Gen 3 (T6) Root

[Nixon506E]

Just got a T6 and was hoping to help get the T6 verified as rootable. I believe the first step would be getting a copy of the latest firmware but am not sure where to look without connecting the vacuum to the internet and reading its request urls. Any suggestions?

[dgiese]

Rockrobo changed the encryption of the Firmware+Soundfiles and some of the update process. As I don't have a T6, I cannot really help. So its at the moment not rootable.

[Nixon506E]

Any suggestions on what would be a good next step considering I do have one. Hoping to help the community if I can.

[fvollmer]

You may find https://dgiese.scripts.mit.edu/talks/34c3-2017/34c3.html interesting. IIRC the initial rooting was done by shorting pins with aluminium foil. So a pretty invasive method.

[Nixon506E]

I have seen @dgiese's talk on this but it seems like the encryption key was kind of just stumbled upon? Not really looking to dump the entire flash of my device especially if it might not have the same passwords in plaintext as before.

[fvollmer]

I'm sure @dgiese can answer this better, but I think the encryption key was found by analyzing the flash dump (which wasn't encrypted).

[Nixon506E]

@fvollmer yes it was, but it was stored on the operating system in plain text and was being used as a password for something else, seems like it just happened to be the same for the ota encryption as well

[dgiese]

Yeah, back then I extracted it by reverse engineering the binaries (its not stored in plaintext). However I think they learned from their mistakes and are doing things now differently. My usual approach would be to open the device and de-solder the MMC, and dump it. That has of cause the risk that you have a bricked device...at least if you are not familiar with BGA chips. But that's purely speculation, as I don't have the device. Time will show. I mean it took 1,5 years for Gen1 until someone, me, published the stuff. Guess for T6 it will be a little bit faster, but still someone needs to sacrifice his/her device.

[Nixon506E]

Gotcha, not sure I am the right person to reverse engineer a password out of the new binary. I got a T6 pretty easily so they are obviously becoming more available. @dgiese, so you don't suggest we try to grab the flash through the usb port and FEL mode anymore? Hoping to not need to modify any hardware if I can get around it.

[dgiese]

Honestly, no idea. If you disassembled it, make some pictures of the hardware. Would like to take a look at it.

[zvldz]

Does anyone have a link to the encrypted firmware?

[dgiese]

Maybe I know someone. But that's a discussion, which we should not have publicly yet. Thats more of a thing I would discuss in telegram or slack or something.

[MickL]

The T6 is now officially available in the EU known as the S6. It launched in Germany, France and Spain for now. Would really really appreciate rooting this device!

Are there news on this? You might also rename this issue from T6 to T6/S6 as i assume the devices are the same.

I am thinking of buying one. If i do so, is there be any possibility supporting you? I see you are also from Germany. They are available at Alternate and Cyberport at least.

[dgiese]

Unfortuantly they started to sign all firmware files and soundpackages. CCrypt is not used anymore. In addition they changed a lot of other things. One thing which is especially nasty is the fact, that now the region is set in a signed config file, which is bound to the cpu id of the device. So there is no trivial way to change the region (t6->s6). Also there is no simple way to root the device like v1 or s5. Beware: some of the nasty stuff seems to be backported to s5 models produced after march 2019. See my twitter comment for that.

If you are interested in working on the t6/s6 firmware, drop me a message.

[MickL]

Thanks for the update! Sounds bad so far, but if the Nintendo Switch is hackable i have a lot of hopes! I ordered the S5 and hope it is not affected of the march update as you said.

Please tell us how we can support you. Donations, Patreon, etc. I want to help where i can.

[dgiese]

A root of the S6/T6 and even for M1S is possible. However it is not as easy as the existing method for the Mi Vacuum Robot (aka Gen1 aka v1) or Roborock S5x (aka Gen2). Especially as it requires opening the device at the moment. I explore with some other peoples at the moment a different approach, however, if you want to have an easy rootable device, you should stay away from S6/T6 and M1S in particular (as M1S uses a completely different platform). The only difference between S5 and S6 seems to be a different brush and an additional sensor for the water tank. More information can be found here: https://www.roboter-forum.com/index.php?thread/35506-hack-des-roborock-s6-t6-planung-ger%C3%A4tekauf-fortschritte/&postID=474142#post474142

For S5: If you buy an global model, you should have no problems with the geoblocking. Also, if you use only valetudo, you should be OK even with the chinese model. The geoblocking is only in effect in combination with the Mi Home app + Cloud.

