Can't update Wyze Cam Pan using official firmware image

[agent86ix]

I've got a Wyze Cam Pan with a bad bootloader that can't flash from the SD card. A user in a thread on another project suggested that perhaps this program could help. However, it doesn't seem to be working like I'd expect.

If I configure the command line utilities to push an official firmware .bin file from Wyze, the camera downloads it but doesn't flash it. The serial output from the camera is:

[test_UP]process_data  11068296  
[test_UP]process_data  11075648  
curl_easy_perform ret:0
[test_UP]printf  file ret 1 
IMP_IVS_PollingResult failed 0 
IMP_IVS_PollingResult failed 0 
[UPGRADE] get_uploadfile_md5:[43][859830e9e74231b83ac1651e00d8d3a8  /tmp/img
]
[UPGRADE] should wait sleep 10
[UPGRADE] RealMd5:[859830e9e74231b83ac1651e00d8d3a8] len:32 
[UPGRADE] FileMd5:[859830e9e74231b83ac1651e00d8d3a8  /tmp/img
] len:43 
msg_queue_snd time: 5F4A6B38, id: 65538, type: 189, cmd: 199
test_up_worker_looptest_up_worker_looptest_up_worker_loop 
IMP_IVS_PollingResult failed 0 
 nLeftSize nLeftSize is 497,,percent percent is 0
[AUTO] scandir no other file del this dir /media/mmcblk0p1/record/
video_PlatForm_get_YUV(358):IMP_FrameSource_GetFrame failed
[UPGRADE] RESET_M_DOWN_FILE_GET rcv file finish wdg:0
msg  {"device_mac":"2CAA8EA0A723","product_model":"WYZECP1_JEF","product_type":"Camera","hardware_ver":"0.0.0.0","firmware_ver":"4.10.6.152","device_model":"WYZECP1_JEF","sc":"360a7068374548a2853526f5e0231ad2","sv":"783390f084374b11a24546fe2edc66c3","timestamp":1598712633000,"language":"en","data":{"process_id":"2CAA8EA0A7231598712633000","step_name":"copy","device_cur_version":"4.10.6.152","device_target_version":"","step_start_time":1598712633,"step_end_time":1598712633,"step_duration":0,"step_result":1,"failed_reason":"","custom_info":""}}  
DEBUG:   curl_post L#128 POST URL[https://statistics-api.wyzecam.com:8615/device/report/upgrade]

DEBUG:   curl_post L#129 POST CTX[{"device_mac":"2CAA8EA0A723","product_model":"WYZECP1_JEF","product_type":"Camera","hardware_ver":"0.0.0.0","firmware_ver":"4.10.6.152","device_model":"WYZECP1_JEF","sc":"360a7068374548a2853526f5e0231ad2","sv":"783390f084374b11a24546fe2edc66c3","timestamp":1598712633000,"language":"en","data":{"process_id":"2CAA8EA0A7231598712633000","step_name":"copy","device_cur_version":"4.10.6.152","device_target_version":"","step_start_time":1598712633,"step_end_time":1598712633,"step_duration":0,"step_result":1,"failed_reason":"","custom_info":""}}]

[TEST] RCV: POST URL[https://statistics-api.wyzecam.com:8615/device/report/upgrade]

[TEST] RCV: POST CTX[{"device_mac":"2CAA8EA0A723","product_model":"WYZECP1_JEF","product_type":"Camera","hardware_ver":"0.0.0.0","firmware_ver":"4.10.6.152","device_model":"WYZECP1_JEF","sc":"360a7068374548a2853526f5e0231ad2","sv":"783390f084374b11a24546fe2edc66c3","timestamp":1598712633000,"language":"en","data":{"process_id":"2CAA8EA0A7231598712633000","step_name":"copy","device_cur_version":"4.10.6.152","device_target_version":"","step_start_time":1598712633,"step_end_time":1598712633,"step_duration":0,"step_result":1,"failed_reason":"","custom_info":""}}]

IMP_IVS_PollingResult failed 0 
IMP_IVS_PollingResult failed 0 
DEBUG:   curl_post L#202 84 bytes retrieved

DEBUG:   curl_post L#206 HTTP RESPONSE = {"timestamp":"1598712634001","code":"1001","message":"parameter is error","data":{}}

