 22, 2023

Telnet cannot be enabled for version:
Version 4.0.1_0022.0642

ERROR:miio.miioprotocol:Unable to discover a device at address 192.168.0.187

The device is connected to the network and is alive.

Trying 192.168.0.187...
telnet: Unable to connect to remote host: Connection refused

The only way to enable Telnet is to flash custom firmware via serial port.
https://github.com/niceboygithub/AqaraM1SM2fw/

netdoggy commented Nov 16, 2023

Note
Model: lumi.gateway.mgl03

Under Windows python and python-miio
there I was an error: {'code': -9999, 'message': 'user ack timeout'}

The problem was solved when I tried the same thing but under WSL(Ubuntu)

ddpsft commented Nov 17, 2023

Trying to make it work but I'm not able to get it. My fw version is to old and I've tried to use the code shown in the image and also serrj_sv's way (https://community.home-assistant.io/t/xiaomi-mijia-smart-multi-mode-gateway-zndmwg03lm-support/159586/61). The code shown in the image get no response. The later returns ok, but still unable to telnet (asks for password). Any ideas?

Also, the first method shown here isn't possible

wizardofozzie commented Nov 19, 2023

Aqara G3 Hub (lumi.camera.gwpagl01) https://github.com/Wh1terat/aQRootG3

@Wh1terat I'm trying to get your code working. I make the QR code, scan it with camera, all good to this point. After it fails, what specifically do I do? Reset the camera and add to Aqara app? fill in ssid/pwd in app and then use camera to scan legit QR code? thanks

Wh1terat commented Nov 21, 2023

@Wh1terat I'm trying to get your code working. I make the QR code, scan it with camera, all good to this point. After it fails, what specifically do I do? Reset the camera and add to Aqara app? fill in ssid/pwd in app and then use camera to scan legit QR code? thanks

No need to reset the camera, just try to add it to the app with a legit QR code. Be aware most firmwares for the last year or two have been patched and are no longer vulnerable. There are methods to downgrade.

wizardofozzie commented Nov 22, 2023

I got lucky! I got the firmware that works
It must be working because I can use the G3 in Home Assistant
Is there a way to downgrade G2H Pro firmware?

Wh1terat commented Nov 22, 2023

@wizardofozzie niceboygithub/AqaraGateway#179

wizardofozzie commented Nov 29, 2023

@wizardofozzie niceboygithub/AqaraGateway#179

@Wh1terat that's crazy- thanks so much!

For G2hPro, I have downgraded to firmware 3.3.4 but telnet won't work. I booted an SD with custom firmware onto the camera but telnet 192.168.1.101 is refused. Any ideas?

bmwcar commented Feb 15, 2024

@wizardofozzie niceboygithub/AqaraGateway#179

@Wh1terat that's crazy- thanks so much!

For G2hPro, I have downgraded to firmware 3.3.4 but telnet won't work. I booted an SD with custom firmware onto the camera but telnet 192.168.1.101 is refused. Any ideas?

i think the new g2h pro camera fix the bug ,so you can not use telnet. Because my g2h pro can use telnet.

superclaw commented Apr 18, 2024

Is there any solution for lumi.gateway.mgl001?

dportabella commented Oct 8, 2024

what can be the problem?

$ GW_IP=192.168...
$ GW_TOKEN=32414f48...
$ miiocli device --ip $GW_IP --token $GW_TOKEN info
Model: lumi.gateway.acn008
Hardware version: Linux
Firmware version: 4.0.5_0005

$ miiocli device --ip $GW_IP --token $GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

$ php miio-cli.php --ip $GW_IP --token $GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}'
PHP Deprecated:  Creation of dynamic property miIO::$bind_ip is deprecated in /php-miio/miio.class.php on line 51

Deprecated: Creation of dynamic property miIO::$bind_ip is deprecated in /php-miio/miio.class.php on line 51
Устройство 192.168.130.181 доступно и ответило:
{"id":123,"error":{"code":-9999,"message":"user ack timeout"},"exe_time":4000}

ASDBigmac commented Dec 9, 2024

Seemingly the Info for 1.5.5_0006 is wrong. I got in without UART by executing the commands and later login via admin/admin

