OpenIPC
/
wiki
mirror of https://github.com/OpenIPC/wiki.git
1
0
Fork 0
Code Activity
wiki/en/device-wyze-integration.md

8.7 KiB
Raw Blame History

OpenIPC Wiki

Table of Content

Wyze integration

This is where we'll be writing down our guide to flashing new devices and reports on our experiments.

Current issues

  • Exposure does not work well https://github.com/OpenIPC/majestic/issues/102
  • SD card does not work in the U-Boot (power is available)
  • Problem with loading u-boot from an microSD card. It doesn't reach the promt. Not only on wyze v3 (https://t.me/openipc_modding/179369), but also on another board T31L (https://t.me/openipc/47739). Most likely it will be IMPOSSIBLE, because in the camera there is a microSD power management MOSFET, which must be turned on BEFORE booting from the card (the experiment with not fully loaded u-boot was possible due to direct power supply to the microSD card, bypassing the transistor). Please confirm my version if it is not possible otherwise.

Known camera modifications

  • WYZE Cam v3
MODEL IC FCC ID PCB VER SoC WIFI NOTES
WYZEC3 25466-WYZEC3A 2AUIUWYZEC3A WYZEV3_T31GC2053 V1.2_20200715 T31X SDIO: Realtek 8189FTV MAC: 7C:78:B2:99:6E:BA https://youtu.be/jm4wze_HY78
WYZEV3_T31GC2053 V1.4_20201010 T31 SDIO: Realtek 8189FTV MAC: 7C:78:B2:69:95:C9 https://youtu.be/t7Nzo-KXTH0
WYZEC3 25466-WYZEC3B 2AUIUWYZEC3B WYZEV3_T31GC2053 V2.02_20210523 T31ZX SDIO: Realtek 8189FTV https://t.me/openipc/38728 https://t.me/openipc/38753
WYZEC3 25466-WYZEC3A 2AUIUWYZEC3A WYZEV3_T31GC2053 V2.02_20210523 T31ZX SDIO: AltoBeam 6031 https://t.me/openipc/49049 https://t.me/openipc/49050
WYZEC3 25466-WYZEC3A 2AUIUWYZEC3A WYZEV3_T31GC2053 V2.03_20211206 T31X SDIO: AltoBeam 6031 https://t.me/openipc/45444 https://t.me/openipc/48942
WYZEC3 25466-WYZEC3F 2AUIUWYZEC3F WYZEV3_T31AGC2053 V3.2_20210714 T31A BGA SDIO: AltoBeam 6031 https://t.me/openipc/43299 https://t.me/openipc/38755 https://t.me/openipc/38757
WYZEC3 25466-WYZEC3F 2AUIUWYZEC3F WYZEV3_T31AGC2053 V3.2_20210714 T31A BGA SDIO: AltoBeam 6031 MAC:D0:3F:27:4F:23:19 https://youtu.be/VkqX9yg0odU

OpenIPC installation

  • Disassemble camera and connect UART adapter or your camera should be already connected to network.

  • Backup

Downgrade original firmware version to (Jun 2021 w-o internet)demo_wcv3_4.36.2.5.bin (WYom20200 Jun 2021 w-o internet)demo_wcv3_4.36.2.5.bin.zip

Login with user root password WYom20200 via telnet or UART console. Insert microSD card to camera and issue commands line by line, not all together:

dd if=/dev/mtd0 of=/media/mmc/mtd0.bin

dd if=/dev/mtd1 of=/media/mmc/mtd1.bin

dd if=/dev/mtd2 of=/media/mmc/mtd2.bin

dd if=/dev/mtd3 of=/media/mmc/mtd3.bin

dd if=/dev/mtd4 of=/media/mmc/mtd4.bin

dd if=/dev/mtd5 of=/media/mmc/mtd5.bin

dd if=/dev/mtd6 of=/media/mmc/mtd6.bin

Output sample:

[root@WCV3:~]# dd if=/dev/mtd0 of=/media/mmc/mtd0.bin
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.133246 seconds, 1.9MB/s
[root@WCV3:~]# dd if=/dev/mtd1 of=/media/mmc/mtd1.bin
3968+0 records in
3968+0 records out
2031616 bytes (1.9MB) copied, 1.039464 seconds, 1.9MB/s
[root@WCV3:~]# dd if=/dev/mtd2 of=/media/mmc/mtd2.bin
7808+0 records in
7808+0 records out
3997696 bytes (3.8MB) copied, 2.070890 seconds, 1.8MB/s
[root@WCV3:~]# dd if=/dev/mtd3 of=/media/mmc/mtd3.bin
7808+0 records in
7808+0 records out
3997696 bytes (3.8MB) copied, 2.459327 seconds, 1.5MB/s
[root@WCV3:~]# dd if=/dev/mtd4 of=/media/mmc/mtd4.bin
3968+0 records in
3968+0 records out
2031616 bytes (1.9MB) copied, 1.048184 seconds, 1.8MB/s
[root@WCV3:~]# dd if=/dev/mtd5 of=/media/mmc/mtd5.bin
7808+0 records in
7808+0 records out
3997696 bytes (3.8MB) copied, 2.703471 seconds, 1.4MB/s
[root@WCV3:~]# dd if=/dev/mtd6 of=/media/mmc/mtd6.bin
768+0 records in
768+0 records out
393216 bytes (384.0KB) copied, 0.201104 seconds, 1.9MB/s
[root@WCV3:~]# dd if=/dev/mtd7 of=/media/mmc/mtd7.bin
128+0 records in
128+0 records out
65536 bytes (64.0KB) copied, 0.029211 seconds, 2.1MB/s

If there wasn't errors, then you backed up such partitions:

[root@WCV3:~]# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00008000 "boot"
mtd1: 001f0000 00008000 "kernel"
mtd2: 003d0000 00008000 "rootfs"
mtd3: 003d0000 00008000 "app"
mtd4: 001f0000 00008000 "kback"
mtd5: 003d0000 00008000 "aback"
mtd6: 00060000 00008000 "cfg"
mtd7: 00010000 00008000 "para"

Save and keep this files in safe place. In case of any errors you should perform this operation once again, probably with microSD card replacement.

