SetConfig commands on BotVacs and Model spoofing.

News and information about the Neato XV-11 Robotic Vacuum. All discussion and troubleshooting questions go here.

SetConfig commands on BotVacs and Model spoofing.

Postby HiTec » November 5th, 2018, 3:30 pm

Is it examined why SetConfig commands wont work on Botvacs? (I know the history of operating system upgrade from XV to Botvac series (Botvacs are QNX) Is there any work done to find a workaround? I'm particularly interested about VacuumPwr and BrushSpeed commands. They dont give any errors when giving those commands to robot, but when checking with GetVersion, they wont save.

I'm also interested about Botvac D:s, Connected and Connected D3,D5 and D7 NeatoControl detailed GetVersion logs. If someone has them, please share. (you can delete user id:s and serials) I already have Connected and Connected D5 logs. It would be interested to Spoof robot model from D3 to D5, maybe even D7 to see what happens with updater. Or from Botvac D to Botvac Connected (i know the normal D doesnt have the WiFi chip on board, just the solder spots for it.)

Also, does someone know what chip model the firmware is stored at (NAND), i didnt looked that when i disassembled my robots.

I have couple of NAND readers available, so it could be interested to do some reads from them if they are compatible.
Last edited by HiTec on November 6th, 2018, 1:23 pm, edited 2 times in total.
HiTec
 
Posts: 35
Joined: February 8th, 2015, 8:17 am

Re: SetConfig commands on Botvacs and version spoofing.

Postby glnc222 » November 5th, 2018, 6:59 pm

You could test it with some minor change checked on the LCD or USB version data. The Botvac was a complete do-over of the system so the firmware design could be different. For example, the log file commands on the XV are absent on the Botvac. The additional hardware on the Vorwerk models such as ultrasound sensors might not be treated as something to configure instead of just separate entire firmware versions. Addition of WiFi would also not be configurable -- lot of software for that.
glnc222
Robot Master
 
Posts: 4809
Joined: January 23rd, 2012, 9:19 pm
Location: North Carolina, U.S.

Re: SetConfig commands on Botvacs and version spoofing.

Postby HiTec » November 6th, 2018, 11:03 am

D5:

Code: Select all
GetVersion
Component,Major,Minor,Build,Aux
BaseID,0.0,0.0,0,0,
Beehive URL, beehive.neatocloud.com,
BlowerType,1,BLOWER_ORIG,
Bootloader Version,18283,,
BrushMotorResistorPowerRating,500,,
BrushMotorResistorResistance,100,,
BrushMotorType,1,BRUSH_MOTOR_ORIG,
BrushSpeed,1200,,
BrushSpeedEco,800,,
ChassisRev,1,,
DropSensorType,1,DROP_SENSOR_ORIG,
LCD Panel,0,0,0,
LDS CPU,F2802x/c001,,
LDS Serial,(censored),,
LDS Software,V2.6.15295,0000000000,
LDSMotorType,2,LDS_MOTOR_MABUCHI,
Locale,1,LOCALE_USA,
MagSensorType,1,MAG_SENSOR_ORIG,
MainBoard Serial Number,(censored),
MainBoard Version,4,,
Model,BotVacD5Connected,XXX-XXXX,
NTP URL, pool.ntp.org,
Nucleo URL, nucleo.neatocloud.com,
QAState,QA_STATE_APPROVED
Serial Number, (censored),P
SideBrushPower,1500,,
SideBrushType,2,SIDE_BRUSH_PRESENT,
SmartBatt Authorization,1
SmartBatt Data Version,512
SmartBatt Device Chemistry,LION1
SmartBatt Device Name,F164A10288
SmartBatt Manufacturer Name,Panasonic
SmartBatt Mfg Year/Month/Day,2083,10,10
SmartBatt Serial Number,(censored)
SmartBatt Software Version,2048
Software Git SHA,XXXXXXX
Software,4,2,3,153,0
Time Local,Tue Oct 30 19:25:05 2018
Time UTC,Tue Oct 30 17:25:05 2018
UI Board Hardware,0,0,
UI Board Software,0,0,
UI Name,NONE
UI Version,NONE
VacuumPwr,65,,
VacuumPwrEco,65,,
WallSensorType,1,WALL_SENSOR_ORIG,
WheelPodType,1,WHEEL_POD_ORIG,
================================================


I´m also interested about what does these mean?

