HclX / WyzeHacks

Hacks I discovered allowing Wyze camera owners to do customizations
MIT License
786 stars 75 forks source link

Add fallback to connect to wifi when Wyzecam v3 debug enabled. #106

Open BiatuAutMiahn opened 3 years ago

BiatuAutMiahn commented 3 years ago

Background: While exploring methods of establishing an rtsp stream from the camera I noticed that killing /system/bin/assis, /system/bin/hl_client, and/or /system/bin/iCamera the system would reboot a few moments after. Thus preventing any attempts to poke and prod around the system. Reviewing the init process shows that if /configs/.debug_flag exists app_init.sh will not spawn these processes. However after creating this file, I ended up soft bricking my device because it will no longer connect to the network.

This PR resolves this matter by implementing a few configuration options to: A, Enable/Disable the debug mode. B, look for wlan.new in the nfs share to update wpa_supplicant.conf and restart wpa_supplicant C, Specify WLAN SSID and KEY in the config.

ghost commented 3 years ago

I have the ability to stream h264 from the cameras as part of a larger project I am getting ready to upload to GitHub. Before I do that, I’d like to find an alpha user.

It just occurred to me yesterday that just the streaming hack may be of more interest than the rest of the project.

There’s a quick demo video here:

https://www.youtube.com/watch?v=h1Xa3kCbsvI

You can read about the project here: ( I talk about the streaming way down at the bottom in the Updates: section )

http://www.sonic.net/~crb/ReadMe.html

The code is rather crufty right now and I’ve only tried it on a V2 cameras. I have a V3 and getting it to run on that is on my todo list.

On Apr 1, 2021, at 3:47 PM, BiatuAutMiahn @.***> wrote:

Background: While exploring methods of establishing an h264 stream from the camera I noticed that killing /system/bin/assis, /system/bin/hl_client, and/or /system/bin/iCamera the system would reboot a few moments after. Thus preventing any attempts to poke and prod around the system. Reviewing the init process shows that if /configs/.debug_flag exists app_init.sh will not spawn these processes. However after creating this file, I ended up soft bricking my device.

This PR resolves this matter by implementing a few configuration options to: A, Enable/Disable the debug mode. B, look for wlan.new in the nfs share to update wpa_supplicant.conf and restart wpa_supplicant C, Specify WLAN SSID and KEY in the config.

You can view, comment on, or merge this pull request online at:

https://github.com/HclX/WyzeHacks/pull/106 https://github.com/HclX/WyzeHacks/pull/106 Commit Summary

Implement WLAN Config & fixes Update hack_ver.inc Update main.sh Tests Fixes More Fixes More Tests File Changes

M installer/config.inc.TEMPLATE https://github.com/HclX/WyzeHacks/pull/106/files#diff-44d2bbb6651f66b186453284c2213283a84025b4e4f001e02a01b556d004d166 (12) M wyze_hack/hack_ver.inc https://github.com/HclX/WyzeHacks/pull/106/files#diff-04d124532681cad49e11c2f9632532a342ab9a4fbe5aa61f805a2b74dfdb6be3 (2) M wyze_hack/main.sh https://github.com/HclX/WyzeHacks/pull/106/files#diff-2729b72c28b9ef22b4d5603e17d5f7183cecefe1631834e4a246c3a033abdda8 (71) Patch Links:

https://github.com/HclX/WyzeHacks/pull/106.patch https://github.com/HclX/WyzeHacks/pull/106.patch https://github.com/HclX/WyzeHacks/pull/106.diff https://github.com/HclX/WyzeHacks/pull/106.diff — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/HclX/WyzeHacks/pull/106, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABBXSYFLYL6PYI2QFKBSLRDTGTZYZANCNFSM42H45WPQ.

BiatuAutMiahn commented 3 years ago

Thx, im currently in the process of compiling the uboot to try and get the ispmem variable in the kernel cmdline then attempt to stream from the V3 again

ghost commented 3 years ago

Sounds good. Good luck. There are probably many different ways to get video off the camera.

