Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

roomba 980 firmware 2.0.0-34 ready? #10

Closed
koalazak opened this issue Dec 30, 2016 · 122 comments

Comments

@koalazak
Copy link
Owner

commented Dec 30, 2016

What about this new firmware update?
Does anyone here upgrade their roomba?
I heard that the new firmware no longer listens on port 443.
For now I recommend deny internet access to your roomba to keep v1.6.6 and enjoy dorita980.

@koalazak koalazak changed the title firmware 2.0.0-34 ready? roomba 980 firmware 2.0.0-34 ready? Dec 30, 2016

@j-vanetten

This comment has been minimized.

Copy link

commented Jan 12, 2017

Mine stopped working, and yup, It's firmware 2.0.0-34. :(

@xibriz

This comment has been minimized.

Copy link

commented Jan 12, 2017

Does the roomba upgrade automaticly?

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Jan 12, 2017

yes @xibriz. but 2.0.0-34 seems to be a beta version only for few users. on 2.0.0. will be update for everyone.

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Jan 12, 2017

Hi @TheMasterBaron thanks for reply!

please, can you run this code and share the output?

test.js

const dgram = require('dgram');

const server = dgram.createSocket('udp4');

server.on('error', (err) => {
  server.close();
  console.log(err);
});

server.on('message', (msg) => {
  try {
    var parsedMsg = JSON.parse(msg);
    console.log(parsedMsg);
    process.exit();
  } catch (e) {}
});

server.on('listening', () => {
  console.log('Looking for robots...');
});

server.bind(5678, function () {
  const message = new Buffer('irobotmcs');
  server.setBroadcast(true);
  server.send(message, 0, message.length, 5678, '255.255.255.255');
});

Is something like this:

$ node test.js
Looking for robots...
{ ver: '2',
  hostname: 'Roomba-xxxxxxxxxxxxxx',
  robotname: 'Dorita',
  ip: '192.168.1.104',
  mac: 'xx:xx:xx:xx:xx:xx',
  sw: 'v1.6.6',
  sku: 'R98----',
  nc: 0,
  proto: 'http' }

thanks!

@KleemannT

This comment has been minimized.

Copy link

commented Jan 12, 2017

Output from test.js:

{ ver: '2',
hostname: 'Roomba-xxxxxxxxxxxx',
robotname: 'Heike',
ip: '192.168.1.15',
mac: 'xx:xx:xx:xx:xx:xx',
sw: 'v2.0.0-34',
sku: 'R98----',
nc: 0,
proto: 'mqtt' }

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Jan 12, 2017

proto: 'mqtt'
oh crap...

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Jan 12, 2017

@KleemannT thanks!
can you test one more thing please?

cou can try deny the internet connection (not lan) to your roomba from the router (parent control or something), soft restart the roomba and try to send commands using dorita980 to look if its listen on port 443 or 80?
(maybe if new firmware detect no internet connection to the cloud, then open local API, i dont know.)

thanks!

@KleemannT

This comment has been minimized.

Copy link

commented Jan 13, 2017

internet access locked for Robot
soft reset
no connection with dorita980
portscan against robot from 1-65535
open port on TCP:8883

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Jan 13, 2017

thank you @KleemannT !
sounds like the new firmware is no longer using http/s portocol and now use mqtt protocol on port 8883. MQTT is more apropiated for IoT things, btw.
When my roomba updates her firmware I'm going to have a lot of work to do in dorita980 ¬¬

thanks!

@CLARENNE-Q

This comment has been minimized.

Copy link

commented Jan 25, 2017

Hi everybody,

First of all, thanks for this good documentation/code it's really appreciated !

I have the same issue:

@
node index.js 
Looking for robots...
{ ver: '2',
  hostname: 'Roomba-30F88508216136XX',
  robotname: 'Terminator',
  ip: '192.168.2.22',
  mac: '80:A5:89:AA:DB:XXX',
  sw: 'v2.0.0-34',
  sku: 'R98----',
  nc: 0,
  proto: 'mqtt' }

