### If you find issues with this document or have improvements, please contribute here: https://github.com/dgiese/dustbuilder-howto/

# This document describes the rooting method via U-Boot shell. Check cmds-reset.txt for the reset method
# This method was patched in newer version, but might still work with the factory version of your robot.
# If you do not get a u-boot prompt, your device might be too new or you updated the robot to a new firmware version.
# In such cases, and if you are in US or Germany, please open a ticket at vaers.dontvacuum.me for help

(You might want to have a firmware build before starting)
It is recommended, that you copy and paste the commands to avoid typos.

Connect via UART to your robot (115200 baud, no flow control). Make sure that the robot is powered off.
Check this document for the pinout and further information: https://builder.dontvacuum.me/dreame/dreame.pdf
Keep the "s" key pressed on your keyboard, while powering the robot on. You should see a "sunxi#" prompt after a few seconds.

In the U-Boot shell run this commands:

setenv init /bin/sh
setenv boot_partition boot1
run setargs_nand
run boot_normal

Your robot should boot and present you a shell

After the system booted, run these commands:
(you need to execute them in the first 10 seconds after having shell, or the robot reboots)

echo V > /dev/watchdog

Temporarily enable the shell and run the normal services:

mount /tmp
mkdir /tmp/fakeetc
cp -R /etc/* /tmp/fakeetc
mount --bind /tmp/fakeetc /etc
echo >> /tmp/fakeetc/inittab
echo '::respawn:-/bin/sh' >> /tmp/fakeetc/inittab
exec init

Check the current installed version (check "fw_arm_ver"):
cat /etc/os-release

Run these commands to print the configuration (save output):

grep "" /mnt/private/ULI/factory/*

Run these commands to save the calibration (save output, outside of the robot):

grep "" /mnt/misc/*.json
grep "" /mnt/misc/*.yaml
cat /mnt/misc/*.txt
hexdump /mnt/misc/*.bin

Make copies of the firmware encryption keys (e.g., to restore the robot to a factory state)
cat /etc/OTA_Key_pub.pem
cat /etc/publickey.pem

Make sure that you save the output of the calibration and the encryption keys before proceeding

Run these commands to create binary backups:
mkdir -p /tmp/backup
tar -cvzf /tmp/backup/misc_backup.tgz -C /mnt/misc .
tar -cvzf /tmp/backup/factory.tgz -C /mnt/private/ULI/factory/ .
cp /tmp/backup/*.tgz /data/


Run this command (replace SSID and password) to connect to your wifi (this will connect the robot to the internet and temporarily to the cloud):
wifi_cli -c "SSID" "password"
^^^ Warning: If you do this, you MUST reset your WiFi after you installed the custom firmware. Otherwise Valetudo will not work fully. ^^^
If wifi_cli does not work, try this instead: wifi_connect "SSID" "password"
^^^ Do not use wifi_cli or wifi_connect if the robot is already in your WiFi! ^^^

Run this commands to download and install the rooted firmware:
cd /tmp
wget --no-check-certificate {url-of-firmware.tar.gz}
tar -xzvf {name-of-firmware.tar.gz}
./install.sh

Side note: You can transfer the firmware via nc or via a local webserver. In that case you do not need to use wifi_cli

Download valetudo binary to /data:
https://github.com/Hypfer/Valetudo/releases
Device dependent (check our website):
1C, F9, D9: valetudo-armv7-lowmem
1T, L10 Pro, Z10 Pro: valetudo-aarch64
wget --no-check-certificate https://github.com/Hypfer/Valetudo/releases/latest/download/valetudo-armv7-lowmem -O /data/valetudo

Make valetudo executable
chmod +x /data/valetudo

Enable boot script
cp /misc/_root_postboot.sh.tpl /data/_root_postboot.sh
chmod +x /data/_root_postboot.sh

Reboot


(If you used wifi_cli, you need to delete files in /data/config/miio, reboot, connect to the robot WiFi and provision the WiFi via Valetudo):
rm /data/config/miio
reboot
- wait for the open WiFi of the robot to show up
- press the Home and Spot button at the same time (if the open WiFi does not show up)
- connect to that WiFi
- navigate to http://192.168.5.1 in your browser
- go to settings/wifi and enter your WiFi credentials