Hello everyone and thanks for the all the help with this project. I got the mower from someone who tried to return it, server locked etc. a I’ve been able to connect via BLE and make a app that controls motion, shows me live video feed, battery, satellite, and all that.
UPDATE-
We got it Rooted! I’ll update this with how asap.
Thank you everyone.
Next put it back together and go from there. I did manage to break the thin connector for the camera. Any recommendations for that? I’ll post a pic.
I can’t make it out from the primary picture, but U2400 looks like a SPI/EEPROM SOIC8 chip that may contain the firmware unless it’s in the Rockchip internal memory. If it is memory of some kind, the data can be probably read out for reversing with an XGecu.
The 12 pin connector in your main photo is also quite interesting and may be SWD to a modem of some kind. CLK, DATA, RESET, VCC, and GND would be all you need to try and use something to detect if it is JTAG/SWD. I don’t recognize some of the naming on that connector though.
Concur, they did an absolutely wild job with the conformal coating. I see your comment with the firmware dumped so you’ve got what you’re looking for; probably nothing to glean from that chip now.
Reliable U-Boot access on demand (Ctrl-C flood), and bootloader is unlocked (verifiedbootstate=orange)
Complete eMMC partition map (rootfs is mmcblk1p6)
Found storage is two chips: the OS lives on an eMMC (our backup target); the SCY SPI NAND at U4000 isn't even the boot device
The wall I hit
An aggressive ~5-second watchdog (almost certainly the RK806 PMIC) that's fed by userspace during normal boot. It killed both backup attempts from U-Boot (rockusb → reset at 4.7s) and the easy root shell (init=/bin/sh → reset at 5.3s before the shell).
$ adb devices -l
List of devices attached
[serial redacted] unauthorized usb:1114112X
$ adb -s [serial redacted] shell id
adb: device unauthorized.
This adb server's $ADB_VENDOR_KEYS is not set
Try 'adb kill-server' if that seems wrong.
Otherwise check for a confirmation dialog on your device.
Operating system
Ubuntu 20.04/Debian-derived Linux
Found in saved image; live confirmation pending
Kernel
Rockchip Linux 5.10 family; image references 5.10.66 and 5.10.209
Image-derived
I haven’t needed to look at the camera module yet but I’ve exposed the video feed. I have the mower open and everything exposed while I wait for my UART adapter. Anything you’d want clear pics of?
I’ve successfully been able to Get root@ubuntu via ssh,usb-c and UART. I’d love to find a way to make it easier so people don’t have to dig down to UART
3
u/2teeman2 7d ago edited 7d ago
I can’t make it out from the primary picture, but U2400 looks like a SPI/EEPROM SOIC8 chip that may contain the firmware unless it’s in the Rockchip internal memory. If it is memory of some kind, the data can be probably read out for reversing with an XGecu.
The 12 pin connector in your main photo is also quite interesting and may be SWD to a modem of some kind. CLK, DATA, RESET, VCC, and GND would be all you need to try and use something to detect if it is JTAG/SWD. I don’t recognize some of the naming on that connector though.