I try to found a TCP port open but nothing:

nmap -sU -p 137,5353 --script nbstat,dns-service-discovery 192.168.2.22
Starting Nmap 7.40 ( https://nmap.org ) at 2017-01-24 22:59 EST
Nmap scan report for 192.168.2.22
Host is up (0.047s latency).
PORT     STATE  SERVICE
137/udp  closed netbios-ns
5353/udp closed zeroconf
MAC Address: 80:A5:89:AA:DB:XX (AzureWave Technology)

nmap -p 1883 --script mqtt-subscribe 192.168.2.22
Starting Nmap 7.40 ( https://nmap.org ) at 2017-01-24 23:20 EST
Nmap scan report for 192.168.2.22
Host is up (0.013s latency).
PORT     STATE  SERVICE
1883/tcp closed mqtt

sudo nmap -sTU 192.168.2.22
Starting Nmap 7.40 ( https://nmap.org ) at 2017-01-24 23:21 EST
Nmap scan report for 192.168.2.22
Host is up (0.0056s latency).
All 2000 scanned ports on 192.168.2.22 are closed
MAC Address: 80:A5:89:AA:DB:XX (AzureWave Technology)
Nmap done: 1 IP address (1 host up) scanned in 57.50 seconds

Is it possible to make a downgrade ?

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Jan 25, 2017

Hi @CLARENNE-Q, sounds like you have a firewell or something (and port is 8883 not default 1883). Try knoking with netcat command:

nc -vz 192.168.2.22 8883

I dont know if its possible to make a downgrade. If you found a way for that, please come back and share how to :)

regards,

@IngmarStein

This comment has been minimized.

Copy link

commented Feb 1, 2017

@koalazak, has your Roomba updated to 2.0.0-34 already?

Here's the netcat output for an updated robot:

$ nc -vz <ip> 8883
found 0 associations
found 1 connections:
     1:	flags=82<CONNECTED,PREFERRED>
	outif en0
	src 192.168.178.20 port 51423
	dst 192.168.178.22 port 8883
	rank info not available
	TCP aux info available

Connection to <ip> port 8883 [tcp/*] succeeded!
@CLARENNE-Q

This comment has been minimized.

Copy link

commented Feb 2, 2017

Hi all,

Sorry, I'am late:

$ nc -vz 192.168.2.22 8883
found 0 associations
found 1 connections:
1: flags=82<CONNECTED,PREFERRED>
outif en0
src 192.168.2.14 port 51580
dst 192.168.2.22 port 8883
rank info not available
TCP aux info available

Connection to 192.168.2.22 port 8883 [tcp/*] succeeded!

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Feb 2, 2017

Hi guys,

@IngmarStein no yet ;/
@CLARENNE-Q you firewall detects tehe nmap, but you can connect with nc to port 8883.

im in conditions to confirm that the new firmware is no longer using http/s protocol and now use mqtt protocol on port 8883. dorita980 needs changes to work with 2.0 firmware.

Im waiting the update in my robot...

@sputt

This comment has been minimized.

Copy link

commented Feb 2, 2017

I have the 2.0.0-34 firmware as of 1/29/2017. Let me know if there's anything you want me to try

@iosdeveloper

This comment has been minimized.

Copy link

commented Feb 3, 2017

Does this change only affect local or also cloud API?

@LordLiverpool2

This comment has been minimized.

Copy link

commented Feb 3, 2017

I am the latest victim of this unwanted update.

If you need me to do any tests, let me know.

@normanth

This comment has been minimized.

Copy link

commented Feb 4, 2017

Hi,

I have the same problem.

With "local" access I get "Internal server error".

With "cloud" access I get infos - but Roomba doesn't act.

http://ds:3000/api/cloud/info/status
{"status":"OK","method":"getStatus","sku":"R980040","country":"",........

http://ds:3000/api/cloud/action/start
{"status":"OK","method":"multipleFieldSet"}

Thanks for the api - very good solution!

Norman

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Feb 4, 2017

thanks guys!
my roomba is updated now. Im reverse engineering the new api.
Will keep you informed!

@koalazak koalazak added the help wanted label Feb 4, 2017

@sheppy99

This comment has been minimized.

Copy link

commented Feb 4, 2017

Mine has updated and stopped talking to the API. Really wish iRobot would stop stuffing about and release a supported API. Not everyone wants several bloated apps on their phone to work stuff when one can do all!!!

Happy to help in any way I can to get this thing working again

@JensBonse

This comment has been minimized.

Copy link

commented Feb 6, 2017

I did some sniffing and 2.0.0-34 is for example now connecting to
https://sl7awxqj03.execute-api.us-east-1.amazonaws.com/dev/v1/30F8431482042630/missionhistory?app_id=IOS-12345678-1234-1234-1234-123456789012
And the whole authentication and header stuff looks more tricky. At least not like the previous headers that could be decoded on first sight.

