Success: Rooted viomi-v8 using a mac

[infused-kim]

Hi,

First of all, thank you so much for your research and rooting script.

I am not sure if this is the right place, but I wanted to add a success report.

Device Info

Model: Mijia STYTJ02YM, viomi-v8, purchased from Xiaomi in the Republic of Georgia
Firmware: 3.5.3_0017
Rooting Device: Intel MacBook Pro

Mac setup

The first thing I want to raise is that this script works on macs (at least intel based ones). Updating the README with this info would probably make this accessible to a lot more people.

To get it working on the mac I had to do was install adb and sha256sum:

# Package for adb
brew install android-platform-tools

# Package for sha256sum
brew install coreutils

OpenWRT note

On another note, at first the process didn't work and I assumed it was because I was using a Mac. Installing linux seemed like a huge chore, but then I realized my router was running OpenWRT and had a USB port.

I was able to install adb on it and run the script. In the end it didn't work on openwrt either, but it turned out to be because the USB cable I was using didn't support data.

I didn't continue trying, but I think the process should work using an openwrt router too.

A lot of people may not have a linux machine or a mac, but some might have openwrt routers and perhaps mentioning that would help some.

Issues encountered

First run failed

The first time I ran the script, it seemed like it worked, but it encountered a few errors.

1. rm: can't remove '/etc/rc.d/S90robotManager': No such file or directory

My vacuum didn't contain this file at all. I think perhaps adb wasn't being killed at all, since it seemed like it worked on first try and disabling the robotManager was not necessary.

2. SSH was installed, but not started

After running the script the first time I tried SSHing into the router, but it didn't work.

So I ran adb shell and got a working shell. So I started dropbear manually and SSH was working. After rebooting it was still working, but I noticed the remaining commands did not succeed.

So I re-ran the script again and then everything completed successfully, including the Valetudo install.

Outdated Valetudo

It looks like the currently installed Valetudo version is about 3 months behind. I re-installed the latest version of Valetudo manually and everything seems to be working very well so far.

Here is the full log:

❯ ./viomi-root.sh
/tmp/viomi-root ~/tmp/viomi-rooting
Starting viomi rooting procedure. Please make sure of the following before starting:
1. Your robot connects to your wifi when booted and your computer is connected to the same network.
2. It is powered off
3. You have a working micro-USB cable plugged into the robot and ready to plug into your computer.

Press [Enter] to continue

We'll now try to connect to the ADB shell. Please connect the USB cable to your computer.
If you hear the Robot voice ('kaichi'), wait another two seconds and unplug and reconnect the cable.
If nothing happens try replugging the USB cable. This may take 10 or more attempts.
adb_shell: 1 file pushed, 0 skipped. 0.1 MB/s (58 bytes in 0.001s)
Shell fixed...
rm: can't remove '/etc/rc.d/S90robotManager': No such file or directory
Please replug the USB cable again. Do not unplug once you hear the sound.
shell_is_ready
Shell is present.
Waiting a bit to allow the robot to connect to wifi.............
Robot IP is 192.168.20.30
--2021-07-15 18:54:34--  https://itooktheredpill.irgendwo.org/static/2020/dropbear_2015.71-2_sunxi.ipk
Resolving itooktheredpill.irgendwo.org (itooktheredpill.irgendwo.org)... 37.187.99.185
Connecting to itooktheredpill.irgendwo.org (itooktheredpill.irgendwo.org)|37.187.99.185|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 81893 (80K) [application/octet-stream]
Saving to: ‘dropbear_2015.71-2_sunxi.ipk’

dropbear_2015.71-2_sunxi.ipk     100%[========================================================>]  79.97K  --.-KB/s    in 0.1s

