dgiese / dustcloud Goto Github PK
View Code? Open in Web Editor NEWXiaomi Smart Home Device Reverse Engineering and Hacking
License: GNU General Public License v3.0
Xiaomi Smart Home Device Reverse Engineering and Hacking
License: GNU General Public License v3.0
Just out of curiosity...
Can anyone comment if the dustcloud still applicable, whom updated their 1st gen Mi robot to firmware version 3.3.9_003194
I have not been following the discussion actively for some time, not sure if they changed the password/the-hacking-method used by dustcloud.
Someone on robotreviews claims they can see Zone Cleaning in latest version of 1st Gen robot;
http://www.robotreviews.com/chat/viewtopic.php?f=6&t=19479&p=147465#p147465
Hello guys,
one question: how to grab a new v2-image? Do i have to connect the vacuum geb2 with the 001168-image first to the dustcloud and can grab a new update via dustcloud?
New-Image 001228 available on china-mainland!
Many thx in advance!
flake8 testing of https://github.com/dgiese/dustcloud
$ flake8 . --count --select=E901,E999,F821,F822,F823 --show-source --statistics
./dustcloud/server.py:531:5: F821 undefined name 'process_data'
process_data(socket,data)
^
https://github.com/dgiese/dustcloud/blob/master/dustcloud/server.py#L119 is the definition of process_data() as a member of the class CloudClient so it must be called as in https://github.com/dgiese/dustcloud/blob/master/dustcloud/server.py#L456 not as in https://github.com/dgiese/dustcloud/blob/master/dustcloud/server.py#L531
hi,
are you planning to support
the active https://github.com/rytilahti/python-miio
project instead of the old https://github.com/ultrara1n/python-mirobo old version?
or does it just work?
There is an erorr with your install commands file.
The error was PHP Fatal error: Uncaught Error: Class 'MySQLi' not found in /var/www/html/dustcloud/index.php:20\nStack trace:\n#0 {main}\n thrown in /var/www/html/dustcloud/index.php on line 20
It could be fixed with adding php5-mysqlnd to apt-get install apache2 php5 php5-mysqlnd mysql-server python3 python3-pip git
sometimes there is an additional character at the end of json string. Is there a possibility to cut this before parsing? I think this was the post for the map.
unable to parse json '{"id":19017xx,"result":["https://awsbj0.fds.api.xiaomi.com/robomap/robomap%2F ..... &Signature=xxxx="]}i': Extra data: line 1 column 668 (char 667)
Headertime 2018-02-19 22:16:55
Localtime 2018-02-19 22:16:54.576622
----------------------------------------
Exception happened during processing of request from ('192.168.x.x', 51066)
Traceback (most recent call last):
File "/usr/local/lib/python3.5/socketserver.py", line 625, in process_request_thread
self.finish_request(request, client_address)
File "/usr/local/lib/python3.5/socketserver.py", line 354, in finish_request
self.RequestHandlerClass(request, client_address, self)
File "/usr/local/lib/python3.5/socketserver.py", line 681, in __init__
self.handle()
File "/var/www/html/server.py", line 396, in handle
self.on_read_cloud()
File "/var/www/html/server.py", line 448, in on_read_cloud
process_result = self.Cloudi.process_cloud_data(self, data)
File "/var/www/html/server.py", line 305, in process_cloud_data
method = m.data.value.get("method", "NONE")
AttributeError: 'NoneType' object has no attribute 'get'
I'm getting TypeError: build() takes 2 positional arguments but 3 were given when trying to follow the instructions from the UPDATE-howto
mirobo --ip=192.168.8.1 --token=TOKEN raw_command miIO.ota '{"mode":"normal", "install":"1", "app_url":"http://192.168.8
.61/v11_003094.pkg", "file_md5":"a086f93a4cafdd3714163f940740783f", "proc":"dnld install"}'
Sending cmd miIO.ota with params {'mode': 'normal', 'install': '1', 'app_url': 'http://192.168.8.61/v11_003094.pkg', 'file_md5': 'a086f93a4cafdd37141
63f940740783f', 'proc': 'dnld install'}
Traceback (most recent call last):
File "/usr/bin/mirobo", line 11, in
load_entry_point('python-miio==0.3.4', 'console_scripts', 'mirobo')()
File "/usr/lib/python3.6/site-packages/click/core.py", line 722, in call
return self.main(*args, **kwargs)
File "/usr/lib/python3.6/site-packages/click/core.py", line 697, in main
rv = self.invoke(ctx)
File "/usr/lib/python3.6/site-packages/click/core.py", line 1066, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
