stek29/dreame_1c_root.md

## dreame_1c_root.md

      
    Raw
  

              dreame_1c_root.md
            
          
    These are just my notes, and described process worked for me on my 1C robot

If anything goes wrong, having USB adapter for FEL flashing might be the only way to restore your robot

this is not an official guide

oh, and I'm not responsible for any damage blah blah

and huge thanks to Dennis and Hypfer, and everyone behind this root :)
0. get uboot shell

to enter uboot shell on 1C you have to:
0. turn robot off normally

hook up uart, open console
press any button and keep holding it
hold HOME button for 3+ seconds (dont release it yet)
hold POWER button for 3+ seconds while still holding HOME
you should be in uboot shell – release both buttons

see dennis' uart slides for more info

notice: step 3 (home button) seems missing in those slides, maybe different vacuums have differences :)
1. in uboot shell

note (thanks, @Hypher):
there is also boot_partition boot2, and setting boot_partition to boot1 when it's corrupted and boot2 is being used might cause trouble.
so try to boot without setting boot_partition first, and only if it doesn't work, try again with boot_partition set.
I'll try to test if boot_partition needs to be set at all, if it's persisted without saveend, and what would be the proper way to set it when I have free time for it.
setenv init /bin/sh
# setenv boot_partition boot1
boot
2. stage1 shell

you have to act quickly before watchdog (or whatever it is) reboots the device
wait for shell – you'll see # /
following commands worked for 1c, might be different for other robots

for ideas on how to get uart shell look at dustbuilder diff to see what exactly it changes to start shell on uart
mount /tmp
mkdir /tmp/fakeetc
cp -R /etc/* /tmp/fakeetc
mount --bind /tmp/fakeetc /etc
echo >> /tmp/fakeetc/inittab
echo '::respawn:-/bin/sh' >> /tmp/fakeetc/inittab
exec init
normal boot should continue, except there will be shell after boot on uart

it's not supposed to reboot, it should keep booting normally in userspace
3. stage2 shell

wait for new shell to pop up - wait for # / again
optional: backup

mkdir /tmp/backup
tar -cvzf /tmp/backup/misc.tgz -C /mnt/misc .
tar -cvzf /tmp/backup/uli_factory.tgz -C /mnt/private/ULI/factory/ .
cd /tmp/backup
now grab misc.tgz and uli_factory.tgz somehow
i.e. by starting upload server and using curl
i've used github.com/mayth/go-simple-upload-server
dont forget to
rm -rf /tmp/backup
flashing

build a custom firmware for manual install method on dustbuilder
and follow howto from there
for example, for 1c this should work:
cd /tmp
wget {url-of-firmware.tar.gz}
tar -xzvf {name-of-firmware.tar.gz}
./install.sh
4. verify

if patched firmware was flashed, you'll get a root shell on uart after boot without doing anything