Tapo C225 Firmware

[alinmiron]

Hi all, This is the URL for Tapo C225 camera firmware.

http://download.tplinkcloud.com/firmware/Tapo_C225v1_en_1.0.14_Build_220922_Rel.76344n__1664445373640.bin

It seems to be weird format or encrypted :-(

alin@robinet:~/Downloads/tapo$ binwalk Tapo_C225v1_en_1.0.14_Build_220922_Rel.76344n__1664445373640.bin

DECIMAL HEXADECIMAL DESCRIPTION

alin@robinet:~/Downloads/tapo$

this is what strings outputs:

alin@robinet:~/Downloads/tapo$ strings Tapo_C225v1_en_1.0.14_Build_220922_Rel.76344n__1664445373640.bin|head !_N&c% nH-PY~ UXBzcq +D[b?A W=y{u{ T*1)jX Cm<H@Gf|; q6mS3y= JO6F]L oo?c3ej

Tried binwalk options,

alin@robinet:~/Downloads/tapo$ binwalk -A Tapo_C225v1_en_1.0.14_Build_220922_Rel.76344n__1664445373640.bin

DECIMAL HEXADECIMAL DESCRIPTION

2229997 0x2206ED ARMEB instructions, function prologue 7496571 0x72637B ARMEB instructions, function prologue 12262302 0xBB1B9E ARMEB instructions, function prologue

seems to be some ARM related so tried the following below but it takes forever.

alin@robinet:~/Downloads/tapo$ binwalk --disasm --verbose Tapo_C225v1_en_1.0.14_Build_220922_Rel.76344n__1664445373640.bin

Scan Time: 2023-02-14 08:09:53 Target File: /home/alin/Downloads/Tapo_C225v1_en_1.0.14_Build_220922_Rel.76344n__1664445373640.bin MD5 Checksum: be7df593a76d5e7543e1f98aaa2d2779

DECIMAL HEXADECIMAL DESCRIPTION

[alinmiron]

new version: http://download.tplinkcloud.com/firmware/Tapo_C225v1_en_1.0.17_Build_230222_Rel.34031n__1678451963069.bin

[najashark]

@alinmiron thanks for your firmware, I was able to downgrade my camera using SD card method. I also documented my RE attempt of this camera here https://github.com/najashark/tplink-tapo-c225-re.

Feel free to discuss there if anything.

[alinmiron]

@najashark I saw your RE attempt. Pressing 'Enter" does not help it seems to delay autobooting. What do you get when you press the "privacy" button located in front of the camera? Keep in mind also the reset button (near the microsd slot). Or perhaps there's a combination of actions ("Enter" while pressing the "privacy" button)

I got this idea from my air purifier. It has 2 touch buttons on the OLED display and another physical button on the back that has as main function the dimming of the display. This button is also used if you what to hard-reset the purifier - you need to press it together with the power button and hold it pressed few seconds if I remember well.

And is just an example, another example would be the SpO2 monitors that you can wear on finger, they have one button that you can use to do more than one function.

[JayFoxRox]

v1

For completeness, here is the other URL from https://github.com/najashark/tplink-tapo-c225-re#firmware-thanks-to-alinmiron :

• http://download.tplinkcloud.com/firmware/Tapo_C225v1_en_1.0.27_Build_231107_Rel.69776n_up_boot-signed_1700203063123.bin

[JayFoxRox]

I was able to downgrade my camera using SD card method

@najashark I spotted this in the scripts, but I found no existing documentation on this. Can you elaborate?

[najashark]

I was able to downgrade my camera using SD card method

@najashark I spotted this in the scripts, but I found no existing documentation on this. Can you elaborate?

I found it in another discussion, here

• https://github.com/nervous-inhuman/tplink-tapo-c200-re/discussions/6#discussioncomment-5487936
• https://github.com/nervous-inhuman/tplink-tapo-c200-re/discussions/6#discussioncomment-5487935

[bmwgurkan]

Hello to everyone, I tried all the versions in the link below for my Tapo C225v2 camera, but I was not successful. I also have 2 C225v1 version cameras and I managed to downgrade them. Can you help with C225v2? (C225v2 Apple Homekit version)

https://web.archive.org/web/*/http://download.tplinkcloud.com/