The good news is that I've rooted the robot.
I'd still like to find a non-intrusive method of rooting the robot: no unscrewing.
I still haven't MITM'd the phone app, but that's coming up. First I have to put a proxy on the robot.
Between the traffic from both the phone and the robot and having the binaries to reverse-engineer, I should be able to figure out a non-invasive root method.
After that I'll start working on an on-robot localization of the "cloud" control.
