I could enable the telnet using the command. However no idea how to enable the port 9898.
I was also able to turn on telnet.No clue how to enable ports as I could not find any hint of the service to run. I was able to disconnect the gateway from the Mi Home app and then re-connect. Just after it was connected, it does seems that port 9898 and 4321 are open. During that time, I enabled the HA Homekit controller integration. This shows the connected zigbee devices. I’ve also followed the instructions to open up MQTT so I have a backup connection using node-red.
Here is the flow for anyone interested (uses file output for debugging and I only have HT and illumination sensors)
[{"id":"2537c1c5.0f952e","type":"tab","label":"Mijia Gateway","disabled":false,"info":""},{"id":"4963be5.b45044","type":"mqtt in","z":"2537c1c5.0f952e","name":"","topic":"gw/588E81FFFE72CDAC/heartbeat","qos":"2","datatype":"auto","broker":"2be25b20.752014","x":160,"y":40,"wires":[["984b561b.7b2b78","db53c55d.fda7c8"]]},{"id":"a91a0861.c1bce8","type":"mqtt in","z":"2537c1c5.0f952e","name":"","topic":"zigbee/recv","qos":"2","datatype":"auto","broker":"2be25b20.752014","x":90,"y":160,"wires":[["953810db.72124","b7b0f845.d1b8b8"]]},{"id":"953810db.72124","type":"debug","z":"2537c1c5.0f952e","name":"ZIGBEE","active":false,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":300,"y":160,"wires":[]},{"id":"984b561b.7b2b78","type":"debug","z":"2537c1c5.0f952e","name":"GATEWAY","active":false,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":490,"y":60,"wires":[]},{"id":"9c441490.ef5ce8","type":"mqtt in","z":"2537c1c5.0f952e","name":"","topic":"gw/588E81FFFE72CDAC/MessageReceived","qos":"2","datatype":"auto","broker":"2be25b20.752014","x":190,"y":100,"wires":[["984b561b.7b2b78","db53c55d.fda7c8"]]},{"id":"c413da38.4effc8","type":"mqtt in","z":"2537c1c5.0f952e","name":"","topic":"zigbee/send","qos":"2","datatype":"auto","broker":"2be25b20.752014","x":90,"y":220,"wires":[["953810db.72124","b7b0f845.d1b8b8","36949d6b.52cfd2"]]},{"id":"b7b0f845.d1b8b8","type":"json","z":"2537c1c5.0f952e","name":"","property":"payload","action":"","pretty":false,"x":290,"y":240,"wires":[["ea74c2b7.f14a6"]]},{"id":"db53c55d.fda7c8","type":"file","z":"2537c1c5.0f952e","name":"Gateway Data","filename":"/share/gateway.log","appendNewline":true,"createDir":false,"overwriteFile":"false","encoding":"none","x":500,"y":100,"wires":[[]]},{"id":"ea74c2b7.f14a6","type":"moment","z":"2537c1c5.0f952e","name":"Time FMT","topic":"","input":"payload.time","inputType":"msg","inTz":"Europe/Amsterdam","adjAmount":0,"adjType":"days","adjDir":"add","format":"","locale":"C","output":"payload.date","outputType":"msg","outTz":"Europe/Amsterdam","x":480,"y":240,"wires":[["5541829.511fb7c"]]},{"id":"6b116c6b.d46c34","type":"mqtt out","z":"2537c1c5.0f952e","name":"","topic":"","qos":"1","retain":"true","broker":"e3b40336.81973","x":1330,"y":240,"wires":[]},{"id":"3f33698a.495996","type":"change","z":"2537c1c5.0f952e","name":"","rules":[{"t":"set","p":"prefix","pt":"msg","to":"\"Mijia/\" & msg.payload.did","tot":"jsonata"},{"t":"delete","p":"payload.cmd","pt":"msg"},{"t":"delete","p":"payload.id","pt":"msg"},{"t":"delete","p":"payload.time","pt":"msg"},{"t":"delete","p":"payload.dev_src","pt":"msg"},{"t":"delete","p":"payload.mi_spec","pt":"msg"},{"t":"delete","p":"payload.params","pt":"msg"},{"t":"delete","p":"payload.did","pt":"msg"}],"action":"","property":"","from":"","to":"","reg":false,"x":820,"y":240,"wires":[["f4b9d80b.407cb8","444b60dd.67688"]]},{"id":"f4b9d80b.407cb8","type":"debug","z":"2537c1c5.0f952e","name":"MQTT","active":false,"tosidebar":true,"console":false,"tostatus":false,"complete":"$sift(function($v, $k) {$k ~> /^prefix|payload/})","targetType":"jsonata","statusVal":"","statusType":"auto","x":990,"y":200,"wires":[]},{"id":"5541829.511fb7c","type":"function","z":"2537c1c5.0f952e","name":"","func":"// illuminatino sensors\nif (msg.payload.mi_spec) {\n if (msg.payload.mi_spec[0].siid == 2) {\n msg.payload.illuminance = msg.payload.mi_spec[0].value;\n }\n if (msg.payload.mi_spec[0].siid == 3) {\n msg.payload.voltage = msg.payload.mi_spec[0].value;\n }\n // calculate battery state from voltage (guess)\n if (msg.payload.voltage) {\n var voltage = msg.payload.voltage;\n \n msg.payload.battery = 6.25 * voltage - 2581.25 ;\n }\n}\n\n//sensor_ht report and heartbeat\nif (msg.payload.params) {\n if(msg.payload.params[0].res_list) {\n msg.payload.did = msg.payload.params[0].did;\n if (msg.payload.params[0].res_list[9].res_name == \"0.1.85\") {\n msg.payload.temperature = msg.payload.params[0].res_list[9].value / 100;\n }\n if (msg.payload.params[0].res_list[10].res_name == \"0.2.85\") {\n msg.payload.humidity = msg.payload.params[0].res_list[10].value / 100;\n }\n if (msg.payload.params[0].res_list[0].res_name == \"8.0.2008\") {\n msg.payload.voltage = msg.payload.params[0].res_list[0].value;\n } \n } else {\n if (msg.payload.params[0].res_name == \"0.1.85\") {\n msg.payload.temperature = msg.payload.params[0].value / 100;\n }\n if (msg.payload.params[0].res_name == \"0.2.85\") {\n msg.payload.humidity = msg.payload.params[0].value / 100;\n }\n if (msg.payload.params[0].res_name == \"8.0.2008\") {\n msg.payload.voltage = msg.payload.params[0].value;\n }\n }\n // calculate battery state from voltage (guess)\n if (msg.payload.voltage) {\n var voltage = msg.payload.voltage;\n var percentage = 0;\n \n if (voltage < 2100) {\n percentage = 0;\n } else if (voltage < 2440) {\n percentage = 6 - ((2440 - voltage) * 6) / 340;\n } else if (voltage < 2740) {\n percentage = 18 - ((2740 - voltage) * 12) / 300;\n } else if (voltage < 2900) {\n percentage = 42 - ((2900 - voltage) * 24) / 160;\n } else if (voltage < 3000) {\n percentage = 100 - ((3000 - voltage) * 58) / 100;\n } else if (voltage >= 3000) {\n percentage = 100;\n }\n msg.payload.battery = percentage;\n }\n}\n\n\nmsg.payload.signal = Math.round(150 - (5/3) * Math.abs(msg.payload.rssi));\n\nreturn msg;\n","outputs":1,"noerr":0,"initialize":"","finalize":"","x":640,"y":240,"wires":[["3f33698a.495996"]]},{"id":"444b60dd.67688","type":"split","z":"2537c1c5.0f952e","name":"","splt":"\\n","spltType":"str","arraySplt":1,"arraySpltType":"len","stream":false,"addname":"topic","x":990,"y":240,"wires":[["a6654668.e8c6f8"]]},{"id":"2fe3d3b3.ef960c","type":"debug","z":"2537c1c5.0f952e","name":"SPLIT","active":false,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":1330,"y":200,"wires":[]},{"id":"9acd5065.674a1","type":"inject","z":"2537c1c5.0f952e","name":"Report","props":[{"p":"payload"},{"p":"topic","vt":"str"},{"p":"qos","v":"0","vt":"str"},{"p":"retain","v":"false","vt":"str"}],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"zigbee/send","payload":"{\"cmd\":\"report\",\"id\":2000001821,\"did\":\"lumi.test\",\"dev_src\":\"0\",\"time\":1594541536692,\"rssi\":-56,\"params\":[{\"res_name\":\"0.1.85\",\"value\":9999}]}","payloadType":"str","x":110,"y":280,"wires":[["b7b0f845.d1b8b8"]]},{"id":"a6654668.e8c6f8","type":"change","z":"2537c1c5.0f952e","name":"","rules":[{"t":"set","p":"topic","pt":"msg","to":" msg.prefix & \"/\" & msg.topic","tot":"jsonata"},{"t":"delete","p":"prefix","pt":"msg"}],"action":"","property":"","from":"","to":"","reg":false,"x":1160,"y":240,"wires":[["2fe3d3b3.ef960c","6b116c6b.d46c34"]]},{"id":"36949d6b.52cfd2","type":"file","z":"2537c1c5.0f952e","name":"Zigbee","filename":"/share/zigbee.log","appendNewline":true,"createDir":false,"overwriteFile":"false","encoding":"none","x":290,"y":200,"wires":[[]]},{"id":"6bf83599.41022c","type":"inject","z":"2537c1c5.0f952e","name":"Heartbeat","props":[{"p":"payload"},{"p":"topic","vt":"str"},{"p":"qos","v":"0","vt":"str"},{"p":"retain","v":"false","vt":"str"}],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"zigbee/send","payload":"{\"cmd\":\"heartbeat\",\"id\":2000002481,\"time\":1594556196531,\"rssi\":-55,\"params\":[{\"did\":\"lumi.test\",\"time\":1594556196531,\"res_list\":[{\"res_name\":\"8.0.2008\",\"value\":2965},{\"res_name\":\"8.0.2011\",\"value\":1},{\"res_name\":\"8.0.2010\",\"value\":3},{\"res_name\":\"8.0.2012\",\"value\":10},{\"res_name\":\"8.0.2013\",\"value\":1},{\"res_name\":\"8.0.2002\",\"value\":8},{\"res_name\":\"8.0.2003\",\"value\":1},{\"res_name\":\"8.0.2004\",\"value\":0},{\"res_name\":\"8.0.2005\",\"value\":0},{\"res_name\":\"0.1.85\",\"value\":2442},{\"res_name\":\"0.2.85\",\"value\":4444},{\"res_name\":\"8.0.2036\",\"value\":0}]}]}","payloadType":"str","x":100,"y":320,"wires":[["b7b0f845.d1b8b8"]]},{"id":"74a3758b.97280c","type":"inject","z":"2537c1c5.0f952e","name":"Sen_Ill","props":[{"p":"payload"},{"p":"topic","vt":"str"},{"p":"qos","v":"0","vt":"str"},{"p":"retain","v":"false","vt":"str"}],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"zigbee/send","payload":"{\"cmd\":\"report\",\"id\":2000002282,\"did\":\"lumi.test\",\"dev_src\":\"0\",\"time\":1594554551272,\"rssi\":-67,\"mi_spec\":[{\"siid\":2,\"piid\":1,\"value\":8888}]}","payloadType":"str","x":110,"y":360,"wires":[["b7b0f845.d1b8b8"]]},{"id":"2be25b20.752014","type":"mqtt-broker","z":"","name":"Mijia Gateway","broker":"192.168.178.184","port":"1883","clientid":"","usetls":false,"compatmode":false,"keepalive":"60","cleansession":true,"birthTopic":"","birthQos":"0","birthPayload":"","closeTopic":"","closeQos":"0","closePayload":"","willTopic":"","willQos":"0","willPayload":""},{"id":"e3b40336.81973","type":"mqtt-broker","z":"","name":"MQTT","broker":"192.168.178.78","port":"1883","clientid":"Node-Red","usetls":false,"compatmode":false,"keepalive":"60","cleansession":true,"birthTopic":"","birthQos":"0","birthPayload":"","closeTopic":"","closeQos":"0","closePayload":"","willTopic":"","willQos":"0","willPayload":""}]
1 Like
I have followed the instruction to modify the filesystem. Unlucky, it couldn’t boot up again. 
What could I do?
Hi Kevin!
Can you explain how you opened 9898
What version of the Mi Home app?
What firmware on Mi Gateway?
