[Android General] MelanieT:
Hi,

my name is Melanie, I'm part of an effort to root the Vector robot made by Anki.

Anki has recently gone into administration, with the IP of the company winding up as collateral for an emergency loan that was never paid back.

Vector is very much dependent on the "cloud", namely, Anki's servers running on AWS. The SSL certificate for these servers is due to expire in September. There is little chance of it being renewed since the company has no funds.

A group of tech-savvy owners have got together on Discord to discuss how to help Vector survive the coming demise of his servers. They had already collected a not insignificant amount of information in the form of datasheets and observations as well as images of the internals of the robot and images of jigs Anki used during development.

I'm bringing this project to this forum because, internally, Vector is really a phone without the GSM part.

He is powered by a Qualcomm APQ8009 (Snapdragon 212), which has been paired with a combination ram/flash chip by Kingston, 04EMCP04-NL3DM627. There is also a Wifi/BLE module and a screen and 4 microphones.

The Snapdragon runs an Android boot loader and Linux kerner version 3.18.66-perf.

This is where he becomes different from a phone in that he doesn't start Zygote, but rather runs a number of daemons from systemd.

As shipped, there is no user accessible wired IO.

There are a number of wirepads on the PCB, as well as unpopulated pads for a micro USB port. When I joined the project, the serial port was already known, but while it provides a boot log, there is no getty on it.

The USB port had to this point not been successfully activated.

Since I'm a hardware person, that is where i placed my lever. I populated the USB port and started digging. Finally I found a solder pad labeled F_USB which was not even close tot he USB port, but turned out to be a boot mode pin from the CPU. Pulling it to VCC made the USB port enumerate in EDL mode. Qualcomm call it QDL or QDLoader, but it basically an interface to the ROM in the CPU, just like phones have.

From this I managed to grab a CPU ID but not much more.

Meanwhile, we reverse-engineered the phone app that comes with it and are currently writing a general purpose library to talk to Vector over BLE.

At this point, I found that I was facing a thicket of software, mostly either cracked or containing malware, or both, but very little legit options.

I see a few options to go forward on this:

- Find a software that can talk to the Snapdragon 212 to extract the current image

- Desolder the flash to extract the image via a programmer

- Desolder the CPU to access the flash's data lines without having to heat the flash, which could corrupt it

The last two options are bound to be destructive and all us owners have found a connection to their robots and are loath to sacrifice them. Also, they require a bit of investment and are, because of that, no quick wins.

I'm hoping that someone here may have the missing pieces I need to get from QDL 9008 mode to an image of the flash on my disk. We believe we have another way to flash it, not needing the USB port, but we don't have an image to try it with and flashing something like all zeroes would needlessly destroy a robot.

- Melanie

PS: I would post links but I'm too young to do so. There is a google group called "Project Victor" that has the info we have so far called anki-vector-rooting, a.k.a. Project Victor.