No Cloud Floor Cleaning

We had our first robovac experience about 6 years ago after doing a remodel. All Samsung appliances were spec’d and there was a cash rebate which we decided to put against a Samsung R7070 which turned out to be really terrible. Very poor navigation and it did not handle pet hair well at all. We sort of wrote off robovacs as not a good fit for out dog/kid household.

Two years ago we decided to give it a try again and if you know me I did a ton of research. We have had a Roborock S5 max for two years which has been great but I had a couple of pet peeves that I was looking to overcome.

❌ Not a fan of IoT devices connecting back to services in China

❌ Better obstacle avoidance. Dogs and kids leave stuff everywhere!

❌ Auto empty a bonus!

❌ Sub-$500 price point

Most of these vacuums (and many other smart devices) run some linux variant which lead me to believe that one could get access to the embedded operating system to make some changes to overcome being cloud anchored to a state sponsored service in China. Turns out privacy researchers were well ahead of this curve when I discovered a platform called Valetudo which is a very active project on Github lead by Sören Beye and contributed to by 100+ developers.

The Dreame Z10 easily fit the bill. Easily rootable so you can install Valetudo which makes this bot 100% autonomous with NO cloud connectivity required. I’ll finally be able to wholesale block China address space at the firewall (along with Russia & Iran).

The process itself was super easy. The number one thing is to NOT download the Dreame app and update the firmware. Newer firmware restrict the easiest way to gain root access and install reverse engineered firmware.

Gently pop the front cover using plastic spudgers and picks. This cover is held on by an array of push to snap connections that come loose with a little force. Be patient and just make your way from one side to the other.
You’ll now see 2x8 header which we will use to connect a USB/UART serial adapter. I use this USB adapter for all of my serial projects. You only need to connect RX, TX & ground. Once connected, setup your terminal emulator at 115200 baud with flow control disabled. The easiest thing to use run this command in linux/Mac terminal session:

screen /dev/ttyUSB0 115200,ixoff

Note that you may need to install screen via apt or other package manager and you’ll need to dig around /dev to see what your actual USB device is.

Once you get connected, power on the vaccum by holding the power button down for a few seconds. You should start seeing some typical linux boot screens. If you don’t you’ll need to troubleshoot your serial connection. Make sure RX is connected to TX, TX to RX…..etc. Once booted, you should see something like this:

wlan0: AP-ENABLEDp2028   {"ret":"ok"}

Now we can exploit a little shell backdoor by pressing the reset button under the dustbin flap. If all went well you will get a login prompt.

p2028_release login:

Woohoo! The best thing to do at this point is to put in a build request at Dustbuilder which will give you your root password and custom firmware. Note that the password is just the serial number of your device run through a MD5 hash and converted to base64.

Connect your computer to the ad-hoc network created by the vacuum. It should be pretty obvious what the SSID is. Take a note of what your IP address is and the robovac is likely going to be 192.168.5.1
At this point we are ready to lay down our custom firmware but first we are going to backup some files just in case things go south and we need to recover our base OS and functionality.
On your computer you are going to want to spin up a simple upload server. If you have python installed this is the easiest way:

$ python3 -m uploadserver

This just spins up a http server on port 8000. Now we can run these commands on our robovac to backup some critical files then uploading them to our PC.

Now kill your upload server to release the port then start a HTTP server on your computer making sure you are in the directory of the firmware you download from the Dustbuilder email.

$ python3 -m http.server

And then back on the robovac, execute the following commands

Once the install script finishes, the robot should reboot. Once it comes back up, reconnect to the ad-hoc wifi network and open a web browser to connect to the IP of the robovac (likely 192.168.5.1). The first prompt you’ll get is to join your home network. I have all of my IoT devices on a dedicated SSID/network that has some restrictions.
Reconnect your computer to your home network and find the address of your robovac (either DHCP table on your route or you can run ifconfig on the serial shell of the vac).
Voila!

At this point you have some options. At a very basic level you can just poke around in here to set up the vacuum. Note that everything you are doing in this web page is hosted on the robot vac itself. NOTHING is going to the cloud.

I personally have integrated this vacuum to my Home Assistant instance via MQTT. All of my scheduling is controlled through automations and I am able to send push notifications to family members to let them know that cleaning is starting and if the robot happens to get stuck.