File "/usr/lib/python3.6/site-packages/click/core.py", line 895, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "/usr/lib/python3.6/site-packages/click/core.py", line 535, in invoke
return callback(*args, **kwargs)
File "/usr/lib/python3.6/site-packages/click/decorators.py", line 64, in new_func
return ctx.invoke(f, obj, *args[1:], **kwargs)
File "/usr/lib/python3.6/site-packages/click/core.py", line 535, in invoke
return callback(*args, **kwargs)
File "/usr/lib/python3.6/site-packages/miio/vacuum_cli.py", line 517, in raw_command
click.echo(vac.raw_command(cmd, params))
File "/usr/lib/python3.6/site-packages/miio/vacuum.py", line 270, in raw_command
return self.send(cmd, params)
File "/usr/lib/python3.6/site-packages/miio/device.py", line 216, in send
m = Message.build(msg, ctx)
TypeError: build() takes 2 positional arguments but 3 were given
The flasher.py script gives me the same error:
python flasher.py -a 192.168.8.1 -t TOKEN -f v11_003094.pkg
Flasher for Xiaomi Vacuum
Connecting to device 192.168.8.1...
error while checking device: build() takes 2 positional arguments but 3 were given
I uploaded the latest English pkg with the 003194 firmware to my v1 robot. Everything works fine, except that the voices for goto and zone cleaning are still in Chinese. Assuming that this works on the v2 robot (I haven't seen any complaints about it), then I think that the voice ids for these functions on v1 is different from the v2.
The following two files seem to be duplicated, which makes them hard to maintain or keep in sync. Can one of them be removed? Maybe the wiki could link to the version-controlled file.
https://github.com/dgiese/dustcloud/blob/master/devices/xiaomi.vacuum/UPDATE-howto.md
https://github.com/dgiese/dustcloud/wiki/VacuumRobots-manual-update-root-Howto
Iam intrested to change the announcements ("Dustbin removed" etc.) with custom sounds.
Yet i have not found the right settings to export my wav files to be playable on the device.
Does someone have working settings which are either universal across programms or applicable for audacity or ffmpeg?
Hi,
I've just wanted to update my robot using the new automated tools which were developed over the last months. However, if I check the wiki page which points to the instructions I see only a broken link:
https://github.com/dgiese/dustcloud/blob/master/devices/xiaomi.vacuum/UPDATE-howto.md
That file isn't part of the repo anymore.
This page contains a hint to look into the subfolders:
https://github.com/dgiese/dustcloud/wiki/VacuumRobots-manual-update-root-Howto
However, that is quite vague. I've searched the repo now for any hints on the mentioned tools but I do not see them. Please add the missing file again and point users to the right place without the need to check all folders for any hints :)
Thank you for your speak yesterday at 34c3! You did tremendous work! Your efforts will affect many other projects in a positive way.
Something that was not completely clear to me was the point you talked about "data" that is uploaded to the xiaomi servers. In your slide data consists log files and this logfiles in turn contain credentials.
I'am referring to this slide:
Do the xiaomi servers grab get credentials?
Hi!
With SSH opened up, I think one of those should be done (sorted by my preference):
I just noticed we don't have any license for the audio generator script and language files (at least as far as I can see). I guess we better fix this now than later. I would suggest GPLv3 for the script and something open like the CC0 for the actual translations.
Obviously we need every contributor to agree:
generate_audio.py
:
audio_ca.csv
:
audio_de.csv
:
audio_en.csv
:
audio_es.csv
audio_pl.csv
What are your thoughts about this?
Hello,
Will I find somewhere a list of voice messages for xiaomi vacuum 2 generation? I would like to create a new language for Vacuum Generation 2 with the help of Audio Generator.
Thank you
Rafal
Great work! I guess now it is also possible to extend the functionality of the "old" robot? I think there, for example to the subdivision of the floor plan of an apartment into individual rooms. This would have the advantage that you do not have to stick the ugly adhesive strips ("Virtual walls") on the floor and no longer has to drag the robot into the individual rooms.
It would be great if you could just call the robot into the living room if you need it right there.
The successor of the robot has afaik such a function, I suspect this will also be exclusive for this.