2021-07-15 18:54:35 (534 KB/s) - ‘dropbear_2015.71-2_sunxi.ipk’ saved [81893/81893]

dropbear_2015.71-2_sunxi.ipk: OK
dropbear_2015.71-2_sunxi.ipk: 1 file pushed, 0 skipped. 178.7 MB/s (81893 bytes in 0.000s)
Installing dropbear (2015.71-2) to root...
Configuring dropbear.
/Users/UserName/.ssh/id_rsa.pub: 1 file pushed, 0 skipped. 1.1 MB/s (415 bytes in 0.000s)
Setting local ssh alias vacuum to root@192.168.20.30.
You can use 'ssh vacuum' to connect to the robot from now on.
SSH was installed.
Please change the root password now. The default one is typically "@3I#sc$RD%xm^2S&".
ssh: connect to host 192.168.20.30 port 22: Connection refused
Restoring robot services.
ssh: connect to host 192.168.20.30 port 22: Connection refused
Your device is now rooted.
ssh: connect to host 192.168.20.30 port 22: Connection refused
Would you like to install Valetudo (open-source cloudless vacuum robot UI)? (y/n) y--2021-07-15 18:54:48--  https://github.com/Hypfer/Valetudo/releases/download/2021.03.0/valetudo-armv7
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://github-releases.githubusercontent.com/140675080/9ed36f00-85ba-11eb-9916-94f76cd3d381?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210715%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210715T145448Z&X-Amz-Expires=300&X-Amz-Signature=3da9cfefcc97bde88b3358fbdc3aa5a9cc1e6d3990ecacc2baf2a2b6dde6e354&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=140675080&response-content-disposition=attachment%3B%20filename%3Dvaletudo-armv7&response-content-type=application%2Foctet-stream [following]
--2021-07-15 18:54:48--  https://github-releases.githubusercontent.com/140675080/9ed36f00-85ba-11eb-9916-94f76cd3d381?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210715%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210715T145448Z&X-Amz-Expires=300&X-Amz-Signature=3da9cfefcc97bde88b3358fbdc3aa5a9cc1e6d3990ecacc2baf2a2b6dde6e354&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=140675080&response-content-disposition=attachment%3B%20filename%3Dvaletudo-armv7&response-content-type=application%2Foctet-stream
Resolving github-releases.githubusercontent.com (github-releases.githubusercontent.com)... 185.199.111.154, 185.199.108.154, 185.199.109.154, ...
Connecting to github-releases.githubusercontent.com (github-releases.githubusercontent.com)|185.199.111.154|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 32291086 (31M) [application/octet-stream]
Saving to: ‘valetudo’

valetudo                         100%[========================================================>]  30.79M  7.79MB/s    in 4.7s

2021-07-15 18:54:53 (6.52 MB/s) - ‘valetudo’ saved [32291086/32291086]

valetudo: OK
ssh: connect to host 192.168.20.30 port 22: Connection refused
lost connection
ssh: connect to host 192.168.20.30 port 22: Connection refused
Pseudo-terminal will not be allocated because stdin is not a terminal.
ssh: connect to host 192.168.20.30 port 22: Connection refused
Robot is restarting, you should be able to reach Valetudo at http://192.168.20.30 once restarted

And the successful 2nd run

❯ ./viomi-root.sh
/tmp/viomi-root ~/tmp/viomi-rooting
Starting viomi rooting procedure. Please make sure of the following before starting:
1. Your robot connects to your wifi when booted and your computer is connected to the same network.
2. It is powered off
3. You have a working micro-USB cable plugged into the robot and ready to plug into your computer.

Press [Enter] to continue

We'll now try to connect to the ADB shell. Please connect the USB cable to your computer.
If you hear the Robot voice ('kaichi'), wait another two seconds and unplug and reconnect the cable.
If nothing happens try replugging the USB cable. This may take 10 or more attempts.
adb_shell: 1 file pushed, 0 skipped. 0.0 MB/s (58 bytes in 0.002s)
Shell fixed...
rm: can't remove '/etc/rc.d/S90robotManager': No such file or directory
Please replug the USB cable again. Do not unplug once you hear the sound.
shell_is_ready
Shell is present.
Waiting a bit to allow the robot to connect to wifi.............
Robot IP is 192.168.20.30
--2021-07-15 19:06:46--  https://itooktheredpill.irgendwo.org/static/2020/dropbear_2015.71-2_sunxi.ipk
Resolving itooktheredpill.irgendwo.org (itooktheredpill.irgendwo.org)... 37.187.99.185
Connecting to itooktheredpill.irgendwo.org (itooktheredpill.irgendwo.org)|37.187.99.185|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 81893 (80K) [application/octet-stream]
Saving to: ‘dropbear_2015.71-2_sunxi.ipk’

