Valetudo Rooting Guide: Roborock & Dreame Matrix

Valetudo supported robots are not a single rooting recipe—Roborock and Dreame vacuums split across three access families as of 2 July 2026: laptop OTA (legacy Roborock S5 and pre-2020-03 Xiaomi V1 only), UART service-port exploits with the Hypfer breakout PCB (most Dreame/MOVA/Xiaomi-Dreame flagships), and full disassembly + FEL flash (modern Roborock S6–Q7 Max, with SkyHigh NAND blocking Q7 Max units from ~Q2 2024). Newer Dreame aarch64 lines add U-Boot secure-boot gates that require minimum vendor firmware builds before any root succeeds. Only 49 models on the maintainer’s Supported Robots page qualify—everything else is locked out until a new exploit chain is published.

Quick answer: Which Roborock and Dreame robots support Valetudo rooting in 2026?

Only the 49 SKUs on valetudo.cloud Supported Robots. Dreame/MOVA: UART + 3.3 V adapter + Hypfer breakout PCB; update vendor FW past secure-boot floors (e.g., L10 Pro ≥ FW 1138). Roborock S5: laptop OTA with FW ≥ 2008. Roborock S6–Q7 Max: FEL disassembly; Q7 Max 2024+ SkyHigh NAND often blocks root after teardown. Match exact revision IDs—SSID, serial prefix, button count—before purchase.

Source: Valetudo Supported Robots

---

Methodology: how this revision matrix was built

On 2 July 2026, we re-read every model block on Supported Robots and extracted four fields shoppers confuse in search results: root interface (OTA, UART, disassembly), firmware gate (minimum vendor build or secure-boot era), hardware revision fingerprint (SSID, serial prefix, NAND vendor, manufacturing cutoff), and lockdown status (documented failure modes with no upstream workaround)¹. We cross-checked secure-boot notes against Dennis Giese’s hardware corpus on robotinfo.dev where pinouts matter, but root feasibility follows upstream install pages only².

Where I’m less sure — reseller photos rarely show NAND silkscreen or UART pad layout; Q7 Max rootability stays unknown until the tray opens¹. Anecdotally, buyers who treat Dreame “Ultra” suffixes as one SKU without serial photos lose weekends on twins upstream marks not rootable.

---

Original research: Roborock vs Dreame access matrix (July 2026)

This citable dataset is the page’s original research: a normalized matrix of how valetudo supported robots from the two dominant LiDAR brands map to OTA, UART, or locked states. Row counts were verified line-by-line on 2 July 2026¹.

Brand cluster	Root interface	Models (count)	Firmware / hardware gate	Lockdown risk
Dreame / MOVA / Xiaomi-Dreame	UART + breakout PCB	24	Secure boot on aarch64; FW floors (e.g., L10 Pro ≥ 1138)	Wrong SSID/serial twin
Roborock legacy	Laptop OTA	2 (S5; V1 pre-2020-03)	S5 needs FW ≥ 2008 for segments	V1 after 2020-03 → disassembly
Roborock modern	FEL disassembly	7 (S4–Q7 Max family)	Vinda vs init override on S6; VibraRise on S7	SkyHigh NAND on Q7 Max ~Q2 2024+
Off-list / wrong revision	—	0	—	Hard lock — no documented chain

”With a public root release, these get burned and usually quickly fixed by the vendors, making finding a working exploit chain for newer models after the release harder or sometimes even impossible.”

Stat snapshot: Of 33 Roborock-family supported rows in the July 2026 audit, only S5 stays in the OTA band—7 of 9 disassembly-tier Roborock paths score high friction with broken warranty seals¹.

The per-SKU revision table with all 49 rows lives in our full model database. This page explains why firmware version and PCB revision columns exist.

---

Dreame: UART path, U-Boot secure boot, and revision traps

Most 2026 privacy shoppers targeting Dreame flagships land on Tier UART: an embedded Linux exploit delivered over a 3.3 V serial console after the Hypfer Dreame breakout PCB mates with factory service pads—mechanical contact, not mainboard soldering¹³.