The installation of dustcloud cloud be simpler if there is a docker image. Since docker has support for armhf this cloud run on the raspberry. Is anybody done any work in this direction?
Hi. Great job. I have a question about the symmetric key to encrypt traffic with the cloud.
This key is unique for each cleaner?
As the cloud knows which key is the encryption?
Really in the cloud has keys for each of the cleaner that went on sale?
Is it possible to identify the encryption key to other devices xiaomi such as light bulbs, sockets, humidifiers, etc.?
With root access it should be possible to let the vacuum analyse and crack wifi networks, but it depends if the wifi chip is capable of packet injection
There could also be modes like:
Hi,
I'd love to play around a little bit more with the firmware, maybe extracting the robot services into a Docker containers etc. so that I could easily update the unterlying Ubuntu to a more recent version.
But I'm afraid that somehow I'm going to brick the device and will have no way to login anymore. Has anyone found another way to get a root shell on the device except for the unlocked SSH login over Wifi? I own the Roborock S50 and have seen in your photos that there is also a USB port hidden under some covers. Can that one be used to get a shell somehow? (Maybe after enabling it via some bootloader flags?) If not, are there functional UART pins on the mainboard that are accessible without completely tearing apart the device?
Hi,
thanks a lot for your work! Very well done!
How do I choose the right firmware from your repo? Does it have to be the same as already installed on the robo? Or can I choose just one of them? And what's the difference between the images? Do they just differ in different ubuntu-packages?
If I have to use the same firmware as already installed, is there a way to get the version without using the app?
Cheers!
I came across this link via http://www.robotreviews.com/chat/viewtopic.php?f=6&t=19479&start=780
therefore i didnt attend the session, merely trying to get an understanding on how one builds a firmware with the .sh script and most importantly how one can carry the actuall rooting to the robot. I know of the micro USB port an Mi App. Assuming there is a certain process involved with micro usb port?
I have downloaded the repository but cant seem to find the instructions on how to apply the built firmware to the Mi vacuum v1.
When i take a quick look at the imagebuilder.sh i see the "authorized_keys" file, is this something generated or extracted from somewhere as I cant seem to locate the file.
Would you kindly share, or better include it as part of the repository, on how to use these tools and carry the actual rooting and fallback to original firmware (if things go wrong)?
thanks for the excellent work and sharing with the community!
Just as a quick info: You can use chroot and qemu to work with the image. E.g. for software development. This way you won't suffer from the small storage. Obviously there is some performance hit, since the processor emulation.
cp $(which qemu-arm-static) rootfs/usr/bin
cp /etc/resolv.conf rootfs/etc/resolv.conf
mount -t proc proc proc/
mount -t sysfs sys sys/
mount -o bind /dev dev/
chroot /mnt qemu-arm-static /bin/bash
I also had to remove the ppa from /etc/apt/sources.list
, since some packages were missing.
Is there a way to download latest firmware without risking installing it on the device?
When running my server.py
via # sudo ./server.sh
I get the following error:
---------Process Thread-id: 140576315725568
ddid = <mydid>, dname = rockrobo, denckey = <mykey>, full_cloud_forward = 0, forward_to_cloud = 0
----------------------------------------
Exception happened during processing of request from ('<robo-ip>', 45572)
Traceback (most recent call last):
File "/usr/lib/python3.5/socketserver.py", line 625, in process_request_thread
self.finish_request(request, client_address)
File "/usr/lib/python3.5/socketserver.py", line 354, in finish_request
self.RequestHandlerClass(request, client_address, self)
File "/usr/lib/python3.5/socketserver.py", line 681, in __init__
self.handle()
File "/home/login/dustcloud/dustcloud/server.py", line 379, in handle
self.on_read()
File "/home/login/dustcloud/dustcloud/server.py", line 454, in on_read
process_result = self.Cloudi.process_data(self,data)
File "/home/login/dustcloud/dustcloud/server.py", line 166, in process_data
m = Message.parse(data, ctx)
TypeError: parse() takes 2 positional arguments but 3 were given
----------------------------------------
According to miio.log
the robo tries to connect to my dustcloud.
Any ideas?
Thanks in advance!
Looks like SQL injection may be possible in show.php
.
$did = $_GET['did'];
...
$res = $mysqli->query("SELECT * FROM statuslog WHERE did = '".$did."' and direction = 'from_client' ORDER by timestamp DESC");
also
$res = $mysqli->query("SELECT * FROM ota WHERE model = '".$model."'");
I have not used PHP in a very long time, but maybe prepared statements would be a better idea?