So seems it is really some beta test. I do not know whether it makes sense to decode everything now.

@normanth: I suppose that with the 2.0.0-34 firmware that roomba registers to the beta cloud service. So the original cloud service still has the records of the roomba but does no longer have authorisation on the roomba. That is why the roomba is no longer listening to the original cloud service. Hope after the beta test the cloud service will return to the original, that only the local connection has to be updated to mqtt.

@sheppy99

This comment has been minimized.

Copy link

commented Feb 7, 2017

@JensBonse did you see the app taking to that address and then that address talking to the Robot? I've been using the Wireshark built into my Router to try and see what is happening. I see a connection to the server, but nothing to the robot despite it starting and stopping from the App. I wonder whether on WiFi the connection is going direct from ios app to robot, maybe via broadcast and the app reports the status to the server.
I am new to Wireshark so could of course be wrong!

@JensBonse

This comment has been minimized.

Copy link

commented Feb 7, 2017

@sheppy99 I saw the App communicating with that address. I did not sniff the the connection of the cloud service with the robot. I just used a man in the middle attack with a proxy. The proxy prevents the direct connection of the phone to the robot. In general there are two ways to communicate with the robot.

  1. Using the cloud as described.
  2. Direct connection of the APP to the robot. (I did not sniff this)
@sheppy99

This comment has been minimized.

Copy link

commented Feb 7, 2017

This has given me an idea. Tomorrow I will put my iPhone on 5Ghz and the Robot will be on 2.4GHz. I will see if I can capture any app to robot traffic. The router will have to pass it between the 2 radio bands, so maybe I can log it

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Feb 7, 2017

Hi guys, im focusing on the local mqtt api, but talking about cloud i see this flow:

  1. Discovery
GET /v1/robot/discover/MY_ROBOT_ID HTTP/1.1
Host: disc-prod.iot.irobotapi.com
User-Agent: aspen/1.9.1.184.1 CFNetwork/808.2.16 Darwin/16.3.0

response:

HTTP/1.1 200 OK
Content-Type: application/json
x-amzn-RequestId: 2c537002-eb08-11e6-aa52-a1421888806e
X-Amzn-Trace-Id: Root=1-58961e0d-00fcdf8067e8fb1f1588e6a5
X-Amz-Cf-Id: f_base64string
{
    "awsRegion": "us-east-1",
    "discoveryTTL": 86400,
    "httpBase": "https://d1nokieziam3wp.cloudfront.net",
    "httpBaseAuth": "https://bcgqn5awqe.execute-api.us-east-1.amazonaws.com/dev",
    "iotTopics": "$aws",
    "irbtTopics": "v005-irbthbu",
    "mqtt": "a2uowfjvhio0fa.iot.us-east-1.amazonaws.com",
    "svcDeplId": "v005"
}

this tells where is the cloud api and mqtt cloud servers (there are two mqqt brokers one inside roomba and other in the cloud)

  1. login:
POST /v1/login HTTP/1.1
Host: d1nokieziam3wp.cloudfront.net get this from discovery
Content-Type: application/json

{"associations":{"0":{"robot_id":"MY_ROBOT_ID","deleted":false,"password":":1:1486234474:ONE_PASSOWRD"}},"app_id":"IOS-UUID"}

response:

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 38
Connection: keep-alive
Date: Sat, 04 Feb 2017 19:07:58 GMT
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: base64string

{"associations": {"0": "ErrorTooNew"}}

aparently the password change all the time, maybe is generated using a timestamp (the first numers in password field are a timestampt)

(I dont know what is the correct response for that login. i always get errorTooNew)

Talking about Local API, I use arpspoof to tells to the mobile app that my computer is the roomba, so the trafics pass throw me and then I redirect the trafic with ip forwarding to the roomba.

arpspoof -i at0 -t mobile_id roomba_ip

thanks for the help!

@koalazak koalazak closed this Feb 7, 2017

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Feb 16, 2017

i click reopen by misstake :p

@iosdeveloper I just publish the v3.0.4 with the discovery method exposed and return all the discovery data, including ip address, blid and protocol version.

@iosdeveloper

This comment has been minimized.

Copy link

commented Feb 16, 2017

So you need discovery first. Is there a way if the network doesn't allow discovery (i.e. no broadcast)?

