OpenIPC
/
wiki
mirror of https://github.com/OpenIPC/wiki.git
1
0
Fork 0
Code Activity
wiki/en/device-wyze-integration.md

11 KiB
Raw Blame History

OpenIPC Wiki

Table of Content

Wyze integration

This is where we'll be writing down our guide to flashing new devices and reports on our experiments.

Current issues

  • Exposure does not work well https://github.com/OpenIPC/majestic/issues/102
  • SD card does not work in the U-Boot (power is available) fixed
  • Problem with loading u-boot from an microSD card. It doesn't reach the promt. Not only on wyze v3 (https://t.me/openipc_modding/179369), but also on another board T31L (https://t.me/openipc/47739). Most likely it will be IMPOSSIBLE, because in the camera there is a microSD power management MOSFET, which must be turned on BEFORE booting from the card (the experiment with not fully loaded u-boot was possible due to direct power supply to the microSD card, bypassing the transistor). Please confirm my version if it is not possible otherwise. impossible without modification (direct 3.3V power supply to the microSD card reader)

Known camera modifications

  • WYZE Cam v3 and WYZE Cam Pan v3
MODEL IC FCC ID PCB VER SoC WIFI NOTES
WYZEC3 25466-WYZEC3A 2AUIUWYZEC3A WYZEV3_T31GC2053 V1.2_20200715 T31X SDIO: Realtek 8189FTV MAC: 7C:78:B2:99:6E:BA https://youtu.be/jm4wze_HY78
WYZEC3 25466-WYZEC3 2AUIUWYZEC3 WYZEV3_T31GC2053 V1.4_20201010 T31ZX SDIO: Realtek 8189FTV MAC: 7C:78:B2:69:95:C9 https://t.me/openipc/49957 https://youtu.be/t7Nzo-KXTH0
WYZEC3 25466-WYZEC3B 2AUIUWYZEC3B WYZEV3_T31GC2053 V2.02_20210523 T31ZX SDIO: Realtek 8189FTV MAC: D0:3F:27:46:A7:7B https://t.me/openipc/38728 https://t.me/openipc/38753
WYZEC3 25466-WYZEC3A 2AUIUWYZEC3A WYZEV3_T31GC2053 V2.02_20210523 T31ZX SDIO: AltoBeam 6031 https://t.me/openipc/49049 https://t.me/openipc/49050
WYZEC3 25466-WYZEC3A 2AUIUWYZEC3A WYZEV3_T31GC2053 V2.03_20211206 T31X SDIO: AltoBeam 6031 https://t.me/openipc/45444 https://t.me/openipc/48942
WYZEC3 25466-WYZEC3F 2AUIUWYZEC3F WYZEV3_T31AGC2053 V3.2_20210714 T31A BGA SDIO: AltoBeam 6031 https://t.me/openipc/43299 https://t.me/openipc/38755 https://t.me/openipc/38757
WYZEC3 25466-WYZEC3F 2AUIUWYZEC3F WYZEV3_T31AGC2053 V3.2_20210714 T31A BGA SDIO: AltoBeam 6031 MAC: D0:3F:27:4F:23:19 https://youtu.be/VkqX9yg0odU
WYZECPAN3 25466-WYZECPAN3 2UAIUWYZECPAN3 WYZE PAN V3 MB V1.3 T31X SDIO: AltoBeam 6031 MAC: D0:3F:27:9C:0D:E7 https://youtu.be/hXTbDsnN9IY

OpenIPC installation

  • Disassemble camera and connect UART adapter or your camera should be already connected to network.

  • Backup

Downgrade original firmware version to (Jun 2021 w-o internet)demo_wcv3_4.36.2.5.bin (WYom20200 Jun 2021 w-o internet)demo_wcv3_4.36.2.5.bin.zip

Login with user root password WYom20200 via telnet or UART console. Insert microSD card to camera and issue command:

for mtd in $(ls /dev/mtdblock*); do dd if=${mtd} of=/media/mmc/${mtd##/*/}.bin; done

Output sample:

[root@WCV3:~]# for mtd in $(ls /dev/mtdblock*); do dd if=${mtd} of=/media/mmc/${mtd##/*/}.bin; done
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.122976 seconds, 2.0MB/s
3968+0 records in
3968+0 records out
2031616 bytes (1.9MB) copied, 0.975797 seconds, 2.0MB/s
7808+0 records in
7808+0 records out
3997696 bytes (3.8MB) copied, 1.955184 seconds, 1.9MB/s
7808+0 records in
7808+0 records out
3997696 bytes (3.8MB) copied, 2.808704 seconds, 1.4MB/s
3968+0 records in
3968+0 records out
2031616 bytes (1.9MB) copied, 0.972091 seconds, 2.0MB/s
7808+0 records in
7808+0 records out
3997696 bytes (3.8MB) copied, 2.299745 seconds, 1.7MB/s
768+0 records in
768+0 records out
393216 bytes (384.0KB) copied, 0.186963 seconds, 2.0MB/s
128+0 records in
128+0 records out
65536 bytes (64.0KB) copied, 0.027560 seconds, 2.3MB/s

If there wasn't errors, then you backed up such partitions:

[root@WCV3:~]# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00008000 "boot"
mtd1: 001f0000 00008000 "kernel"
mtd2: 003d0000 00008000 "rootfs"
mtd3: 003d0000 00008000 "app"
mtd4: 001f0000 00008000 "kback"
mtd5: 003d0000 00008000 "aback"
mtd6: 00060000 00008000 "cfg"
mtd7: 00010000 00008000 "para"

Check if files on microSD card with command ls -la /media/mmc/

[root@WCV3:~]# ls -la /media/mmc/
drwxr-xr-x    7 root     root          8192 May 14 01:52 .
drwxrwxrwt    3 root     root            60 May 14 01:50 ..
-rwxr-xr-x    1 root     root        262144 May 14 01:52 mtdblock0.bin
-rwxr-xr-x    1 root     root       2031616 May 14 01:52 mtdblock1.bin
-rwxr-xr-x    1 root     root       3997696 May 14 01:52 mtdblock2.bin
-rwxr-xr-x    1 root     root       3997696 May 14 01:52 mtdblock3.bin
-rwxr-xr-x    1 root     root       2031616 May 14 01:52 mtdblock4.bin
-rwxr-xr-x    1 root     root       3997696 May 14 01:52 mtdblock5.bin
-rwxr-xr-x    1 root     root        393216 May 14 01:52 mtdblock6.bin
-rwxr-xr-x    1 root     root         65536 May 14 01:52 mtdblock7.bin

Save and keep this files in safe place. In case of any errors you should perform this operation once again, probably with microSD card replacement.

  • Determine SoC model

Download ipctool-mips32 to microSD card (https://github.com/OpenIPC/ipctool/releases/download/latest/ipctool-mips32) and insert microSD card in camera. Login to camera and issue command /media/mmc/ipctool-mips32 There should be something like model: T31ZX in console output. Important part is ZX

Output sample:

[root@WCV3:~]# /media/mmc/ipctool-mips32 
---
chip:
  vendor: Ingenic
  model: T31ZX
rom:
  - type: nor
    block: 32K
    partitions:
      - name: boot
        size: 0x40000
        sha1: 20776e92
      - name: kernel
        size: 0x1f0000
        sha1: 6887b828
      - name: rootfs
        size: 0x3d0000
        sha1: d368892a
      - name: app
        size: 0x3d0000
        path: /system,squashfs
        sha1: 04b813a8
      - name: kback
        size: 0x1f0000
        sha1: 83ccf23a
      - name: aback
        size: 0x3d0000
        sha1: 48bbe705
      - name: cfg
        size: 0x60000
        path: /configs,jffs2,rw
      - name: para
        size: 0x10000
        sha1: 472a55b0
    size: 16M
ram:
  total: 128M
  media: 32M
firmware:
  kernel: "3.10.14__isvp_swan_1.0__ (PREEMPT Wed Apr 14 17:44:51 CST 2021)"
  toolchain: gcc version 4.7.2 (Ingenic r2.3.3 2016.12) 
  libc: uClibc 0.9.33.2
  main-app: /system/bin/iCamera
  • Flash OpenIPC U-boot

Open https://openipc.org/cameras/vendors/ingenic and choose appropriate SoC model from list.

In this case our choice Ingenic T31X.