EDIT: another one in showcmdlog.php
$res = $mysqli->query("SELECT * FROM devices WHERE did = '".$_GET["did"]."'");
$res = $mysqli->query("SELECT * FROM cmdqueue WHERE did = '".$_GET["did"]."' ORDER BY CMDID DESC LIMIT 100");
EDIT2: and in showlog.php
$res = $mysqli->query("SELECT * FROM devices WHERE did = '".$_GET["did"]."'");
if ($longlog == 1)
{
$res = $mysqli->query("SELECT * FROM statuslog WHERE did = '".$_GET["did"]."' ORDER by id DESC LIMIT 2000");
}else
{
$res = $mysqli->query("SELECT * FROM statuslog WHERE did = '".$_GET["did"]."' ORDER by id DESC LIMIT 100");
}
Hi,
how can i change the sound files without a complete re-flash? is there an miIO.ota command?
thx
I'd like to make use of custom kernel modules. Has anyone managed to cross compile working modules.
That's my try so far, but I am not able to load the modules
https://github.com/simonswine/rockrobo-kernel/commits/master
root@raspberrypi:/home/pi/dustcloud/dustcloud# bash server.sh
Traceback (most recent call last):
File "/dustcloud/server.py", line 33, in
from build_map import build_map
ImportError: No module named 'build_map'
I'm not able to start the server.
I'm having trouble installing a rooted firmware on my vacuum. I have generated a custom firmware from v11_003094 downloaded from here: https://dustcloud.seemoo.de/public/xiaomi.vacuum.gen1/original/encrypted/
I'm using this soundpack: https://github.com/dgiese/dustcloud/tree/master/xiaomi.vacuum.gen1/original-soundpackages/encrypted
When installing the firmware using ./flasher.py -a <ip> -t <token> -f output/v11_003094.pkg
(but with actual ip and token), it downloads the image successfully, but fails when installing it a few minutes later with the error message: "couldn't upgrade firmware, switching to previous version".
Log from imagebuilder.sh
Running on a Mac, adjusting commands accordingly
Generate SSH Host Keys
Generating public/private rsa key pair.
Your identification has been saved in ssh_host_rsa_key.
Your public key has been saved in ssh_host_rsa_key.pub.
The key fingerprint is:
SHA256:vupJ+R1Yxf5h1vLpez/0TlrhN4j975JJUT4ablLPDJQ [email protected]
The key's randomart image is:
+---[RSA 2048]----+
| . |
| . E .|
| + o |
| o +.o.|
| S . + %oo|
| o o .oB+Oo|
| o o ..o+o**|
| . o o . *==|
| .+.o . .B@|
+----[SHA256]-----+
Generating public/private dsa key pair.
Your identification has been saved in ssh_host_dsa_key.
Your public key has been saved in ssh_host_dsa_key.pub.
The key fingerprint is:
SHA256:W4my7GpZKS9bd7HhU5r12azfeblotxS2L0xvaT2vSTk [email protected]
The key's randomart image is:
+---[DSA 1024]----+
| |
| |
| |
| . . |
| ..S = o o |
| ..oo + O .o=o|
| =+ o B oE+*|
| +o.. . . o=XO|
| .o+. ..*O@|
+----[SHA256]-----+
Generating public/private ecdsa key pair.
Your identification has been saved in ssh_host_ecdsa_key.
Your public key has been saved in ssh_host_ecdsa_key.pub.
The key fingerprint is:
SHA256:0R5aXROrbZM1DT/+H2osvkK0nOxsIgyLQFr5VSKe9ag [email protected]
The key's randomart image is:
+---[ECDSA 256]---+
| =. |
| . o .. . . =.|
| o + =. + . .o+|
| .o o o .* . o.oo|
|o. . o S + . =. |
|o .E * . ..|
|. . + + . ..|
| . . o . = . o. o|
| . o oo+. .|
+----[SHA256]-----+
Generating public/private ed25519 key pair.
Your identification has been saved in ssh_host_ed25519_key.
Your public key has been saved in ssh_host_ed25519_key.pub.