  • Determine SoC model

Download ipctool-mips32 to microSD card (https://github.com/OpenIPC/ipctool/releases/download/latest/ipctool-mips32) and insert microSD card in camera. Login to camera and issue command /media/mmc/ipctool-mips32 There should be something like model: T31ZX in console output. Important part is ZX Output sample:

[root@WCV3:~]# /media/mmc/ipctool-mips32 
---
chip:
  vendor: Ingenic
  model: T31ZX
rom:
  - type: nor
    block: 32K
    partitions:
      - name: boot
        size: 0x40000
        sha1: 20776e92
      - name: kernel
        size: 0x1f0000
        sha1: 6887b828
      - name: rootfs
        size: 0x3d0000
        sha1: d368892a
      - name: app
        size: 0x3d0000
        path: /system,squashfs
        sha1: 04b813a8
      - name: kback
        size: 0x1f0000
        sha1: 83ccf23a
      - name: aback
        size: 0x3d0000
        sha1: 48bbe705
      - name: cfg
        size: 0x60000
        path: /configs,jffs2,rw
      - name: para
        size: 0x10000
        sha1: 472a55b0
    size: 16M
ram:
  total: 128M
  media: 32M
firmware:
  kernel: "3.10.14__isvp_swan_1.0__ (PREEMPT Wed Apr 14 17:44:51 CST 2021)"
  toolchain: gcc version 4.7.2 (Ingenic r2.3.3 2016.12) 
  libc: uClibc 0.9.33.2
  main-app: /system/bin/iCamera
  • Flash OpenIPC U-boot

Open https://openipc.org/cameras/vendors/ingenic and choose appropriate SoC model from list.

In this case our choice Ingenic T31X.

In Downloads section find OpenIPC Bootloader for Ingenic T31X and download it.

https://github.com/OpenIPC/firmware/releases/download/latest/u-boot-t31x-universal.bin

Copy u-boot-t31x-universal.bin to microSD card and insert microSD card in camera.

telnet would be unavailable after the command below (flashcp) !

Login to camera and issue command: flashcp -v /media/mmc/u-boot-t31x-universal.bin /dev/mtd0

Output sample:

[root@WCV3:~]# flashcp -v /media/mmc/u-boot-t31x-universal.bin /dev/mtd0
Erasing block: 8/8 (100%) 
Writing kb: 242/242 (100%) 
Verifying kb: 242/242 (100%)

Now your camera flashed with OpenIPC U-boot, but whole system is still stock. So, next re/boot will load OpenIPC U-boot only (in cycling mode, until stop with Ctrl+C in UART console).

  • Flash kernel and rootfs

Since we identified our chip as Ingenic T31X open https://openipc.org/cameras/vendors/ingenic and choose T31X.

In Downloads section find OpenIPC Linux (Lite) for Ingenic T31X and download it.

https://github.com/OpenIPC/firmware/releases/download/latest/openipc.t31-nor-lite.tgz

Power off the camera.

Extract and copy rootfs.squashfs.t31 uImage.t31 to microSD card. Insert microSD card in camera.

Power on the camera.

During power on the camera press Ctrl+C several times until it shows OpenIPC promt like this OpenIPC #

Then issue command run setnor16m

After you press the Enter key the camera will almost immediately restart and you will have to catch the prompt again.

Then issue command

mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} uImage.${soc} ; sf probe 0; sf erase 0x50000 0x300000; sf write ${baseaddr} 0x50000 ${filesize}

and next

mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} rootfs.squashfs.${soc} ; sf probe 0; sf erase 0x350000 0xa00000; sf write ${baseaddr} 0x350000 ${filesize}

Output sample:

OpenIPC # mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} uImage.${soc} ; sf probe 0; sf erase 0x50000 0x300000; sf write ${baseaddr} 0x50000 ${filesize}
reading uImage.t31
1855437 bytes read in 89 ms (19.9 MiB/s)
the manufacturer 5e
SF: Detected ZB25VQ128

--->probe spend 5 ms
SF: 3145728 bytes @ 0x50000 Erased: OK
--->erase spend 9871 ms
SF: 1855437 bytes @ 0x50000 Written: OK
--->write spend 3286 ms

OpenIPC # mw.b ${baseaddr} ff 1000000; fatload mmc 0:1 ${baseaddr} rootfs.squashfs.${soc} ; sf probe 0; sf erase 0x350000 0xa00000; sf write ${baseaddr} 0x350000 ${filesize}
reading rootfs.squashfs.t31
5079040 bytes read in 236 ms (20.5 MiB/s)
the manufacturer 5e
SF: Detected ZB25VQ128

--->probe spend 4 ms
SF: 10485760 bytes @ 0x350000 Erased: OK
--->erase spend 31730 ms
SF: 5079040 bytes @ 0x350000 Written: OK
--->write spend 8949 ms