I am always happy about support for the procurement of new devices (as potential alternatives to v1 and s5). I did a fundraising for the T6 which went okayish. At the moment I look also at other vendors. If you have too much $$$, then drop me an email (dgi[at]mit.edu) and we find a way ;)

[kiekerjan]

Beware: some of the nasty stuff seems to be backported to s5 models produced after march 2019.

Which nasty stuff do you mean? Does the newer s50 not accept the rooted firmware?

[dgiese]

They backported the Geoblocking mechanism of the T6 to newer S5. I cant really tell how it is exactly implemented on the newer S5, as I dont have one.

[apll64]

@dgiese Any chance you could provide some insight to the method you are referring to in your comment #213 (comment)? I am currently thinking about buying a S6/T6 and would not mind opening the device. However, I need to be sure it is indeed rootable. I would prefer the S6/T6 because it supposedly charges quicker and makes a little less noise.

[breichldomico]

@dgiese Any chance you could provide some insight to the method you are referring to in your comment #213 (comment)? I am currently thinking about buying a S6/T6 and would not mind opening the device. However, I need to be sure it is indeed rootable. I would prefer the S6/T6 because it supposedly charges quicker and makes a little less noise.

I already own an S6 and would not mind opening the device if there is a way to get Valetudo on the device. If you could provide some hints it would be awesome! ;)

[dgiese]

It is now supported, however you need to disassemble the devices :( I did not find a trivial way to root the device without disassembling. All options require some amount of it...
See my message here with the links to the tutorials.
https://twitter.com/dgi_DE/status/1277223172862029824

[dgiese]

As a sidenote: The current image builder is not compatible with the S6/T6 due to the different firmware package format.

[scholdan]

Hello do you think this will work with the S5 max also? i added pictures in #252

[jwveldhuis]

@dgiese would this work with the Roborock S4 too?

[dgiese]

S5 Max is different. S4 might work... do you have one? then contact me ;)
Btw: I created an overview of the hardware to give you an idea: https://dontvacuum.me/robotinfo/

[jwveldhuis]

@dgiese yes I have an S4, will send you an email.

[daihashi]

S5 Max is different. S4 might work... do you have one? then contact me ;)
Btw: I created an overview of the hardware to give you an idea: https://dontvacuum.me/robotinfo/

The S4 is the model I disassembled and sent you pictures at the beginning of January. Not sure if you were ever able to look at the pictures I sent you. I sent a follow up email on March 18th, but I suspect you are very busy with other projects and may not have seen it.

The email conversation in question was to your @seemoo.xx-xxxxxxxxx.de email address.

[hunterOO1]

Today we tried the it with v3.5.8_2652 with the newer model

1. single user mode

2. Added ssh authorized keys

3. patched the ports to 29

4. reboot

Unfortunately dropbear does not seem to answer. After rebooting in single user all our changes were still there. Adding "-p 29" to dropbear in /etc/inittab also did not change a thing.
Anyone sucessfull with the latest version?

If you want to root the device, you should always downgrade to your factory version. Roborock usually blocks the typical ways we use for rooting after a while. Just a thing: if you patched the firewall to block port 29 instead of 22... then it is not a good idea to put dropbear on port 29 ;) Try port 2222 or so. Make sure that the permissions for /root are set correctly. Otherwise you might get trouble logging in.

Alternatively, you can update the system manually. I will update the cheatsheet for that.

Yep. All devices after v1 and s5 need disassembly in some sort.

Is there any way to install custom voices package without rooting the Roborock S5 Max? (I don't want disassembly it)

[napopa]

@andreas-bulling I too have the S5 Max and am willing to root. I see here you were asking about the process of rooting, etc. And then here you managed to figure out how to root it. Can you perhaps point me to the docs you used? I haven't gone through the process yet but am willing to try.

Sure, happy to help.

To get access to the UART pins I followed
https://dontvacuum.me/teardowns/roborock.vacuum.s5e/
Big thanks go to @dgiese who pointed me to this page.

To root the device I followed
https://builder.dontvacuum.me/s5e-cheatsheet.txt
As mentioned above, however, I had to install the latest valetudo version to make it work. The new wget URL is
https://github.com/Hypfer/Valetudo/releases/download/2021.03.0/valetudo-armv7

The firmware image you can get here:
https://dustbuilder.dontvacuum.me/_s5e.html
Before rooting I upgraded to the latest firmware using the Roborock mobile app and selected the corresponding option in the dustbuilder form.