The key fingerprint is:
SHA256:m/qIZBK+6oK3QyJlWN4SInv96WyxoFfkke2oJpFQ0ig [email protected]
The key's randomart image is:
+--[ED25519 256]--+
| o |
|E = |
|oO + o |
|+ * o + . |
| =.o + =S |
|o.+.. B .o |
|ooooo* oo |
|o ==+.=o |
|++o*..o.. |
+----[SHA256]-----+
decrypt soundfile
ccrypt: /Users/robin/git/dustcloud/xiaomi.vacuum.gen1/firmwarebuilder/english.pkg: key does not match -- unchanged
unpack soundfile
decrypt firmware
ccrypt: /Users/robin/git/dustcloud/xiaomi.vacuum.gen1/firmwarebuilder/v11_003094.pkg: key does not match -- unchanged
unpack firmware
fuse-ext2: version:'0.0.7', fuse_version:'27' [main (../../fuse-ext2/fuse-ext2.c:324)]
fuse-ext2: enter [do_probe (../../fuse-ext2/do_probe.c:30)]
fuse-ext2: leave [do_probe (../../fuse-ext2/do_probe.c:55)]
fuse-ext2: opts.device: /Users/robin/git/dustcloud/xiaomi.vacuum.gen1/firmwarebuilder/disk.img [main (../../fuse-ext2/fuse-ext2.c:351)]
fuse-ext2: opts.mnt_point: image [main (../../fuse-ext2/fuse-ext2.c:352)]
fuse-ext2: opts.volname: rootfs [main (../../fuse-ext2/fuse-ext2.c:353)]
fuse-ext2: opts.options: rw+ [main (../../fuse-ext2/fuse-ext2.c:354)]
fuse-ext2: parsed_options: rw,allow_other,local,noappledouble,fsname=/Users/robin/git/dustcloud/xiaomi.vacuum.gen1/firmwarebuilder/disk.img,fstypename=ext2,volname=rootfs [main (../../fuse-ext2/fuse-ext2.c:355)]
fuse-ext2: mounting read-write [main (../../fuse-ext2/fuse-ext2.c:369)]
patch ssh host keys
disable SSH firewall rule
integrate SSH authorized_keys
reconfiguring network traffic to xiaomi
pack new firmware
encrypt firmware
MD5 (output/v11_003132.pkg) = b53cbee500c817adb2a4fb4d5f6bb3cf
Output from flasher.py
:
./flasher.py -a <ip> -t <token> -f output/v11_003094.pkg
Flasher for Xiaomi Vacuum
Connecting to device <ip>...
Got error when receiving: timed out
Retrying with incremented id, retries left: 3
Starting local http server...
Serving http server at <local-ip>:57104
Sending ota command with parameters: {"mode": "normal", "file_md5": "b53cbee500c817adb2a4fb4d5f6bb3cf", "install": "1", "app_url": "http://192.168.1.182:57104/output/v11_003094.pkg", "proc": "dnld install"}
Ota started!
192.168.1.83 - - [01/Feb/2018 00:42:37] "GET /output/v11_003132.pkg HTTP/1.1" 200 -
Firmware downloaded successfully.
Exiting.
Hi everyone,
after having struggled to build the image on the mac, I've succeeded and I'm at the point where I want to discover the bot. However, I fail to get the result:
(dustcloud-m69SZaQf) bash-3.2$ mirobo discover --handshake true
INFO:miio.device:Sending discovery to <broadcast> with timeout of 5s..
WARNING:miio.device:error while reading discover results: 'utf-8' codec can't decode byte 0xdb in position 1: invalid continuation byte
My system is latest High Sierra with python/pip installed via brew. LC_ALL and LANG are set to en_US.UTF-8 and exported.
(dustcloud-m69SZaQf) bash-3.2$ uname -a
Darwin mac 17.4.0 Darwin Kernel Version 17.4.0: Sun Dec 17 09:19:54 PST 2017; root:xnu-4570.41.2~1/RELEASE_X86_64 x86_64
(dustcloud-m69SZaQf) bash-3.2$ pip --version
pip 9.0.1 from /Users/user/.local/share/virtualenvs/dustcloud-m69SZaQf/lib/python3.6/site-packages (python 3.6)
(dustcloud-m69SZaQf) bash-3.2$ python --version
Python 3.6.4
Any thoughts on debugging/fixing this?
Best
Hendrik
I prepared a docker container which builds the custom firmware. Now I wonder if running flasher.py inside the container will work concerning communicating with the robot. I'm no python programmer so I'm not sure how to interpret the code. The script would need to get the Docker host IP and passing an optional port to the script would also be cool.
