# OpenIPC Wiki [Table of Content](../README.md) Wyze integration ---------------- This is where we'll be writing down our guide to flashing new devices and reports on our experiments. ### Current issues * Exposure does not work well https://github.com/OpenIPC/majestic/issues/102 * ~~SD card does not work in the U-Boot (power is available)~~ fixed * ~~Problem with loading u-boot from an microSD card. It doesn't reach the promt. Not only on wyze v3 (https://t.me/openipc_modding/179369), but also on another board T31L (https://t.me/openipc/47739). Most likely it will be IMPOSSIBLE, because in the camera there is a microSD power management MOSFET, which must be turned on BEFORE booting from the card (the experiment with not fully loaded u-boot was possible due to direct power supply to the microSD card, bypassing the transistor). Please confirm my version if it is not possible otherwise.~~ impossible without modification (direct 3.3V power supply to the microSD card reader) ### Known camera modifications * WYZE Cam v3 | MODEL | IC | FCC ID | PCB VER | SoC | WIFI | NOTES | | --- | --- | --- | --- | --- | --- | --- | | WYZEC3 | 25466-WYZEC3A | 2AUIUWYZEC3A | WYZEV3_T31GC2053 V1.2_20200715 | T31X | SDIO: Realtek 8189FTV | MAC: 7C:78:B2:99:6E:BA https://youtu.be/jm4wze_HY78 | | WYZEC3 | 25466-WYZEC3 | 2AUIUWYZEC3 | WYZEV3_T31GC2053 V1.4_20201010 | T31ZX | SDIO: Realtek 8189FTV | https://t.me/openipc/49957 MAC: 7C:78:B2:69:95:C9 https://youtu.be/t7Nzo-KXTH0 | | WYZEC3 | 25466-WYZEC3B | 2AUIUWYZEC3B | WYZEV3_T31GC2053 V2.02_20210523 | T31ZX | SDIO: Realtek 8189FTV | MAC: D0:3F:27:46:A7:7B https://t.me/openipc/38728 https://t.me/openipc/38753 | | WYZEC3 | 25466-WYZEC3A | 2AUIUWYZEC3A | WYZEV3_T31GC2053 V2.02_20210523 | T31ZX | SDIO: AltoBeam 6031 | https://t.me/openipc/49049 https://t.me/openipc/49050 | | WYZEC3 | 25466-WYZEC3A | 2AUIUWYZEC3A | WYZEV3_T31GC2053 V2.03_20211206 | T31X | SDIO: AltoBeam 6031 | https://t.me/openipc/45444 https://t.me/openipc/48942| | WYZEC3 | 25466-WYZEC3F | 2AUIUWYZEC3F | WYZEV3_T31AGC2053 V3.2_20210714 | T31A BGA | SDIO: AltoBeam 6031 | https://t.me/openipc/43299 https://t.me/openipc/38755 https://t.me/openipc/38757 | | WYZEC3 | 25466-WYZEC3F | 2AUIUWYZEC3F | WYZEV3_T31AGC2053 V3.2_20210714 | T31A BGA | SDIO: AltoBeam 6031 | MAC:D0:3F:27:4F:23:19 https://youtu.be/VkqX9yg0odU | ### OpenIPC installation * Disassemble camera and connect UART adapter or your camera should be already connected to network. * Backup Downgrade original firmware version to (Jun 2021 w-o internet)demo_wcv3_4.36.2.5.bin [(WYom20200 Jun 2021 w-o internet)demo_wcv3_4.36.2.5.bin.zip](https://github.com/OpenIPC/wiki/files/10755387/WYom20200.Jun.2021.w-o.internet.demo_wcv3_4.36.2.5.bin.zip) Login with user `root` password `WYom20200` via telnet or UART console. Insert microSD card to camera and issue command: `for mtd in $(ls /dev/mtdblock*); do dd if=${mtd} of=/media/mmc/${mtd##/*/}.bin; done` Output sample: ``` [root@WCV3:~]# for mtd in $(ls /dev/mtdblock*); do dd if=${mtd} of=/media/mmc/${mtd##/*/}.bin; done 512+0 records in 512+0 records out 262144 bytes (256.0KB) copied, 0.122976 seconds, 2.0MB/s 3968+0 records in 3968+0 records out 2031616 bytes (1.9MB) copied, 0.975797 seconds, 2.0MB/s 7808+0 records in 7808+0 records out 3997696 bytes (3.8MB) copied, 1.955184 seconds, 1.9MB/s 