Open utterances-bot opened 4 years ago
Hello! Your method will help if my vacuum cleaner blinks slowly but does not respond to pressing and cannot work? https://youtu.be/lGFEfKLKq64
I don’t know. Give it a try.
@rumpeltux Suddenly he will completely break? Could you make a script that you can simply run when connected to a PC?
Potentially, once there’s more use of root functionality. E.g. a Valetudo install script.
I connected the device to my MacBook, ran while true; do adb shell; done and didn't get any shell or terminal. Tried to put the usb cable in while running the vacuum, put it in before booting and the booted several times. But nothing worked. I am on a version later, so version 3.5.3_0044. Maybe they fixed the terminal access? Can someone on the same version verify this behaviour?
Sorry I meant version 3.5.3_0045. dmesg | grep usb doesn't show any usb device, maybe they turned the usb debugging completely off.
Did you power off the vacuum before connecting the USB? The adb briefly appears around the time the vacuum plays its first sound after power on. It’s also not 100% reliable (but probably ~80% or so), so you may need to try twice. I looked at the diff to the 3.5.3_0045 firmware. There’s no indication that adb was disabled.
Did you power off the vacuum before connecting the USB? The adb briefly appears around the time the vacuum plays its first sound after power on. It’s also not 100% reliable (but probably ~80% or so), so you may need to try twice. I looked at the diff to the 3.5.3_0045 firmware. There’s no indication that adb was disabled.
Yes, I also disconnected the battery from the vacuum. I tried it very often, but the shell does not appear. I also tried adb with my phone, there was no problem the shell appeared immediatly.
Ok maybe I got a charging only usb cable or I didnt saw the shell (lol?). Now I am stuck at point 2, I don't know why but it spawns the shell instead of running the given the command. I tried to run with the -n and -t flag and also put the command into quotes, this also does not work. Maybe my the adb for Mac OS is broken or my robot. Is there a way run commands on boot?
You’ll need to push the fixed /bin/adb_shell
as outlined in the article to be able to execute shell commands.
You’ll need to push the fixed
/bin/adb_shell
as outlined in the article to be able to execute shell commands.
I did it, also I pulled the file from the vacuum to double check that this is the actual file. It seems to be that the custom adb_shell file stays there also after reboot, but still it isnt possible to run shell commands.
I did it, also I pulled the file from the vacuum to double check that this is the actual file. It seems to be that the custom adb_shell file stays there also after reboot, but still it isnt possible to run shell commands.
So what’s the error you’re getting?
I did it, also I pulled the file from the vacuum to double check that this is the actual file. It seems to be that the custom adb_shell file stays there also after reboot, but still it isnt possible to run shell commands.
So what’s the error you’re getting?
There arent any errors, it just spawns the shell instead of running the given command.
There arent any errors, it just spawns the shell instead of running the given command.
If you get a shell that’s good enough. You can try piping commands to it: echo id | adb shell
You can also just adb push -a
an executable shell script for startup execution, e.g. /etc/rc.d/S51rootme
.
It’ll be executed on every boot.
thanks, successfully rooted. is there a way how to get the valetudo on this device?
thanks, successfully rooted. is there a way how to get the valetudo on this device?
Yes, but support is super limited right now. See https://github.com/Hypfer/Valetudo/blob/viomi/viomi_instructions.md for details.
Would you be able to extract the URL of STYJ02YM v7 firmware updates from your rooted device?
I'm struggling to make the vacuum download the firmware from Xiaomi's servers (progress is stuck on 1%, jumps to 70 or 80% and then back to 1%, until an error pops out) and I'd want to try to sideload it from a local server. Unfortunately, I can't find any URL of v3.5.3_0046 besides seeing that it connects to cdn.cnbj0.fds.api.mi-img.com
in my DNS server logs.
Would you be able to extract the URL of STYJ02YM v7 firmware updates from your rooted device?
I'm struggling to make the vacuum download the firmware from Xiaomi's servers (progress is stuck on 1%, jumps to 70 or 80% and then back to 1%, until an error pops out) and I'd want to try to sideload it from a local server. Unfortunately, I can't find any URL of v3.5.3_0046 besides seeing that it connects to
cdn.cnbj0.fds.api.mi-img.com
in my DNS server logs.