Hi,
I was waiting for something like this for some time (because proprietary vacuums either suck (no pun intended) or are very expensive as was mentioned in the 34c3 talk), thank you.
However, there is a lot of stuff to do and this issue tracker is not the best communication medium for all aspects... this I would like to propose some other means like a mailing list and/or IRC channel and making that visible in the readme. FWIW, I just joined #dustcloud on freenode's IRC but apparently I was having that idea first... :)
Seems that the cleaning records are kept nicely in a sqlite database (/mnt/data/rockrobo/robot.db)
Besides all the cleaning records, the database also seems to contain the maps.
However, the file format is different than the ppm files found on the device.
Have you already looked into / been able to understand the format of these blobs in the database?
BTW. Thanks for the great work.... lots of fun..
Any ideas about extending internal storage?
Can usb port be utilized for connecting pen drive?
Current situation is sad enough:
root@rockrobo:~# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/root 494M 380M 89M 82% /
devtmpfs 202M 4.0K 202M 1% /dev
none 4.0K 0 4.0K 0% /sys/fs/cgroup
tmpfs 30M 4.0K 30M 1% /tmp
none 50M 236K 50M 1% /run
none 5.0M 0 5.0M 0% /run/lock
tmpfs 100M 8.5M 92M 9% /run/shm
none 100M 0 100M 0% /run/user
/dev/mmcblk0p11 16M 2.0M 13M 14% /mnt/reserve
/dev/mmcblk0p1 1.6G 332M 1.2G 22% /mnt/data
/dev/mmcblk0p6 16M 1.2M 14M 8% /mnt/default
/dev/mmcblk0p10 494M 221M 248M 48% /mnt/updbuf
Please check line 43+44 in (all?) csv files
43 remote_complete.wav Use remote control.
44 remote.wav Use of the remote control completed.
Text 43 is for line 44 and vice versa
Can I use the robot in a separated WiFi without internet?
I just installed a rooted v11_003077.pkg
firmware on my new and never used robot. After this I could get status infos etc. via mirobo
. To avoid the open WiFi I connected the robot to my newly created seperated wifi by executing
mirobo --ip=192.168.8.1 --token=#my_token# configure_wifi #SSID# #password#
and then I was able to connect to the robot via SSH using the separated network. To get the new token I executed:
printf $(cat /mnt/data/miio/device.token) | xxd -p
For some reason all mirobo commands fail now. E.g. the command
mirobo --ip=192.168.4.199 --token=#new_token# status
just returns Unable to discover the device 192.168.4.199
. I tried to check if the robot receives anything with tcpdump port 54321 -v
and according to the output
tcpdump: listening on wlan0, link-type EN10MB (Ethernet), capture size 65535 bytes
01:53:53.288888 IP (tos 0x0, ttl 64, id 10468, offset 0, flags [DF], proto UDP (17), length 60)
192.168.4.196.46105 > 192.168.4.199.54321: UDP, length 32
01:54:03.842597 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 60)
192.168.4.199.54321 > 192.168.4.196.46105: UDP, length 32
the robot receives packages. Any ideas what is missing to communicate locally with the robot?
Has anybody figured out how to control the (rooted) robot 'locally'?
For example: you are logged in with ssh and can query the actual status or start the cleaning.
I would like to query the actual status and report it to my home automation if the status changes.
I know I can qery the status from remote with mirobo. But network-polling every few minutes to get data, that changes only every few days, seems not to be very smart..
Although there is this enable_cors-function in server.py, my browser won't show the actual map because:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://dustcloud.****:1121/get_map?did=64****. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
Did I do something wrong? Or any idea, how I could fix this?
Edit - Some more information
When trying to open above page in a browser, it results in 404.
I'm running server.py with ./server.sh -sport 8080
and the command-server is defined as http://dustcloud.****:1121
in config.php
Hey guys. Was curious if porting Support for GH or Echo devices would be possible after rooting.
I figure it should. Since all you have to do is send a signal to the device via the Internet to start cleaning...
Anyone smarter than me able to tell me about this?
If I understand correctly, once provisioned, the device sends some packet containing JSON ciphered with a static device-specific AES key.
What ciphering suite is being used ? EBC ? CTR ?
Because if it's any of those 2, then it can be possible to figure out the key by monitoring the WIFI's network traffic.