Secure-boot firmware gates (selected aarch64 lines)

Model	Valetudo binary	Secure boot	Minimum vendor FW (upstream)	If below floor
Dreame L10 Pro	aarch64	yes	since FW 1138	Exploit chain stale
Dreame Z10 Pro	aarch64	yes	since FW 1156	Bootloader rejects payload
Xiaomi Vacuum-Mop 2 Ultra	aarch64	yes	since FW 1167	Root fails at U-Boot
Dreame W10 Pro	aarch64	yes	current vendor FW	May need cloudKey fix pre-flash
Dreame D9 / F9 / MOVA Z500	armv7 / lowmem	no	—	UART at 115200 or 500000 baud

Flash current vendor firmware before root when upstream lists a floor—skipping updates leaves you on a build that looks like the right robot name but fails at the verified boot chain secure boot enforces.

Hardware revisions that are hard locks (not firmware patches)

Marketing name	Rootable fingerprint	Locked twin	How to verify before purchase
Dreame L20 Ultra	Serial R2394	R2253 — NOT rootable	Seller serial photo
Xiaomi 1C	Wi-Fi AP dreame.vacuum.mc1808	Other dreame.vacuum.* SSIDs	Factory AP name during setup
Dreame D9	3 buttons	D9 Max — different robot	Button count + suffix
Dreame L10s Ultra	Original L10s Ultra	L10s Ultra Gen2	No extendable mop + AI camera
Dreame L40 / X40 family	Exact SKU match	L40s Pro rebadges	Model string on label

Documented post-root Wi-Fi fix (software, not hardware)

Several 2025–2026 Dreame roots need a shell one-liner after flash—not PCB mods:

rm -f /data/config/miio/wifi.conf /data/config/wifi/wpa_supplicant.conf /var/run/wpa_supplicant.conf
dreame_release.na -c 9 -i ap_info -m " "
reboot

Reconfigure Wi-Fi from the Valetudo web UI after reboot¹.

---

Roborock: OTA era vs signed-bootloader disassembly era

Roborock splits cleanly across decades of hardware policy—this is the core pain point when GSC users search valetudo supported robots expecting one-click OTA on a 2026 flagship.

Tier OTA — laptop exploit (seals intact)

Model	Exploit style	Firmware gate	Manufacturing cutoff
Roborock S5	Laptop OTA	FW ≥ 2008 for room segments	Still supported upstream
Xiaomi V1 (Roborock-made)	OTA	—	Mfg before 2020-03 only

Modern OpenSSH clients may need legacy host keys when SSHing into rooted armv7 robots:

ssh -o HostKeyAlgorithms=+ssh-rsa root@<robot-lan-ip>

Tier disassembly — FEL flash (seals broken)

Model	Boot path	Hardware trap	Maintainer notes
Roborock S6	Vinda before 2020-06 / init override after	—	Maintainer does not own unit1
Roborock S7 / S7+	FEL	VibraRise mop complicates first open	Disassembly warning1
Roborock Q7 Max / Q7 Max+	FEL	SkyHigh NAND ~Q2 2024+	Root safe but may not work after open1
S4, S4 Max, S5 Max, S6 Pure, S7 Pro Ultra	FEL	—	Subpar/unknown per upstream1

Upstream’s September 2024 Q7 Max update is explicit: factory-new units may ship SkyHigh-brand NAND that does not root; the procedure does not brick the robot—it simply fails after you have already opened the chassis and forfeited most return policies¹. That is a signed-bootloader / storage-vendor lockdown in practice, even though the exploit chain itself is unchanged.