Sideloading from a local server will only work if you already have root access (you need to send the update command on the cloud interface). While this works, there’s no public tool yet that allows you do to so.
In your case, I’d try a factory reset. The flash may be full so the update package might not fit into it. (You could also root, do a backup / make sure the partition has sufficient space.)
Sideloading from a local server will only work if you already have root access (you need to send the update command on the cloud interface). While this works, there’s no public tool yet that allows you do to so.
In your case, I’d try a factory reset. The flash may be full so the update package might not fit into it. (You could also root, do a backup / make sure the partition has sufficient space.)
Can't I use mirobo update-firmware
to make the vacuum install a package from the URL I specify? I'm pretty sure that's how rooting is performed on gen 1 and 2 of the original Xiaomi Vacuum.
I don't want to root the device just yet, as I might send it back to the seller under warranty if I don't manage to perform the update. Do you happen to know the button combination to perform a factory reset though? The manual is in Chinese and that's not a language I'm familiar with 😉
Can't I use
mirobo update-firmware
to make the vacuum install a package from the URL I specify? I'm pretty sure that's how rooting is performed on gen 1 and 2 of the original Xiaomi Vacuum.
Nope, as with newer Roborocks updates cannot be installed via the local interface. (Rooting would be much easier this way too)
I don't want to root the device just yet, as I might send it back to the seller under warranty if I don't manage to perform the update. Do you happen to know the button combination to perform a factory reset though? The manual is in Chinese and that's not a language I'm familiar with
Nope, maybe the official app has this option.
So I just rooted the vacuum and found out that the storage on the partition mounted as /rom
is completely full.
Filesystem Size Used Available Use% Mounted on
rootfs 9.7M 1.1M 8.1M 12% /
/dev/root 22.5M 22.5M 0 100% /rom
tmpfs 249.9M 20.0K 249.9M 0% /tmp
/dev/by-name/rootfs_data
9.7M 1.1M 8.1M 12% /overlay
overlayfs:/overlay 9.7M 1.1M 8.1M 12% /
tmpfs 512.0K 0 512.0K 0% /dev
/dev/by-name/UDISK 107.7M 5.7M 96.4M 6% /mnt/UDISK
/dev/by-name/boot 4.0M 3.2M 810.0K 80% /boot
/dev/by-name/boot-res
8.0M 39.0K 7.9M 0% /boot-res
/dev/by-name/private 1008.5K 5.0K 1003.5K 0% /mnt/SNN
overlayfs:/overlay/usr
9.7M 1.1M 8.1M 12% /usr
Is it the partition where the vacuum unpacks downloaded firmware packages and can it be simply emptied? How does it look on your device?
This is how the contents of the root and /rom directories look like:
root@TinaLinux:/# ls -l /
drwxr-xr-x 1 root root 1024 Mar 18 04:47 bin
drwxrwxrwx 2 root root 16384 Jan 1 1970 boot
drwxrwxrwx 2 root root 8192 Jan 1 1970 boot-res
drwxr-xr-x 8 root root 2800 Mar 18 04:47 dev
drwxr-xr-x 1 root root 1024 Aug 16 2019 etc
-rwxrwxr-x 1 root root 78 Aug 16 2019 init
drwxr-xr-x 1 root root 1024 Aug 16 2019 lib
drwx------ 2 root root 12288 Jan 1 1970 lost+found
drwxr-xr-x 1 root root 1024 Aug 16 2019 mnt
drwxr-xr-x 10 root root 1024 Aug 16 2019 overlay
dr-xr-xr-x 86 root root 0 Jan 1 1970 proc
drwxr-xr-x 16 root root 223 Aug 16 2019 rom
drwxr-xr-x 2 root root 3 Aug 16 2019 root
drwxr-xr-x 2 root root 873 Aug 16 2019 sbin
dr-xr-xr-x 13 root root 0 Jan 1 1970 sys