BrushMotorResistorPowerRating,500,,
BrushMotorResistorResistance,100,,

Could someone with D3 or D7 post their NeatoControl GetVersion log so i could check differences? Could there also be a hardware dependant brush motor speed control via resistor resistance, or what does those lines mean?

Because D5 motherboard R151 resistor indeed is a 100ohm resistor. It reads on the resistor itself (R100). It´s right next to the Main Brush motor connector. If i see correctly from the ebay pics, The D3 has the same resistor. It would be interested to see if D7 also has the same R100, or different rating. It is possible, that the SetConfig Changes are blocked by a hardware detection of different resistance numbers. What if D7 has a different main brush resistor resistance and we swap D5 resistor to same value, whats the outcome? But yea, this is just a pure speculation. It´s also interesting to see that D5 has BrushSpeed and VacuumPwr ECO modes, but there isnt possibility to turn those, or turbo mode on because its only a D7 option.

If i only had even an broken D7... Or even D7 GetVersion log and high resolution motherboard pics. If someone has a broken D3 or D7 motherboard, and is willing to donate it for name of science, i will pay shipping costs. It would be interesting to do some reverse engineering, because the PCB:s are the same between the models. I just got my D5 to work, so i´m not too interested of removing the eMMC to check wire routing on motherboard and then hope if my reflowing work with basic tools will work.

Disassembled my D5 again to check where the firmware is at. Seems that it´s stored at "U43" (Lower right corner of the power button, when looking at the front of the robot) Kingston EMMC04G-M627 4GB MLC NAND & eMMC controller chip, so it should be possible to read it with USB SD card reader (make it appear like an standard SD card on computer), wired to correct points (4 wires needed) of eMMC chip. I dont know if the memory data is encrypted, could be, could be not, who knows the security of these things. Should still be easier than doing a Arnezami´s/Robinsod´s Timing Attack on Xbox 360, which i years ago did, first in this country.

https://media.kingston.com/pdfs/emmc/eM ... _flyer.pdf

I have just requested a datasheet with input/output pins from Kingston (its not public information, so i will not share that.).

Unfortunatelly I´m only good at hardware, coding and other complex software related things are pain to me.

Some software expert should join to this project. Aim is to open up a possibility to change Configurations, such as main brush speed and vacuum power and tweaking things here and there to customize robot to users needs, not needing to rely on official firmware upgrades, which Neato Robotics are killing right after new model comes to the markets. I i recall correctly, Original Connected model was announced to get some upgrades, that newer saw a daylight after new D series was introduced to markets.

Original Connected:

Code: Select all
GetVersion
Component,Major,Minor,Build,Aux
APPassword,XXXXXXXX
BaseID,1.2,1.0,18000,2000,
BatteryType,4,LIION_4CELL_SMART,
Beehive URL, beehive.neatocloud.com
BlowerType,1,BLOWER_ORIG,
Bootloader Version,18502,,
BrushMotorType,1,BRUSH_MOTOR_ORIG,
BrushSpeed,1400,,
BrushSpeedEco,800,,
ChassisRev,1,,
Cloud Selector, -1
Cometa URL, nucleo.neatocloud.com
DropSensorType,1,DROP_SENSOR_ORIG,
LCD Panel,137,240,124,
LDS CPU,F2802x/c001,,
LDS Serial,(Censored),,
LDS Software,V2.6.15295,0000000000,
LDSMotorType,2,LDS_MOTOR_MABUCHI,
Locale,1,LOCALE_USA,
MagSensorType,1,MAG_SENSOR_ORIG,
MainBoard Serial Number,Censored,
MainBoard Version,1,,
Model,BotVacConnected,905-0249,
QAState,QA_STATE_APPROVED
Serial Number,Censored,P
SideBrushPower,1500,,
SideBrushType,2,SIDE_BRUSH_VORWERK_REV1,
SmartBatt Data Version,512
SmartBatt Device Chemistry,LION
SmartBatt Device Name,F164A1028
SmartBatt Manufacturer Name,Panasonic
SmartBatt Mfg Year/Month/Day,2051,10,10
SmartBatt Serial Number,XXXXX
SmartBatt Software Version,2048
Software,2,2,0,296,0
Time Local,Thu Nov  1 18:07:04 2018
Time UTC,Thu Nov  1 15:07:04 2018
UI Board Hardware,0,0,
UI Board Software,1,3,
UI Name,Davinci
UI Version,1.0.0
VacuumPwr,80,,
VacuumPwrEco,65,,
WallSensorType,1,WALL_SENSOR_ORIG,
WheelPodType,1,WHEEL_POD_ORIG,
Last edited by HiTec on November 6th, 2018, 1:53 pm, edited 2 times in total.
HiTec
 
Posts: 35
Joined: February 8th, 2015, 8:17 am

Re: SetConfig commands on Botvacs and version spoofing.

