Roborock S6/T6 Teardown: Many screws away from getting root... (Part 1 of the rooting process)

With the introduction of the Roborock S6 and T6 (and S4/T4) models it is not possible to use the old method to get root access to the vacuum robots [see my talks to learn more about the old method]. Roborock changed the firmware format and started to sign all firmwares, sound packages and configurations. Also the manufacturer introduced geo-blocking, where the T6 model would not work outside of Mainland China. While the hardware and functionality is very similar to the S5, this step effectively prevents users from taking over control over their devices and to disconnect them from the cloud. Without root it is also not possible to defeat the geo-blocking.
This video is the first step to root the devices. Unfortunately the process is complicated and requires a disassembly of the device, which also voids the warranty. You can find the second part of the rooting process here: • Roborock S6/T6 Technic...
Before you disassemble the device, you should think about if you really require root access. If you mistrust the Xiaomi Mi Home app, you might want to try the native Roborock app to control your device. To continue you will require an UART/Serial adapter. Do not start to disassemble your device before you did not get a UART adapter (and tested it). Typical adapters use FT232RL, FT232, PL2303TA or CP2102 chips, and usually cost under 10$/€.
Find more information about previous findings on my website: dontvacuum.me
Some teardown pictures of the S6/T6 and other vacuums you can find here: dontvacuum.me/...
Technical information about Roborock and Xiaomi Robots you find here:
dontvacuum.me/...
If you want to exchange with other people about the S6/T6 and rooting, here are our Telegram groups:
t.me/joinchat/...
t.me/joinchat/...
Keep in mind, that I am not an experienced KZbinr, therefore the quality of the video and audio might not satisfy your expectations. Leave a comment if you have helpful advice about things I can improve.
You need to remove in total 58 screws:
7 x big screws from the bottom plate
8 x front bumper
12 x short screws
21 x long screws
2 x PCB button board
3 x LIDAR
4 x PCB
1 x Sidebrush (captive screw)

[@konspikuous420]

S6 painted the floor with dog mess. Cleanup required a complete teardown. This video was key in reassembling it all. Big thanks!

[@JdsChief]

Very, very useful, even for the S4. I was able to use this video to flash my S4 with Valetudo. There were two hiccups, but one was from a failure midway through from my UART bridge. It took a little while to figure out that was the culprit. However, Dennis and I figured out how to easily repurpose a node MCU to do the job. The second glitch came from how the robot booted up (on B instead of A), and may have arrived that way at my house. Dennis quickly figured out how to fix the flashing for that problem. Otherwise, it went smoothly. Now I can SSH into the robot over wifi, or even over microUSB cable, since one comes off the board. It took me several hours, and you do want to go slowly and document all of the screws. There is nothing too complicated, but it is a lot of small steps, so you probably want to take your time, go slowly through them in a quiet place.

[@dennisgiese5591]

You forgot to mention that you have a spare screw ;)

[@mrbrown38]

The time you put into the overlay circles was truly helpful over other videos.

[@renaudfraisse3745]

Thank you so much, this video was of great help (had to clean the filter next to the fan to remove an error 10). Cheers

Thank you for the video. Helped me to clean output filter. And I have S6 and I have more screws on the bottom. :)

[@stefanblutke8053]

Vielen Dank für das anschauliche Video. Hat mir sehr geholfen.

[@haus_automation]

Awesome job :) Thanks for sharing!

[@dennisgiese5591]

Great to hear that it is useful. If you know people with a Roborock device (S4,T4,S6,T6), feel free to share the information ;)

[@zacktzuk]

Brilliant, thank you, helped me get rid of this error 10 nuisance.

[@alexisdrouin6569]

Thx for this video. I also had to clean the filter next to the fan.

[@gokuhs]

Thanks! Very useful! With this video i can do the maintenance, thanks for share with us :)

[@savas134]

Thank you for such helpful video 👍

[@shin310591]

Thanks for sharing !

[@user-mu1ut9uy1r]

Useful video, thx!

[@MrJbruenning]

Thanks man you help me a lot

[@tillkorten7252]

Thanks a lot for the excellent video! In your opinion, would Roborock be able to prevent this rooting process with a firmware update (for example by disabling/encrypting the UART connection)?