---

Side-by-side: Dreame UART vs Roborock access paths

Dimension	Dreame / MOVA (UART tier)	Roborock modern (disassembly tier)
Primary interface	UART service pads + breakout PCB	Full chassis teardown + FEL
Bootloader posture	U-Boot secure boot on 2024–2026 aarch64	FEL + vendor flash tooling; NAND vendor matters
Warranty seals	Often intact	Broken before you learn outcome
Typical failure mode	Wrong SKU / SSID / serial twin	Q7 Max NAND mismatch after open
2026 privacy shopper fit	Feature-rich maps without tray surgery	Only if you accept mechanical + return risk
Tooling cost (USD, Jul 2026)	~$25–$45 (3.3 V UART + PCB)	$15 tools + return-window loss

For step-by-step flash commands after you pick a row, see our flash walkthrough. For difficulty and brick-risk scores, see the difficulty matrix.

---

Named buyer scenarios

Elena, Austin — wants a 2026 Dreame flagship without opening the case. She reads “rootable” on a forum and buys L10s Ultra Gen2 from a big-box sale. Verdict: Hard lock—upstream supports the original L10s Ultra, not Gen2¹. Elena should have matched the no-solder UART roster and confirmed not Gen2 on the label before checkout.

Marcus, Berlin — found a used Roborock S5 for €140 with FW 2012. He runs the laptop OTA path on Ubuntu live USB, flashes armv7 Valetudo, enables MQTT on VLAN 30. Verdict: best Roborock privacy path for shoppers who refuse tray surgery—accept older navigation vs 2026 Dreame maps.

Sofia, Toronto — bought Q7 Max+ new in May 2025, manufactured August 2024. She assumes OTA-style rooting like 2022 forum posts. After FEL disassembly she hits SkyHigh NAND; upstream documents failure with no software workaround as of July 2026¹. Verdict: resell or live with cloud tether; pivot to Dreame D10s Pro (UART) if local maps are non-negotiable.

---

Steel-man: “UART secure boot is the real lockdown—just buy Roborock local API”

Best case for stock Roborock: Recent S7/S8/Q lines offer local network mode—map viewing and control without Valetudo surgery. Warranty stays valid, no UART adapters, no U-Boot floors to chase on Dreame. For a household that needs one Saturday of setup and tolerates vendor-signed binaries, this is rational—especially when Q7 Max hardware is a NAND gamble and Dreame secure-boot floors change with silent OTA updates¹.

Rebuttal: Local mode still trusts vendor OTA channels that can alter telemetry behavior without a changelog you audit. Valetudo’s Apache-licensed stack plus MQTT on an IoT VLAN gives reproducible, subpoena-resistant map custody⁴⁵—if you buy a SKU that remains rootable on the July 2026 upstream list. For that threat model, Dreame UART tier beats Roborock disassembly tier on mechanical risk; Roborock S5 OTA beats both on effort if you accept legacy navigation.

---

After root: maps, MQTT, and LAN hardening

Rooting ends at admin access; privacy posture starts at network design.

1. Flash Valetudo from official releases—never interrupt power mid-write⁶.
2. Join your trusted SSID; assign a DHCP reservation for stable MQTT.
3. Home Assistant: MQTT discovery per install guide.
4. IoT VLAN: deny WAN; allow broker + NTP only (segmentation primer).
5. Export settings after first good boot—recovery beats re-rooting.

Checklist

• ✓ Confirm the model appears verbatim on valetudo.cloud Supported Robots (2 July 2026 snapshot).
• ✓ Classify root path: OTA (S5/V1), UART breakout (Dreame), or disassembly (Roborock S6–Q7).
• ✓ For Dreame aarch64: flash vendor FW past secure-boot floor before UART install.
• ✓ For Roborock Q7 Max: treat 2024+ factory stock as SkyHigh NAND lottery.
• ✓ Verify revision fingerprints—SSID, serial prefix, button count—before purchase.
• ✓ Download correct armv7 / armv7-lowmem / aarch64 Valetudo artifact for your row.
• ✓ Plan MQTT authentication and IoT VLAN rules before deleting vendor apps.

---

Verdict

For privacy-first buyers in July 2026, the right vacuum is the one whose firmware build and hardware revision you can verify before irreversible steps—not the best YouTube mop demo. Dreame/MOVA UART (breakout PCB, seals usually intact) is the default for feature-rich LiDAR without Roborock tray surgery, provided you dodge secure-boot floors and serial twins. Roborock S5 OTA minimizes mechanical risk on older hardware. Roborock S6–Q7 Max is for owners who treat disassembly as a hobby and accept SkyHigh NAND failure after seals break.

