Reverse engineering project for the 3irobotix CRL-200S robotic vacuum cleaner. This repository documents the hardware architecture, communication protocols, and component specifications discovered during the process of understanding and rebuilding the robot's functionality from scratch.

Based on the research in this repository, a complete custom firmware has been implemented in Rust:

VacuumTiger - Open-source firmware platform for autonomous vacuum robots

Drishti - Real-time diagnostic visualization and control interface

• Configuration-driven architecture: Define sensors and actuators in JSON
• Generic TCP protocol: Any SLAM application can control the robot
• High performance: 500Hz sensor updates with sub-25ms command latency
• Minimal footprint: ~3,000 lines of Rust with no proprietary SDKs

This repository focuses on the reverse engineering research that made VacuumTiger possible:

• Hardware Reverse Engineering: Document PCB layout, identify components, and map connector pinouts
• Protocol Analysis: Decode communication protocols for sensors and peripherals
• Firmware Analysis: Understand original system architecture and binary protocols

• Lidar sensor protocol decoded and documented
• Real-time Lidar visualization tool (Python)
• Main motherboard component identification
• Connector pinout mapping and documentation
• A33-GD32F103 communication protocol reverse engineered
• Original firmware binary analysis (AuxCtrl process)
• Device access methods (SSH, debug mode) documented
• Custom firmware implemented → VacuumTiger

• Detailed circuit analysis and tracing
• Complete command ID mapping for MCU protocol

The 3irobotix CRL-200S uses a dual-processor architecture:

• Main CPU: Allwinner A33 (ARM Cortex-A7 Quad-Core) - likely handles high-level logic, WiFi, and user interface
• Motor Control MCU: GigaDevice GD32F103VCT6 (ARM Cortex-M3) - handles real-time motor control and sensor interfacing
• Lidar: 3irobotix Delta-2D with UART interface
• Memory: 4Gbit DDR3L RAM, 2Gbit NAND Flash
• Power: X-Powers AXP223 PMIC, 4-cell Li-ion battery with CN3704 charge controller
• Connectivity: Realtek RTL8189ETV WiFi module

1. Lidar Sensor Analysis - Protocol specification, pinout, and visualization tool
2. Motherboard Analysis - Component identification, connector mapping, and circuit analysis
   • Component Diagram - Detailed component identification and connections
   • Connection Evidence - A33-GD32 hardware connection analysis

3. GD32F1 MCU Protocol - Communication protocol between A33 and GD32F103
   • GD32 Protocol - VERIFIED ⭐ - Complete verified protocol specification (RECOMMENDED)
   • Protocol Discovery Changelog - Evolution of understanding through 5 phases
   • CRC Algorithm Discovery - XOR checksum reverse engineering
   • Initial Protocol Analysis - Binary reverse engineering (contains outdated info, see notes)

4. Software & Firmware Analysis - Original firmware analysis, system architecture, and device access methods
   • AuxCtrl Binary Details - Deep analysis of the AuxCtrl process
   • Serial MITM Approach - PTY-based protocol capture method
   • Serial Logging Guide - Tools and techniques for packet capture
   • Test Results - Protocol testing outcomes

5. Firmware Projects - Rust-based firmware for Allwinner A33
   • AuxCtrl-Rust - Open-source GD32 communication library
   • Lidar Reader - Rust library for 3iRobotix Delta-2D Lidar

Real-time visualization tool for the 3irobotix Delta-2D Lidar sensor.

Requirements:

pip install pyserial matplotlib

Usage:

1. Connect Lidar to USB-UART adapter
2. Update serial port in scan.py (line 5)
3. Run: python Research/Lidar/scan.py

The tool displays a real-time polar plot showing distance measurements at 360 degrees.

To enable extended debugging and logging:

1. Create file /mnt/UDISK/debug_mode on the device
2. Reboot or restart the Monitor process
3. Logs will be written to /mnt/UDISK/log/

See Software Analysis for more details on the system architecture.

This is a personal reverse engineering project. Documentation improvements, protocol discoveries, and hardware analysis are welcome.

Apache 2.0 - See LICENSE file for details.