[@dennisgiese5591]

Thank you for your feedback ;) Technically they could block the UART, as they do in newer models. There are other rooting methods (which are a backup). But at this point I don't think that they would block UART in older models, especially as I am not sure if they have a way to update U-Boot. However they will likely lock down things in future models (like they did with the firmware updates). That's the reason why I don't immediately publish rooting methods and wait until newer firmware is out. In case of the S6/T6 they released the multi-floor feature and that a good point to release the root.

[@darksouza]

Hello Dennis, very detailed video. I have a Roborock S6 MaxV which doesn't finish the factory reset process and power blinking keeps on going forever. Is there a way to fix this using your method? Also what is the micro USB port for?

[@JosueSantiagoG]

This was amazing. However, am I to understand that there is no way to get the two big wheels out?

[@robissmm]

Does this method also works for S5 Max? As far as I can see in firmware builder S5 Max is supported. Anyway, great job, thanks !!!

[@dennisgiese5591]

The idea is the same, but it works slightly different. Roborock changed the firmware structure and hardware, which makes it very challenging. The "vinda" file is not existing anymore and they replaced the login shell. I am working right now on the documentation and tests of the root. Also Valetudo is ported, however it is more complex. There are some issues which needs to be fixed and tested in general. There is no recovery, so no second chance. I really want to avoid that people brick their devices while trying to root it. Expect some update in a few days ;)

[@_smt_]

hey @@dennisgiese5591, amazing video! Do you know something about S5 Max version? Thanks!

[@dennisgiese5591]

@@_smt_ Check this step-by-step manual: builder.dontvacuum.me/s5e-cheatsheet.txt

[@dennisgiese5591]

Whoops, in case you did not saw it yet, check this cheatsheet: builder.dontvacuum.me/s5e-cheatsheet.txt

[@_smt_]

@@dennisgiese5591 Wow! Thanks Dennis. I'll check it now. Do you know if the teardown is similar to your video for S5 Max?

[@Skans-Gustav]

Very nice description of how to tear down an S6. How many screws? I lost count.

[@mrnrod420]

This seems like it may be a helpful resource in rooting my Lydsto R1. Somehiw got myself banned from the Valetudo Telegram channel for asking questions I think or maybe sounding like a noob. I am new to the whole RE thing since I only have my associates thought I would find some help there guess not. I'll just fork and do it all on my own till i can do a PR

[@mubull]

Tks for the video. Is it necessary to remove top n bottom cover, bumper, top sensors etc to just clean the filter? Thts a lot of screws to just get rid of error 10 for s6?

[@supaaRzz]

Hi I am trying to remove the dust bin assembly from the bottom side although it seems that my right side is completely jammed and has no budge. All screws were removed. Do you know what can help?

[@karolinabodziony9543]

Hey... during the process I’ve lost the extra black filter inside... any idea where I could buy a replacement? Please help!

[@garbagedayy]

Damn you took out everything but the ONE thing i wanted which was how to take out the wheels :/

[@dennisgiese5591]

It should be only a few screws more. Maybe you see something in the pictues: dontvacuum.me/teardowns/roborock.vacuum.x6/ . I stopped taking the wheels out, as it is not really useful for rooting. Out of curiousity: why so many people are interested in the wheels?

[@zero2zero4]

@@dennisgiese5591 because the s6 is famous for getting the right wheel stuck

[@konyagabor5743]

Hi Dennis, thanks for the video. I followed each steps and cleared my filters. After assembling I keep receiving a new error saying a strong magnetic field is detected... Do you have any ideas how to fix? I have all the screws and everything...

[@aaoaaa]

Hi, can you please help me rooting the G10s Pro? The Chinese version of the new S7 maxv ultra. I am stuck with it

[@EnverOsmanov]

Great video. I suppose you have Xiaomi Mi Precision Screwdriver. Mine screwdriver is too short and fat and I stuck in the middle of the process. I will buy the one you have.

