Camera stream debugging

[ryanelliottsmith]

Thanks for this project, it's excellent!

Out of curiosity, I did a small amount of digging into the camera stream startup flow on a Roborock S7 Maxv.

I noticed that requests to start a stream from the vacuum camera(using either the official app, or LocalRock) result in the vacuum firing off DNS queries to ONBOARDING_DOMAINiot.roborock.com, that looks concatenated in a similar way to the onboarding process. Those requests naturally NXDOMAIN and the app throws a -108 error, and mqtt receives payload={"t":1791501030,"dps":{"102":"{\"id\":X,\"error\":{\"code\":-10014,\"message\":\"request turnserver failed\"}}"}}

The endpoint it tries to hit doesn't appear to be controlled by the country code, or purely by the value of token.r sent during onboarding. For example:
With the server api-example.com:555/ sent during onboarding, and country_domain = 'us', the camera TURN config lookup process would then hit api-example.comiot.roborock.com:443

That client connection does validate certs, so unless there's some weird concatenation logic in the firmware for this endpoint, I'd guess it's going to be pretty tricky to work around.

I dont have access to decrypted firmware, I have an S7 MaxV that appears to be borderline unrootable unless your name happens to be Dennis, so I'm kinda just flailing in the dark a little bit. Any ideas are welcome

[Lash-L]

Hey @ryanelliottsmith

Take a look here for some conversation around it!

#18 (comment)

[ryanelliottsmith]

oooh, thanks!

Coincidentally, my local onboarding domain is exactly 15 chars, excluding ':555/', so that really threw me off.