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Feb 16, 2017

mmm i think is not possible. maybe resolving the hostname for that ip but i think is needed a brodcast too.

@iosdeveloper

This comment has been minimized.

Copy link

commented Feb 16, 2017

Ok, thanks 👌

@rwscott1961

This comment has been minimized.

Copy link

commented Feb 16, 2017

@jeffqchen

This comment has been minimized.

Copy link

commented Feb 16, 2017

I'm on FW 2.0.0-34 but when I try to get the password it throws an error "Error getting password" after showing all the robot information.

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Feb 16, 2017

are you using node 6 or 7?
I just push version 3.0.5 fixing a bug in getpassword for node 6 and 7.

@jeffqchen

This comment has been minimized.

Copy link

commented Feb 16, 2017

I just purged everything and cloned again, this time it works but the password I got was nothing something like :1:1486868728:XXXXXXXXX, but only 16 characters.

@koalazak

This comment has been minimized.

Copy link
Owner Author

commented Feb 16, 2017

ok, but that 16chars password works for you? I think old passwords works nice too.

@jeffqchen

This comment has been minimized.

Copy link

commented Feb 17, 2017

Yes, it worked when I tried to start it with the example js.

@fgomecs

This comment has been minimized.

Copy link

commented Feb 17, 2017

Hello experts!
I tested my new BLID and PWD via myapp.js and I was able to connect just like jeffqchen, but when I try test this in my real homebridge config I get the following error:

[2/16/2017, 10:17:42 PM] [Roomba] Initializing Roomba980 accessory...
/usr/local/lib/node_modules/homebridge-roomba980/node_modules/dorita980/lib/v2/ cloud.js:7
throw new Error('Not implemented.');
^

Error: Not implemented.
at dorita980 (/usr/local/lib/node_modules/homebridge-roomba980/node_modules /dorita980/lib/v2/cloud.js:7:9)
at new cloud (/usr/local/lib/node_modules/homebridge-roomba980/node_modules /dorita980/index.js:12:10)
at RoombaAccessory (/usr/local/lib/node_modules/homebridge-roomba980/index. js:21:28)
at Server._loadAccessories (/usr/local/lib/node_modules/homebridge/lib/serv er.js:265:29)
at Server.run (/usr/local/lib/node_modules/homebridge/lib/server.js:81:38)
at module.exports (/usr/local/lib/node_modules/homebridge/lib/cli.js:40:10)
at Object. (/usr/local/lib/node_modules/homebridge/bin/homebridg e:17:22)
at Module._compile (module.js:571:32)
at Object.Module._extensions..js (module.js:580:10)
at Module.load (module.js:488:32)
at tryModuleLoad (module.js:447:12)
at Function.Module._load (module.js:439:3)
at Module.runMain (module.js:605:10)
at run (bootstrap_node.js:420:7)
at startup (bootstrap_node.js:139:9)
at bootstrap_node.js:535:3

Here is my config.json file (I replaced the password with Xs and the IP with A,B,C,D)

"accessory": "Roomba980",
"name": "Roomba",
"blid": "3115800850519510",
"robotpwd": ":1:1486952168:XXXXXXXXXXXXXXX",
"robotIP": "A.B.C.D"

I bet is something silly, but I just can't make it work....

P.S.
I cloned and installed dorita980 and also re-installed homebridge-roomba980 again

@twentworth12

This comment has been minimized.

Copy link

commented Feb 17, 2017

@fgomecs the cloud APIs used in the homebridge module aren't implemented yet in dorita980. You'll need to edit the code to use the local API, I had this mostly working last night, and hope to look at it again tomorrow.

@steedferns

This comment has been minimized.

Copy link

commented Feb 17, 2017

I wrote the homebridge-roomba980 plugin. I'll work on changing everything to local this weekend.

@fgomecs

This comment has been minimized.

Copy link

commented Feb 17, 2017

Thank you guys! Definitely above my paygrade :) I thought it was as easy as bypassing this.myRobotViaCloud. I got exited because homebridge started and it authenticated the Roomba, but it obvioulsy started to crash in other "Cloud" rutines.

I will not mess with the file and let the fathers of this children take care of it...

Cya this weekend! Good nigh

@fgomecs

This comment has been minimized.

Copy link

commented Feb 20, 2017

@BladeZX9123

This comment has been minimized.