On Apr 1, 2021, at 7:08 PM, BiatuAutMiahn @.***> wrote:

Thx, im currently in the process of compiling the uboot to try and get the ispmem variable in the kernel cmdline then attempt to stream from the V3 again

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/HclX/WyzeHacks/pull/106#issuecomment-812276922, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABBXSYGPNAYPEJORMBEXUZLTGURJXANCNFSM42H45WPQ.

BiatuAutMiahn commented 3 years ago

Seems i've missed something

U-Boot SPL 2013.07 (Apr 02 2021 - 06:08:19)
Timer init
CLK stop
PLL init
pll_init:366
pll_cfg.pdiv = 10, pll_cfg.h2div = 5, pll_cfg.h0div = 5, pll_cfg.cdiv = 1, pll_cfg.l2div = 2
nf=116 nr = 1 od0 = 1 od1 = 2
cppcr is 07405100
CPM_CPAPCR 0740510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPMPCR 0640510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPVPCR 0640510d
cppcr 0x9a7b5510
apll_freq 1392000000
mpll_freq 1200000000
vpll_freq = 1200000000
ddr sel mpll, cpu sel apll
ddrfreq 600000000
cclk  1392000000
l2clk 696000000
h0clk 240000000
h2clk 240000000
pclk  120000000
CLK init
SDRAM init
sdram init start
ddr_inno_phy_init ..!
phy reg = 0x00000007, CL = 0x00000007
ddr_inno_phy_init ..! 11:  00000004
ddr_inno_phy_init ..! 22:  00000006
ddr_inno_phy_init ..! 33:  00000006
REG_DDR_LMR: 00000210
REG_DDR_LMR: 00000310
REG_DDR_LMR: 00000110
REG_DDR_LMR, MR0: 00f73011
T31_0x5: 00000007
T31_0x15: 0000000c
T31_0x4: 00000000
T31_0x14: 00000002
INNO_TRAINING_CTRL 1: 00000000
INNO_TRAINING_CTRL 2: 000000a1
T31_cc: 00000003
INNO_TRAINING_CTRL 3: 000000a0
T31_118: 0000003c
T31_158: 0000003c
T31_190: 0000001e
T31_194: 0000001c
jz-04 :  0x00000051
jz-08 :  0x000000a0
jz-28 :  0x00000024
DDR PHY init OK
INNO_DQ_WIDTH   :00000003
INNO_PLL_FBDIV  :00000014
INNO_PLL_PDIV   :00000005
INNO_MEM_CFG    :00000051
INNO_PLL_CTRL   :00000018
INNO_CHANNEL_EN :0000000d
INNO_CWL        :00000006
INNO_CL         :00000007
DDR Controller init
DDRC_STATUS         0x80000001
DDRC_CFG            0x0aa88a42
DDRC_CTRL           0x0000011c
DDRC_LMR            0x00400008
DDRC_DLP            0x00000000
DDRC_TIMING1        0x050f0a06
DDRC_TIMING2        0x021c0a07
DDRC_TIMING3        0x200a0722
DDRC_TIMING4        0x26240031
DDRC_TIMING5        0xff060405
DDRC_TIMING6        0x321c0505
DDRC_REFCNT         0x00910603
DDRC_MMAP0          0x000020f8
DDRC_MMAP1          0x00002800
DDRC_REMAP1         0x030e0d0c
DDRC_REMAP2         0x07060504
DDRC_REMAP3         0x0b0a0908
DDRC_REMAP4         0x0f020100
DDRC_REMAP5         0x13121110
DDRC_AUTOSR_EN      0x00000000
sdram init finished
SDRAM init ok
board_init_r
image entry point: 0x80100000

U-Boot 2013.07 (Apr 02 2021 - 06:08:19)