Postby HiTec » November 6th, 2018, 1:47 pm

glnc222 wrote:You could test it with some minor change checked on the LCD or USB version data.


What do you mean by that sentence? Sorry my english isn´t the best possible.
HiTec
 
Posts: 35
Joined: February 8th, 2015, 8:17 am

Re: SetConfig commands on BotVacs and Model spoofing.

Postby glnc222 » November 6th, 2018, 5:55 pm

Send a USB SetConfig command to the robot when on the dock. Use a command such as
SetConfig BatteryType 3 -- instead of the type 4 shown in your GetVersion results.
Repeat GetVersion to see if it has changed to 3. Change it back to 4 before using the robot.

Many parameters are shown in your display not found in XV models. It appears the firmware has become more elaborate. It would not be surprising that the SetConfig command is not supported. There are plenty of ways to set configuration in data blocks included within a firmware package, without dynamic USB configuration.

The old firmware installation process included a terminal emulator script with SetConfig Commands etc. besides binary code files to flash. An entirely different method could be used on the more advanced Botvacs. The original SetConfig commands were discovered (in Russia I think) possibly by capturing the USB data stream during updating, as well as examining the operation of the special terminal emulator, updater program, with its script files, found somehow.

The only applications of the SetConfig in the past have been either to convert NiMh Neato XV models to Vorwerk settings for lithium batteries, or to use the Vorwerk updater program when Neato stopped supplying their version of the updater. I do not see what use SetConfig could have with the newer Botvac's.
The settings are all made to match the hardware in the particular vacuum model. I do not see any reason to change the hardware, so what use is the SetConfig?

Advise if English not clear.
glnc222
Robot Master
 
Posts: 4809
Joined: January 23rd, 2012, 9:19 pm
Location: North Carolina, U.S.

Re: SetConfig commands on BotVacs and Model spoofing.

Postby antekw2 » November 8th, 2018, 6:03 pm

Here is data for the getversion command.
Vacuum cleaner model - D5 connected
Code: Select all
GetVersion
Component,Major,Minor,Build,Aux
BaseID,0.0,0.0,0,0,
Beehive URL, beehive.neatocloud.com,
BlowerType,1,BLOWER_ORIG,
Bootloader Version,18283,,
BrushMotorResistorPowerRating,500,,
BrushMotorResistorResistance,100,,
BrushMotorType,1,BRUSH_MOTOR_ORIG,
BrushSpeed,1200,,
BrushSpeedEco,800,,
ChassisRev,1,,
DropSensorType,1,DROP_SENSOR_ORIG,
LCD Panel,0,0,0,
LDS CPU,F2802x/c001,,
LDS Serial,XXXXXXXXXXXX,,
LDS Software,V2.6.15295,0000000001,
LDSMotorType,2,LDS_MOTOR_MABUCHI,
Locale,1,LOCALE_USA,
MagSensorType,1,MAG_SENSOR_ORIG,
MainBoard Serial Number,XXXXXXXXXX,
MainBoard Version,4,,
Model,BotVacD5Connected,905-0358,
NTP URL, pool.ntp.org,
Nucleo URL, nucleo.neatocloud.com,
QAState,QA_STATE_INVALID                                   <======== two red led
Serial Number,XXXXXXXXXXXX,P
SideBrushPower,1500,,
SideBrushType,2,SIDE_BRUSH_PRESENT,
SmartBatt Authorization,1
SmartBatt Data Version,512
SmartBatt Device Chemistry,LION1
SmartBatt Device Name,F164A10288
SmartBatt Manufacturer Name,Panasonic
SmartBatt Mfg Year/Month/Day,2089,10,11
SmartBatt Serial Number,XXXXX
SmartBatt Software Version,2048
Software Git SHA,x
Software,4,2,3,153,0
Time Local,Sat Jan  1 00:05:20 2000
Time UTC,Fri Dec 31 23:05:20 1999
UI Board Hardware,0,0,
UI Board Software,0,0,
UI Name,NONE
UI Version,NONE
VacuumPwr,65,,
VacuumPwrEco,65,,
WallSensorType,1,WALL_SENSOR_ORIG,
WheelPodType,1,WHEEL_POD_ORIG,
================================================