Exact procedure
I followed the directions already posted for telnet. I did not open 9898, it was open on its own and only for a while after adding to the mi home app. App version is 5.7.5, firmware is whatever is 1.4.6_0030 (current version). The “developer mode” option is nowhere to be found but this still worked:
php miio-cli.php --ip $ip --token $token --sendcmd '{"id":0,"method":"enable_telnet_service", "params":[]}'
for me, I delete the gateway from the mi home app. I then added the device from scratch using standard manufacturer procedures. In home assistant, I added a homekit-controller integration via the UI and used the homekit code on the QR sticker on the bottom of the gateway (I typed the digits rather than scan the QR) and it worked. I also did this two weeks ago, but it stopped updating after 10 days. No idea if it will stop again as I’m only 5 days in this time. That’s why I used the telnet hack above and set up MQTT to be open, which is also shown above (comment out the bind 127.0.0.1 line as mentioned in step 5 of post #60 in this thread)
Pretty hard to open, i used pry tools of thin metal like this:
The bottom:
Inside after opening:
The empty shell with antennas:
Top of the print board:
Bottom of the board:
Where can I connect the UART to send "psm-set network.open_pf3 "
You can’t. As serrj-sv mention above, that command does not exist on this device
As this device is using mqtt internally, you can try using serrj-sv’s method. Telnet into this device and patch mqtt to Home assistant.
I dont remember which one Tx which RX, just try swap.
UART setting: 38400 8n1, disable flow control.
Rx is DISABLED by default, it means you can see system messages, but CANNOT type anything.
To fix it run via telnet:
echo enable > /sys/class/tty/tty/enable
1 Like
It is possible to fix, but its not easy. You’ll have to open device and solder UART. If you feel confident I’ll guide you what to do
Same problem here, glad to hear there’s a possible way to fix it.
Hi. Maybe you can also help me to fix my broken gateway v2 (with radio). It stopped working. I soldered UART and looks like one of partitions is corrupted, maybe there is a method to reflash it.
I see:
## [1] = psm start = 0x6000 size = 0x4000
## [2] = appfw start = 0xa000 size = 0x96000
## [3] = userdata start = 0xa0000 size = 0xa000
## [4] = mcufw start = 0xaa000 size = 0x60000
## [5] = wififw start = 0x10a000 size = 0x30000
## [6] = wififw start = 0x13a000 size = 0x30000
## [7] = appfw start = 0x16a000 size = 0x96000
## [8] = musicfw start = 0x200000 size = 0xe00000
[psmu] Error: failed to init PSM status code -1
When I enter ‘help’ there are only 3 commands available:
# help
help
system-conf
echo <on/off>
# system-conf
Someone checked if telnet works on version 1.4.5_0016?
I am currently on version 1.4.4_0003. Everything works fine.
@kevindf I see you have version 1.4.6_0030 and the telnet is working?
I already confirmed that it is working as this was stated in the procedure that I followed. I remain with the port closed, but MQTT opened up to the network and still using node red to process and report to Home Assistant using the flow I already shared. I’ve since had some momentary losses of data from the standard Homekit connection (came back after a day or two), but MQTT hasn’t failed. I’m expecting a few more HT sensors in the coming days to add into the system.
Is it possible to manage devices, such as light bulbs (IKEA Tradfri) with the same configuration of this gateway as you (Node-Red + MQTT+ZNDMWG03LM)?
or are only sensors available?
I only have Xiaomi sensors currently, plus some bluetooth devices (which have nothing to do with the gateway). I would love to extend range via a tradfri extender but I cannot see it in the Mi Home app, so I’m not sure if it can even be added let alone if it shows up in mqtt. Not sure if I want to buy one without some better hint that there is a chance of it working. I recently added a mi sensor and it was immediately there, so it’s a question quickly answered if/when hardware is in hand 
Worst case, I may look at migrating to a conbee and deConz
I have IKEA light bulbs connected to this gateway via the official MiHome app, but they are not thrown into HomeKit, they are only managed from the MiHome app.
Here I was hoping that using such a pwned gateway configuration i will be able to add these devices to the HomeKit via HA + Node-Red
I used your flow (for HT and illumination sensors) for try to see messages from/to ikea bulbs, and i see they there (debug in Node-Red).
but then I don’t understand what need to do to make them appear in HA
sorry for the stupid question, but could you give me a couple of recommendations or links so I can figure out where to go next? 
The flow takes the gateway MQTT and spits out something for your own broker (can format to suit your needs). For HA, I just add MQTT platform sensors:
If you need more info on how to process the non-mi data, check the debug nodes for the payload info as this is what you need to have exposed to your own broker for HA .
Hello, I have the same problem. Did you find a solution ?
Thanks