$ miiocli device --ip 10.0.x.x --token 445159xxxx raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; /bin/riu_w 101e 53 3012 ; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

$ miiocli device --ip 10.0.x.x --token 445159xxxx raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

$ telnet 10.0.x.x
Trying 10.0.x.x...
Connected to 10.0.x.x.
Escape character is '^]'.

rlxlinux login: admin
Password:
Login incorrect
rlxlinux login: admin
Password:
Lumi Linux version 3.0

| | || | |||
| | _ _ _____ _ | | _ ____ _ _ _ _
| || || || | | | || | _ | | | |\ / /
| || || || | | || | | || | | | | || |/
||_||||||| ||||| ||___|_/_/

For further information check:
https://www.aqara.com

mebitek commented Feb 21, 2025

lumi.gateway.mgl001 here: I can activate telnet (from my linux console I can telnet it and prompting for user and password) using the key sequence 5 2 2 2 2 2 2.
but I cannot login. I've tried a lot of combinatiojn (user admin, root, app), (password: 123, 123123, emopty one) without success. any idea?

superclaw commented Feb 21, 2025

lumi.gateway.mgl001 here: I can activate telnet (from my linux console I can telnet it and prompting for user and password) using the key sequence 5 2 2 2 2 2 2. but I cannot login. I've tried a lot of combinatiojn (user admin, root, app), (password: 123, 123123, emopty one) without success. any idea?

Hi! Can you please tell how did you activate telnet on lumi.gateway.mgl001?

mebitek commented Feb 21, 2025 •

edited

Loading

lumi.gateway.mgl001 here: I can activate telnet (from my linux console I can telnet it and prompting for user and password) using the key sequence 5 2 2 2 2 2 2. but I cannot login. I've tried a lot of combinatiojn (user admin, root, app), (password: 123, 123123, emopty one) without success. any idea?

Hi! Can you please tell how did you activate telnet on lumi.gateway.mgl001?

I press the reset button 5 times, then pause 2 times, pause, 2 times, pause etc. the sequence is 5 2 2 2 2 2 2

however no login, I cannot find user and password

fanyan1026 commented Feb 26, 2025

way 3 it does not work
DEBUG:miio.device:Detected model lumi.aircondition.acn05
Model: lumi.aircondition.acn05
Hardware version: Linux
Firmware version: 4.0.6_0006

C:\Programs\Python\Python311>miiocli device --ip 192.168.0.13 --token xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

zvldz/soft_hack.md

Soft hack to open telnet

1 way (recommended)

2 way (recommended if not using Home Assistant)

3 way (maybe problem with sequence id)

Aqara Hub E1 (ZHWG16LM usb stick)

1 way (recommended)

2 way (recommended if not using Home Assistant)

3 way (maybe problem with sequence id)

vinter-wu commented May 9, 2022

brainb203 commented May 18, 2022

aminhusni commented Jun 30, 2022

niceboygithub commented Sep 11, 2022 • edited Loading

Djeloan commented Sep 13, 2022 • edited Loading

y306702588 commented Sep 21, 2022

Pedrocomp commented Nov 7, 2022

mcdona1d commented Nov 28, 2022

mcdona1d commented Nov 28, 2022

lowo56 commented Dec 3, 2022

xorxorxorxor commented Jan 13, 2023

Error Infomation

Device Information

How it happens?

aminhusni commented May 22, 2023

netdoggy commented Nov 16, 2023

ddpsft commented Nov 17, 2023

wizardofozzie commented Nov 19, 2023

Wh1terat commented Nov 21, 2023

wizardofozzie commented Nov 22, 2023

Wh1terat commented Nov 22, 2023

wizardofozzie commented Nov 29, 2023

bmwcar commented Feb 15, 2024

superclaw commented Apr 18, 2024

dportabella commented Oct 8, 2024

ASDBigmac commented Dec 9, 2024

mebitek commented Feb 21, 2025

superclaw commented Feb 21, 2025

mebitek commented Feb 21, 2025 • edited Loading

fanyan1026 commented Feb 26, 2025

niceboygithub commented Sep 11, 2022 •

edited

Loading

Djeloan commented Sep 13, 2022 •

edited

Loading

mebitek commented Feb 21, 2025 •

edited

Loading