Skip to content

Instantly share code, notes, and snippets.

@stek29
Last active March 18, 2025 09:40
Show Gist options
  • Save stek29/5c44244ae190f3757a785f432536c22a to your computer and use it in GitHub Desktop.
Save stek29/5c44244ae190f3757a785f432536c22a to your computer and use it in GitHub Desktop.
Root Dreame Robot without via uart only

These are just my notes, and described process worked for me on my 1C robot
If anything goes wrong, having USB adapter for FEL flashing might be the only way to restore your robot
this is not an official guide
oh, and I'm not responsible for any damage blah blah
and huge thanks to Dennis and Hypfer, and everyone behind this root :)

0. get uboot shell

to enter uboot shell on 1C you have to: 0. turn robot off normally

  1. hook up uart, open console
  2. press any button and keep holding it
  3. hold HOME button for 3+ seconds (dont release it yet)
  4. hold POWER button for 3+ seconds while still holding HOME
  5. you should be in uboot shell – release both buttons

see dennis' uart slides for more info
notice: step 3 (home button) seems missing in those slides, maybe different vacuums have differences :)

1. in uboot shell

note (thanks, @Hypher): there is also boot_partition boot2, and setting boot_partition to boot1 when it's corrupted and boot2 is being used might cause trouble. so try to boot without setting boot_partition first, and only if it doesn't work, try again with boot_partition set. I'll try to test if boot_partition needs to be set at all, if it's persisted without saveend, and what would be the proper way to set it when I have free time for it.

setenv init /bin/sh
# setenv boot_partition boot1
boot

2. stage1 shell

you have to act quickly before watchdog (or whatever it is) reboots the device wait for shell – you'll see # /

following commands worked for 1c, might be different for other robots
for ideas on how to get uart shell look at dustbuilder diff to see what exactly it changes to start shell on uart

mount /tmp
mkdir /tmp/fakeetc
cp -R /etc/* /tmp/fakeetc
mount --bind /tmp/fakeetc /etc
echo >> /tmp/fakeetc/inittab
echo '::respawn:-/bin/sh' >> /tmp/fakeetc/inittab
exec init

normal boot should continue, except there will be shell after boot on uart
it's not supposed to reboot, it should keep booting normally in userspace

3. stage2 shell

wait for new shell to pop up - wait for # / again

optional: backup

mkdir /tmp/backup
tar -cvzf /tmp/backup/misc.tgz -C /mnt/misc .
tar -cvzf /tmp/backup/uli_factory.tgz -C /mnt/private/ULI/factory/ .
cd /tmp/backup

now grab misc.tgz and uli_factory.tgz somehow i.e. by starting upload server and using curl i've used github.com/mayth/go-simple-upload-server dont forget to

rm -rf /tmp/backup

flashing

build a custom firmware for manual install method on dustbuilder and follow howto from there

for example, for 1c this should work:

cd /tmp
wget {url-of-firmware.tar.gz}
tar -xzvf {name-of-firmware.tar.gz}
./install.sh

4. verify

if patched firmware was flashed, you'll get a root shell on uart after boot without doing anything

@MrSaatci
Copy link

Hello, I was able to get to the uboot once but I couldn't run the last command, and now everytime I try to stop at the sunxi line it just freezes there and I'm force to continue with normal booting. Am I doing something wrong? I'm pressing S, then Home and then Power. I keep all pressed.

@Xamelion45
Copy link

Thank alot about your tuturial! UART not working in my Xiaomi 1C.
Some adds after my installations:
After step 2 i don`t see in putty "new shell to pop up - wait for # / again" after full boot i start write and its answer on my text after 1 and 2 step!
Then i done 3 and 4 steps.
Robot restarted and after boot i can write in shell, and open IP of robot i see webpage with "External access to Valetudo is blocked."
I connect to robot via ssh with root and password from dustbuilder and go to data\valetudo_config.json and change in nano "blockExternalAccess": true to false and UI is loaded!!!!