Board: ISVP (Ingenic XBurst T31 SoC)
DRAM:  128 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 439k for U-Boot at: 83f90000
Reserving 32784k for malloc() at: 81f8c000
Reserving 32 Bytes for Board Info at: 81f8bfe0
Reserving 124 Bytes for Global Data at: 81f8bf64
Reserving 128k for boot params() at: 81f6bf64
Stack Pointer at: 81f6bf48
Now running in RAM - U-Boot at: 83f90000
MMC:   msc: 0
the manufacturer 5e
SF: Detected ZB25VQ128

*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ====>phy 0:0x0-0x0 found
SPEED:0, DUPLEX:0
Jz4775-9161
Hit any key to stop autoboot:  0
the manufacturer 5e
SF: Detected ZB25VQ128

--->probe spend 4 ms
SF: 2621440 bytes @ 0x40000 Read: OK
--->read spend 843 ms
## Booting kernel from Legacy Image at 80600000 ...
   Image Name:   Linux-3.10.14__isvp_swan_1.0__
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1801102 Bytes = 1.7 MiB
   Load Address: 80010000
   Entry Point:  803e17b0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.14__isvp_swan_1.0__ (chenx@chenx-Latitude-3490) (gcc version 4.7.2 (Ingenic r2.3.3 2016.12) ) #10 PREEMPT Wed Dec 16 04:24:48 CST 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 RESET ERROR PC:801C7B40
[    0.000000] [<801c7b40>] __delay+0x0/0x10
[    0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)
[    0.000000] FPU revision is: 00b70000
[    0.000000] CCLK:1392MHz L2CLK:696Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 00518000 @ 00010000 (usable)
[    0.000000]  memory: 00038000 @ 00528000 (usable after init)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 32kB, 8-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 8-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] pls check processor_id[0x00d00100],sc_jz not support!
[    0.000000] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS1,115200n8 mem=64M@0x0 rmem=64M@0x4000000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),2560k(kernel),2048k(root),-(appfs)
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 59028k/65536k available (3945k kernel code, 6508k reserved, 1270k data, 224k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:358
[    0.000000] clockevents_config_and_register success.
[    0.000015] Calibrating delay loop... 1391.00 BogoMIPS (lpj=6955008)
[    0.087830] pid_max: default: 32768 minimum: 301
[    0.092686] Mount-cache hash table entries: 512
[    0.097596] Initializing cgroup subsys debug
[    0.101850] Initializing cgroup subsys freezer
[    0.108016] regulator-dummy: no parameters
[    0.112206] NET: Registered protocol family 16
[    0.126868] bio: create slab <bio-0> at 0
[    0.132314] jz-dma jz-dma: JZ SoC DMA initialized
[    0.137382] SCSI subsystem initialized
[    0.141236] usbcore: registered new interface driver usbfs
[    0.146780] usbcore: registered new interface driver hub
[    0.152196] usbcore: registered new device driver usb
[    0.157381]  (null): set:249  hold:250 dev=100000000 h=500 l=500
[    0.163460] media: Linux media interface: v0.10
[    0.168043] Linux video capture interface: v2.00
[    0.174055] Switching to clocksource jz_clocksource
[    0.178986] cfg80211: Calling CRDA to update world regulatory domain
[    0.185852] jz-dwc2 jz-dwc2: cgu clk gate get error
[    0.190733] DWC IN OTG MODE
[    0.194164] dwc2 dwc2: Keep PHY ON
[    0.197570] dwc2 dwc2: Using Buffer DMA mode
[    0.201856] dwc2 dwc2: Core Release: 3.00a
[    0.206051] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[    0.212376] dwc2 dwc2: new USB bus registered, assigned bus number 1
[    0.219436] hub 1-0:1.0: USB hub found
[    0.223170] hub 1-0:1.0: 1 port detected
[    0.227252] dwc2 dwc2: DWC2 Host Initialized
[    0.231668] NET: Registered protocol family 2
[    0.236434] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.243344] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.249820] TCP: Hash tables configured (established 512 bind 512)
[    0.256098] TCP: reno registered