Hi @andreas-bulling , thanks this is really helpful.
One question, could you direct me to which picture (https://dontvacuum.me/teardowns/roborock.vacuum.s5e/) is showing the UART pins and which ones they are? Other models have marks on the picture with TX,RX,GND but not the S5 max... Thanks!

[gatesry]

@napopa - Check picture 14.

Reference: https://www.youtube.com/watch?v=r_04K5SPEXI

[gatesry]

@hunterOO1 - After I gained root on my S5M, I discovered that the filesystem is squashfs and mostly read-only. This limits most mods from working correctly.

E: See Issue 14 on Roborock Oucher

[smtdev]

Is there any disassembly guide for S5 Max? I just found a YT video for S6/T6 version but I don't know if this is valid -> https://www.youtube.com/watch?v=r_04K5SPEXI

[urholaukkarinen]

@smtdev Here is a good one: https://www.youtube.com/watch?v=0vLa4-iikzM
There are some steps you can skip, if you simply want to access and remove the motherboard.

[smtdev]

@urholaukkarinen thanks! I'll check it now.

[Martin11180]

Hello
I did it with my S5 Max according to these instructions https://builder.dontvacuum.me/s5e-cheatsheet.txt. Unfortunately, I get the message Read-only file system via SSH and Valutudo
what is wrong

[gatesry]

Hello
I did it with my S5 Max according to these instructions https://builder.dontvacuum.me/s5e-cheatsheet.txt. Unfortunately, I get the message Read-only file system via SSH and Valutudo
what is wrong

Nothing is wrong. S5M is squashfs, and therefore not really editable.

[An-MS]

Hi everbody

I've got an S5 Max 2020 Variant. I followed the instructions step by step to root the device.
The board is connected via a PL2303TA to the RX/TX pins of the board, but I don't get any output while using minicom. Any ideas or hints what the reason could be?
When I do a loopback with the RX/TX of the adapter I can see what I type.

Thx in advance.

[gatesry]

PL2303TA

I would double-check your COM/SERIAL port settings. https://youtu.be/r_04K5SPEXI?t=594

[x29a]

@mazak-ui what does the squashfs mean? is it still a usable modification?

[gatesry]

@mazak-ui what does the squashfs mean? is it still a usable modification?

See: #213 (comment) or S-FS Wiki

[x29a]

Ok i get what squashfs is and i read your post and the linked issues. i rather meant: does it make sense to flash dustcloud currently on those devices (and possibly valetudo) or will this not work correctly anway.

[gatesry]

@x29a - Oh, got it! I may go back to stock fw because of the current limitations. Besides the fun process of learning how to solder and use USB Serial adapters, I haven't had much luck in integrating with Home Assistant and the associated mods it brings.

Still grateful that the capability exists and the efforts of those involved.

[ejohb]

Hi guys,

To get access to the UART pins I followed
https://dontvacuum.me/teardowns/roborock.vacuum.s5e/
Big thanks go to @dgiese who pointed me to this page.

To root the device I followed
https://builder.dontvacuum.me/s5e-cheatsheet.txt
As mentioned above, however, I had to install the latest valetudo version to make it work. The new wget URL is
https://github.com/Hypfer/Valetudo/releases/download/2021.03.0/valetudo-armv7

The firmware image you can get here:
https://dustbuilder.dontvacuum.me/_s5e.html
Before rooting I upgraded to the latest firmware using the Roborock mobile app and selected the corresponding option in the dustbuilder form.

I've successfully rooted an S5 Max recently using these instructions. But today I'm trying with a second device but can only get partial junk at the serial terminal. I'm using all the same settings as worked before. Anyone know what might be the problem?

I tried swapping out the USB/serial adapter and replaced the wiring, none of which fixed it. Pressing 's' regardless does not seem to work.

[ejohb]

Turns out the USB port I was using for the micro USB/ground wasn't working. So now I have clean output. Still pressing 's' still doesn't work and I end up at rockrobo login:. Can anyone help with that?

Edit: I remembered I was using Putty last time, not Termite. Now 's' works. But perhaps someone else can learn from my idiocy :)

[andreas-bulling]

I also had to try a few times - make sure you keep pressing from the very beginning

[AdriaanDeVos]

Thanks to this thread I was able to jailbreak my device in four hours of work. Thanks everyone!

Resources used:

• Gen 3 (T6) Root #213 (comment)
• https://dontvacuum.me/robotinfo/
• https://www.youtube.com/watch?v=0vLa4-iikzM
• https://www.youtube.com/watch?v=r_04K5SPEXI

[ejohb]

Hi again,

Now I've rooted two S5Ms I'm keen to upgrade to the latest Valentudo optimised for low memory.