@milkos86
Copy link

My vacuum is in soft-bricked state after confirming update at MI app. instead of getting to "stage 1 shell" I get this message:

[31.930]read partition: boot or recovery
[32.138]sunxi flash read :offset 100000, 2830336 bytes OK
Android's image name: organ-perf1
Kernel load addr 0x40008000 size 2760 KiB
RAM disk load addr 0x41000000 size 1 KiB
in boot normal mode,pass normal para to cmdline
android.hardware = sun8iw15p1
[32.140]ready to boot
[32.140]check cpu power status
[32.140][cpu1]cpu 1 enter wfi mode
[32.143]cpu2 has poweroff
[32.169][cpu1]set cpu off by secure os
[32.169]cpu1 has poweroff
[32.170]prepare for kernel
NAND_UbootExit
[32.171]NB1: NAND_LogicExit
[32.177]
Starting kernel ...
[32.177]weak clean_timestamp_counter

If you look at the console more closely, then at the very beginning there is such a line - axp2585 read error
probe axp858 failed

axp2585 This is the power management controller for the processor and other peripherals of the board. Perhaps the problem is in it or in the harness next to it.

@einarpersson
Copy link

Worked on Dreame F9! I had to redo it a couple of times (the watchdog got me). I used dufs as a file server and a AZDelivery CP2102 for UART connection

Notes:

"press any button and keep holding it"

I didn't get first that this meant keyboard buttons 🤦‍♂️

@treibholz
Copy link

On my F9 the "any button" to press was "s". Other "any buttons" didn't work.

@eramax
Copy link

eramax commented Oct 18, 2023

My Dreame F9 Firmware is 4.1.8_1107 , do you think It can work with such steps?

@akrigator
Copy link

I've spent too much time doing that with my Xiaomi 1C, so i have to share my experience:

  1. Plug uart to a disabled vacuum
  2. Push the power button for 1 sec to see few log string related booting, vacuum will not start booting, it's just attempting to do that.
  3. Hold 's' key on laptop, in 1 second hold power button on vacuum until you will see sunxi#ssss in terminal. 's' count is increased while you are holding the key.
    The main issue was that i was not able to input something into terminal at this state.
    I've reproduced this a ton of times, and finally has discovered that if 's' key has been released while sunxi#ssss has about 0-15 's' characters then input will be locked.
    So you should continue holding 's' key and power button until sunxi#ssss will contain about 30 's' characters and only after this release button.

Then i've tried to install valetudo several times. After each attempt i saw in terminal that installation has been completed successfully, but after post-installation automatic reboot the vacuum has not run valetudo, just continue boot as usual. I've left vacuum disabled on dock for a day, and try install one more time and it has been reboot into valetudo finally.

CC: @MrSaatci

@pktiuk
Copy link

pktiuk commented Feb 12, 2025

Could you tell me how am I supposed to connect my robot to the internet during this procedure (to be able to use wget)?
Should I firstly configure it using an official Xiaomi app first?

EDIT I get it, I should connect to the Wi-Fi AP to have devices in the same network (I think it would be good to mention it directly :) )

Do you also have a lot of random logs like

$ sudo screen /dev/ttyUSB0 115200,ixoff
miio_client[1337]: [I] miio_net_wifi: opening
miio_client[1337]: [I] miio_net_wifi: local ctrl path is /tmp/miio_unix_1337-956.
miio_client[1337]: [E] miio_net_wifi: connect error! (miio_net_wifi_ctrl_open,350)
miio_client[1337]: [E] miio_net_wifi: open failed! (miio_net_wifi_ctrl_open,383)

In the tty connection?

@akrigator
Copy link

@pktiuk, your output show that original fw is loaded already, at this stage it prints a lot of logs into stdout, especially if device is reset to factory settings. You will connect vacuum to home access point after Valetudo is installed. But for installation you should connect your computer to the vacuum access point and setup web server on your computer to have ability download valetudo to vacuum from computer directly without internet access.

