HangZhou Yushu Tech Unitree Go1

Looking for Quadruped friends? Join "The Dog Pound animal control for Stray robot dogs" slack group: <br> https://join.slack.com/t/robotdogs/shared_invite/zt-24ep8mqn4-1p42Aq7owRv9klLI~3C5Pw<br>

Looking for a Unitree Go1 Air, Pro, or MAX hack to enable EDU low-level functions? Look no further than Unitree Go1 Free-Dog SDK featuring 'faux-level' support! from Former "DJI Slack OG" @bin4ry

If you like this repo, fork it... Click to Fork https://github.com/MAVProxyUser/YushuTechUnitreeGo1! Make sure you keep your forked copy up to date, lots of changes happen over time. You won't want a stale copy.

Table of Contents

宇树科技 HangZhou Yushu Technology (Unitree) go1 deep dive & unofficial development notes:

• HangZhou Yushu Tech Unitree Go1
• Robot Internal Architecture
• Expansion Header
• Cameras - Super Sensory System
• Programming interface
• Update interface
• Upload interface
• SDK usage on non EDU models
  • Requirements
  • Example Walk on Unitree go1 pro
  • ros2_udp & ros2_walk_example
  • ROS1 examples
• Passwords
• Backup internal flash on all devices
• Power Output
• Installing TCPdump on the RasPi
• Sniffing MQTT traffic on the dog
• Sending MQTT commands to the dog.
• STM32 MicroROS?
  • TFTP to RToS
  • What talks to the STM at 192.168.123.10?
• MIT Cheetah code
  • Backflip
• Bluetooth
• Mobile App
• 4G / 5G support
• 4G use in the USA
• GPS from 4G module
• Wifi backdoor
• Autostart items
• PDB emergency shut off (backdoor? no way to disable)
• Troubleshooting
  • Stop dog from standing up at boot (Disable triggers)
  • General software repair
• Go1 series Product Matrix
  • Go1 (TM?)
  • Go1 Air
  • Go1 Pro
  • Go1 Pro MAX
  • Go1 Nx
  • Go1 MAX
  • Go1 Edu
  • Go1 Edu Plus
  • Go1 Edu Explorer

One of the first affordable affordable quadrupeds on the market is sold by Unitree Robotics. The marketing has exploded out of seemingly no where, and now the dogs are seemingly everywhere. Often confused as "Boston Dynamics Spot", or specifically being a "knock off Spot" the Go1 series is hard to miss these days. This likely started with the artificially low advertising cost. Beefed up marketing videos sold everyone on the low cost Air version of the dog, while hyping features of the EDU model.

"This $2,700 robot dog will carry a single bottle of water for you: Who needs a tote bag when you have a little robot butler?"<br> <br>

The reality is a "usable" version of the dog that can actually be programmed can never be obtained for $2700. This cost is reserved alone for the basic "RC" version of the dog, a version with no extra internal computing capability. Never mind the import costs, or artificial $1000 support overhead costs tacked on by most distributors at the request of Unitree.

Robot Internal Architecture

The Unitree go1 dog is in essence an evolution of MIT Cheetah SPIne architecture. https://dspace.mit.edu/bitstream/handle/1721.1/118671/1057343368-MIT.pdf

In the Unitree design a Raspberry Pi & multiple Jetson boards take places of the Intel "UP" board in the Cheetah design. The RS485 network and STM32 motion processing is nearly identical. You can in fact easily find reminants of the Cheetah code in the Legged_sport binary from Unitree.

<p align="center"> <img src="https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/NetworkLayout.png"><br> </p> <p align="center"> <img src="https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/FlowChart.png"><br> </p> <p align="center"> <img src="https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/sdk.png"><br> </p> <p align="center"> <img src="https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/arch.png"><br> </p> <p align="center"> <img src="https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Ports.png"><br> </p>

Note: The two small pins next to the XT30U connector on the dog's belly appear to be P & N signals for the RS485 "motors" network on the "A4". <br>

The connector is properly called a XT30(2 2)-F and can be purchased here: https://www.aliexpress.com/item/3256801621419825.html

Expansion Header

The back of the dog has a "40-pin Centronics connector" expansion connector that can be used to access various ports connected to the hardware on the dogs innards.