drwxrwxrwt 9 root root 340 Mar 18 04:49 tmp
drwxr-xr-x 1 root root 1024 Aug 16 2019 usr
lrwxrwxrwx 1 root root 4 Aug 16 2019 var -> /tmp
drwxr-xr-x 2 root root 3 Aug 16 2019 www
root@TinaLinux:/# ls -l /rom
drwxr-xr-x 2 root root 997 Aug 16 2019 bin
drwxr-xr-x 2 root root 30 Aug 16 2019 dev
drwxr-xr-x 18 root root 811 Aug 16 2019 etc
-rwxrwxr-x 1 root root 78 Aug 16 2019 init
drwxr-xr-x 10 root root 735 Aug 16 2019 lib
drwxr-xr-x 2 root root 3 Aug 16 2019 mnt
drwxr-xr-x 2 root root 3 Aug 16 2019 overlay
drwxr-xr-x 2 root root 3 Aug 16 2019 proc
drwxrwxr-x 2 root root 27 Aug 16 2019 rom
drwxr-xr-x 2 root root 3 Aug 16 2019 root
drwxr-xr-x 2 root root 873 Aug 16 2019 sbin
drwxr-xr-x 2 root root 3 Aug 16 2019 sys
drwxrwxrwt 2 root root 3 Aug 16 2019 tmp
drwxr-xr-x 7 root root 101 Aug 16 2019 usr
lrwxrwxrwx 1 root root 4 Aug 16 2019 var -> /tmp
drwxr-xr-x 2 root root 3 Aug 16 2019 www
root@TinaLinux:/#
--- Edit:
I just found this, which is taken from the original Viomi V2 Pro and it seems that 100% usage of /rom is intentional. In fact, everything looks similiar to my output. I'll try to find some logs on the device and see what happens during attempted updates.
@mLupine Great. Thank you for your work. I hope that with your help we will be able to download our own firmware and language packs
It looks like comments on https://itooktheredpill.irgendwo.org/2020/viomi-firmware-update-analysis/ is not allowed, so i write it here: Hi, i did an update to ver 0046. Before that i had a successful root on v. 0045. After updating the robot, when i try to connect via ssh - the connection is successful but after the password prompt, i enter the password and i get a reply that the password is invalid. I had a password set before via telnet and this was probably changed during the update. I tried the default password from your post about rooting, but it doesn't work either. I also can't get into the vacuum via telnet after the update. The procedure that was previously successful does not work now. Otherwise the robot works normally, i just lost the ssh connection and i can't recover it.
I managed to find the cause of my problem:
root@TinaLinux:/rom/etc/miio# touch /mnt/UDISK/debug_mode
root@TinaLinux:/rom/etc/miio# /usr/sbin/upgrade
2020/03/18,19:21:42.246952[LogXu][LogNormal]upgrade main!
----[CLogConfig::TConfigParams] ----
log_file_path =
log_directory_prefix = ./
auto_build_directory = NO
create_log_name_auto = NO
log_time_string = YES
log_module_string = YES
log_username_string = YES
log_level_string = YES
also_printf = YES
printf_this_call = YES
add_to_logfile = YES
different_log = YES
out_log_level = 2
out_log_type = 1
log_user_list = 2047
CLog::init: file is /mnt/UDISK/log/upgrade.temp for logging.
CLog::init: Open file /mnt/UDISK/log/upgrade.temp for logging.
CLog::init: m_out_type: File(/mnt/UDISK/log/upgrade.temp) m_out_level: LogNormal Logging User Logging Time Also printing
2020/03/18,19:22:04.233127[LogXu][LogNormal]upgardeMsgProcess :: UPGRADE_STATE_DOWNLOAD_START
2020/03/18,19:22:04.242781[LogXu][LogNormal]upgardeMsgProcess :: ROBOTAPP_CTRL_DOWNLOAD_INSTALL_REQ
2020/03/18,19:22:04.244978[LogXu][LogNormal][upgardeMsgProcess] g_url:https://cdn.cnbj0.fds.api.mi-img.com/miio_fw/d3ca92018269f29fb046f4f2da53555f_upd_viomi.vacuum.v7.bin?GalaxyAccessKeyId=5721718224520&Expires=1586437654000&Signature=0RlW87tnRHX1h6YekruyCxU6Ozc=&uniqRequestId=25704162,g_md5:d3ca92018269f29fb046f4f2da53555f.