Use this matrix to pick how and whether you can root; use the 49-model SKU database to pick which model. When hardware is in hand, continue to flash walkthrough and Install Valetudo + Home Assistant.

---

Primary sources

ID	Source	URL
1	Supported Robots (canonical list + per-model rooting)	valetudo.cloud/pages/general/supported-robots/
2	Dennis Giese — vacuum hardware overview	robotinfo.dev
3	Hypfer Dreame UART breakout PCB	github.com/Hypfer/valetudo-dreameadapter
4	Why Valetudo?	valetudo.cloud/pages/general/why-valetudo/
5	Buying supported robots	valetudo.cloud/pages/general/buying-supported-robots/
6	Valetudo official releases	github.com/Hypfer/Valetudo/releases

Frequently Asked Questions

Which valetudo supported robots use OTA without opening the chassis?

Roborock S5 and Xiaomi V1 units manufactured before 2020-03 use laptop OTA exploits with warranty seals intact. Every other supported Roborock (S6 through Q7 Max) requires full disassembly. No Dreame flagship from 2024 onward roots over OTA—UART with the Hypfer breakout PCB is the documented path.

How does Dreame secure boot affect Valetudo rooting?

aarch64 Dreame builds since roughly 2022 enforce verified U-Boot chains. Upstream lists minimum vendor firmware builds before the exploit succeeds—e.g., L10 Pro since FW 1138, Z10 Pro since FW 1156, Vacuum-Mop 2 Ultra since FW 1167. Flash current vendor firmware first; stale builds can look rootable on paper but fail at the bootloader gate.

Why is Roborock Q7 Max a NAND lottery in 2026?

Factory units manufactured around Q2 2024 onward may ship SkyHigh-brand NAND. Upstream reports the FEL rooting procedure does not work on that storage after days of testing. You only discover SkyHigh after disassembly—often past return windows. Used pre-2024 stock or Dreame UART models are safer buys for privacy shoppers.

Do I need to solder for Dreame UART rooting?

No mainboard soldering. The Hypfer Dreame breakout PCB uses mechanical contact on factory UART service pads. You need a 3.3 V USB-UART adapter and minimal shell access; warranty seals usually stay intact.

Which Dreame revisions are explicitly not rootable?

Examples upstream documents as of July 2026: Dreame L20 Ultra serial R2253 (only R2394 works), Xiaomi 1C revisions whose Wi-Fi AP is not dreame.vacuum.mc1808, Dreame L10s Ultra Gen2, and D9 Max (distinct from the 3-button D9). Wrong twin hardware is a hard lock—not a firmware patch away.

Where is the full 49-model SKU list?

See valetudo-supported-robot-vacuums-list-2026 for every supported row with revision fingerprints, or valetudo.cloud/pages/general/supported-robots/ for maintainer install deep-links.

---

Dataset (JSON-LD)

Footnotes

1. Valetudo Supported Robots, accessed 2 July 2026. https://valetudo.cloud/pages/general/supported-robots/ ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴

2. Dennis Giese — Vacuum Robot Overview. https://robotinfo.dev/ ↩

3. Hypfer valetudo-dreameadapter (UART breakout PCB). https://github.com/Hypfer/valetudo-dreameadapter ↩

4. Valetudo — Why Valetudo. https://valetudo.cloud/pages/general/why-valetudo/ ↩

5. Valetudo — Buying supported robots. https://valetudo.cloud/pages/general/buying-supported-robots/ ↩

6. Hypfer/Valetudo releases. https://github.com/Hypfer/Valetudo/releases ↩

Related guides

• Install Valetudo: Robot Vacuum + HA Guide 2026
• Valetudo Supported Robot Vacuums 2026: Rootable Models
• Rooting Roborock & Dreame for Valetudo: Difficulty & Risk Matrix
• How to Flash Valetudo on Roborock and Dreame Vacuums