Testing report for S8 Pro Ultra

[cryptk]

I have the local roborock server working pretty well with an S8 Pro Ultra with a few issues.

I am unable to get the Roborock app to work. I have set up the mitm proxy per your instructions, and I can validate that it is working as I can see decrypted traffic in it's interface when I use some other apps such as Home Assistant app and the apps from some other IOT thing vendors. However submitting the request to get a verification code with the Roborock app just gives a message saying "Network unavailable". The only roborock related traffic I see in mitmproxy for roborock are a few DNS queries. It appears that the app on Android might employ certificate pinning. Have you tested the app functionality on an Android device?

The other issue that I had, which likely needs some better documentation, or will perhaps be resolved in future versions of the integration, was difficulty in getting the URL change in core.config_entries to stick. Edit the file, restart Home Assistant, back to defaults. Disable the integration, edit the file, enable the integration, back to default domains.

I ended up using the HA CLI to stop HA core, then I edited the file, then I started HA core back up (just `ha core stop/start from an SSH connection) and that finally got the updated domains to work.

So everything seems to be working, with the exception of the Roborock App, likely due to certificate pinning. I now have the vacuum fully firewalled off from the internet, great work!

[Bookwalker23]

I am having the same issue with the app. I don't quite understand how to log back into the app. I am also on Android and I am having troubles installing the certificate as VPN/User certificate, only as CA certificate which I guess the app does not accept.

However I don't have enough knowledge to be of any help here.

[DonSidro]

I ran into the same issue. After patching the APK with apk-mitm to trust user-added CAs, the app crashes when requesting a verification code during login.
Looking at the logs, the app loads a native library (librrcodec.so) which appears to perform integrity/tamper detection. Since the patched APK is re-signed with a different key, the native code detects the signature mismatch and kills the process (SIGKILL signal 9) immediately.
Maybe one of the older apk's doesn't have this detection, but I'll have to find it or try with a rooted device ;)

[DonSidro]

Update after some more digging I think i finally made it work, I can login while Wireguard is running and I can see the map after disabling Wireguard

The fix was to patch librrcodec.so directly. The verification function at VA 0x5ce1c is only called from two places in JNI_OnLoad (at 0x4bdcc and 0x4c428). I replaced both BL (branch-link) instructions with NOP (D503201F), so the signature check never runs. The actual crypto functions (codec, init) the app needs are unaffected.
To apply the patch:

Run apk-mitm roborock.apk as normal
Decompile the patched APK with apktool d roborock-patched.apk -o roborock_work
Replace roborock_work/lib/arm64-v8a/librrcodec.so with the patched version
Rebuild with apktool b roborock_work -o roborock_final.apk
Sign with apksigner sign --ks my-key.keystore roborock_final.apk

I can't attach the patched librrcodec.so so for now if you wanna try I got the patched apk and librrcodec in my fork of this repo.

[cryptk]

@DonSidro Be careful having those in your fork, redistribution puts you into some not great places legally. A better option would probably be to have a script that handles downloading the apk and all of the patching, with the end result being an apk ready to be installed on a device. That way you aren't distributing anything other than code that you created (and presumably licensed in a way to allow collaboration and redistribution).

[DonSidro]

@cryptk Thanks for the headsup, ill see what i can do ;)

[Lash-L]

Interesting - surprises me that they don't seem to be doing certificate pinning on the ios side of the app.

I'll update the documentation stating that it currently only works for ios and @DonSidro if you are able to get a clear step in the documentation for android, that would be greatly appreciated!

[DonSidro]

@Lash-L I've opened a PR for this.
@cryptk if you have the time, I'd really appreciate you testing the steps and script 🙏