2020/03/18,19:22:04.263683[LogXu][LogNormal]UPGRADE_STATE_DOWNLOAD_START
2020/03/18,19:22:04.280030[LogXu][LogNormal][Save] ########## save to ConfigFile ########
2020/03/18,19:22:04.281684[LogXu][LogNormal][main] url:https://cdn.cnbj0.fds.api.mi-img.com/miio_fw/d3ca92018269f29fb046f4f2da53555f_upd_viomi.vacuum.v7.bin?GalaxyAccessKeyId=5721718224520&Expires=1586437654000&Signature=0RlW87tnRHX1h6YekruyCxU6Ozc=&uniqRequestId=25704162,md5:d3ca92018269f29fb046f4f2da53555f.
2020/03/18,19:22:06.283382[LogXu][LogNormal]UPGRADE_STATE_OTA_WAIT_DOWNLOAD
2020/03/18,19:22:06.292231[LogXu][LogNormal][DownLoadThread] ##### OTA Download Thread start #####
2020/03/18,19:22:06.398359[LogXu][LogNormal]###### enter [download_ota_pack] ######
2020/03/18,19:22:06.403632[LogXu][LogNormal][download_ota_pack] url is https://...
* Trying 46.238.67.43...
* TCP_NODELAY set
* Connected to cdn.cnbj0.fds.api.mi-img.com (46.238.67.43) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/sysconf/gdroot-g2.crt
CApath: none
* error:14077410:lib(20):func(119):reason(1040)
* Closing connection 0
2020/03/18,19:22:07.873729[LogXu][LogNormal][download_ota_pack] curl_easy_perform failed : SSL connect error
2020/03/18,19:22:07.876460[LogXu][LogNormal][download_ota_pack] get http info --> content length: 0.000000.
2020/03/18,19:22:07.885283[LogXu][LogNormal][Save] ########## save to ConfigFile ########
2020/03/18,19:22:07.887600[LogXu][LogNormal][download_ota_pack] Content-Length:0.000000 , package.gettotalSize():0.
2020/03/18,19:22:17.891646[LogXu][LogNormal]###### exit [download_ota_pack] ######
2020/03/18,19:22:17.895252[LogXu][LogNormal][DownLoadThread] ##### OTA Download Thread stop #####
2020/03/18,19:22:18.297661[LogXu][LogNormal]UPGRADE_STATE_DOWNLOAD_FILESH
2020/03/18,19:22:18.300685[LogGareth][LogNormal]file /mnt/UDISK/misc-upgrade/CRL200S-OTA.tar.gz md5 d41d8cd98f00b204e9800998ecf8427e
2020/03/18,19:22:18.305203[LogXu][LogNormal]MD5Compase::[file: /mnt/UDISK/misc-upgrade/CRL200S-OTA.tar.gz] [packageMD5: d3ca92018269f29fb046f4f2da53555f ] [fileMd5: d41d8cd98f00b204e9800998ecf8427e ]
2020/03/18,19:22:18.311368[LogXu][LogNormal]Parse fail !!!!!!!
The /usr/sbin/upgrade
command is not able to download a file using HTTPS due to some connection/validation error. It kept trying though, retrying every few seconds.
So, hoping that it reads the config file every time, I modified the URL and removed the "s" from "https". And that was a success - the robot downloaded the firmware from the new URL. I guess you could specify your own URL there and it would work just as well.
The update, however, did brick my vacuum. I'm stuck in the "soft white light flashing" phase and the vacuum doesn't fully turn on or connect to Wi-Fi 😢
I just checked the microUSB port and, unfortunately, the device doesn't connect at all anymore - not even for a second. I guess that's it for the vacuum.
I just checked the microUSB port and, unfortunately, the device doesn't connect at all anymore - not even for a second. I guess that's it for the vacuum.
I really did see no indication for this in https://itooktheredpill.irgendwo.org/2020/viomi-firmware-update-analysis/. Make sure the Robot is powered off before attempting to connect the USB.
Edit: Oh, if you did brick the robot, it can well be that adb doesn’t start either.
@mLupine what is happening to your robot now? Did you manage to restore it?
@mLupine what is happening to your robot now? Did you manage to restore it?
Unfortunately not. I didn't find a way to do it (yet?).
someone got root access on firmware 0046. I can't do anything.
someone got root access on firmware 0046. I can't do anything.