Technically, the ciphered packet's bytes are pkt(i) = msg(i) XOR transformedKey(i)
and since msg(i)
is {
for i == 0
, and }
for i == msg.length-1
, then you can figure out the transformedKey(i)
byte-by-byte while sending packets of different size (for example, by changing the SSID length on your WIFI router)
So the step by step guide would be:
transformedKey(0)
and transformedKey(msg.length -1)
from the equation abovetransformedKey(msg.length - 1)
for the next byte of the AES keyAs a side remark, since first JSON is produced by the same software, it's possible to guess more than one byte at a time, since the first part of the message will be the same {"id":
.
Obviously, this fails if the AES key changes (which, I don't think it does as I understand it), or if the IV used is based on some random event (but, if it's based on NTP time, it's completely hackable too).
Can someone confirm the ciphering scheme used ?
Would suggest changing Line 16 to reflect correct speling of "my_cloudserver_i_p" variable, to make searching possible.
Line 16: # TODO: change myCloudserverIP to your CloudserverIP (the IP where this script is running)
Line 181: my_cloudserver_i_p = "10.0.0.1"
Hi,
I created a docker image for Raspberry Pi and x64 computers
https://github.com/JackGruber/docker_dustcloud
Regards
Alex
Did someone try to update the robot using apt update && apt upgrade
? Or even upgrade to Ubuntu 16.04? Is it risky?
Hello everyone,
I found a really nice testing application on the robot, which has a lot of funny options. You can find it under: /opt/rockrobo/firmware/uart_test
It allows the following:
root@rockrobo:/mnt/data/rockrobo/sounds# uart_test-3.2.1-20170620 -h
[ 3358027]<N>uart_test-3.2.1-20170620 VERSION:3.2.1
[ 3358028]<N>Usage:
[ 3358028]<N>Options:
[ 3358028]<N> -v <v1> <v2> <v3> linespeed,angular velocity,linespeed when a turn
[ 3358028]<N> -f <speed> set fan speed 0~100
[ 3358028]<N> -b <speed> set brush speed 0~100
[ 3358028]<N> -s <speed> set sweep speed 0~100
[ 3358028]<N> -e <wav_file> play sound
[ 3358028]<N> -g get mcu status
[ 3358028]<N> -m <nisfb> set mcu into the mode
[ 3358028]<N> n set mcu into nomal mode (default)
[ 3358029]<N> i set mcu into idle mode
[ 3358029]<N> s set mcu into shutdown mode
[ 3358029]<N> r set mcu reset
[ 3358029]<N> -p <adinweclg> print mcu debug log
[ 3358029]<N> a print info and above log
[ 3358029]<N> d print debug and above log
[ 3358029]<N> i print info and above log
[ 3358029]<N> n print notice and above log
[ 3358029]<N> w print Warning and above log
[ 3358029]<N> e print erro and above log
[ 3358029]<N> c print crit and above log
[ 3358030]<N> l print alert and above log
[ 3358030]<N> g print emerg log
[ 3358030]<N> s print uart raw data
[ 3358030]<N> -u <mcu_firmware> upgrade_mcu fw
[ 3358030]<N> -U Auto Upgrade Mcu
[ 3358030]<N> -l test led command
[ 3358030]<N> -t <abcd...z> test case for debug
[ 3358030]<N> AT command facotory or bit command
[ 3358030]<N> -d <abcd...z> debug the report result from mcu
[ 3358030]<N> a print all mcu status
[ 3358030]<N> d print dock vol if mcu report
[ 3358030]<N> s print all switch status(bumper,drop,dock,bat_info,key,dustin)
[ 3358031]<N> c print wheel current
[ 3358031]<N> l print acc_gyro_quat_odo_time
[ 3358031]<N> w print wall
[ 3358031]<N> u print ultra
[ 3358031]<N> t print mcu ts offset
[ 3358031]<N> -w <lds_spd> set lds spd(200~400)
[ 3358031]<N> -r test random
[ 3358031]<Help>
support key contrl when test move runtime:
[ 3358031]<Help> h print help
[ 3358031]<Help> w go front
[ 3358032]<Help> s go back
[ 3358032]<Help> a turn left
[ 3358032]<Help> d trun right
[ 3358032]<Help> z force stop move
[ 3358032]<Help> x force/normal mode
[ 3358032]<Help> UP force go front
[ 3358032]<Help> LEFT force turn left
[ 3358032]<Help> RIGHT force turn rigth
[ 3358032]<Help> DOWN force go back
[ 3358032]<Help> b disable/enable mcu_heartbeat
[ 3358033]<Help> f start fan sweep and brush
