Hacking Sandman Doppler

Think this is the best place, since I’m not asking for configuration help…because I can’t configure it, stuck on old software.

I recently got one, promptly rooted it to poke around. It seems like it’d be able to handle wyoming-satellite but probably not openwakeword, would love to be proved wrong.

Running pretty old software, about 8+ years old at this point, makes developing for it tricky. Runs Yocto Rocko, but it needs a custom hardware layer to be properly configured; using machine type as arm will only give usable binaries if they are 100% statically linked; anything else needs the libraries yocto generates (and don’t replace the ones already on the doppler, else you’ll test your unbricking skills). I’ve gotten a bit further using buildroot-2017-11 on a debian 9 machine, binaries will run (static and dynamically linked). I’m not a developer though, so it’s slow going.

I would love a backup of someone’s root partition who’s running the latest software (or at least something that has local control).

I will try to write a howto later (my first attempt at rooting was way too messy, for one thing you only need to remove one speaker and not disassemble the whole danged thing), but here’s the basic rundown (not responsible if you brick your doppler, if these instructions are too vague then don’t attempt):

Turn it upside down, remove the (to you) left speaker grill and four screws holding the speaker in. There’s a small motherboard with the SOC on it, toward the front you’ll see the RX TX and GRND connection points. I had the most success with making a good connection there and plugging/unplugging from the usb device on the computer. The doppler will NOT boot while it’s fully connected, so just plug it in, have minicom or whatever running on your pc with it connected to the doppler, then quickly remove the ground wire and reconnect while hitting a key so you can interrupt uboot. Once there change the bootcmd to get into single user mode. Set a root passwd. Reboot (will probably need to cut/restore power to the doppler), should be able to login normally. Use wget or curl to download a busybox binary so you can start a telnet server (included one does not have that applet for obvious reasons). You can also run dropbear, bit harder to find a working one (look for armv7l for binaries that can run on the doppler). Start it in rc.local, check that it works on reboot, and you shouldn’t need the serial adapter anymore (unless you brick it, which I already have once).

One of the first things I’d do is backup your partitions. Nowhere near enough space to do a local backup, but if you have an ftp server you can backup there. Here’s the command I used:

dd if=/dev/mmcblk0p3 | curl -T - -u username:password ftp://192.168.1.5/part3.img

Partitions are 1-4, 1 is boot, 2 and 3 are root (it’s an A/B config), 4 is data. Wouldn’t be a bad idea once you have a full backup (and verified they work, I mounted the root and data as a regular loopback file) to flash your known working root partition to the backup root; I’ve discovered if you boot into an older version it gets angry and won’t work even when you get it back on the correct root, you have to do a factory reset (and with their servers going down one by one…I wouldn’t want to do that unless necessary).

I haven’t been able to get wyoming-satellite to work locally, but I can route the audio to another server running wyoming-satellite (it needs to be able to load the snd-aloop module). Raspberry Pi devices should be fine, anything that can load snd-aloop and run wyoming-satellite (I’m currently running on a virtual machine under proxmox). Some hackery is needed to get this working (for some reason I need to use the screen command to get the bit that listens for speaker output, while it’s not needed to send the mic input; also the doppler bin needs to run as root), but anyway, it’s possible to get the sandman doppler to continue operating normally PLUS have a local voice assistant (that runs on a different system).

I bought a few more, I don’t have high hopes that any of the NIB units have newer software that supports local control but fingers are crossed. Once someone who DOES have the newer software backs up their partition, we should be able to upgrade units running older software. And I’m hoping that someone who actually knows what they’re doing jumps in, as it’s all very much a hack job at the moment.

My next steps are to attempt writing a how-to so someone else can replicate what I’ve done so far.

Haven’t found anyone crazy…er…brave enough to try this themselves, so here’s my very beta, very unproven how-to (I half followed along and generally wrote down exactly what I did that was successful and took some photos along the way). If you get this to work, do post so those who are too smart to be the guinea pigs can jump in. I’d also appreciate any feedback to make the how-to better.

It’s pretty difficult to permanently brick the device, I haven’t managed to do so yet. If you completely bork everything (for example, you start replacing library files willy-nilly), you can switch the active partition in uboot to boot into the backup partition. That’ll cause some havoc if it’s an older software version than it was running prior, likely necessitating a factory reset, but at the moment their setup servers are still online.

If you have a recent-ish software version that has built-in local control, let me know. I very much would like a copy. I’m stuck on version 1214, I’d really like 1714 (the latest stable) or even 1860 (latest beta). Once you’re rooted it’s a simple matter of dd’ing the current partition to a local ftp server (yes, it’s not ideal to dd an active partition, but I’ve restored such a backup and it worked).