As part of my quest for cloudless home automation using Home Assistant, I recently bought a pair of Mova Z500 robot vacuums for $169 a piece (one for downstairs, one for upstairs) for use with Valetudo, a local network solution for a variety of cloud-powered robot vacuums, only to discover that there was no public documentation on how to root this specific model yet.
This document is the result of the digging I had to do to get it working. Hopefully it makes the process clearer for others to follow. Feel free to copy and share it anywhere.
Note: These instructions are for Windows. Linux and OS X users should use the Terminal instead of PuTTY.
Helpful Telegram groups:
This document was compiled from several different sources. Credit goes to:
- Dennis Giese (@dgi_DE) for discovering the rooting method and creating DustCloud and DustBuilder
- Sören Beye for creating Valetudo
- Viktor Oreshkin whose notes for the Dreame 1C root procedure were used for root Option B since I initially had issues with the default password approach.
- Mova Z500 (of course)
- Laptop with wifi
- USB UART adapter
- 3x 2mm (not 2.54mm) jumper cables
- Python 3.x
- Windows – PuTTY
Summary of Rooting Procedure
- Build firmware with DustBuilder
- Connect USB UART adapter to the robot’s debug headers
- Establish root shell
- Backup calibration data
- Install DustBuilder firmware
- Install Valetudo
Step 1: Build firmware with DustBuilder
- Go to https://builder.dontvacuum.me/_dreame_p2156.html
- Enter your email address and attach your SSH public key file
- Enter the full serial number from the sticker under the robot’s dustbin (starts with P, ends with ZM)
- Make sure to check Patch DNS if you want to use Valetudo
- Check “build for manual installation”
You will get an email with the download link when your firmware is ready.
Step 2: Connect USB UART adapter to the robot’s debug headers
- Pry up the panel on the top of the robot. It’ll pop out without too much force.
- Turn the robot to face you. From the bottom left corner, the headers are: Boot Select, RX, TX, Ground (see image below)
- Make sure your UART adapter is in 3.3V mode
- Connect RX on the UART adapter to TX on the robot and vice versa
- Connect ground on the UART adapter to ground on the robot
Do not connect any other pins. Only RX, TX, and Ground are needed for this method.
For more details, see Dennis’ talk from DEFCON 29 .
Step 3: Establish root shell
- Set Connection Type to Serial
- Under Session > Logging choose “All session output” – this is to save calibration data later
- Under Connection > Serial
- Set Speed (baud) to 115200
- Set Serial line to the COM port for your UART adapter
- Set Flow Control to None
- Save this config. You’ll probably need it again.
If the robot is off, hold Power for 3+ seconds until it turns on and connect via PuTTY. You should see startup messages in the terminal. If not, check your RX/TX and Ground wires.
Windows note: If you get a serial connection error, check your COM port in Device Manager.
Option A: Wifi reset button shell
- Remove the dustbin and check the sticker under it. This is your robot’s serial number, something like PxxxxxxxxxxxxxxxZM (Note: The serial number on the the bottom of the robot is different. Mine has “0000P01” instead of “ZM””. You need to use the one that ends with “ZM”.)
- Use this online tool to convert your serial number into the default root password for your robot. Make sure you enter the serial number in all caps with no spaces.
- Use a pin or something to press the Reset button next to the wifi light under the lid. You should get a login prompt over UART.
- Login with username
rootand the password from step 2.
Congrats, you should have root access.
If this works, continue to Step 4: Backup Callibration Data. Otherwise try Option B
Option B: U-boot shell upgrade
Step 1: Connect to uboot shell
- If the robot is on, hold Power for 3+ seconds until it shuts off
- Hold “s” (or any other key)
- While still holding “s”, press and hold Power on the robot for 3+ seconds until it turns on.
- Keep holding “s” until you get a shell over UART
Step 2: Upgrade uboot shell to root shell
Run these commands to boot into a root shell:
setenv init /bin/sh setenv boot_partition boot1 boot
Step 3: Trick watchdog into not restarting your shell
Quickly, before watchdog reboots your shell, run these commands:
mount /tmp mkdir /tmp/fakeetc cp -R /etc/* /tmp/fakeetc mount --bind /tmp/fakeetc /etc echo >> /tmp/fakeetc/inittab echo '::respawn:-/bin/sh' >> /tmp/fakeetc/inittab exec init
Step 4: Backup calibration data
Run these commands to backup the calibration data:
grep "" /mnt/private/ULI/factory/* grep "" /mnt/misc/*.json grep "" /mnt/misc/*.yaml cat /mnt/misc/*.txt hexdump /mnt/misc/*.bin
Some of these will fail. Don’t worry about it. We just want to get the output into the log file as a backup.
Step 5: Install DustBuilder firmware
- Connect your laptop to the robot’s wifi access point (starts with “dreame”)
- Start a web server on your laptop in the folder with the DustBuilder firmware using the command
python -m http.server --bind 192.168.5.100
- In the serial terminal,
/tmpand download your custom DustBuilder firmware with
tar -xvzf <firmware_filename>.tar.gz
- Connect the charging dock.
When complete, the robot will reboot and you’ll get a root shell automatically over UART.
Step 6: Install Valetudo
- On your laptop, download the appropriate Valetudo release (valetudo-armv7) and place it in the same directory as the Python web server in step 7
- Reconnect to the robot wifi AP
- From the robot shell over UART, run these commands:
cd /data wget http://192.168.5.100:8000/valetudo-armv7 -O valetudo cp /misc/_root_postboot.sh.tpl _root_postboot.sh chmod +x valetudo _root_postboot.sh reboot
After rebooting, Valetudo will be up and running. To set up wifi and use the Valetudo web interface, connect to the robot AP again and go to http://192.168.5.1 in your web browser.
That’s it! Happy vacuuming!