<p align="center"> <img src="https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/AfterSalesSupport/Expansion/pinout.png"><br> </p> <p align="center"> <img src="https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/AfterSalesSupport/Expansion/Hirose40sFX2.png"><br> </p>

You can get variants of the connector fairly easily. There are a number of pin arrangements and minor variations. One example is listed below.

PART: FX2CA2-40P-1.27DSAL(71)-ND<br> DESC: CONN HEADER VERT 40POS 1.27MM<br> MFG : Hirose Electric Co Ltd [CI] / FX2CA2-40P-1.27DSAL(71)<br> https://www.hirose.com/product/document?clcode=CL0572-2768-1-71&productname=FX2-100P-0.635SH(71)&series=FX2&documenttype=Catalog&lang=en&documentid=D49368_en<br> https://www.digikey.com/short/195n09w7<br>

More detail is located here: https://github.com/MAVProxyUser/YushuTechUnitreeGo1/tree/main/AfterSalesSupport/Expansion

Cameras - Super Sensory System

Unitree advertises the "SSS Super-Sensing System" as follows, "1 set of fisheye binocular depth sensing angle = 150x170", "5 sets of fisheye binocular depth sensing" + "fisheye AI sensing", "1 set of fisheye binocular depth sensing = 4 sets of Intel Realsense sensing angle", "Thus: 5 sets of fisheye binocular depth sensing = 20 groups of Intel Realsense sensing angles".

Strings in the camera binary help us identify the vision hardware

unitree@unitree-desktop:~/Unitree/autostart/camerarosnode/cameraRosNode$ grep 2610 . -r
Binary file ./src/unitree_camera/lib/amd64/libtstc_V4L2_xu_camera.a matches
Binary file ./src/unitree_camera/lib/arm64/libtstc_V4L2_xu_camera.a matches
Binary file ./devel/lib/unitree_camera/point_cloud_node matches
Binary file ./devel/lib/unitree_camera/example_point matches

SPCA_2610 must be the camera name.

source//Extension_Unit_Class/Extension_Unit_SPCA2650_Protocol.cpp

This is clearly a SunPlus based "SSS" system. https://www.synopsys.com/dw/doc.php/ss/SunPlusIT_usb3.0-phy-controller.pdf https://www.sunplusit.com/EN/Product/PcCamera

Each Jetson Nano includes the following USB devices, in some cases multiple per.

Bus 001 Device 002: ID 1bcf:2cd1 Sunplus Innovation Technology Inc. 

The linux hardware database lists the camera package here: https://linux-hardware.org/index.php?id=usb:1bcf-2cd1 "Sunplus Innovation Technology USB2.0 Camera"

Upon contacting SunTrust, they did confirm they make the camera's for Unitree, but refused any outside support such as providing a PDF manual for the chipset.

Programming interface

Recent versions of the Go1 firmware, specifically Go1_2022_05_11_e0d0e617.zip and up include "Blockly Programming". This can be used to send a limited set of commands to the Go1. Additionally it has a security vulnerability that allows arbitrary code execution via python on the dog.

In Go1_2022_05_11_e0d0e617/raspi/Unitree/autostart/programming we find programming.py<br> It imports ./build/robot_interface_high_level.cpython-37m-aarch64-linux-gnu.so in order to call the UDP listen functions.

import robot_interface_high_level as robot_interface

...

unitree_go1 = robot_interface.RobotInterface()

The interface seems to blindly pass user input to exec().

The exec() method executes the dynamically created program, which is either a string or a code object.

First the code passes through compile()

compile() method is used if the Python code is in string form or is an AST object, and you want to change it to a code object.

This handles all the MIT Scratch code blocks from the mobile client.

An example exploit is here: https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/mqtt_python.py

Update interface

The firmware update interface similarly contains a vulnerability that can allow for arbitrary code execution on the dog via python.

In Go1_2021_12_10_d799e0c3/raspi/Unitree/autostart/updateDependencies we find startup_manager.py<br> It declares itself to be "Unitree System Manager", and offers the following functions

Functions:
1. run bash files
2. delete uploaded packages
3. run update packages
4. process topics when modules shut down

This can also be used to run arbitry commands.

def on_message(client, userdata, msg):
    global updatePackage