Locked/broken bootloader solutions/suggestions

[chrismyers81]

First off...thank you all very much for this fantastic project. It's breathed new life and opportunities for several of our cameras that would have otherwise had no purpose following changes that Wyze has made.

In that vein of new life into old products, I'm wondering if anyone has figured out solutions to the bootloader issues that Wyze has introduced (accidentally or intentionally) with at least some of their older products. My situation specifically surrounds the Cam Pan v1, but I'm not sure if there are other impacted models. In this case it was with a brand new (old stock) camera.

With our camera, I started out with the steps laid out here - https://thingino.com/wyze-cp1

At first it seemed like things were going ok; the first two steps I'd end up with a blue light for a bit, but not as long as I expected. At the time I didn't think anything of it. When I got to step 3, nothing happened; I'd go through the process but nothing would be saved to the SD card afterwards. I thought that maybe this was expected, but moving on to step 4 wouldn't result in a thingio wireless network either. I tried repeating the process a few times in case I'd done a step incorrectly but the result was the same.

I did more searching and came across an alternate version of the same process, with a few different steps - https://github.com/themactep/thingino-firmware/wiki/Camera:-Wyze-v2-%E2%80%90-Neos-SmartCam-%E2%80%90-ATOM-Cam-1 (operating under the assumption that the CP1 and Wyze v2 were similar enough, since the instructions for several products seemed the same.)

I walked through that process, and had a similar outcome. Doing some random tests it appeared that it still had the regular Wyze firmware on it (eg. short-pressing the setup button would result in the usual Wyze setup voice.)

I decided to pop the back cover off to try the manual firmware update, but didn't find the chip mentioned in the instructions...it looked like I had a new hardware revision possibly? This started me doing more web searches, which led to an increasingly discouraging thread of discoveries. One, apparently there are two hardware revisions, which can be distinguished by the text of the QR code. I was unlucky enough to have the FOO variant. However, even if I'd had the older DOO variant, based on comments I've seen it appears that Wyze intentionally or unintentionally broke the bootloader along the way (around firmware revision 4.10.6.156) which prevented folks from doing further manual updates. https://forums.wyze.com/t/cant-flash-firmware-to-cam-pan/95238/34

Based on comments in that Wyze thread I spiraled through a number of other threads on their site and other github projects which make it seem as if this is a bit hopeless at this point -
EliasKotlyar/Xiaomi-Dafang-Hacks#1563
https://github.com/agent86ix/wyze-cam-pan-sd-flash-fix

ending with

HclX/WyzeUpdater#9

Apparently Wyze is working on blocking this hack from both server side and device side. So we need to accept the fact that whatever new loopholes we discover, they will be blocked again by Wyze. OTA installation is pretty much dead.

So I guess the summary of this is -- for devices that Wyze has intentionally or unintentionally broken the bootloader itself...are there any options or tricks to get Thingio working on it? I know that this wouldn't be likely for devices with secureboot, but I'm thinking more of older devices like the CP1 I'm trying to breathe new life into.

Thanks all!

[gtxaspec]

The wyze devices can typically always be restored via USB, using the cloner utility. Have you read the Ingenic Cloner wiki article if you are still having issues?

[chrismyers81]

I did; before starting the discussion thread I decided to pop the back cover off to try the manual firmware update, but didn't find the chip mentioned in the instructions...it looked like I had a new hardware revision possibly?

[gtxaspec]

Share photos!

[chrismyers81]

I ended up finding a flash chip on the back of the PCB after fully disassembling the camera, but the pin-short method doesn't seem to work (or I haven't been able to figure out the trick.)

[gtxaspec]

how are you plugging it into the computer? you need to use the full size USB-A port, the micro usb is POWER only.

[chrismyers81]

I'm sorry for my delayed response, I don't get a lot of opportunities to work on projects like this.

I was able to get it figured out. The key things for me -

1. I didn't realize that I needed to use both USB ports; previously I was trying one or the other, but not both at the same time. So I ended up plugging the USB-A port into my computer first, then short the pins on the chip while I plugged in the micro usb.
2. I needed to symlink a library for the cloner to be able to work; I can't remember the one off the top of my head at this point, but when starting the cloner from the command line rather than double-clicking on the binary from KDE, it turned out it was tossing errors about one of the libraries missing. My computer (Debian 12) had a newer version of the library installed, so I just created a symlink with the name of the old one, and the error went away.
3. I needed to run the cloner as root. It would load fine as an unprivileged user, but wouldn't detect anything. After I started the cloner as root, it was able to detect the camera and write the firmware.

So at this point, I've got it working :)