[    0.259317] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.265241] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.271790] NET: Registered protocol family 1
[    0.276399] RPC: Registered named UNIX socket transport module.
[    0.282326] RPC: Registered udp transport module.
[    0.287143] RPC: Registered tcp transport module.
[    0.291862] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.298722] freq_udelay_jiffys[0].max_num = 10
[    0.303146] cpufreq  udelay  loops_per_jiffy
[    0.307602] dwc2 dwc2: ID PIN CHANGED!
[    0.311406] 12000     59956   59956
[    0.314625] 24000     119913  119913
[    0.318081] 60000     299784  299784
[    0.321512] 120000    599569  599569
[    0.325043] 200000    999282  999282
[    0.328657] 300000    1498924         1498924
[    0.332286] 600000    2997848         2997848
[    0.336067] 792000    3957159         3957159
[    0.339702] 1008000   5036385         5036385
[    0.343498] 1200000   5995696         5995696
[    0.350930] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.357484] jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
[    0.363210] msgmni has been set to 115
[    0.367931] io scheduler noop registered
[    0.371854] io scheduler cfq registered (default)
[    0.377755] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[    0.385282] console [ttyS1] enabled, bootconsole disabled
[    0.385282] console [ttyS1] enabled, bootconsole disabled
[    0.398980] brd: module loaded
[    0.403482] loop: module loaded
[    0.407250] zram: Created 2 device(s) ...
[    0.411434] logger: created 256K log 'log_main'
[    0.416715] jz TCU driver register completed
[    0.421502] the id code = 5e4018, the flash name is ZB25VQ128
[    0.427495] JZ SFC Controller for SFC channel 0 driver register
[    0.433612] 4 cmdlinepart partitions found on MTD device jz_sfc
[    0.439734] Creating 4 MTD partitions on "jz_sfc":
[    0.444683] 0x000000000000-0x000000040000 : "boot"
[    0.450044] 0x000000040000-0x0000002c0000 : "kernel"
[    0.455539] 0x0000002c0000-0x0000004c0000 : "root"
[    0.460834] 0x0000004c0000-0x000001000000 : "appfs"
[    0.466264] SPI NOR MTD LOAD OK
[    0.469552] tun: Universal TUN/TAP device driver, 1.6
[    0.474758] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    0.481270] usbcore: registered new interface driver zd1201
[    0.487064] usbcore: registered new interface driver r8152
[    0.492751] usbcore: registered new interface driver asix
[    0.498410] usbcore: registered new interface driver usb-storage
[    0.504699] usbcore: registered new interface driver usbserial
[    0.510810] usbcore: registered new interface driver usb_ch34x
[    0.516848] ch34x: USB driver for USB to serial chip ch340, ch341, ch9341, etc.
[    0.524382] ch34x: V1.12 On 2020.03.06
[    0.528285] usbcore: registered new interface driver ch37x
[    0.533965] usbcore: registered new interface driver pl2303
[    0.539744] usbserial: USB Serial support registered for pl2303
[    0.546087] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[    0.552076] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[    0.557498] jzmmc_v1.2 jzmmc_v1.2.1: vmmc regulator missing
[    0.563425] jzmmc_v1.2 jzmmc_v1.2.1: register success!
[    0.568897] hidraw: raw HID events driver (C) Jiri Kosina
[    0.574585] usbcore: registered new interface driver usbhid
[    0.580386] usbhid: USB HID core driver
[    0.584524] TCP: cubic registered
[    0.587966] NET: Registered protocol family 17
[    0.593182] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[    0.600303] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[    0.608766] List of all partitions:
[    0.612390] 1f00             256 mtdblock0  (driver?)
[    0.617695] 1f01            2560 mtdblock1  (driver?)
[    0.622899] 1f02            2048 mtdblock2  (driver?)
[    0.628131] 1f03           11520 mtdblock3  (driver?)
[    0.633338] No filesystem could mount root, tried:  squashfs
[    0.639219] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
[    0.647834] Rebooting in 3 seconds..Restarting after 4 ms