7808+0 records in 7808+0 records out 3997696 bytes (3.8MB) copied, 2.808704 seconds, 1.4MB/s 3968+0 records in 3968+0 records out 2031616 bytes (1.9MB) copied, 0.972091 seconds, 2.0MB/s 7808+0 records in 7808+0 records out 3997696 bytes (3.8MB) copied, 2.299745 seconds, 1.7MB/s 768+0 records in 768+0 records out 393216 bytes (384.0KB) copied, 0.186963 seconds, 2.0MB/s 128+0 records in 128+0 records out 65536 bytes (64.0KB) copied, 0.027560 seconds, 2.3MB/s ``` If there wasn't errors, then you backed up such partitions: ``` [root@WCV3:~]# cat /proc/mtd dev: size erasesize name mtd0: 00040000 00008000 "boot" mtd1: 001f0000 00008000 "kernel" mtd2: 003d0000 00008000 "rootfs" mtd3: 003d0000 00008000 "app" mtd4: 001f0000 00008000 "kback" mtd5: 003d0000 00008000 "aback" mtd6: 00060000 00008000 "cfg" mtd7: 00010000 00008000 "para" ``` Check if files on microSD card with command `ls -la /media/mmc/` ``` [root@WCV3:~]# ls -la /media/mmc/ drwxr-xr-x 7 root root 8192 May 14 01:52 . drwxrwxrwt 3 root root 60 May 14 01:50 .. -rwxr-xr-x 1 root root 262144 May 14 01:52 mtdblock0.bin -rwxr-xr-x 1 root root 2031616 May 14 01:52 mtdblock1.bin -rwxr-xr-x 1 root root 3997696 May 14 01:52 mtdblock2.bin -rwxr-xr-x 1 root root 3997696 May 14 01:52 mtdblock3.bin -rwxr-xr-x 1 root root 2031616 May 14 01:52 mtdblock4.bin -rwxr-xr-x 1 root root 3997696 May 14 01:52 mtdblock5.bin -rwxr-xr-x 1 root root 393216 May 14 01:52 mtdblock6.bin -rwxr-xr-x 1 root root 65536 May 14 01:52 mtdblock7.bin ``` Save and keep this files in safe place. In case of any errors you should perform this operation once again, probably with microSD card replacement. * Determine SoC model Download `ipctool-mips32` to microSD card (https://github.com/OpenIPC/ipctool/releases/download/latest/ipctool-mips32) and insert microSD card in camera. Login to camera and issue command `/media/mmc/ipctool-mips32` There should be something like `model: T31ZX` in console output. Important part is `ZX` Output sample: ``` [root@WCV3:~]# /media/mmc/ipctool-mips32 --- chip: vendor: Ingenic model: T31ZX rom: - type: nor block: 32K partitions: - name: boot size: 0x40000 sha1: 20776e92 - name: kernel size: 0x1f0000 sha1: 6887b828 - name: rootfs size: 0x3d0000 sha1: d368892a - name: app size: 0x3d0000 path: /system,squashfs sha1: 04b813a8 - name: kback size: 0x1f0000 sha1: 83ccf23a - name: aback size: 0x3d0000 sha1: 48bbe705 - name: cfg size: 0x60000 path: /configs,jffs2,rw - name: para size: 0x10000 sha1: 472a55b0 size: 16M ram: total: 128M media: 32M firmware: kernel: "3.10.14__isvp_swan_1.0__ (PREEMPT Wed Apr 14 17:44:51 CST 2021)" toolchain: gcc version 4.7.2 (Ingenic r2.3.3 2016.12) libc: uClibc 0.9.33.2 main-app: /system/bin/iCamera ``` * Flash OpenIPC U-boot Open https://openipc.org/cameras/vendors/ingenic and choose appropriate SoC model from list. In this case our choice Ingenic T31X. In Downloads section find `OpenIPC Bootloader for Ingenic T31X` and download it. https://github.com/OpenIPC/firmware/releases/download/latest/u-boot-t31x-universal.bin Copy `u-boot-t31x-universal.bin` to microSD card and insert microSD card in camera. `telnet` would be unavailable after the command below (`flashcp`) ! Login to camera and issue command: `flashcp -v /media/mmc/u-boot-t31x-universal.bin /dev/mtd0` Output sample: ``` [root@WCV3:~]# flashcp -v /media/mmc/u-boot-t31x-universal.bin /dev/mtd0 Erasing block: 8/8 (100%) Writing kb: 242/242 (100%) Verifying kb: 242/242 (100%) ``` Now your camera flashed with OpenIPC U-boot, but whole system is still stock. So, next re/boot will load OpenIPC U-boot only (in cycling mode, until stop with `Ctrl+C` in UART console). * Flash kernel and rootfs Since we identified our chip as Ingenic T31X open https://openipc.org/cameras/vendors/ingenic and choose T31X. In Downloads section find `OpenIPC Linux (Lite) for Ingenic T31X` and download it. https://github.com/OpenIPC/firmware/releases/download/latest/openipc.t31-nor-lite.tgz Power off the camera. Extract and copy `rootfs.squashfs.t31` `uImage.t31` to microSD card. Insert microSD card in camera. Power on the camera. During power on the camera press `Ctrl+C` several times until it shows OpenIPC prompt like this `OpenIPC #` Then issue command `run setnor16m` After you press the Enter key the camera will almost immediately restart and you will have to catch the prompt again. Then issue command: ```bash mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} uImage.${soc} ; sf probe 0; sf erase 0x50000 0x300000; sf write ${baseaddr} 0x50000 ${filesize} ``` and next: ```bash mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} rootfs.squashfs.${soc} ; sf probe 0; sf erase 0x350000 0xa00000; sf write ${baseaddr} 0x350000 ${filesize} ``` Output sample: ```shell OpenIPC # mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} uImage.${soc} ; sf probe 0; sf erase 0x50000 0x300000; sf write ${baseaddr} 0x50000 ${filesize} reading uImage.t31 1855437 bytes read in 89 ms (19.9 MiB/s) the manufacturer 5e SF: Detected ZB25VQ128 --->probe spend 5 ms SF: 3145728 bytes @ 0x50000 Erased: OK --->erase spend 9871 ms SF: 1855437 bytes @ 0x50000 Written: OK --->write spend 3286 ms OpenIPC # mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} rootfs.squashfs.${soc} ; sf probe 0; sf erase 0x350000 0xa00000; sf write ${baseaddr} 0x350000 ${filesize} reading rootfs.squashfs.t31 5079040 bytes read in 236 ms (20.5 MiB/s) the manufacturer 5e SF: Detected ZB25VQ128 --->probe spend 4 ms SF: 10485760 bytes @ 0x350000 Erased: OK --->erase spend 31730 ms SF: 5079040 bytes @ 0x350000 Written: OK --->write spend 8949 ms ``` If everything went well, issue the command `reset` and camera should start boot OpenIPC. ```console Welcome to OpenIPC openipc-t31 login: root /###### /###### /####### /###### /##__ ## |_ ##_/ | ##__ ## /##__ ## | ## \ ## /###### /###### /####### | ## | ## \ ## | ## \__/ | ## | ## /##__ ## /##__ ## | ##__ ## | ## | #######/ | ## | ## | ## | ## \ ## | ######## | ## \ ## | ## | ##____/ | ## | ## | ## | ## | ## | ##_____/ | ## | ## | ## | ## | ## ## | ######/ | #######/ | ####### | ## | ## /###### | ## | ######/ \______/ | ##____/ \_______/ |__/ |__/ |______/ |__/ \______/ | ## | ## build |__/ master+98e3bca7, 2023-02-11 Please help the OpenIPC Project to cover the cost of development and long-term maintenance of what we believe is going to become a stable, flexible Open IP Network Camera Framework for users worldwide. Your contributions could help us to advance the development and keep you updated on improvements and new features more regularly. Please visit https://openipc.org/sponsor/ to learn more. Thank you. root@openipc-t31:~# ```