Brookstone Rover Land & Sea

layout: true
<div class="my-header">March 2018</div>

---
## Brookstone Rover Land & Sea

![Rover image](images/LandSea_Rover.jpg?raw=true "LandSea Rover")
---
### Outline
- Land & Sea Rover details
 - $100 waterproof floating wheeled rover from **Brookstone**
 - WiFi control using an Android or iPhone app
 - camera swivels from forward facing to pointing down (underwater)
 - powered by 6 AA disposable batteries with no charging jack

- Python packages for previous Brookstone rovers
 - Who created them and how?

- Discovering the current rover details 
 - Repeating some of the same steps
 - Using new sources of info

- Beginnings of ROS integration
 - Measuring the speed using a 3D scanner and the Point Cloud Library
---
### Land & Sea Rover details

---
### Python Packages for Previous Rovers
With commits on GitHub ranging from 2014 to 2016 at https://github.com/simondlevy/RoverPylot, the drivers for previous Brookstone Rovers were created by **Professor Simon Levy** who teaches computer science at Washington & Lee University in Virginia where he frequently creates open source APIs for various hardware, such as the Parrot AR.Drone and the Neato XV-11.

His repository has Python code to control both the Brookstone **Rover 2.0** and the **Rover Revolution**, optionally using a PS3 controller.

<table width="100%">
    <tr>
        <td align="center">
<img src="images/roverpylot.png">
        </td>
        <td align="center">
<img src="images/revolution.jpeg">
        </td>
    </tr>
</table>
---

#### Old drivers don't work for the new Land Sea Rover

<pre><code>
 class Rover:

def __init__(self):
         ''' Creates a Rover object that you can communicate with.'''
 
         self.HOST = '192.168.1.100'
         self.PORT = 80
 
         TARGET_ID = 'AC13'
         TARGET_PASSWORD = 'AC13'
 
         self.TREAD_DELAY_SEC = 1.0
         self.KEEPALIVE_PERIOD_SEC = 60 
 
         # Create command socket connection to Rover
         self.commandsock = self._newSocket()
 
         # Send login request with four arbitrary numbers
         self._sendCommandIntRequest(0, [0, 0, 0, 0])
                
        # Get login reply
        reply = self._receiveCommandReply(82)
</code></pre>

</td>
        <td align="left">
Both driver classes inherit from the Rover class, and the __init__() method of Rover unconditionally starts by sending zeros to port 80 of the Rover.
        </td>
    </tr>
</table>

---
### Discovering the new Land Sea Rover details

Professor Levy has a very detailed blog post titled *"How I hacked the Brookstone Rover 2.0"* at https://isgroupblog.blogspot.com/2013/09/how-i-hacked-brookstone-rover-20.html where he describes using the following tools:

#### APK to JAR converter
- **dex2jar** is available at http://code.google.com/p/dex2jar/
- d2j-dex2jar.sh -f Rover_Land_Sea_v6.1.0.0.1_apkpure.com.apk

#### Java decompiler
- He used the free trial version of the decompiler from **SecureTeam** http://secureteam.net/Java-Decompiler.aspx
- java -jar d4j.jar

#### Wireshark
- Packet capture tool to show the actual messages being passed between the Android app and the Rover.
---
#### Using the Java decompiler on the new Land Sea Rover apk file

- Searching for the word "backward" found the code that controls the wheels.  It _**actually calls a cgi program**_ named ptz_control.cgi at the Rover's IP address.
- Connecting to that IP address with a browser shows the login screen for a webcam.
- Searching through the Java source shows that the username and password are 'admin' and ''.
---
#### Land Sea Rover webcam GUI at http://192.168.1.1

PTZ Settings appears in the webcam GUI and it is used to set up patrol zones of pre-defined camera movements.  Apparently it was hijacked for Rover control.

Seeing "sosocam" and "reecam" mentioned in the Java source code and in the webcam GUI leads to a web search that results in Shenzen Reecam, which is apparently a webcam software package widely used with drones...
---
#### Reecam and the Land Sea Rover

- The Reecam company maintains a documentation wiki that describes SOME of the API of ptz_control.cgi at http://wiki.reecam.cn/CGI/Controls .  Other cgi commands like set_params, request_av, and get_log are also documented.