FTR, I upgraded to 0046 firmware a while ago and root access is preserved. I’m using ssh-key authentication instead of password though.
@rumpeltux great job, I hope we will be able to change the firmware in chinese version v7 to the global v8
I've managed to do some progress on fixing my bricked robot. I won't go into details on how I got there yet (I'll publish a description of the process if it actually turns out to be useful), but I found the serial connector on the board and after a lot of struggle I managed to get access to the UBoot shell with the possibility to put the device into the FEL and Fastboot(!) modes.
I also downloaded the OTA package and unpacked it — and this is where I got stuck. I don't know the partition layout on the device and have no idea what the offsets are to flash the boot image, initramfs and userdata.
Is there any chance that anyone with a rooted robot could extract the partition layout from the device and share it? I hope it's the last missing piece to be able to recover broken robots back to life 🤞
Is there any chance that anyone with a rooted robot could extract the partition layout from the device and share it? I hope it's the last missing piece to be able to recover broken robots back to life
Hope this helps:
from /proc/cmdline
:
partitions=boot-res@nanda:env@nandb:boot@nandc:rootfs@nandd:rootfs_data@nande:private@nandf:recovery@nandg:misc@nandh:UDISK@nandi
from /proc/partitions
:
major minor #blocks name
93 0 1024 nanda
93 8 1024 nandb
93 16 4096 nandc
93 24 49152 nandd
93 32 10240 nande
93 40 1024 nandf
93 48 32768 nandg
93 56 1024 nandh
93 64 113664 nandi
Is there any chance that anyone with a rooted robot could extract the partition layout from the device and share it? I hope it's the last missing piece to be able to recover broken robots back to life
Hope this helps:
from
/proc/cmdline
:partitions=boot-res@nanda:env@nandb:boot@nandc:rootfs@nandd:rootfs_data@nande:private@nandf:recovery@nandg:misc@nandh:UDISK@nandi
from
/proc/partitions
:major minor #blocks name 93 0 1024 nanda 93 8 1024 nandb 93 16 4096 nandc 93 24 49152 nandd 93 32 10240 nande 93 40 1024 nandf 93 48 32768 nandg 93 56 1024 nandh 93 64 113664 nandi
This is awesome, thank you!
One more question, though. What are the contents of the rootfs and rootfs_data partitions? The OTA package contains only one rootfs image and I wonder where it should actually go.
One more question, though. What are the contents of the rootfs and rootfs_data partitions? The OTA package contains only one rootfs image and I wonder where it should actually go.
rootfs is the squashfs that’s also included in the OTA package. rootfs_data is the overlay fs. I hope yours is still intact?
rootfs is the squashfs that’s also included in the OTA package. rootfs_data is the overlay fs. I hope yours is still intact?
I don't know yet (although I have a premonition and it's not an optimistic one). I'll find out once I get UBoot to load the kernel first - I'll work on it tomorrow.
I don't know yet (although I have a premonition and it's not an optimistic one). I'll find out once I get UBoot to load the kernel first - I'll work on it tomorrow.
Broken robot after.45 update and I have too weak knowledge to get a solution alone. Hope you will find a solution mLupine. In any event, thanks for your try/help ! 🤞
My vacuum has just started speaking Chinese again :). I'm starting to reassmble it and if it turns out to be working, I'll describe how I brought it back to life.
My vacuum has just started speaking Chinese again :). I'm starting to reassmble it and if it turns out to be working, I'll describe how I brought it back to life.
Any way to change the language pack...? :)
My vacuum has just started speaking Chinese again :). I'm starting to reassmble it and if it turns out to be working, I'll describe how I brought it back to life.
Any way to change the language pack...? :)
Plenty of ways to do that - the easiest would be to use the modified MiHome app. You can Google it up, it's quite a popular solution. The English voice pack is already present on the device.
I assembled the robot. It connected to Wi-Fi, speaks English, and now charges. The battery discharged to about 2% during my experiments so it will take it some time to fully charge. It seems that the device is alive, though :)
Also, a new update just appeared - v3.5.3_0047. I'm holding off on it for now, though. Don't feel like going through the same process once again 😃
I assembled the robot. It connected to Wi-Fi, speaks English, and now charges. The battery discharged to about 2% during my experiments so it will take it some time to fully charge. It seems that the device is alive, though :)
Congrats ! I'm looking forward to hearing process solution we have to follow 😃
@mLupine Congratulations. Also will be glad to see how you have done that. I hope your way will work for other people too.