[@ciel6347]

I am looking to replace a broken speaker on my s6pure Attack on Titan edition and I just want to know before I disassemble the device if the speaker connectors are soldered or if they attach to one of the physical connectors on the PCP. If the latter, I think I should be able to just buy a used s6 on eBay and take the parts I need.

[@dennisgiese5591]

All parts are having connects. Afaik, the speaker uses a red/black wired connector. Should be trivial to replace.

[@ciel6347]

@@dennisgiese5591Thank you! By luck my speaker did not fully break from water exposure; letting the speaker dry out for 2 days was enough to restore loud volume function. Finding the part is sadly no cheap task because it's not available on AliExpress and Roborock customer support declined to sell it.

[@davidtang6614]

I need to replace the fan, can I only remove top part to get to fan or do you have to also remove bottom?

[@zero2zero4]

how do you remove the wheel?

[@JosueSantiagoG]

This is what I wanted to know. Mine went through dog poop. It seems that they don't come off???? How do I ever truly get it clean?

[@JosueSantiagoG]

Did you figure it out?

[@zero2zero4]

yes. try this kzbin.info/www/bejne/Zqevkmdjns6esK8 & kzbin.info/www/bejne/e4S1lGWppbJ7e7s

[@MrPisekot]

Hi. Is there a soldered accelerometer and gyroscope module on the board? Or is it part of a separate module?

[@dennisgiese5591]

Its seperate in the back of the unit, next to the speaker.

[@njmaverick7]

Hey mate, I was wondering if you know the pinout for the motor connector on the board. I believe two are for +14V, GND, two others for the direction I/O. Could you help me with that?

[@dennisgiese5591]

Not really :( I did not measure the voltage on the wheels. A while ago I was looking at the Dreame robots and they seem to have a 12V and 16V pins. But I was never really looking into the wheels.

[@susantasharma]

Hi, it was such a great video. I have also visited your website. Full of valuable informations are there. I wonder if you have detailed spec regarding Ecovacs DEEBOT T9AIVI (RAM, FLASH, CPU etc.). Thanks in advance.

[@rkvkydqf]

Wow! What company is so scared as to make you reassemble the device to make it work locally.

[@garthwatkins1711]

One that is not sold locally this up until recently was only available in Asia being Chinese based and the number one selling robot vacuum cleaner in china and Asia. I bought my first one in Hong Kong 5 years ago and only locally released about 3 years ago but with no service department. The vacuum parts are very cheap and the vacuum is very easy to service and replace parts yourself if your careful.

[@jasonseebaluck]

Great video. Have used it multiple times. Anyone had any thoughts off swapping a T6 mother board and replacing with an S6? I have a T6 and don’t fancy flashing. But managed to find an S6 motherboard. Any thoughts?

[@davidarango2207]

Any clue if alternative mopping/sweeping patterns, like cross passes or Y-mopping (from viomi) could be implemented now that root is a reality?

[@dennisgiese5591]

Not really. The patterns are implemented somewhere deep in the software. It would be tricky without source code or a lot of reverse engineering to change that.

[@martinrognoli9337]

Hi, sorry. I have looking for a lot of info related to this. I have a S5 chinese version and i want to use it outside china, S5 need to be byspassed this way too. Or that model could be updated without doing all this process. There still is a way to do it only by software? Your answer will means a lot to me, all the information that i get is from some years ago and nothing of that solutions are working right know. Thanks! -btw sorry for my english -

[@dennisgiese5591]

Thankfully the region change for the S5 is not as difficult as for the newer models. Download these files and follow the readme: github.com/dgiese/dustcloud/tree/master/devices/xiaomi.vacuum.gen2/CN_to_EU_script

[@martinrognoli9337]

@@dennisgiese5591 Thanks a lot! I was looking for something like this so long. The readme content is a little short, the file doesn´t have so mucho info about copying the files to the vacuum. Do you know any tutorial or something similar to follow to make it happen? I haven´t so much knowledge about coding and another stuff needed. Thanks again. Martin.

[@allenwhipps1233]

I watched because I wanted to see the 'noise reduction filter.' I keep getting 'filter is clogged' meaning that it thinks that the other filter is clogged. I suspect that it is the back side of the noise filter that has picked up enough dust and debris to impede the air flow. I think that not blocking the exit of air would make the vacuum work better as a vacuum although increasing the noise. Have you tried just taking out that filter? it looks like it is some sponge material although, from the outside, it is a grid of tiny holes.

