Root Dreame Robot without via uart only

dreame_1c_root.md

These are just my notes, and described process worked for me on my 1C robot
If anything goes wrong, having USB adapter for FEL flashing might be the only way to restore your robot
this is not an official guide
oh, and I'm not responsible for any damage blah blah
and huge thanks to Dennis and Hypfer, and everyone behind this root :)

0. get uboot shell

to enter uboot shell on 1C you have to: 0. turn robot off normally

1. hook up uart, open console
2. press any button and keep holding it
3. hold HOME button for 3+ seconds (dont release it yet)
4. hold POWER button for 3+ seconds while still holding HOME
5. you should be in uboot shell – release both buttons

see dennis' uart slides for more info
notice: step 3 (home button) seems missing in those slides, maybe different vacuums have differences :)

1. in uboot shell

note (thanks, @Hypher): there is also boot_partition boot2, and setting boot_partition to boot1 when it's corrupted and boot2 is being used might cause trouble. so try to boot without setting boot_partition first, and only if it doesn't work, try again with boot_partition set. I'll try to test if boot_partition needs to be set at all, if it's persisted without saveend, and what would be the proper way to set it when I have free time for it.

setenv init /bin/sh
# setenv boot_partition boot1
boot

2. stage1 shell

you have to act quickly before watchdog (or whatever it is) reboots the device wait for shell – you'll see # /

following commands worked for 1c, might be different for other robots
for ideas on how to get uart shell look at dustbuilder diff to see what exactly it changes to start shell on uart

mount /tmp
mkdir /tmp/fakeetc
cp -R /etc/* /tmp/fakeetc
mount --bind /tmp/fakeetc /etc
echo >> /tmp/fakeetc/inittab
echo '::respawn:-/bin/sh' >> /tmp/fakeetc/inittab
exec init

normal boot should continue, except there will be shell after boot on uart
it's not supposed to reboot, it should keep booting normally in userspace

3. stage2 shell

wait for new shell to pop up - wait for # / again

optional: backup

mkdir /tmp/backup
tar -cvzf /tmp/backup/misc.tgz -C /mnt/misc .
tar -cvzf /tmp/backup/uli_factory.tgz -C /mnt/private/ULI/factory/ .
cd /tmp/backup

now grab misc.tgz and uli_factory.tgz somehow i.e. by starting upload server and using curl i've used github.com/mayth/go-simple-upload-server dont forget to

rm -rf /tmp/backup

flashing

build a custom firmware for manual install method on dustbuilder and follow howto from there

for example, for 1c this should work:

cd /tmp
wget {url-of-firmware.tar.gz}
tar -xzvf {name-of-firmware.tar.gz}
./install.sh

4. verify

if patched firmware was flashed, you'll get a root shell on uart after boot without doing anything

I installed firmware with valetudo, but this app does not start together with my vacuum.

I was able to go to run this app manually (and use it to connect my device to wifi)

cd /data
./valetudo
miio_client[1150]: [I] ots: -->kplv sent.
miio_client[1150]: [I] ots: <--kplv ack.
[2025-02-13T14:15:31.780Z] [INFO] No configuration file present. Creating one at: /tmp/valetudo_config.json
[2025-02-13T14:15:31.821Z] [INFO] Set Logfile to /tmp/valetudo.log
[2025-02-13T14:15:31.850Z] [INFO] Autodetected Dreame1CValetudoRobot
[2025-02-13T14:15:32.011Z] [INFO] Starting Valetudo 2024.11.0
[2025-02-13T14:15:32.012Z] [INFO] Commit ID: 9b98e3ebfedc10e5d1bb1b388ae7a53b6fb0be1a
[2025-02-13T14:15:32.014Z] [INFO] Configuration file: /tmp/valetudo_config.json
[2025-02-13T14:15:32.016Z] [INFO] Logfile: /tmp/valetudo.log
[2025-02-13T14:15:32.019Z] [INFO] Robot: Dreame 1C (Dreame1CValetudoRobot)
[2025-02-13T14:15:32.020Z] [INFO] JS Runtime Version: v20.10.0-Valetudo
[2025-02-13T14:15:32.021Z] [INFO] Arch: arm
[2025-02-13T14:15:32.024Z] [INFO] Max Heap Size: 34 MiB
[2025-02-13T14:15:32.025Z] [INFO] Node Flags: --expose-gc --max-heap-size=34 --optimize-for-size --lite-mode --no-regexp-tier-up --no-expose-wasm
[2025-02-13T14:15:32.053Z] [INFO] Autogenerated System ID: ProductiveDefinitiveGoldfinch
[2025-02-13T14:15:32.059Z] [INFO] DeviceId 415463847
[2025-02-13T14:15:32.060Z] [INFO] IP 127.0.0.1
[2025-02-13T14:15:32.061Z] [INFO] CloudSecret ds34dMdasasabmA
[2025-02-13T14:15:32.062Z] [INFO] LocalSecret UtFUiMsTdasasdg
[2025-02-13T14:15:32.065Z] [INFO] Firmware Version: 1122
[2025-02-13T14:15:32.108Z] [INFO] Valetudo can be reached via: valetudo-productivedefinitivegoldfinch.local
miio_client[1150]: [I] ots: -->kplv sent.
miio_client[1150]: [I] ots: <--kplv ack.
[2025-02-13T14:15:45.942Z] [INFO] Starting NetworkConnectionStabilizer
[2025-02-13T14:15:45.952Z] [INFO] Setting /proc/self/oom_score_adj to 666. Previous value: 0
[2025-02-13T14:15:45.954Z] [INFO] Setting process priority to 10. Previous value: 0
[2025-02-13T14:15:45.973Z] [INFO] Dummycloud is spoofing 127.0.0.1:8053 on 127.0.0.1:8053
[2025-02-13T14:15:45.992Z] [INFO] Webserver running on port 80
[2025-02-13T14:15:46.002Z] [INFO] FDSMockServer running on port 8079
[2025-02-13T14:15:46.031Z] [INFO] Bonjour service "Valetudo ProductiveDefinitiveGoldfinch Web" with type "http" started
[2025-02-13T14:15:46.033Z] [INFO] Bonjour service "Valetudo ProductiveDefinitiveGoldfinch" with type "valetudo" started
[2025-02-13T14:15:46.004Z] [INFO] Successfully set the robot time via NTP to 2025-02-13T14:15:46.919Z