[ 3358033]<Help> t start fan,set sweep and brush inversion
[ 3358033]<Help> g stop fan sweep and brush
[ 3358033]<Help> o open all switch
[ 3358033]<Help> c close all switch
[ 3358033]<Help> e set mcu print debug log
[ 3358033]<Help> l set mcu disable/enable charging
[ 3358033]<Help>
[ 3358033]<N>
support key contrl to get mcu status:
[ 3358033]<N> h print help info
[ 3358034]<N> a print dustin status
[ 3358034]<N> b print bumper status
[ 3358034]<N> c print cliff status
[ 3358034]<N> d print dock status
[ 3358034]<N> e print drop status
[ 3358034]<N> f print fan info
[ 3358034]<N> i print TestInfo status
[ 3358034]<N> j print CaliInfo
[ 3358034]<N> k print secret code
[ 3358034]<N> l print wheel info
[ 3358034]<N> m print main brush info
[ 3358035]<N> n print SN and PN
[ 3358035]<N> o print odo and gyro status
[ 3358035]<N> p print power status
[ 3358035]<N> r print Dev Info
[ 3358035]<N> s print sweep info
[ 3358035]<N> t print mcu ts offset
[ 3358035]<N> u print ultra distance
[ 3358035]<N> v print mcu version and sys_mode
[ 3358035]<N> w print wall distance
[ 3358035]<N> x print bootloader Version
[ 3358035]<N> z print mcu RTC
[ 3358036]<N> Z set cur ap time to mcu RTC
[ 3358036]<Help>
support key contrl when test led runtime:
[ 3358036]<Help> h print help info
[ 3358036]<Help> l change led light level
[ 3358036]<Help> s sent led command
[ 3358036]<Help> c change set mode(cur or rstr)
[ 3358036]<Help>
[ 3358036]<Help> n none
[ 3358036]<Help> r red color
[ 3358036]<Help> o orange color
[ 3358037]<Help> w white color
[ 3358037]<Help>
[ 3358037]<Help> 1 turn on
[ 3358037]<Help> 2 turn off
[ 3358037]<Help> 3 blink
[ 3358037]<Help> 4 fastblink
[ 3358037]<Help> 5 breath
[ 3358037]<Help> 6 deepbreath
[ 3358037]<Help>
[ 3358037]<Help> 0 set repeat = 0
[ 3358037]<Help> 8 set repeat = 4
[ 3358038]<Help> 9 set repeat = -1
[ 3358038]<Help>
hi,
rooting my vacuum worked fine, but of course my previously used token to remote control it using python-miio was replaced by a random new one. the new created token is no longer valid though after having joined my iot network, so I wonder if anybody already found out where it could be extracted/generated directly on the rockrobo system, so controlling the vacuum via python-miio works again. already searched for it but haven't found anything that looks like a 32 byte token yet anywhere.
As seen in the presentation, you were able to use playerv or playernav to get the map data. When i request map:0 using playerv I'm only getting timeouts, requesting laser:3 works fine. What am i doing wrong? How did you get that data?
After setting up a dustcloud, I receive the following error when my robot tries to connect:
---------Process Thread-id: 1978647664
ddid = 64647090, dname = saugobot, denckey = rnM5ZY6eVbQGcRJ2, full_cloud_forward = 0, forward_to_cloud = 0
(!!!) Warning, did missmatch: 0 != 64647090
----------------------------------------
Exception happened during processing of request from ('10.168.1.61', 34254)
Traceback (most recent call last):
File "/usr/lib/python3.5/socketserver.py", line 625, in process_request_thread
self.finish_request(request, client_address)
File "/usr/lib/python3.5/socketserver.py", line 354, in finish_request
self.RequestHandlerClass(request, client_address, self)
File "/usr/lib/python3.5/socketserver.py", line 681, in __init__
self.handle()
File "server.py", line 381, in handle
self.on_read()
File "server.py", line 456, in on_read
process_result = self.Cloudi.process_data(self,data)
File "server.py", line 172, in process_data
mysocket.devtype = m.header.value["devtype"]
KeyError: 'devtype'
----------------------------------------
The same happens with 'serial' if I comment out line 172 (mysocket.devtype = m.header.value["devtype"]
).
Looks like both of them are not part of the message received from miio.protocol.
Second strange thing is the ´did missmatch´.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.