My vacuum has just started speaking Chinese again :). I'm starting to reassmble it and if it turns out to be working, I'll describe how I brought it back to life.
Any way to change the language pack...? :)
Plenty of ways to do that - the easiest would be to use the modified MiHome app. You can Google it up, it's quite a popular solution. The English voice pack is already present on the device.
I assembled the robot. It connected to Wi-Fi, speaks English, and now charges. The battery discharged to about 2% during my experiments so it will take it some time to fully charge. It seems that the device is alive, though :)
Also, a new update just appeared - v3.5.3_0047. I'm holding off on it for now, though. Don't feel like going through the same process once again 😃
Yes I know about modified app from kapiba.ru but it only allows to switch language to English, v8 version of STYJ supports Polish, Russian etc. Do not install v3.5.3_0047 - I've been testing it two days and it has some stupid bugs, it also changes the English voice (I don't know why) for a worse one. After upgrade my robot need to be rebooted after every installing the 2 in 1 box, instead of this the water pomp doesn't work.
Yes I know about modified app from kapiba.ru but it only allows to switch language to English, v8 version of STYJ supports Polish, Russian etc. Do not install v3.5.3_0047 - I've been testing it two days and it has some stupid bugs, it also changes the English voice (I don't know why) for a worse one. After upgrade my robot need to be rebooted after every installing the 2 in 1 box, instead of this the water pomp doesn't work.
What do you mean with version v8? Would like to switch language to anything different than chinese.
What do you mean with version v8? Would like to switch language to anything different than chinese.
With https://github.com/Hypfer/Valetudo the default language is switched to english on boot.
Yes I know about modified app from kapiba.ru but it only allows to switch language to English, v8 version of STYJ supports Polish, Russian etc. Do not install v3.5.3_0047 - I've been testing it two days and it has some stupid bugs, it also changes the English voice (I don't know why) for a worse one. After upgrade my robot need to be rebooted after every installing the 2 in 1 box, instead of this the water pomp doesn't work.
What do you mean with version v8? Would like to switch language to anything different than chinese.
STYJ02YM has two versions, chinese - v7 and global - v8, it is still the same model but with two different firmwares. Chinese version supports multi map, in v8 you can store only one map but you have multiple languages to choose. V7 version is getting more firmware updates too - but I don't know if it is advantage or not because firmwares has a lot of bugs and could brick the robot as we can see on theese examples...
What do you mean with version v8? Would like to switch language to anything different than chinese.
With https://github.com/Hypfer/Valetudo the default language is switched to english on boot.
Yeah, but I am a bit scared because many users have to reset their device randomly with Valetudo -.-.
Yes I know about modified app from kapiba.ru but it only allows to switch language to English, v8 version of STYJ supports Polish, Russian etc. Do not install v3.5.3_0047 - I've been testing it two days and it has some stupid bugs, it also changes the English voice (I don't know why) for a worse one. After upgrade my robot need to be rebooted after every installing the 2 in 1 box, instead of this the water pomp doesn't work.
What do you mean with version v8? Would like to switch language to anything different than chinese.
STYJ02YM has two versions, chinese - v7 and global - v8, it is still the same model but with two different firmwares. Chinese version supports multi map, in v8 you can store only one map but you have multiple languages to choose. V7 version is getting more firmware updates too - but I don't know if it is advantage or not because firmwares has a lot of bugs and could brick the robot as we can see on theese examples...
Ah I see, did already someone looked into the firmware difference? Maybe its possible to import language files.
Ah I see, did already someone looked into the firmware difference? Maybe its possible to import language files.
I believe it's possible to load the v7 firmware onto the v8 robot and vice-versa using the method I described earlier. It should be also fairly easy to sideload custom language packs once you have rooted your device.
@mLupine how is your vacuum after charging? Is it working properly?
Rooting the Xiaomi STYJ02YM (viomi-v7) Vacuum Robot - itooktheredpill
https://itooktheredpill.irgendwo.org/2020/rooting-xiaomi-vacuum-robot/