It finally happened, found a full buffer overflow + exploit for the first time🥳

The target, The Signed OTA of the Xiaomi Thermometer (2.1.1_0159)

This now enables a full OTA update to custom firmware.
Will be shared later

The BLE Keys need to be known to do this,still all OTA