Vacuum cleaner rooting

Public Forum otwarte
1

Looks like the issue with Dreame introducing secure boot is solved now:

@vazhnov Should we try again with our vacuums? :grin: I am on one hand a bit scared, but on the other – tempted. One thing that’s required is a breakout PCB – we can order a few of those boards, make them and have them stored somewhere in HS if someone would need to use them for their own robots.

1 Like
2

Let me post here my previous attempt to flash it:

January 2023 I’ve bought Dreame bot L10 pro.

I connected with USB TTY adapter (speed = 115200) and found this in boot logs:

[352]HELLO! SBOOT is starting!
[355]sboot commit : ee0e26c
NOTICE:  BL3-1: v1.0(debug):b108d89
NOTICE:  BL3-1: Built : 14:13:35, 2020-04-08
NOTICE:  BL3-1 commit: 8
NOTICE:  secure os exist
MESSAGE: [0x0] TEE-CORE: OP-TEE version: 5f533bf9-dirty #1 2020年 08月 08日 星期六 03:04:16 UTC arm
NOTICE:  BL3-1: Preparing for EL3 exit to normal world
NOTICE:  BL3-1: Next image address = 0x4a000000
[01.185][NE]rawnand not support chip 1: 03 03 03 03 03 03 03 03
[01.190][NE]rawnand not support chip 2: 03 03 03 03 03 03 03 03
[01.196][NE]rawnand not support chip 3: 03 03 03 03 03 03 03 03
[01.207]Item0 (Map) magic is bad
[03.158]set disp.dev2_output_type fail. using defval=0
[03.202]secure storage read rpmb_key fail with:-1
[03.207]secure storage read dm_crypt_key fail with:-1
[03.213][ARISC ERROR] :get [allwinner,sunxi-hwspinlock] device node error
[SCP] :sunxi-arisc driver begin startup 2
[SCP] :0x1
[SCP] :arisc version: []
[SCP] :arisc startup ready
[SCP] :arisc startup notify message feedback
[SCP] :send hard sync feedback message: 0x900200
[SCP] :sunxi-arisc driver v1.10 is starting
[03.993]Starting kernel ...

numid=13,iface=MIXER,name='Headphone Switch'
  ; type=BOOLEAN,access=rw------,values=1
  : values=on
numid=9,iface=MIXER,name='Headphone Volume'
  ; type=INTEGER,access=rw---R--,values=1,min=0,max=7,step=0
  : values=3
  | dBscale-min=-42.00dB,step=6.00dB,mute=0
numid=10,iface=MIXER,name='LINEOUT Output Select'
  ; type=ENUMERATED,access=rw------,values=1,items=2
  ; Item #0 'DAC_SINGLE'
  ; Item #1 'DAC_DIFFER'
  : values=1
numid=15,iface=MIXER,name='LINEOUT Switch'
  ; type=BOOLEAN,access=rw------,values=1
  : values=on
numid=6,iface=MIXER,name='LINEOUT volume'
  ; type=INTEGER,access=rw---R--,values=1,min=0,max=31,step=0
  : values=31
  | dBrange-
    rangemin=0,,rangemax=1
      | dBscale-min=0.00dB,step=0.00dB,mute=1
    rangemin=2,,rangemax=31
      | dBscale-min=-43.50dB,step=1.50dB,mute=1

numid=11,iface=MIXER,name='ADCL Input MIC1 Boost Switch'
  ; type=BOOLEAN,access=rw------,values=1
  : values=on
numid=4,iface=MIXER,name='MIC1 gain volume'
  ; type=INTEGER,access=rw---R--,values=1,min=0,max=31,step=0
  : values=0
  | dBscale-min=0.00dB,step=1.00dB,mute=0
numid=12,iface=MIXER,name='ADCR Input MIC2 Boost Switch'
  ; type=BOOLEAN,access=rw------,values=1
  : values=on
numid=5,iface=MIXER,name='MIC2 gain volume'
  ; type=INTEGER,access=rw---R--,values=1,min=0,max=31,step=0
  : values=0
  | dBscale-min=0.00dB,step=1.00dB,mute=0
e2fsck 1.43.9 (8-Feb-2018)
ext2fs_check_if_mount: Can't check if filesystem is mounted due to missing mtab file while determining whether /dev/by-name/misc is mounted.
/dev/by-name/misc: clean, 17/256 files, 1120/2048 blocks
Failed to connect to ubus
oggdec from vorbis-tools 1.4.0
Decoding "/audio/EN/0.ogg" to "/tmp/0.wav"
	[100.0%]
Playing WAVE '/tmp/0.wav' : Signed 16 bit Little Endian, Rate 16000 Hz, Mono
Successfully initialized wpa_supplicant
crond[1186]: crond (busybox 1.31.0) started, log level 8

p2029
cp: can't stat '/data/config/ava/ota_mark': No such file or directory
killall: rsyslogd: no process killed
chpasswd: password for 'root' changed
killall: wifi_led_flash.sh: no process killed
sh: write error: Invalid argument
channel:6 is ok
Configuration file: /tmp/hostapd.conf
Using interface wlan0 with hwaddr 24:18:c6:16:c4:11 and ssid "dreame-vacuum-p2029_miapC411"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED
p2029
{"ret":"ok"}

One of these messages (I don’t remember which one exactly) indicated, that the firmware is too fresh for the patching method which was available in 2023.

@fleg, let’s try the new method!

I can bring my robot to the HS, with a TTY USB adapter.

3

I can’t come to the HS today, but I wonder whether getting the dedicated breakout adapter won’t make the whole process easier and less risky. I’ve never before ordered anything from a PCB manufacturer, but I can try to do it this week.

4

On the same page there is also valetudo community telegram where people can send you adapters after using them, or because they had to order multiple pcbs. It’ll be way quicker to grab one from community and to just solder it.

5

I have to order some PCBs anyway, but thanks for the heads up - we can let people know that there will be some almost-publicly-accesible adapters in HS.

6

PCBs have arrived, but I won’t be able to go to HS today. I’ll try to deliver them later this week. They aren’t soldered or anything, I’ll try to do as much as possible assuming all the required parts are already in HS. After that everyone will be free to use the board.

I would be grateful if someone could check today if everything from the bill of materials is available in HS. If not, then I would be grateful for the link to the missing USB sockets as I can’t find the exact ones on Allegro (but I also don’t really have time right now to look for them deeper), if the goldpins aren’t available in HS then I can take some from my private stash at home.

1 Like
7

I’m not sure which USB sockets exactly will fit those boards so I will probably order a few of those:

1 Like