U-Boot SPL 2013.07 (Apr 02 2021 - 06:08:19)
Timer init
CLK stop
PLL init
pll_init:366
pll_cfg.pdiv = 10, pll_cfg.h2div = 5, pll_cfg.h0div = 5, pll_cfg.cdiv = 1, pll_cfg.l2div = 2
nf=116 nr = 1 od0 = 1 od1 = 2
cppcr is 07405100
CPM_CPAPCR 0740510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPMPCR 0640510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPVPCR 0640510d
cppcr 0x9a7b5510
apll_freq 1392000000
mpll_freq 1200000000
vpll_freq = 1200000000
ddr sel mpll, cpu sel apll
ddrfreq 600000000
cclk  1392000000
l2clk 696000000
h0clk 240000000
h2clk 240000000
pclk  120000000
CLK init
SDRAM init
sdram init start
ddr_inno_phy_init ..!
phy reg = 0x00000007, CL = 0x00000007
ddr_inno_phy_init ..! 11:  00000004
ddr_inno_phy_init ..! 22:  00000006
ddr_inno_phy_init ..! 33:  00000006
REG_DDR_LMR: 00000210
REG_DDR_LMR: 00000310
REG_DDR_LMR: 00000110
REG_DDR_LMR, MR0: 00f73011
T31_0x5: 00000007
T31_0x15: 0000000c
T31_0x4: 00000000
T31_0x14: 00000002
INNO_TRAINING_CTRL 1: 00000000
INNO_TRAINING_CTRL 2: 000000a1
T31_cc: 00000003
INNO_TRAINING_CTRL 3: 000000a0
T31_118: 0000003c
T31_158: 0000003c
T31_190: 0000001e
T31_194: 0000001c
jz-04 :  0x00000051
jz-08 :  0x000000a0
jz-28 :  0x00000024
DDR PHY init OK
INNO_DQ_WIDTH   :00000003
INNO_PLL_FBDIV  :00000014
INNO_PLL_PDIV   :00000005
INNO_MEM_CFG    :00000051
INNO_PLL_CTRL   :00000018
INNO_CHANNEL_EN :0000000d
INNO_CWL        :00000006
INNO_CL         :00000007
DDR Controller init
DDRC_STATUS         0x80000001
DDRC_CFG            0x0aa88a42
DDRC_CTRL           0x0000011c
DDRC_LMR            0x00400008
DDRC_DLP            0x00000000
DDRC_TIMING1        0x050f0a06
DDRC_TIMING2        0x021c0a07
DDRC_TIMING3        0x200a0722
DDRC_TIMING4        0x26240031
DDRC_TIMING5        0xff060405
DDRC_TIMING6        0x321c0505
DDRC_REFCNT         0x00910603
DDRC_MMAP0          0x000020f8
DDRC_MMAP1          0x00002800
DDRC_REMAP1         0x030e0d0c
DDRC_REMAP2         0x07060504
DDRC_REMAP3         0x0b0a0908
DDRC_REMAP4         0x0f020100
DDRC_REMAP5         0x13121110
DDRC_AUTOSR_EN      0x00000000
sdram init finished
SDRAM init ok
board_init_r
image entry point: 0x80100000

U-Boot 2013.07 (Apr 02 2021 - 06:08:19)

Board: ISVP (Ingenic XBurst T31 SoC)
DRAM:  128 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 439k for U-Boot at: 83f90000
Reserving 32784k for malloc() at: 81f8c000
Reserving 32 Bytes for Board Info at: 81f8bfe0
Reserving 124 Bytes for Global Data at: 81f8bf64
Reserving 128k for boot params() at: 81f6bf64
Stack Pointer at: 81f6bf48
Now running in RAM - U-Boot at: 83f90000
MMC:   msc: 0
the manufacturer 5e
SF: Detected ZB25VQ128

