Hi, I kinda used claude to write most of this as I’m new here but basically I was working with it to see if I would be able to connect to my roomba 105 (the newer linup with lidar) and force the auto empty base to evac dustbin on demand since irobot doesn’t allow 105 owners to control the dock from the app and i find the robot sometimes doesn’t evac when it should due to the 5 minute logic. I got similar results to what others found with the v4 protocal where you can get your credentials from dorita 980 but the robot refuses to connect. I did find however that it will wake when you connect it to your computer via the micro usb port in the battery compartment but other than that it won’t show up on my windows 11 pc at all and behaves like it normally would (I didn’t remove the battery). If anyone is curious, it does say “powering on” when I plug it in like it would when you normally turn it on, and as I said earlier it does function as normal. For additional context, my robot did not come with the mop (i believe there is some additional functionality with the mopping robots including a sensor in the bin for it to detect when it’s full which mine doesn’t have).Here is what claude intended on saying since I kinda had it walk me through this entire thing:
Hi everyone,
I’ve been investigating local control of my iRobot Roomba 105 and wanted to share my findings in case they’re useful to anyone working on V4 protocol support. My goal was simply to trigger the auto-empty dock on demand as my robot sometimes skips emptying when it returns to the dock.
Device info:
- Model: iRobot Roomba 105
- SKU: Q352020
- Software version: p25-105+9.3.6+I3.6.149
- Protocol: V4
What I tried:
roombapy local discovery — no robots found at all, the robot doesn’t appear on the network via discovery
Local password retrieval via roombapy — timed out, couldn’t establish a connection to the robot directly
Cloud credential retrieval via dorita980 — this worked successfully and returned valid BLID and password credentials
Local MQTT connection via roombapy — this is where it gets interesting. The robot actively refuses the connection rather than timing out:
ConnectionRefusedError: [WinError 10061] No connection could be made
because the target machine actively refused it
This suggests the robot receives the connection attempt and deliberately rejects it rather than simply not listening — meaning the MQTT server is running but speaking a different protocol
USB port investigation — I found a micro USB port on the underside of the robot behind a screwed access panel in the battery compartment. Here’s what I found:
- Plugging in a USB cable while the robot is off wakes the robot up, suggesting it’s electrically connected to the power management system
- No device appears in Windows Device Manager when connected
- ADB detects no devices
- Tried two different cables including one confirmed to have data connections
- Tried connecting during boot sequence — no device appeared at any point
The USB waking the robot up is particularly interesting and seems undocumented — it suggests the data pins may be active but speaking a non-standard protocol, possibly UART rather than USB
Questions:
- Has anyone successfully established a local MQTT connection to a V4 protocol robot?
- Does anyone know what port the V4 protocol uses if not 8883?
- Does anyone recognise the USB port behaviour — could it be a UART serial connection using a USB connector?
- Is there any known way to trigger the evac/auto-empty command on V4 robots?
Any help or pointers would be really appreciated. Happy to run any further tests if useful.
Thanks
UPDATE(also had claude write this because it kinda walked me through what everything meant when attempting to hack my roomba:
Update — Wireshark Traffic Analysis via PC Hotspot
Following up on my initial post with some additional findings. I connected the robot to a PC hotspot and used Wireshark to capture all network traffic. Here’s what I found:
Network Architecture:
The Roomba 105 communicates exclusively with AWS servers located in Ashburn, Virginia. All servers are hardcoded IP addresses — the robot performs no DNS lookups whatsoever, which appears to be a deliberate security measure to prevent traffic interception and redirection.
Servers the robot talks to:
16.15.244.29— AWS, no hostname (likely command/control)16.15.252.18— AWS, no hostname (likely command/control)52.216.41.64— AWS52.216.209.184— AWS52.216.212.32— AWS52.217.133.88— AWS52.217.202.168— AWS52.217.235.72— AWS54.231.132.128— confirmeds3-1.amazonaws.com(map/log uploads)3.221.135.0— confirmedec2-3-221-135-0.compute-1.amazonaws.com
Protocol observations:
- All traffic is TLSv1.2 encrypted
- No SNI (Server Name Indication) in TLS handshakes
- No DNS queries — all IPs are hardcoded
- Robot connects directly to IP addresses rather than domain names
- S3 traffic suggests map data and/or cleaning logs are being uploaded to cloud storage
What this rules out:
- No Chinese manufacturer servers detected anywhere — Dreame, Ecovacs and Xiaomi servers are completely absent
- This appears to be genuinely iRobot’s own cloud infrastructure, not a rebranded Chinese platform
USB port additional findings: As mentioned in the original post, there is a micro USB port in the battery compartment behind a screwed access panel. Additional testing confirmed:
- Plugging in USB while robot is off wakes the robot up — confirming electrical connection to power management
- No device appears in Windows Device Manager at any point including during boot sequence
- ADB detects no devices
- Tried two different data cables
- Port does not respond to standard USB protocol at all — likely a UART serial connection using a USB connector for physical convenience
Questions for the community:
- Does anyone recognise this AWS infrastructure as matching any known iRobot V4 protocol work?
- Has anyone found a way to decrypt TLSv1.2 traffic from a Roomba without root access?
- Does the hardcoded IP approach give any clues about the underlying protocol?
- Has anyone successfully rooted a 2025 series Roomba?
Happy to run any further tests if useful. All findings are from a Roomba 105 (SKU: Q352020, Software: p25-105+9.3.6+I3.6.149).