@pktiuk
Copy link

pktiuk commented Feb 13, 2025

I installed firmware with valetudo, but this app does not start together with my vacuum.

I was able to go to run this app manually (and use it to connect my device to wifi)

cd /data
./valetudo
miio_client[1150]: [I] ots: -->kplv sent.
miio_client[1150]: [I] ots: <--kplv ack.
[2025-02-13T14:15:31.780Z] [INFO] No configuration file present. Creating one at: /tmp/valetudo_config.json
[2025-02-13T14:15:31.821Z] [INFO] Set Logfile to /tmp/valetudo.log
[2025-02-13T14:15:31.850Z] [INFO] Autodetected Dreame1CValetudoRobot
[2025-02-13T14:15:32.011Z] [INFO] Starting Valetudo 2024.11.0
[2025-02-13T14:15:32.012Z] [INFO] Commit ID: 9b98e3ebfedc10e5d1bb1b388ae7a53b6fb0be1a
[2025-02-13T14:15:32.014Z] [INFO] Configuration file: /tmp/valetudo_config.json
[2025-02-13T14:15:32.016Z] [INFO] Logfile: /tmp/valetudo.log
[2025-02-13T14:15:32.019Z] [INFO] Robot: Dreame 1C (Dreame1CValetudoRobot)
[2025-02-13T14:15:32.020Z] [INFO] JS Runtime Version: v20.10.0-Valetudo
[2025-02-13T14:15:32.021Z] [INFO] Arch: arm
[2025-02-13T14:15:32.024Z] [INFO] Max Heap Size: 34 MiB
[2025-02-13T14:15:32.025Z] [INFO] Node Flags: --expose-gc --max-heap-size=34 --optimize-for-size --lite-mode --no-regexp-tier-up --no-expose-wasm
[2025-02-13T14:15:32.053Z] [INFO] Autogenerated System ID: ProductiveDefinitiveGoldfinch
[2025-02-13T14:15:32.059Z] [INFO] DeviceId 415463847
[2025-02-13T14:15:32.060Z] [INFO] IP 127.0.0.1
[2025-02-13T14:15:32.061Z] [INFO] CloudSecret ds34dMdasasabmA
[2025-02-13T14:15:32.062Z] [INFO] LocalSecret UtFUiMsTdasasdg
[2025-02-13T14:15:32.065Z] [INFO] Firmware Version: 1122
[2025-02-13T14:15:32.108Z] [INFO] Valetudo can be reached via: valetudo-productivedefinitivegoldfinch.local
miio_client[1150]: [I] ots: -->kplv sent.
miio_client[1150]: [I] ots: <--kplv ack.
[2025-02-13T14:15:45.942Z] [INFO] Starting NetworkConnectionStabilizer
[2025-02-13T14:15:45.952Z] [INFO] Setting /proc/self/oom_score_adj to 666. Previous value: 0
[2025-02-13T14:15:45.954Z] [INFO] Setting process priority to 10. Previous value: 0
[2025-02-13T14:15:45.973Z] [INFO] Dummycloud is spoofing 127.0.0.1:8053 on 127.0.0.1:8053
[2025-02-13T14:15:45.992Z] [INFO] Webserver running on port 80
[2025-02-13T14:15:46.002Z] [INFO] FDSMockServer running on port 8079
[2025-02-13T14:15:46.031Z] [INFO] Bonjour service "Valetudo ProductiveDefinitiveGoldfinch Web" with type "http" started
[2025-02-13T14:15:46.033Z] [INFO] Bonjour service "Valetudo ProductiveDefinitiveGoldfinch" with type "valetudo" started
[2025-02-13T14:15:46.004Z] [INFO] Successfully set the robot time via NTP to 2025-02-13T14:15:46.919Z

