Xiaomi IR remote :another way to get access token and raw ir code

just open it and access serial0 with baudrate 115200 , then we can get all what we need:access token and ir code(we need use mijia app to send a specific command)


Thanks for the photo, this seems like an ESP inside it, could you indicate which one it is (ESP8266 or 8285)?

it’s ESP32

boot log:

Wow that’s really really nice, could you indicate where you bought it please ?

of course. I bought it from jd.com.

As there is several available in this website could you post a direct link to the product please?

I bought it in China (https://item.jd.com/1670375932.html) and I don’t know if you can place an order outside China. The latest price has risen by 20RMB and you may need to search for it yourself.

Think I found it on another site, I have ordered it.
I will come back if I succeed in hacking it.
In all the case thanks for the infos

1 Like

Hack in progress


things i know so far:

LED Orange: GPIO 18
LED Blue: GPIO 23
LED on = 0, LED off = 1

IR Receiver: GPIO 27
Button Reset: GPIO 0

I could not compile with Arduino because the precompiled libraries are for duo core ESP32, so i made a ESP-IDF Project and it works perfect.

Have Fun


You mean that the model used of esp32 is a single core one ?

Yes, it’s a single core.
ESP-IDF v3.3 can’t identify the model.
Maybe a new one or a custom Version.

It seems that there is not a lot of resources regarding esp32 single core…
For my curiosity how did you found that this uC is a single core one ?

If you flash an Arduino project, you will get a boot loop and this error massage over the serial port:
E (431) cpu_start: Running on single core chip, but application is built with dual core support.

And with ESP-IDF, the following information is displayed:
Chip is unknown ESP32 (revision 1)
Features: WiFi, BT, Single Core, 240MHz, VRef calibration in efuse, Coding Scheme 3/4

Well, it should be enough for the features this product was designed for and I only need WIFI/MQTT connection to Home Assistant, BT tracking and IR remote control.

1 Like


From my investigation here is some other pins:
the four free round connections at the bottom left of the ESP should be:

  • GPIO32
  • GPIO33
  • GPIO34
  • GPIO35

TX1 and RX1 are linked to the ESP SD_DATA_3 (U1TXD) and SD_DATA_2 (U1RXD)

IR emitter circuit to GPIO13

At this time I’m quite surprise that the IR circuits are directly linked to the ESP and that there is an additionnal uC “cfeon q32c”, I don’t what is it for.

Yes, i didn’t verified all pins but i think its the default pin layout from page 7.

what do you mean with “IR emitter circuit to GPIO13” ?
The IR LED array is connected to GPIO26.

I think the serial Flash (cfeon q32c) is for the firmware and/or addition data. Because referring to the original partition table one OTA partition has only 1,4 MB and that’s really small.

What’s the status of this? I have a unit with the new ESP32 board. Would like to be able to flash ESPHome or similar on it and do away with the Xiaomi app. Happy to assist with programming and debugging, but wanted to see how far everyone else got before reinventing the wheel.

With the help of Paul Nicholls and his single core framework on the ESPHome Discord chat, I’ve managed to build a test firmware and flash it manually via the ESPHome-Flasher. OTA flashing seems to fail at 38%. Will confirm and test IR emitters and receiver, and LEDs. Any suggestions for the extra 4 GPIO?

I’ll upload my ESPHome yaml to github soon

Wow, that’s great !! Thanks for sharing this.

Add an RF receiver and emitter.