I've tried asking on their GitHub for the process but no reply. I was wondering if anyone here has managed it?

[andreas-bulling]

see my comment above #213 (comment)

[Zerwin]

Hi, hope someone can help me here. I'm trying to root the S5 Max, but can't seem to get to the console. I disassembled it and soldered some wires to the pins. When I start the S5 Max I can see the boot process in the putty console, but I can't for the life of me get him to stop the autoboot and get to a console. No matter if I press from the beginning or at any other time, it just continues booting.
Here is a pastebin of the output I get https://pastebin.com/Mccqefw0
As you can see, in the end after he finished booting he starts typing "s", but it seems like before he just ignores which is why I can't stop the boot.
Any ideas as to what I could make wrong ?

Edit: I should note, I saw the "nand block 6 is bad", "** Bad device mmc 2 **", "filled invalid page(0,30,0)..." things in the boot, but for some reason my S5 Max isn't really bothered by it, atleast with the Roborock app it works flawlessly still, even performed an minor firmware upgrade earlier to test.

[BongoEADGC6]

Is there potentially a way to avoid disassembly by creating a webserver that mirrors the update path that the vacuum is looking for and redirecting DNS? Basically hosting the rooted firmware for the vacuum to install similar to the push method, but in a pull method. Just curious if that's already been ruled out or not.

[sibero80]

Is there potentially a way to avoid disassembly by creating a webserver that mirrors the update path that the vacuum is looking for and redirecting DNS? Basically hosting the rooted firmware for the vacuum to install similar to the push method, but in a pull method. Just curious if that's already been ruled out or not.

I might be wrong, but I think we have to go the disassembly route so we can bypass some crypto checks done during the update process that we currently can't go around.

[LordDN]

Hi, hope someone can help me here. I'm trying to root the S5 Max, but can't seem to get to the console. I disassembled it and soldered some wires to the pins. When I start the S5 Max I can see the boot process in the putty console, but I can't for the life of me get him to stop the autoboot and get to a console. No matter if I press from the beginning or at any other time, it just continues booting.
Here is a pastebin of the output I get https://pastebin.com/Mccqefw0
As you can see, in the end after he finished booting he starts typing "s", but it seems like before he just ignores which is why I can't stop the boot.
Any ideas as to what I could make wrong ?

Edit: I should note, I saw the "nand block 6 is bad", "** Bad device mmc 2 **", "filled invalid page(0,30,0)..." things in the boot, but for some reason my S5 Max isn't really bothered by it, atleast with the Roborock app it works flawlessly still, even performed an minor firmware upgrade earlier to test.

Good day, just checking to see if you managed to root your S5e yet. I am stuck in the same position, with working UART access (and commands like "2" working) but "s" being ignored by the robot. Would love to solve this.

[henriklied]

Hi, hope someone can help me here. I'm trying to root the S5 Max, but can't seem to get to the console. I disassembled it and soldered some wires to the pins. When I start the S5 Max I can see the boot process in the putty console, but I can't for the life of me get him to stop the autoboot and get to a console. No matter if I press from the beginning or at any other time, it just continues booting.
Here is a pastebin of the output I get https://pastebin.com/Mccqefw0
As you can see, in the end after he finished booting he starts typing "s", but it seems like before he just ignores which is why I can't stop the boot.
Any ideas as to what I could make wrong ?
Edit: I should note, I saw the "nand block 6 is bad", "** Bad device mmc 2 **", "filled invalid page(0,30,0)..." things in the boot, but for some reason my S5 Max isn't really bothered by it, atleast with the Roborock app it works flawlessly still, even performed an minor firmware upgrade earlier to test.

Good day, just checking to see if you managed to root your S5e yet. I am stuck in the same position, with working UART access (and commands like "2" working) but "s" being ignored by the robot. Would love to solve this.

Same issue here. I've now tried minicom, picocom, screen, Serial.app on macOS, and Putty on Windows with two different USB-TTL adapters and nothing is happening when I hold "s" during boot.

I also get the same " ** Bad device mmc 2 ** unable to open file ./rockrobo/dram.size" error: https://pastebin.com/raw/FVzjMMzi

Anyone got any ideas? FEL mode, is that an option to get a shell?

[dgiese]

For reference: for all NAND based Roborock robots (S5 Max, S4 Max, S6 Pure, S7,...) you can use the FEL rooting method. You need to build a FEL firmware in builder.dontvacuum.me . The exact steps to install it are here: https://builder.dontvacuum.me/howtos/nand/fel/_howto.html