In Downloads section find OpenIPC Bootloader for Ingenic T31X and download it.

https://github.com/OpenIPC/firmware/releases/download/latest/u-boot-t31x-universal.bin

Copy u-boot-t31x-universal.bin to microSD card and insert microSD card in camera.

telnet would be unavailable after the command below (flashcp) !

Login to camera and issue command: flashcp -v /media/mmc/u-boot-t31x-universal.bin /dev/mtd0

Output sample:

[root@WCV3:~]# flashcp -v /media/mmc/u-boot-t31x-universal.bin /dev/mtd0
Erasing block: 8/8 (100%) 
Writing kb: 242/242 (100%) 
Verifying kb: 242/242 (100%)

Now your camera flashed with OpenIPC U-boot, but whole system is still stock. So, next re/boot will load OpenIPC U-boot only (in cycling mode, until stop with Ctrl+C in UART console).

  • Flash kernel and rootfs

Since we identified our chip as Ingenic T31X open https://openipc.org/cameras/vendors/ingenic and choose T31X.

In Downloads section find OpenIPC Linux (Lite) for Ingenic T31X and download it.

https://github.com/OpenIPC/firmware/releases/download/latest/openipc.t31-nor-lite.tgz

Power off the camera.

Extract and copy rootfs.squashfs.t31 uImage.t31 to microSD card. Insert microSD card in camera.

Power on the camera.

During power on the camera press Ctrl+C several times until it shows OpenIPC prompt like this OpenIPC #

Then issue command run setnor16m

After you press the Enter key the camera will almost immediately restart and you will have to catch the prompt again.

Then issue command:

mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} uImage.${soc} ; sf probe 0; sf erase 0x50000 0x300000; sf write ${baseaddr} 0x50000 ${filesize}

and next:

mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} rootfs.squashfs.${soc} ; sf probe 0; sf erase 0x350000 0xa00000; sf write ${baseaddr} 0x350000 ${filesize}

Output sample:

OpenIPC # mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} uImage.${soc} ; sf probe 0; sf erase 0x50000 0x300000; sf write ${baseaddr} 0x50000 ${filesize}
reading uImage.t31
1855437 bytes read in 89 ms (19.9 MiB/s)
the manufacturer 5e
SF: Detected ZB25VQ128

--->probe spend 5 ms
SF: 3145728 bytes @ 0x50000 Erased: OK
--->erase spend 9871 ms
SF: 1855437 bytes @ 0x50000 Written: OK
--->write spend 3286 ms

OpenIPC # mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} rootfs.squashfs.${soc} ; sf probe 0; sf erase 0x350000 0xa00000; sf write ${baseaddr} 0x350000 ${filesize}
reading rootfs.squashfs.t31
5079040 bytes read in 236 ms (20.5 MiB/s)
the manufacturer 5e
SF: Detected ZB25VQ128

--->probe spend 4 ms
SF: 10485760 bytes @ 0x350000 Erased: OK
--->erase spend 31730 ms
SF: 5079040 bytes @ 0x350000 Written: OK
--->write spend 8949 ms

If everything went well, issue the command reset and camera should start boot OpenIPC.

Welcome to OpenIPC
openipc-t31 login: root

    /######                                    /######  /#######    /######
   /##__  ##                                  |_  ##_/ | ##__  ##  /##__  ##
  | ##  \ ##   /######    /######   /#######    | ##   | ##  \ ## | ##  \__/
  | ##  | ##  /##__  ##  /##__  ## | ##__  ##   | ##   | #######/ | ##
  | ##  | ## | ##  \ ## | ######## | ##  \ ##   | ##   | ##____/  | ##
  | ##  | ## | ##  | ## | ##_____/ | ##  | ##   | ##   | ##       | ##    ##
  |  ######/ | #######/ |  ####### | ##  | ##  /###### | ##       |  ######/
   \______/  | ##____/   \_______/ |__/  |__/ |______/ |__/        \______/
             | ##
             | ##                              build
             |__/                             master+98e3bca7, 2023-02-11

 Please help the OpenIPC Project to cover the cost of development and
 long-term maintenance of what we believe is going to become a stable,
 flexible Open IP Network Camera Framework for users worldwide.

 Your contributions could help us to advance the development and keep
 you updated on improvements and new features more regularly.

 Please visit https://openipc.org/sponsor/ to learn more. Thank you.

root@openipc-t31:~#