Hacking a Neato Robotics BotVac Connected

[korttoma]

Does this mean that we can look forward to seeing some kind of HA integration?

[Miamijerry]

@hek

I will have a Botvac Connected to test with soon, hope to get it working with Vera.

[Brutus]

I now have the Botvac connected and want to interact with it in Domoticz.

To bad neato isn't willing to help us out so I downloaded the stripped app file.

Can maybe someone put me in the right direction to extract some commands in these files.
There are a lot of files and I don't know which one to use.

Thank you.

[mfalkvidd]

http://youtu.be/Vua9Z_8aESA is an introduction to Android reverse engineering. It might be useful.

[hek]

@Brutus

Sorry haven't had time to do much cleaner-hacking during x-mas here. But I must have stripped a bit too much from the zip above (the initial pack was way too big to upload here)..
Might be easier if you decompile apk yourself to get the full file list.
http://www.javadecompilers.com/apk

Anyhow a good starting point would be /res/values/strings.xml which contains the service endpoints

<string name="beehive_endpoint_staging">https://beehive-staging.neatocloud.com</string>
 <string name="cometa_endpoint_playground">https://cometa-playground.neatocloud.com</string>
 <string name="cometa_endpoint_production">https://cometa.neatocloud.com</string>
<string name="cometa_endpoint_staging">https://cometa-staging.neatocloud.com</string>

Then you can follow that back in the program where it's used.
/com/neatorobotics/android/p032e/p042j/C0746c.java
Then search for C0746c and so on...

[Brutus]

Thank you for your help.
I have downloaded the "APK Downloader" add-on for Firefox (https://addons.mozilla.org/nl/firefox/addon/apk-downloader/) and followed the instructions.
After downloading te APK I decompiled it at the given website. I now have almost 3000 files ;)

Will look in the files later. Hope I can find something usefull. Its the first time for me.

I was wondering did you already find something usefull to use?

Have a nice day to you all.

[sundberg84]

@hek I was looking at the Neato as well - except it was hart to HA integrate, are you happy with the robot?

[hek]

There is nothing wrong with its cleaning abilities. Impressed by their room scanning algorithm.

[m26872]

@hek I'm surprised you didn't research for maximum open source/HA support in first time. Suppose it's to late to change it now? Even if it's easy to hack this one, I think it's a good general principle - to a certain price of course.

[hek]

Yeah, yeah.. usually good at doing research.. But this one was a black friday find... Didn't have time to do my homework.. :/ Have to pay for that now ....

[m26872]

@hek ... but you'll also have more fun. 😉

[Brutus]

@hek

I am now looking at the files you provided. I can't get some logic out of it.

You gave some service endpoints and then you pointed to the java file. I don't see the link between these two.

Sorry for my noob questions i'm not an programmer.

I am only looking for a why to implement the Neato in my domoticz home automation. But google gives very little help. Only desent hit was this link.

Greetings.

[kalle]

Maybe this will help:

https://www.neatorobotics.com/resources/programmersmanual_20140305.pdf

https://groups.google.com/forum/#!msg/hbrobotics/zKz_33SD7ys/NSV1gjhiIj4J

[Brutus]

@Kalle ... I think this isn't for the Neato Botvac Connected. It has a USB port, but we want to control it through the wifi connection it has.

[mfalkvidd]

I agree that the wifi api seems more natural, but connecting an Arduino to the usb port might prove easier since documentation of the usb api is available.

[tbowmo]

It seems (from a quick glance) that you need a USB host device, connected to that USB port.. So that would leave a standard arduino out of the question.

Perhaps an raspberry, or another higher end platform running an OS, could be used..

[Yveaux]

@kalle Chances are that the commands & format are identical for the newer wifi model -- companies tend not to reinvent the wheel for each product ;-)
You'd only have to find out how these commands are transfered to the BotVac.

[Daniel Eriksson]

What I have come up with so far is that the Neato it self is running a websocket server on port 8081 - and uses some kind of standard Auth-behavior in the headers,

Hypertext Transfer Protocol
GET /drive HTTP/1.1\r\n
Host: xxx.xxx.xxx.xxx:8081\r\n
Sec-WebSocket-Key: XXXXXXX==\r\n
Sec-WebSocket-Version: 13\r\n
Upgrade: websocket\r\n
Origin: ws://xxx.xxx.xxx.xxx:8081/drive\r\n
Date: Tue, 29 Dec 2015 09:17:57 GMT\r\n
Authorization: NEATOAPP XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\r\n
Connection: Upgrade\r\n
\r\n
[Full request URI: http://xxx.xxx.xxx.xxx:8081/drive]
[HTTP request 1/1]

There also a port 8080 open but I can not figure out what's running on that one.

The communication between the Neato and the central server is handled via a server on Amazon - this traffis is HTTPS though. Next step is to set up a SSLSplit and hope that they don't have a pinned cert.

[hek]

Nice find @Daniel-Eriksson,

Do we really need to know what's happening between the Neato <-> Cloud?
My initial though was to mimic the app to poll status and send commands via the cloud service.

[Daniel Eriksson]

If we can figure out what's going on between Cloud <-> Neato we can do a version which is in depended on the Cloud-service being online or not - which also means that we can disallow it internet access