u/MaslovK

▲ 2 r/DnD

[OC] [Art] Painted my party's guitar with runes — it tells the story of our entire D&D campaign

Look closer — it's not just an ornament. The runes spell out a compressed retelling of our D&D campaign: a journey to a remote island (we sailed there to sabotage a tiefling prince's plans, though things turned out very differently once we arrived), the Storm Veil and the awakening of Laroktu — a dragon of the mirror abyss, our clash with Duke Hawkmoth, and the final battle against the Veil mages where we sealed the portal in the dragon's lair.

The text spirals out from the center — the same way the story itself unspooled from a single point and gradually wrapped around the whole island. One continuous spiral, woven together with the names of those who lived it.

The guitar has its own little odyssey too. It first belonged to Ashes of Dawn, our bard. Then our fighter Ace bought it. I — Bayazur, the party warlock and your humble narrator — covered it in runes. And now it hangs on the wall of our druid Horo. A small circle that went through all of us. None of it would have happened if our DM Ingvar hadn't gathered us around the same table and turned us into a party. Thanks for the adventure.

Painted with Molotow acrylic markers. The body of the text is written in Wendish (Slavic) runes — we're a Russian-speaking party — while the character names are in the Elder Futhark.

u/MaslovK — 19 hours ago

Painted a friend's guitar with Wendish runes — it tells the story of our D&D campaign

Look closer and it's not just an ornament — the runes spell out a compressed retelling of our campaign: an island, a tiefling prince, the Storm Veil and the awakening of Laroktu, the dragon of the mirror abyss, our clash with Duke Hawkmoth, and the final battle against the Veil mages where we sealed the portal in the dragon's lair.

The main text runs in a spiral from the center — the same way the story itself unspooled from a single point and gradually wrapped around the whole island. Everything woven into one continuous line.

Since we're a Russian-speaking party, the body of the text is written in Wendish runes (also known as Slavic runes). The character names, however, are in the Elder Futhark — they were already in English/Latin, so it felt natural to use a Germanic system for them: Ace (fighter), Horo (druid), Ashes of Dawn (bard), Bayazur (warlock, that's me), and our DM Ingvar. A small circle that went through all of us — the guitar first belonged to Ashes of Dawn, then was bought by Ace, I covered it in runes, and now it hangs on Horo's wall.

Materials: Molotow acrylic paint markers on the guitar body. Took several evenings, plenty of test runs on paper first.

None of this would have happened if Ingvar hadn't gathered us around the same table. Thanks for the adventure.

u/MaslovK — 2 days ago

The Mijia/Shunzao vacuum generation is a community blind spot — none of the usual rooting projects (dustbuilder, Valetudo, dontvacuum.me, dustcloud, rumpeltux) have touched it. I spent ~4 days reverse-engineering the protocol surface from outside (no hardware teardown, all software-only) on a live S40 unit. Putting the data publicly so the next person who gets one of these doesn't start from scratch.

**Family (all on the same Shunzao Linux firmware platform 4.5.6_xxxx):**

* `xiaomi.vacuum.ov81gl` — Xiaomi Robot Vacuum **S40** — fw `4.5.6_0079`

* `xiaomi.vacuum.b108gl` — Xiaomi Robot Vacuum **S20 / S20+** — fw `4.5.6_0208`

* `xiaomi.vacuum.ov71gl` — Xiaomi Robot Vacuum **S40 Pro**

**Highlights from recon:**

* Linux userspace confirmed (`hw_ver: "Linux"`, /proc fields leak in miIO.info response)

* MIoT-only — Roborock-class commands all return `-9999, "user ack timeout"`

* siid=21 is undocumented but responds with real values

* siid=2 has piids extending to ≥101 (naive sweep to 30 misses 70+ properties)

* Only UDP/54321 open. No TCP listeners, no mDNS advert, no SSDP, no BLE in normal operation

* Mi Home → cloud TLS decrypts (rooted-emulator MITM); vacuum itself does NOT trust user CAs — closes the obvious URL-injection / fake-CDN attack

* Voice-pack install signature is known, packs are plain ZIPs (`LANG/<N>.mp3`) on a public CDN bucket

* Cloud `/miotspec/action` error-code dictionary catalogued (9-digit packed codes)

**The blocker is SoC ID** — without opening the case, I can't pin down whether it's Allwinner / Rockchip / something else. That's the prerequisite for any flash extraction or UART work.

**Full paste-ready dossier (no personal data):**

https://gist.github.com/breakneck-git/98b8c7abf4f74cddd9303271674e48b9

**Comment on python-miio issue for the b108gl sister model:**

https://github.com/rytilahti/python-miio/issues/2042#issuecomment-4332676636

If anyone owns one of these and is up for cracking the case open / probing UART / dumping flash, ping me — I have the cloud/protocol side mapped and can save someone a week of recon work. Sanitized pcap excerpts and property dumps available on request (raw corpus stays private — contains tokens + apartment layout coords).

reddit.com
u/MaslovK — 22 days ago

The Mijia/Shunzao vacuum generation is a community blind spot — none of the usual rooting projects (dustbuilder, Valetudo, dontvacuum.me, dustcloud, rumpeltux) have touched it. I spent ~4 days reverse-engineering the protocol surface from outside (no hardware teardown, all software-only) on a live S40 unit. Putting the data publicly so the next person who gets one of these doesn't start from scratch.

**Family (all on the same Shunzao Linux firmware platform 4.5.6_xxxx):**

* `xiaomi.vacuum.ov81gl` — Xiaomi Robot Vacuum **S40** — fw `4.5.6_0079`

* `xiaomi.vacuum.b108gl` — Xiaomi Robot Vacuum **S20 / S20+** — fw `4.5.6_0208`

* `xiaomi.vacuum.ov71gl` — Xiaomi Robot Vacuum **S40 Pro**

**Highlights from recon:**

* Linux userspace confirmed (`hw_ver: "Linux"`, /proc fields leak in miIO.info response)

* MIoT-only — Roborock-class commands all return `-9999, "user ack timeout"`

* siid=21 is undocumented but responds with real values

* siid=2 has piids extending to ≥101 (naive sweep to 30 misses 70+ properties)

* Only UDP/54321 open. No TCP listeners, no mDNS advert, no SSDP, no BLE in normal operation

* Mi Home → cloud TLS decrypts (rooted-emulator MITM); vacuum itself does NOT trust user CAs — closes the obvious URL-injection / fake-CDN attack

* Voice-pack install signature is known, packs are plain ZIPs (`LANG/<N>.mp3`) on a public CDN bucket

* Cloud `/miotspec/action` error-code dictionary catalogued (9-digit packed codes)

**The blocker is SoC ID** — without opening the case, I can't pin down whether it's Allwinner / Rockchip / something else. That's the prerequisite for any flash extraction or UART work.

**Full paste-ready dossier (no personal data):**

https://gist.github.com/breakneck-git/98b8c7abf4f74cddd9303271674e48b9

**Comment on python-miio issue for the b108gl sister model:**

https://github.com/rytilahti/python-miio/issues/2042#issuecomment-4332676636

If anyone owns one of these and is up for cracking the case open / probing UART / dumping flash, ping me — I have the cloud/protocol side mapped and can save someone a week of recon work. Sanitized pcap excerpts and property dumps available on request (raw corpus stays private — contains tokens + apartment layout coords).

reddit.com
u/MaslovK — 22 days ago