dropbear_2015.71-2_sunxi.ipk     100%[========================================================>]  79.97K   518KB/s    in 0.2s

2021-07-15 19:06:47 (518 KB/s) - ‘dropbear_2015.71-2_sunxi.ipk’ saved [81893/81893]

dropbear_2015.71-2_sunxi.ipk: OK
dropbear_2015.71-2_sunxi.ipk: 1 file pushed, 0 skipped. 167.6 MB/s (81893 bytes in 0.000s)
Installing dropbear (2015.71-2) to root...
Configuring dropbear.
Collected errors:
 * resolve_conffiles: Existing conffile /etc/dropbear/dropbear_rsa_host_key is different from the conffile in the new package. The new conffile will be placed at /etc/dropbear/dropbear_rsa_host_key-opkg.
 * resolve_conffiles: Existing conffile /etc/config/dropbear is different from the conffile in the new package. The new conffile will be placed at /etc/config/dropbear-opkg.
/Users/UserName/.ssh/id_rsa.pub: 1 file pushed, 0 skipped. 0.2 MB/s (415 bytes in 0.003s)
Setting local ssh alias vacuum to root@192.168.20.30.
You can use 'ssh vacuum' to connect to the robot from now on.
SSH was installed.
Please change the root password now. The default one is typically "@3I#sc$RD%xm^2S&".
Changing password for root
New password: 

Retype password: 

Password for root changed by root
Restoring robot services.
Your device is now rooted.
sh: can't create /sys/class/gpio/gpio233/value: nonexistent directory
sh: can't create /sys/class/gpio/gpio233/value: nonexistent directory
Would you like to install Valetudo (open-source cloudless vacuum robot UI)? (y/n) y--2021-07-15 19:08:05--  https://github.com/Hypfer/Valetudo/releases/download/2021.03.0/valetudo-armv7
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response...
302 Found
Location: https://github-releases.githubusercontent.com/140675080/9ed36f00-85ba-11eb-9916-94f76cd3d381?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210715%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210715T150805Z&X-Amz-Expires=300&X-Amz-Signature=d5495309beb5477d0623589e671e84e8c1fcb522cc41ea2dce7a09dbdf220b40&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=140675080&response-content-disposition=attachment%3B%20filename%3Dvaletudo-armv7&response-content-type=application%2Foctet-stream [following]
--2021-07-15 19:08:05--  https://github-releases.githubusercontent.com/140675080/9ed36f00-85ba-11eb-9916-94f76cd3d381?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210715%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210715T150805Z&X-Amz-Expires=300&X-Amz-Signature=d5495309beb5477d0623589e671e84e8c1fcb522cc41ea2dce7a09dbdf220b40&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=140675080&response-content-disposition=attachment%3B%20filename%3Dvaletudo-armv7&response-content-type=application%2Foctet-stream
Resolving github-releases.githubusercontent.com (github-releases.githubusercontent.com)... 185.199.111.154, 185.199.108.154, 185.199.109.154, ...
Connecting to github-releases.githubusercontent.com (github-releases.githubusercontent.com)|185.199.111.154|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 32291086 (31M) [application/octet-stream]
Saving to: ‘valetudo’

valetudo                         100%[========================================================>]  30.79M  9.35MB/s    in 3.3s