*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ====>phy 0:0x0-0x0 found
SPEED:0, DUPLEX:0
Jz4775-9161
Hit any key to stop autoboot:  0
isvp_t31#

Update: Fixed uboot, mtdparts were messed up. Even after setting ispmem in cmdline still cannot get sensor to work, looking into driver modules next.

endertable commented 3 years ago

I have the ability to stream h264 from the cameras as part of a larger project I am getting ready to upload to GitHub. Before I do that, I’d like to find an alpha user. It just occurred to me yesterday that just the streaming hack may be of more interest than the rest of the project. There’s a quick demo video here: https://www.youtube.com/watch?v=h1Xa3kCbsvI You can read about the project here: ( I talk about the streaming way down at the bottom in the Updates: section ) http://www.sonic.net/~crb/ReadMe.html The code is rather crufty right now and I’ve only tried it on a V2 cameras. I have a V3 and getting it to run on that is on my todo list.

This looks very promising on a stock camera. I like the progression you are making, especially on stock camera firmware. The local h264 streaming sounds very cool. I have something similar to your cli except I am using plain ole Korn shell and wget commands to interact with the wyze API mostly because I don't know how to program in python, hehe. It's very kludgy but so far works well, until, like you say, Wyze changes their API. Looking forward to your github..

gtxaspec commented 2 years ago

@BiatuAutMiahn were you able to get a working uboot compiled?

BiatuAutMiahn commented 2 years ago

Unfortunately no, I abandoned this project after Wyze pretty much made this irrelevant

gtxaspec commented 2 years ago

@BiatuAutMiahn, perhaps I can pick your brain since you were working on replacing the bootloader, is it possible to flash via serial? or just via /dev/mtd0?

BiatuAutMiahn commented 2 years ago

@BiatuAutMiahn, perhaps I can pick your brain since you were working on replacing the bootloader, is it possible to flash via serial? or just via /dev/mtd0?

No, but I was able to put the bootloader on the sdcard and managed to use the uboot serial prompt to flash it

BiatuAutMiahn commented 2 years ago

At one point I managed to get the T31 toolchain in attempt to make my own binaries and hopefully get uboot compiled but life happened and I switch focus. If we can get some kind of discord or telegram thread going I can hop back on this project for a while but I'm by no means an expert.

BiatuAutMiahn commented 2 years ago

https://github.com/BiatuAutMiahn/IVSP-T31-1.1.1-20200508

gtxaspec commented 2 years ago

checkout t.me/wzmods @BiatuAutMiahn

endertable commented 2 years ago

Hi guys, y’all seem like the ones that would have answers to some questions I’ve always pondered. How much power does the boot loader and or kernel have over the cam once the Wyze binaries have taken over (iCamera, assis, etc)? Is the kernel solely used as the OS or does it still have control as far as firmware updates? When I do the SD card update, is that the kernel that does it or does it still pass control over to iCamera and assis? Thanks

gtxaspec commented 2 years ago

the sd card update is done by the bootloader. once the bootloader loads the kernel, it takes over everything.

endertable commented 2 years ago

This may be going a little sideways I just figure considering you guys build uboot images, you know about compiling. I notice the build toolchain of mips-gcc472-glibc216-32bit-r2.3.3 is on here. How would I use that to compile tcpdump for the cams. I know I would also need to compile libpcap. My linux uname comes up with 'i686 i686 i386 GNU/Linux' (if that's important) and what special CFLAGS=, LDFLAGS=, etc would I need to make sure I use the uClibc that the cams do. Thanks.

gtxaspec commented 2 years ago

wz_mini includes a static build of tcpdump, cross compiling can be a pain.

endertable commented 2 years ago

Didn't notice that. You been busy. Great job on that repo!! :)

Thanks