Case study
Xiaomi Kettle BLE protocol: reconstructing a smart kettle's control interface
Documents the closed Bluetooth Low Energy GATT protocol of the Xiaomi Kettle, which the author reconstructed by decompiling the Mi Home Android app and disassembling its native encryption library. The write-up covers the connection and authentication handshake, the layout of status notifications and the writable settings characteristics, with a small Go reimplementation of the cipher helpers. The author built a kettle-to-MQTT bridge for Home Assistant from it but did not publish that code, and gives no guarantee that the notes work for others.
- Targets
- Protocol
- Category
- Independent reconstruction cases
- Relationship
- Independent reconstruction project
- Sources reviewed
Requirements & limits
- Reviewed at the final commit of 2018-11-29; the repository is archived and consists of a README and one Go file. README says the kettle is built on a QN9020 MCU, and it names no specific model or firmware version.
- Applying the notes needs the user's own kettle and any BLE library that can read, write and subscribe to characteristics; the author used Go with currantlabs/ble. The Mi Home app, its native library and any decompiled output are not included, and the handshake uses a token the client generates itself, so no vendor key is committed or needed.
- README lists device limits it observed: heating cannot be started over BLE unless Keep Warm mode is already active, Keep Warm can only be re-enabled with the physical button, and its time limit tops out at 12 hours.
- cipher.go contains only the cipher and byte-mixing helpers, not a client. There are no tests, captures or verification records, so the protocol description is author-reported; the README credits jadx-gui and IDA Pro, and this review ran neither the code nor a kettle.
- WTFPL version 2 (LICENSE.txt). Xiaomi and Mi Home remain trademarks of their owner, and the reviewed sources establish no AI or REA use.
About this entry
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · anna-oake/xiaomi-kettle · Revision fbc0b51
- cipher.go GitHub · anna-oake/xiaomi-kettle · Revision fbc0b51
- LICENSE.txt GitHub · anna-oake/xiaomi-kettle · Revision fbc0b51
More in Protocols
- Ford Fiesta MK5 MS-CAN: decoding the dashboard and radio bus · Case study
- uniden-r8-ble: reconstructing the Uniden R8 radar detector's BLE telemetry · Case study
- opendash: reconstructing the Scanmatik SM3 J2534 adapter protocol · Case study
- OWL: an open Apple Wireless Direct Link implementation · Case study
- Wireshark · Tool
- Netzob · Tool