Root Dreame Robot without via uart only

dreame_1c_root.md

These are just my notes, and described process worked for me on my 1C robot
If anything goes wrong, having USB adapter for FEL flashing might be the only way to restore your robot
this is not an official guide
oh, and I'm not responsible for any damage blah blah
and huge thanks to Dennis and Hypfer, and everyone behind this root :)

0. get uboot shell

to enter uboot shell on 1C you have to: 0. turn robot off normally

1. hook up uart, open console
2. press any button and keep holding it
3. hold HOME button for 3+ seconds (dont release it yet)
4. hold POWER button for 3+ seconds while still holding HOME
5. you should be in uboot shell – release both buttons

see dennis' uart slides for more info
notice: step 3 (home button) seems missing in those slides, maybe different vacuums have differences :)

1. in uboot shell

note (thanks, @Hypher): there is also boot_partition boot2, and setting boot_partition to boot1 when it's corrupted and boot2 is being used might cause trouble. so try to boot without setting boot_partition first, and only if it doesn't work, try again with boot_partition set. I'll try to test if boot_partition needs to be set at all, if it's persisted without saveend, and what would be the proper way to set it when I have free time for it.

setenv init /bin/sh
# setenv boot_partition boot1
boot

2. stage1 shell

you have to act quickly before watchdog (or whatever it is) reboots the device wait for shell – you'll see # /

following commands worked for 1c, might be different for other robots
for ideas on how to get uart shell look at dustbuilder diff to see what exactly it changes to start shell on uart

mount /tmp
mkdir /tmp/fakeetc
cp -R /etc/* /tmp/fakeetc
mount --bind /tmp/fakeetc /etc
echo >> /tmp/fakeetc/inittab
echo '::respawn:-/bin/sh' >> /tmp/fakeetc/inittab
exec init

normal boot should continue, except there will be shell after boot on uart
it's not supposed to reboot, it should keep booting normally in userspace

3. stage2 shell

wait for new shell to pop up - wait for # / again

optional: backup

mkdir /tmp/backup
tar -cvzf /tmp/backup/misc.tgz -C /mnt/misc .
tar -cvzf /tmp/backup/uli_factory.tgz -C /mnt/private/ULI/factory/ .
cd /tmp/backup

now grab misc.tgz and uli_factory.tgz somehow i.e. by starting upload server and using curl i've used github.com/mayth/go-simple-upload-server dont forget to

rm -rf /tmp/backup

flashing

build a custom firmware for manual install method on dustbuilder and follow howto from there

for example, for 1c this should work:

cd /tmp
wget {url-of-firmware.tar.gz}
tar -xzvf {name-of-firmware.tar.gz}
./install.sh

4. verify

if patched firmware was flashed, you'll get a root shell on uart after boot without doing anything

My vacuum is in soft-bricked state after confirming update at MI app.
instead of getting to "stage 1 shell" I get this message:

[31.930]read partition: boot or recovery
[32.138]sunxi flash read :offset 100000, 2830336 bytes OK
Android's image name: organ-perf1
Kernel load addr 0x40008000 size 2760 KiB
RAM disk load addr 0x41000000 size 1 KiB
in boot normal mode,pass normal para to cmdline
android.hardware = sun8iw15p1
[32.140]ready to boot
[32.140]check cpu power status
[32.140][cpu1]cpu 1 enter wfi mode
[32.143]cpu2 has poweroff
[32.169][cpu1]set cpu off by secure os
[32.169]cpu1 has poweroff
[32.170]prepare for kernel
NAND_UbootExit
[32.171]NB1: NAND_LogicExit
[32.177]
Starting kernel ...
[32.177]weak clean_timestamp_counter

If your robot is still bricked, create a ticket on VAERS.dontvacuum.me
I heard some cases, but I would like to investigate that.

You have helped my not long ago, by copying and changing the boot sequence

Hello, I was able to get to the uboot once but I couldn't run the last command, and now everytime I try to stop at the sunxi line it just freezes there and I'm force to continue with normal booting. Am I doing something wrong? I'm pressing S, then Home and then Power. I keep all pressed.

Thank alot about your tuturial! UART not working in my Xiaomi 1C.
Some adds after my installations:
After step 2 i don`t see in putty "new shell to pop up - wait for # / again" after full boot i start write and its answer on my text after 1 and 2 step!
Then i done 3 and 4 steps.
Robot restarted and after boot i can write in shell, and open IP of robot i see webpage with "External access to Valetudo is blocked."
I connect to robot via ssh with root and password from dustbuilder and go to data\valetudo_config.json and change in nano "blockExternalAccess": true to false and UI is loaded!!!!

My vacuum is in soft-bricked state after confirming update at MI app. instead of getting to "stage 1 shell" I get this message:

[31.930]read partition: boot or recovery
[32.138]sunxi flash read :offset 100000, 2830336 bytes OK
Android's image name: organ-perf1
Kernel load addr 0x40008000 size 2760 KiB
RAM disk load addr 0x41000000 size 1 KiB
in boot normal mode,pass normal para to cmdline
android.hardware = sun8iw15p1
[32.140]ready to boot
[32.140]check cpu power status
[32.140][cpu1]cpu 1 enter wfi mode
[32.143]cpu2 has poweroff
[32.169][cpu1]set cpu off by secure os
[32.169]cpu1 has poweroff
[32.170]prepare for kernel
NAND_UbootExit
[32.171]NB1: NAND_LogicExit
[32.177]
Starting kernel ...
[32.177]weak clean_timestamp_counter

If you look at the console more closely, then at the very beginning there is such a line - axp2585 read error
probe axp858 failed

axp2585 This is the power management controller for the processor and other peripherals of the board. Perhaps the problem is in it or in the harness next to it.

Worked on Dreame F9! I had to redo it a couple of times (the watchdog got me). I used dufs as a file server and a AZDelivery CP2102 for UART connection

Notes:

"press any button and keep holding it"

I didn't get first that this meant keyboard buttons 🤦‍♂️

On my F9 the "any button" to press was "s". Other "any buttons" didn't work.

My Dreame F9 Firmware is 4.1.8_1107 , do you think It can work with such steps?