Copy link

commented Feb 21, 2017

I had the HTTP working in .net but now I am looking to get MQTT working in .Net
Is there any info on this that anyone knows of?
Thanks

@sputt

This comment has been minimized.

Copy link

commented Feb 21, 2017

I did a quick port for .NET of the basic functionality. This should get you started:
http://www.rafb.me/results/QU5qhq13.html

@BladeZX9123

This comment has been minimized.

Copy link

commented Feb 21, 2017

Thanks - I will check that out

@BladeZX9123

This comment has been minimized.

Copy link

commented Feb 21, 2017

Looks great. Let me know if you get it receiving all state info like in dorita980 (myRobotViaLocal.getRobotState)

@sputt

This comment has been minimized.

Copy link

commented Feb 21, 2017

I believe just returning _State would be equivalent. Dorita also just accumulates whatever the robot sends

@BladeZX9123

This comment has been minimized.

Copy link

commented Feb 21, 2017

What version of M2MQTT library are you using?
Looks like the following is not valid in 4.1

MqttSslProtocols.TLSv1_2

Wondering if an older version is best

@BladeZX9123

This comment has been minimized.

Copy link

commented Feb 21, 2017

Where do you define StateUpdateEventArgs?

@BladeZX9123

This comment has been minimized.

Copy link

commented Feb 22, 2017

I got the MqttSslProtocols working by using the 4.3 version of the library but am not sure how you are defining StateUpdateEventArgs

@sputt

This comment has been minimized.

Copy link

commented Feb 23, 2017

@BladeZX9123

This comment has been minimized.

Copy link

commented Feb 26, 2017

Thanks sputt - I got things up and running

@fgomecs

This comment has been minimized.

Copy link

commented Feb 26, 2017

@BladeZX9123

This comment has been minimized.

Copy link

commented Feb 26, 2017

Does anyone know which value holds whether edge clean is on and which one is always finish even when bin is full?

Also, anyone know what these ones mean:

noPP: false,
ecoCharge: false,
vacHigh: false,
binPause: false,
openOnly: false,

@BladeZX9123

This comment has been minimized.

Copy link

commented Feb 26, 2017

I think openOnly is for edge clean and binPause is for finishing when bin is full

@NickWaterton

This comment has been minimized.

Copy link

commented Apr 23, 2017

Does anyone have a working example of a python script to connect to the mqtt server on the roomba?

I have tried using Paho client, but I'm not sure what client_id, user name and password to use. My username is a bunch of digits, and the password is 16 characters (not hex) with no 1:xxx time stamp stuff. I've tried client_id same as user (blid), password (as given by getpassword), but no luck.

I'm also not sure about all the certificate talk, do I need this to connect to the mqtt server, or just to intercept the messages (to and from the app)? If so, what certificate do I specify in Client.tls_set() ?

Thanks,

@NickWaterton

This comment has been minimized.

Copy link

commented Apr 24, 2017

If anyone is interested, I have managed to connect to the Roomba mqtt server (locally) with python.

Here is my script (3117850851637850 is my blid, use your own and your own 16 char password):

#!/usr/bin/env python

import paho.mqtt.client as mqtt
import ssl

def on_connect(client, userdata, flags, rc):
    print("Connected with result code "+str(rc))
    client.subscribe("#")
    
def on_message(mosq, obj, msg):
    print(msg.topic+" "+str(msg.qos)+" "+str(msg.payload))  
    
def on_publish(mosq, obj, mid):
    pass

def on_subscribe(mosq, obj, mid, granted_qos):
    print("Subscribed: %s %s" % (str(mid), str(granted_qos)))

def on_disconnect(mosq, obj, msg):
    print("mqtt disconnected")

def on_log(mosq, obj, level, string):
    print(string)

client = mqtt.Client(client_id="3117850851637850")
client.on_connect = on_connect
client.on_message = on_message
client.on_subscribe = on_subscribe
client.on_publish = on_publish
client.on_disconnect = on_disconnect
#client.on_log = on_log

client.tls_set("/etc/ssl/certs/ca-certificates.crt",
               None,
               None, cert_reqs=ssl.CERT_NONE, tls_version=ssl.PROTOCOL_TLSv1, ciphers=None)

# disables peer verification
client.tls_insecure_set(True)
client.username_pw_set("3117850851637850", "16charpassword")
client.connect(host="192.168.100.181", port=8883, keepalive=60)

client.loop_forever()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
You can’t perform that action at this time.