- There is a GitHub repository at https://github.com/larsks/mdcam with a Python tool named **mdcam**, which uses some of the Reecam interface to control MicroDrone 3.0 cameras.

- http://gw.tnode.com/drone/micro-drone-3-0-camera-api/ is a blog entry which points out that you can use the set_params command to enable **telnetd**, allowing you to log in to the Linux instance running on the Rover.

However, because some of the Rover operations are not documented by any of these sources, wireshark can help:

---
#### Wireshark and the Land Sea Rover

Assuming your laptop was issued the IP 192.168.1.101 by the Rover, using the following filter:

<pre class="small_pre">
http.request.uri && ip.src == 192.168.1.101 
</pre>

clearly shows the exact parameters being passed in the calls to **ptz_control.cgi** when using the webcam GUI (in this example) to rotate the camera UP.  Other actions can also be captured by Wireshark and cross referenced against the decompiled Java code.
---
#### Motor Control for the Land Sea Rover
The Java code sends the undocumented command number **100** to **ptz_control.cgi** to control the motor speeds.  It stores a 4 byte array to keep track of motion control:
- right wheels:
 - **byte0** has the value 0 if the _right_ wheels should turn _backward_, and the value 1 if the _right_ wheels should turn _forward_
 - **byte1** has the speed of the _right_ wheels, ranging from 0 indicating a stop to 255 being the highest speed.
- left wheels:
 - **byte2** has the value 0 if the _left_ wheels should turn _backward_, and the value 1 if the _left_ wheels should turn _forward_
 - **byte3** has the speed of the _left_ wheels, ranging from 0 indicating a stop to 255 being the highest speed.

To set the motor speed, the Java code assembles these 4 bytes into a single integer like this:

and sends **this integer** as the parameter value to **ptz_control.cgi** along with the command number **100** like this:

<pre class="small_pre">
http://192.168.1.1:80/ptz_control.cgi?param=17432837&command=100&pwd=&user=admin
</pre>

---
#### So, the basic Land Sea Rover driver architecture could be...
Like mdcam:

- the new driver uses the Python Requests library to make http calls and parse results

- there is no attempt to handle audio

Unlike mdcam:

- the new driver supports different specific commands due to the hardware

- slightly different logging so that integration with ROS can happen more easily

- mdcam uses the "click" library @click decorators to make methods available to the command line, while the new driver uses the inspect module to dynamically make driver methods command line accessible _(anyway, command line usage is not really important for a driver)_.
---
#### Logging in to the Land Sea Rover via telnet

Here is the output of **cat /proc/cpuinfo**

<pre class="small_pre">
Processor       : ARM926EJ-S rev 5 (v5l)
BogoMIPS        : 95.02
Features        : swp half fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant     : 0x0
CPU part        : 0x926
CPU revision    : 5

Hardware        : W55FA93
Revision        : 0000
Serial          : 0000000000000000
</pre>

Here is the beginning of the output of **cat /proc/kmsg**

<pre class="small_pre">
0 = 2
<4>div0 = 3
<4>div0 = 4
<4>Div1 = 0,  Div0 = 3
<4>USBH IP  Reset
<4>CONFIG_W55FA93_USB_HOST_LIKE_PORT1
<6>w55fa93-ohci w55fa93-ohci: Nuvoton W55FA93 OHCI Host Controller
<6>w55fa93-ohci w55fa93-ohci: new USB bus registered, assigned bus number 1
<6>w55fa93-ohci w55fa93-ohci: irq 18, io mem 0xb1009000
<4>ohci_w55fa93_start
<6>hub 1-0:1.0: USB hub found
<6>hub 1-0:1.0: 2 ports detected
<4>USB device plug in
</pre>

Searching for **"Nuvoton W55FA93"** gives...
---
#### Nuvoton and the Land Sea Rover
This PDF file: http://webshop.atlantikelektronik.de/Webpage/NuvotonPSG2011.pdf

shows:

but it has no info about detecting battery charge levels.  So a remotely operated Rover will die unexpectedly, but there's no way to recharge its 6 AA batteries anyway.  It would be nice to have a 9v battery pack with Wi-Fi status reporting and Qi wireless recharging, maybe using a BeagleChip?

---
### ROS
- ROS is a range of **independent** software packages of cooperating **nodes** that run simlutaneously as **processes** on one or more computers to control a robot.