Christmas Hacking: Rooting a Vacuum+Mop Robot
I believe this year I found the easiest way ever to impress my family with my technical skills... by rooting a Dreame W10 cleaning robot :)
We always had dismissed buying one due to the obvious privacy concerns of connecting an always-online device with camera and microphone to the Xiaomi cloud. But this year, they're available for cheap (I got mine at 70% off MSRP) and the hardware has glowing reviews and there's now Dustbuilder support [1].
The rooting process was exceptionally simple. Next to the dustbin, there's an UART port to which you connect one of those $5 USB to UART converters (3.3V model). I've painted the pinout I used in [2].
$ sudo screen /dev/ttyUSB0 115200,ixoff
Press the reset button... and you have a root login prompt. Calculate your password according to [3] and you can now do backups of the nand with dd+curl and install a patched firmware like [4] to add an SSH server.
By now, it should work with MQTT and 3rd-party miio apps without any internet connection. As a last step, you can install the excellent Valetudo open source web-GUI [5] which, BTW, is React+NodeJS so easy to customize to your liking.
And now, everyone in the house can remote-control the vacuum robot just by opening a website :) No apps and no chinese cloud needed.
The Dreame W10 that I use also supports multiple floors through miio commands, so I patched my Valetudo installation to support that. Just never ever mention multiple floors to the Valetudo team, because they have a very strict policy that everyone who doesn't own a single-floor penthouse apartment must be an idiot ^_^
But overall, the rooting process was easy, didn't require any disassembly of the robot, didn't require any obscure tools and now I can ssh into root on the robot and it doesn't have any internet connection and works just fine. Also integrates with Home Assistant, if you fancy that.
Happy Christmas hacking, everyone!
[1] https://dontvacuum.me/robotinfo/detail_dreame.vacuum.p2027_0.html
[2] https://ibb.co/TwfdMxT
[3] https://builder.dontvacuum.me/dreamepassword.php
[4] https://builder.dontvacuum.me/_dreame_p2027.html
[5] https://valetudo.cloud/