[@dennisgiese5591]

I think I just left it at some point by accident, because I forgot it while reassembling. So technically it should work without the additional filter. But I am not sure if removing solves your problem. Sounds more like a hardware issue.

[@rickscott4911]

Very late reply, but there's also a mesh filter under the fan axle which was half clogged on my unit and contributing to the Error 10

[@plexflymate1478]

Hey Dennis aufgrund von Akku Problemen roote ich mein Xoami mi Robot vaccum v1 nun auch der hat das Ruby MB V5 an welchen Port soll RX / TX ?

[@gsfahrer92]

Hast du es rausgefunden? Da stecke ich gerade auch fest

[@silvar05123]

@@gsfahrer92beim v1 hatte ich doch noch eine Rootbaare Firmware ohne RX und TX zu Brücken ich musste lediglich ein Firmware reset machen und den neuen Sync Key aus der App auslesen dann ging das rooten

[@stanisawbiaas827]

Hi There can you explain how to run this robot without - WiFi - ex. disconnecting some wire from the board etc.?

[@dennisgiese5591]

If you rooted it, then you can just disable the wifi card (or disable WPAsupplicant). You would still have access over USB and can reenable it.

[@stanisawbiaas827]

​@@dennisgiese5591 Thank you for reply. That makes me very happy. I try to limit WIFI waves in my environment.

[@DheeraVenkatraman]

Does the procedure differ for the S6 Pure?

[@dennisgiese5591]

The commands differ, but the overall process is the same. Check this document: builder.dontvacuum.me/s5e-cheatsheet.txt The more important question is, if there are cheaper and better alternatives for you, like Dreame robots.

[@AlexManMe]

Hey there will this enable me to use my T6 outside of China? I purchased mine in China at the end of last year November. However when I bought it back to the UK it didn’t work

[@dennisgiese5591]

You can change the region if you install a custom firmware. Or you just replace the cloud with Valetudo ;)

[@AlexManMe]

@@dennisgiese5591 thank you, I will definitely try this out before opening the thing up :-)

[@SusenStrzempek]

Interessantes Video aber warum man nur ein Model hackt wo doch fast alle männlichen youtuber ganze saugroboter farmen haben würde mich sehr interessieren. Sieht für mich doch schwer nach einbruchsvorbereitung aus. Natürlich kann ich voll falsch liegen aber in Verbindung mit maps der saugroboter ist das ja wohl nicht ausgeschlossen. Vielleicht kommt ja mal ein Kommentar warum nur ecovacs staubsauger gehackt wurden sind und nicht allgemein gültig mehrere Modelle. Gut zu den hiesigen heutigen Begriffen des namens sichheitsforscher habe ich mal andere masstäbe gelernt. Aber past schon bei den einen können die Anforderungen nicht hoch genug sein bei anderen nicht tief genug. Zieht sich ja alles durch dieser Humbug. Denn nach Maßstäben die mir erklärt wurden sind, ist dieses Video kein hack mehr aber das entscheiden da eh alle anderen und ich bestimmt nicht.

[@MaDX78]

does the usb port on pcb is powered ? I plan to attach a raspberry pi zero to it with a camera

[@dennisgiese5591]

Not sure if you can pull enought power from it, even if it would. But you might be able to get some power from the pcb (e.g. the WiFi module)

[@MaDX78]

@@dennisgiese5591 ok 🙏

[@gabi.bialas]

Is it possible to turn off the WiFi on roborock S6?

[@dennisgiese5591]

I think so. But then you cannot access it any more (except via USB)

[@johnadams3038]

This robot has a really bad design, you can never clean it completely.. the convenience is lost when you spend hours cleaning that sucker

[@dennisgiese5591]

Yep. But thats the case for all robots...

[@johnadams3038]

@@dennisgiese5591 There’s hairs and dirt under the warranty plate, I had to take it off to clean it.

[@JosueSantiagoG]

@@dennisgiese5591 which one have you found to be the was easiest to truly clean?