But an app does not seem to work properly

@pktiuk could you try run valetudo by method in https://gist.github.com/stek29/5c44244ae190f3757a785f432536c22a?permalink_comment_id=4445307#gistcomment-4445307

I wanted, but file /data/valetudo_config.json does not exist

/data # ls  /data
  /data
DivideDebug        camera.yaml        passwd-            wifimac.txt
DivideMap          config             private.tar.gz
Robot_Para.yaml    log                softmac
_root_postboot.sh  passwd             valetudo

(/data/config contains directories ava, miio, system and wifi)

Installation output looks fine:

~ # ./install.sh
stall.sh
---------------------------------------------------------------------------
 Dreame manual Firmware installer
 Copyright 2020 by Dennis Giese [dgiese at dontvacuum.me]
 Intended to work on mc1808,p2008,p2009,p2041
 Version: dreame.vacuum.mc1808
 Use at your own risk
---------------------------------------------------------------------------
model=dreame.vacuum.mc1808
check image file size
Checking integrity
./boot.img: OK
./rootfs.img: OK
Start installation ... the robot will automatically reboot after the installation is complete
Preparation complete, will install valetudo first
killall: valetudo: no process killed
Valetudo installation finished, continue FW update

But after install, I still can't connect to the device using SSH

 > ssh [email protected]
ssh: connect to host 192.168.1.32 port 22: Connection refused

[2025-02-13T14:15:32.014Z] [INFO] Configuration file: /tmp/valetudo_config.json
in any case i would recommend to reinstall it again.

It did not help.

In logs I see

[2025-02-13T14:55:31.479Z] [WARN] Unable to reach vacuum. Giving up after 100 tries

It seems, that something went wrong, because step 4

root shell on uart after boot without doing anything

Does not work for me, I still have to go through uboot

you have to specify a certificate for ssh connection to valetudo host, like that in .ssh/config:

Host valetudo.lan
  User root
  HostName 192.168.88.7
  IdentityFile ~/.ssh/j6797fc1111301c.id_rsa

and then just ssh valetudo.lan
the certificate has been provided to you by mail after custom build procedure is done

I think, that connection refused means that port is closed

pawel@asus ~ [255]> ssh [email protected]
ssh: connect to host 192.168.1.32 port 22: Connection refused

I've left vacuum disabled on dock for a day, and try install one more time and it has been reboot into valetudo finally.

I will leave it for some days and try again next week

I think, that connection refused means that port is closed

pawel@asus ~ [255]> ssh [email protected]
ssh: connect to host 192.168.1.32 port 22: Connection refused

I've left vacuum disabled on dock for a day, and try install one more time and it has been reboot into valetudo finally.

I will leave it for some days and try again next week

I was having exact same issues as you on my device. I was able to flash it by using ./install-manual.sh (it's included in firmware archive) script instead of ./install.sh.
My guess that on latest firmware OTA tool (which is used in ./install.sh script) doesn't allow rooted firmware. In ./install-manual.sh dd is used to write boot and rootfs images.

I had opportunity to play with 1C but in dreame.vacuum.mb1808 version. /etc/os-release shown:

"fw_mcu_ota__ver": b1808",
"fw_arm_ver": "4.3.3_1820"

Just for curiosity I uploaded firmware using mentioned by @akrigator way and after reboot I was able to play with Valetudo. As I expected device is non-operational now - no battery and charging port recognition, buttons don't work as well. Basically there's no way to manually control device. No doubt it's a well looking server now :) Let me know if you need some testing and experimenting with this model.

I retried it with install manual and it worked.
Now valetudo starts as expected :)
Thanks for help