The vacuum cleaner does not start. Two red LEDs are on. There is a WiFi and USB connection. All engines are efficient. The battery also looks functional.
antekw2
 
Posts: 3
Joined: November 8th, 2018, 5:45 pm

Re: SetConfig commands on BotVacs and Model spoofing.

Postby HiTec » November 9th, 2018, 7:24 am

QAState,QA_STATE_INVALID <======== two red led

That should be:

QAState,QA_STATE_APPROVED

That seems to be the problem with your robot, but i dont have any clue what QAState means.
HiTec
 
Posts: 35
Joined: February 8th, 2015, 8:17 am

Re: SetConfig commands on BotVacs and Model spoofing.

Postby antekw2 » November 9th, 2018, 7:56 am

Yes. The problem with my robot occurred after the update. Previously, the regulation required Lidar. None of the setconfig commands work. You probably need to follow the way of communicating with servers, eg when setting a schedule, docking, etc. I found this way:
https://www.nccgroup.trust/us/about-us/ ... ed-part-1/
antekw2
 
Posts: 3
Joined: November 8th, 2018, 5:45 pm

Re: SetConfig commands on BotVacs and Model spoofing.

Postby HiTec » November 9th, 2018, 8:16 am

What update? 4.2.3? If it was that, maybe you should wait and see if the Neato app offers you the latest 4.3.0 update thats rolling out this weekend. Maybe, just maybe it fixes it.
HiTec
 
Posts: 35
Joined: February 8th, 2015, 8:17 am

Re: SetConfig commands on BotVacs and Model spoofing.

Postby antekw2 » November 9th, 2018, 11:45 am

Yes, Software,4,2,3,153,0
antekw2
 
Posts: 3
Joined: November 8th, 2018, 5:45 pm

Re: SetConfig commands on BotVacs and Model spoofing.

Postby HiTec » November 10th, 2018, 9:22 am

4.3.0-152 Getversion log:

Code: Select all
GetVersion
Component,Major,Minor,Build,Aux
BaseID,0.0,0.0,0,0,
Beehive URL, beehive.neatocloud.com,
BlowerType,1,BLOWER_ORIG,
Bootloader Version,18283,,
BrushMotorResistorPowerRating,500,,
BrushMotorResistorResistance,100,,
BrushMotorType,1,BRUSH_MOTOR_ORIG,
BrushSpeed,1200,,
BrushSpeedEco,800,,
ChassisRev,1,,
DropSensorType,1,DROP_SENSOR_ORIG,
LCD Panel,0,0,0,
LDS CPU,F2802x/x,,
LDS Serial,xxxxxxxxxxxxxx,,
LDS Software,V2.6.15295,0000000000,
LDSMotorType,2,LDS_MOTOR_MABUCHI,
Locale,1,LOCALE_USA,
MagSensorType,1,MAG_SENSOR_ORIG,
MainBoard Serial Number,xxxxxxxxxxxxxxxxxxxx,
MainBoard Version,4,,
Model,BotVacD5Connected,905-0358,
NTP URL, pool.ntp.org,
Nucleo URL, nucleo.neatocloud.com,
QAState,QA_STATE_APPROVED
Serial Number,xxxxxxxxxxxxxxxxxxxxxxx
SideBrushPower,1500,,
SideBrushType,2,SIDE_BRUSH_PRESENT,
SmartBatt Authorization,1
SmartBatt Data Version,512
SmartBatt Device Chemistry,LION1
SmartBatt Device Name,F164A10288
SmartBatt Manufacturer Name,Panasonic
SmartBatt Mfg Year/Month/Day,2105,10,10
SmartBatt Serial Number,xxxxxx
SmartBatt Software Version,2048
Software Git SHA,xxxxxxxxx
Software,4,3,0,152,0
Time Local,Sat Nov 10 15:13:38 2018
Time UTC,Sat Nov 10 13:13:38 2018
UI Board Hardware,0,0,
UI Board Software,0,0,
UI Name,NONE
UI Version,NONE
VacuumPwr,65,,
VacuumPwrEco,65,,
WallSensorType,1,WALL_SENSOR_ORIG,
WheelPodType,1,WHEEL_POD_ORIG,


BrushSpeed,1200,,
BrushSpeedEco,800,,


VacuumPwr,65,,
VacuumPwrEco,65,,


What the f?

There is no difference in VacuumPwr and VacuumPwrEco modes? Main brush speed is the same as previous update, as well as main brush eco mode?

There is no "real" turbo mode here. Thats why there seems to be no audible difference in turbo and eco modes! Seems that turbo mode is normal mode and only eco mode is enabled via update. Disappointment is a one word how to describe this.
HiTec
 
Posts: 35
Joined: February 8th, 2015, 8:17 am

Re: SetConfig commands on BotVacs and Model spoofing.

Postby glnc222 » November 10th, 2018, 12:42 pm

Long ago I saw something to the effect the Vorwerk VR100, the first model, had a brush speed of 1600rpm compared to the 1200 on the Neato models. The VR200 version of Botvac could differ -- the wider brush presents a different mechanical load. Over USB in Test Mode the brush motor can be run at this higher speed, but the default setting for cleaning is 1200. Vorwerk introduced the combo bristle & blade brush later dubbed "pet brush" on Neato models. The brush is the main cleaning function of these robots lacking the suction power of full size vacuums.
Brush speed must be compared with the number of blades on a brush as these multiply the sweeping of each rotation.
The Samsung Powerbot uses a lower speed brush around 1100 I think, using an IR sensor setup and frequency scale on a multimeter to measure.

One way to appraise the power of these robots is to compare the battery capacity with the run time specified, figuring in a 1/3 unused buffer in the capacity (giving about 2ah used in Neato XV), giving the power load of the vacuum. A higher power, "turbo" mode with a shorter run time can show how much extra power is supplied.
Suction fan efficiency did seem to vary a lot with a greatly improved fan in the Botvac models compared to XV -- supporting the wider intake on those models (so about the same air flow rate across the intake).
"Quiet" and "Eco" economy modes supplied will not be useful on carpet.
glnc222
Robot Master
 
Posts: 4809
Joined: January 23rd, 2012, 9:19 pm
Location: North Carolina, U.S.

Re: SetConfig commands on BotVacs and Model spoofing.

Postby HiTec » November 10th, 2018, 5:00 pm

The main brush motor and brush is the same as previous generation connected and i doubt there is any difference on motherboards main brush motor driver circuitry that would prevent using 1400rpm. I think this is just one artificial way of bringing more performance differences between the models.

Lets design a great robot and prevent users to get most out of it.

I emailed neato support about this. Their D5 page says "Increase suction power and brush speed with Turbo mode".

Well, this update wont increase anything, so thats the problem. False advertising.
HiTec
 
Posts: 35
Joined: February 8th, 2015, 8:17 am

Re: SetConfig commands on BotVacs and Model spoofing.

Postby glnc222 » November 11th, 2018, 11:16 am

Turbo modes are dubious options in two ways. Extra high loads on the battery may wear it out faster reducing lifetime, increasing long term operating cost. Also I found on the Samsung no special increase in cleaning effectiveness on carpet with this mode. The typical quick test of surface debris pickup of sprinkled material is not indicative. It takes a long time to measure actual performance with the actual bin content. I do like the automatic high power activated by a dirt detector feature, not sure if on Neato's. The Samsung goes off only every now and then in certain corners and spots against walls. The newer Botvac's I think have automatic hard floor - carpet detection and may turn on extra power on carpet -- check the specs. How they detect is not clear, but the Roomba was mentioned by its former designer posting here as using Mouse tech to distinguish surface textures. Carpet also presents higher drag on the wheels which might be measured by motor loading.
glnc222
Robot Master
 
Posts: 4809
Joined: January 23rd, 2012, 9:19 pm
Location: North Carolina, U.S.


Return to Neato Robotics

Who is online

Users browsing this forum: im1kissfan, jdong, johnnyh, KeldBroe, kersian, Metalworker, Miles267, ps0001, vic7767 and 347 guests