But an app does not seem to work properly

obraz

@akrigator
Copy link

@pktiuk
Copy link

pktiuk commented Feb 13, 2025

I wanted, but file /data/valetudo_config.json does not exist

/data # ls  /data
  /data
DivideDebug        camera.yaml        passwd-            wifimac.txt
DivideMap          config             private.tar.gz
Robot_Para.yaml    log                softmac
_root_postboot.sh  passwd             valetudo

(/data/config contains directories ava, miio, system and wifi)

Installation output looks fine:

~ # ./install.sh
stall.sh
---------------------------------------------------------------------------
 Dreame manual Firmware installer
 Copyright 2020 by Dennis Giese [dgiese at dontvacuum.me]
 Intended to work on mc1808,p2008,p2009,p2041
 Version: dreame.vacuum.mc1808
 Use at your own risk
---------------------------------------------------------------------------
model=dreame.vacuum.mc1808
check image file size
Checking integrity
./boot.img: OK
./rootfs.img: OK
Start installation ... the robot will automatically reboot after the installation is complete
Preparation complete, will install valetudo first
killall: valetudo: no process killed
Valetudo installation finished, continue FW update

But after install, I still can't connect to the device using SSH

 > ssh [email protected]
ssh: connect to host 192.168.1.32 port 22: Connection refused

@akrigator
Copy link

akrigator commented Feb 13, 2025

[2025-02-13T14:15:32.014Z] [INFO] Configuration file: /tmp/valetudo_config.json
in any case i would recommend to reinstall it again.

@pktiuk
Copy link

pktiuk commented Feb 13, 2025

It did not help.

In logs I see

[2025-02-13T14:55:31.479Z] [WARN] Unable to reach vacuum. Giving up after 100 tries

It seems, that something went wrong, because step 4

root shell on uart after boot without doing anything

Does not work for me, I still have to go through uboot

@akrigator
Copy link

you have to specify a certificate for ssh connection to valetudo host, like that in .ssh/config:

Host valetudo.lan
  User root
  HostName 192.168.88.7
  IdentityFile ~/.ssh/j6797fc1111301c.id_rsa

and then just ssh valetudo.lan
the certificate has been provided to you by mail after custom build procedure is done

@pktiuk
Copy link

pktiuk commented Feb 13, 2025

I think, that connection refused means that port is closed

pawel@asus ~ [255]> ssh [email protected]
ssh: connect to host 192.168.1.32 port 22: Connection refused

I've left vacuum disabled on dock for a day, and try install one more time and it has been reboot into valetudo finally.

I will leave it for some days and try again next week

@boildead
Copy link

I think, that connection refused means that port is closed

pawel@asus ~ [255]> ssh [email protected]
ssh: connect to host 192.168.1.32 port 22: Connection refused

I've left vacuum disabled on dock for a day, and try install one more time and it has been reboot into valetudo finally.

I will leave it for some days and try again next week

I was having exact same issues as you on my device. I was able to flash it by using ./install-manual.sh (it's included in firmware archive) script instead of ./install.sh.
My guess that on latest firmware OTA tool (which is used in ./install.sh script) doesn't allow rooted firmware. In ./install-manual.sh dd is used to write boot and rootfs images.

@tomaszcode
Copy link

I had opportunity to play with 1C but in dreame.vacuum.mb1808 version. /etc/os-release shown:

"fw_mcu_ota__ver": b1808",
"fw_arm_ver": "4.3.3_1820"

Just for curiosity I uploaded firmware using mentioned by @akrigator way and after reboot I was able to play with Valetudo. As I expected device is non-operational now - no battery and charging port recognition, buttons don't work as well. Basically there's no way to manually control device. No doubt it's a well looking server now :) Let me know if you need some testing and experimenting with this model.

@pktiuk
Copy link

pktiuk commented Mar 18, 2025

I retried it with install manual and it worked.
Now valetudo starts as expected :)
Thanks for help

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment