Hey all, not sure I can share the method yet, but for the first time publicly (i believe), me and another person (will add credit if they want) found a stable method to fully jailbreak Roomba, allowing access finally to the internal SSH server, and MQTT broker (and removing the need for cloud access with some tinkering i believe).
All of this reverse engineering has been done with publicly available downloadable firmware packages with Ghidra.
I’ve been working on making this method persistent, and reverse engineering the entire cleantrack (codename for the roomba’s main software) and connectivity_manager (mqtt internal+cloud+local broker) programs to figure out how it works at the low level.
I currently have figured out how to access the upward-facing camera (and take pictures w/ it), but none of the other sensors (yet! just haven’t tried). I believe we can make use of them with some serial communication protocol, but I’ll have to research deeper its communication. Bonus, theoretically at this point, we can control the entire bot ourselves if we get this to work!
As for an update to the pose parameter missing from dorita980, I’m still looking for a way to re-enable it.
Here are some interesting images from my i7:
I’ve even managed to get FTP working, its a very limited Ubuntu+BusyBox distro. Digging through the file structure, we can find the very pmaps we previously extracted from the cloud. I also just dumped some files to my main computer to look at and see the contents. Very interesting stuff!
