Categories
Home Automation Tutorials

How to Root the Mova Z500 Robot Vacuum and Install Valetudo

As part of my quest for cloudless home automation using Home Assistant, I recently bought a pair of Mova Z500 robot vacuums for $169 a piece (one for downstairs, one for upstairs) for use with Valetudo, a local network solution for a variety of cloud-powered robot vacuums, only to discover that there was no public documentation on how to root this specific model yet.

This document is the result of the digging I had to do to get it working. Hopefully it makes the process clearer for others to follow. Feel free to copy and share it anywhere.

Note: These instructions are for Windows. Linux and OS X users should use the Terminal instead of PuTTY.

Helpful Telegram groups:

This document was compiled from several different sources. Credit goes to:

Required Hardware

  • Mova Z500 (of course)
  • Laptop with wifi
  • USB UART adapter
  • 3x 2mm (not 2.54mm) jumper cables

Required Software

  • Python 3.x
  • Windows – PuTTY

Summary of Rooting Procedure

  1. Build firmware with DustBuilder
  2. Connect USB UART adapter to the robot’s debug headers
  3. Establish root shell
  4. Backup calibration data
  5. Install DustBuilder firmware
  6. Install Valetudo

Step 1: Build firmware with DustBuilder

  1. Go to https://builder.dontvacuum.me/_dreame_p2156.html
  2. Enter your email address and attach your SSH public key file
  3. Enter the full serial number from the sticker under the robot’s dustbin (starts with P, ends with ZM)
  4. Make sure to check Patch DNS if you want to use Valetudo
  5. Check “build for manual installation”
  6. Submit

You will get an email with the download link when your firmware is ready.

Step 2: Connect USB UART adapter to the robot’s debug headers

  1. Pry up the panel on the top of the robot. It’ll pop out without too much force.
  2. Turn the robot to face you. From the bottom left corner, the headers are: Boot Select, RX, TX, Ground (see image below)
  3. Make sure your UART adapter is in 3.3V mode
  4. Connect RX on the UART adapter to TX on the robot and vice versa
  5. Connect ground on the UART adapter to ground on the robot

Do not connect any other pins. Only RX, TX, and Ground are needed for this method.

For more details, see Dennis’ talk from DEFCON 29 .

Step 3: Establish root shell

PuTTY configuration:

  1. Set Connection Type to Serial
  2. Under Session > Logging choose “All session output” – this is to save calibration data later
  3. Under Connection > Serial
    1. Set Speed (baud) to 115200
    2. Set Serial line to the COM port for your UART adapter
    3. Set Flow Control to None
  4. Save this config. You’ll probably need it again.

If the robot is off, hold Power for 3+ seconds until it turns on and connect via PuTTY. You should see startup messages in the terminal. If not, check your RX/TX and Ground wires.

Windows note: If you get a serial connection error, check your COM port in Device Manager.

Option A: Wifi reset button shell
  1. Remove the dustbin and check the sticker under it. This is your robot’s serial number, something like PxxxxxxxxxxxxxxxZM (Note: The serial number on the the bottom of the robot is different. Mine has “0000P01” instead of “ZM””. You need to use the one that ends with “ZM”.)
  2. Use this online tool to convert your serial number into the default root password for your robot. Make sure you enter the serial number in all caps with no spaces.
  3. Use a pin or something to press the Reset button next to the wifi light under the lid. You should get a login prompt over UART.
  4. Login with username root and the password from step 2.

Congrats, you should have root access.

If this works, continue to Step 4: Backup Callibration Data. Otherwise try Option B

Option B: U-boot shell upgrade

Source: https://gist.github.com/stek29/5c44244ae190f3757a785f432536c22a

Step 1: Connect to uboot shell
  1. If the robot is on, hold Power for 3+ seconds until it shuts off
  2. Hold “s” (or any other key)
  3. While still holding “s”, press and hold Power on the robot for 3+ seconds until it turns on.
  4. Keep holding “s” until you get a shell over UART
Step 2: Upgrade uboot shell to root shell

Run these commands to boot into a root shell:

setenv init /bin/sh
setenv boot_partition boot1
boot
Step 3: Trick watchdog into not restarting your shell

Quickly, before watchdog reboots your shell, run these commands:

mount /tmp
mkdir /tmp/fakeetc
cp -R /etc/* /tmp/fakeetc
mount --bind /tmp/fakeetc /etc
echo >> /tmp/fakeetc/inittab
echo '::respawn:-/bin/sh' >> /tmp/fakeetc/inittab
exec init

Step 4: Backup calibration data

Run these commands to backup the calibration data:

grep "" /mnt/private/ULI/factory/*
grep "" /mnt/misc/*.json
grep "" /mnt/misc/*.yaml
cat /mnt/misc/*.txt
hexdump /mnt/misc/*.bin

Some of these will fail. Don’t worry about it. We just want to get the output into the log file as a backup.

Step 5: Install DustBuilder firmware

  1. Connect your laptop to the robot’s wifi access point (starts with “dreame”)
  2. Start a web server on your laptop in the folder with the DustBuilder firmware using the command python -m http.server --bind 192.168.5.100
  3. In the serial terminal, cd into /tmp and download your custom DustBuilder firmware with wget http://192.168.5.100:8000/<firmware_filename>.tar.gz
  4. Untar: tar -xvzf <firmware_filename>.tar.gz
  5. Connect the charging dock.
  6. Run ./install

When complete, the robot will reboot and you’ll get a root shell automatically over UART.

Step 6: Install Valetudo

  1. On your laptop, download the appropriate Valetudo release (valetudo-armv7) and place it in the same directory as the Python web server in step 7
  2. Reconnect to the robot wifi AP
  3. From the robot shell over UART, run these commands:
cd /data
wget http://192.168.5.100:8000/valetudo-armv7 -O valetudo
cp /misc/_root_postboot.sh.tpl _root_postboot.sh
chmod +x valetudo _root_postboot.sh
reboot

After rebooting, Valetudo will be up and running. To set up wifi and use the Valetudo web interface, connect to the robot AP again and go to http://192.168.5.1 in your web browser.

That’s it! Happy vacuuming!