2021-07-15 19:08:09 (9.35 MB/s) - ‘valetudo’ saved [32291086/32291086]

valetudo: OK
valetudo                                                                                        100%   31MB   1.2MB/s   00:25
Pseudo-terminal will not be allocated because stdin is not a terminal.
 _____  _              __     _
|_   _||_| ___  _ _   |  |   |_| ___  _ _  _ _
  | |   _ |   ||   |  |  |__ | ||   || | ||_'_|
  | |  | || | || _ |  |_____||_||_|_||___||_,_|
  |_|  |_||_|_||_|_|  Tina is Based on OpenWrt!
 ----------------------------------------------
 Tina Linux (Neptune, 57513AA3)
 ----------------------------------------------
Robot is restarting, you should be able to reach Valetudo at http://192.168.20.30 once restarted

[DevaquaApp]

Hello,
Here are the problems encountered on my side:

• Do not try to rename the rsa file (just enter press)
  otherwise there may be problems with ssh authentication afterwards.
  On mac, run the ssh keygen command before executing the script.

Thank you very much for your comment it helped me a lot.

[mkozinenko]

Lucky you. Trying all the day with no luck. The only thing I was able to find so far is AppleUSBHostUserClient::start: missing entitlement com.apple.appledfr.client in dmesg on device connecting. What's your MacOS version? Any additional setup? My guess is that may be caused with the fact I'm using some cheap hub for my MBP to connect USB typeA to macbook's typeC port and something is wrong with either data or power in my case.

[infused-kim]

I had that message too and it still worked. Try using a different USB cable. It seems like your cable doesn't support data.

I had exactly the same issue until I tried a different cable.

[mkozinenko]

Thank you! Will try. One additional question - did you manage to find USB-C to micro-USB cable our was using some USB-C hub? I'm trying with the hub.

[infused-kim]

I used Apple's usb-c dongle that has an HDMI and USB port. I think the hub shouldn't matter. The cable itself is important.

[mkozinenko]

Thank you for the answer. I actually tried like 4 cables (2 bought recently, specifically "sync/data" cables, 4 wires - checked). Device appears on the device list for like 2 seconds (which is not possible if it's charging only cable I guess), then disconnects and robot boots up. Trying to understand the root cause. Will update you if I will find it out.

[infused-kim]

The device showing up for 2 seconds only is the expected behavior I think.

The reason the vacuum is rootable is because Xiaomi didn’t disable the ADB console completely. They just kill it after booting, but if you are able to run the commands fast enough you can gain permanent root.

That’s why the script has the infinite loop sending the command.

Check out the original blog post explaining the rooting process and try running the commands manually:
https://itooktheredpill.irgendwo.org/2020/rooting-xiaomi-vacuum-robot/

[mkozinenko]

I understand the process. And it looks like it just don't give enough time to do anything with adb. Of course, I tried manually, no luck. adb devices shows no devices, I cannot do adb shell. I was trying to use Ubuntu, two different Mac laptops - all the same. Linux shows that device is connected, displays its idVendor and idProduct and then shows it's disconnected. Both Macs are also showing the same (connected and then disconnect in a second or so). I did a full disassembling of my robot today just to check if it doesn't have any other USB ports etc - it doesn't have it. Continuing to investigate. Two cables I used are tested - they work fine with Android phone. I'd say I must be just unlucky or maybe they changed something recently (I've bought my vacuum like 1,5 months ago) :) btw also tried to play with udev on Ubuntu, all the possible options like disable MTP (and checks) etc. Still doesn't work. It looks like it's an issue on vacuum side for me. Awesome hobby anyways :)))

[midicape]

@mkozinenko @infused-kim is/was the ADB device displayed under dmesg?
I also use v8 with 3.5.3_0017 and like @mkozinenko still struggle to root the device. dmesg does not say anything about adb. lsusb detects Allwinner Technology sunxi SoC OTG connector in FEL/flashing mode so it should be possible :D

[rumpeltux]

@infused-kim Thanks for your report. I updated the README.
#25 should also have improved some of the issues you were encountering.
We’ll also need to incorporate the new findings from @Dropaq in rumpeltux/python-miio#1 (comment) like not trying to remove the S90robotManager for v8 models.