[TEST] RCV: 84 bytes retrieved

[TEST] RCV: HTTP RESPONSE = {"timestamp":"1598712634001","code":"1001","message":"parameter is error","data":{}}

upgrade_close_wdg_in_camera_ok_handlerupgrade_close_wdg_in_camera_ok_handler 
stop_app_prob_wdtstop_app_prob_wdtstop_app_prob_wdtstop_app_prob_wdtstop_app 
stop_app_prob_wdtstop_app_prob_wdtstop_app_prob_wdtstop_app_prob_wdtstop_app 
IMP_IVS_PollingResult failed 0 
IMP_IVS_PollingResult failed 0 
[APPUP] g_nUpFilelen = 0
Size of file.cpp: 11075648 bytes.
[APPUP] g_nUpFilelen = 11075648
[APPUP] stop here stop here stop here  ready release catch
testup_jiabo_upgrade!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
IMP_IVS_PollingResult failed 0 
tar: invalid tar magic
is_Update_System_num =1 is_Update_System_num =1 is_Update_System_num =1
msg_queue_snd time: 5F4A6B3B, id: 65538, type: 189, cmd: 191
get REBOOT_MESS_TO_ICAMERA_SET 
umount: /dev/mtdblock4 busy - remounted read-only
umount: tmpfs busy - remounted read-only
gpio 46 read error
umount: can't remount tmpfs read-only
The system is going down[  195.945419] RTL871X: rtw_cmd_thread(wlan0) _rtw_down_sema(&pcmdpriv->cmd_queue_sema) return _FAIL, break
gpio 46 read error
gpio 46 read error
gpio 46 read error
gpio 46 read error
gpio 46 read error
video_PlatForm_get_YUV(358):IMP_FrameSource_GetFrame failed
gpio 46 read error
gpio 46 read error
fopen:: No such file or directory
gpio 46 read error
gpio 46 read error
gpio 46 read error
IMP_IVS_PollingResult failed 0 
gpio 46 read error
gpio 46 read error
gpio 46 read error
gpio 46 read error
gpio 46 read error
gpio 46 read error
gpio 46 read error
[  196.333417] codec_codec_ctl: set CODEC_TURN_OFF...
[  196.352836] codec_codec_ctl: set CODEC_TURN_OFF...
Sent SIGKILL to all processes
Requesting system reboot
[  197.944107] codec_codec_ctl: set CODEC_TURN_OFF...
[  197.949091] codec_codec_ctl: set CODEC_SHUTDOWN...
[  197.964415] mmc0: card 1234 removed
[  197.973782] Restarting system.
[  197.976952] Restarting after 4 ms

There's a lot of console spam from various bits of the camera which are still running. Two things that jump out at me:

1. It looks like the camera is phoning home to statistics-api.wyzecam.com to log the update, but gets an error in return. This doesn't seem to be stopping it, but it is interesting to note.
2. There's an "invalid tar magic" line - perhaps that indicates that the expected firmware file should be in tar format?

[agent86ix]

I was able to capture an "official" update run from the serial log, and it seems like it is grabbing this file:

http://d1fk93tz4plczb.cloudfront.net/UpgradeKit/1595945527/Upgrade_4.10.6.156_07281855.tar

Which is indeed a tar file, and the contents are a very different format than the .bin files that Wyze makes available for uboot/SD card based upgrades.

[HclX]

That's expected. Their OTA update is file based and has a different format than the firmware image you can get from their website. For your case, I'd suggest you gain telnet access via wyzehacks, and then see if you can manually flash bootloader via telnet.

On Sat, Aug 29, 2020, 08:07 agent86ix notifications@github.com wrote:

I was able to capture an "official" update run from the serial log, and it seems like it is grabbing this file:

http://d1fk93tz4plczb.cloudfront.net/UpgradeKit/1595945527/Upgrade_4.10.6.156_07281855.tar

Which is indeed a tar file, and the contents are a very different format than the .bin files that Wyze makes available for uboot/SD card based upgrades.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/HclX/WyzeUpdater/issues/2#issuecomment-683302683, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAZNWD5WSHUAGLMU7YK7SSLSDEKTNANCNFSM4QPBDFWQ .

[agent86ix]

OK, I was unaware of WyzeHacks (https://github.com/HclX/WyzeHacks) before you mentioned it, thanks for both of these projects :)

It doesn't look like the OTA update contains a bootloader image (I don't see it in the tar file, and additionally if there was an update, installing an OTA update would likely fix this problem). Based on what I learned from https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/blob/master/hacks/howto_modfirmware.md , it seems like the binary releases from Wyze likely contain a bootloader image I can pull.

Do you know how to leverage the shell prompt to flash the bootloader on this device? I'm missing that piece of the puzzle.

[agent86ix]

Ah, I think I found the doc:

https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/blob/master/hacks/flashinguboot.md

[agent86ix]

Leveraging your tools and pointers, I built:

https://github.com/agent86ix/wyze-cam-pan-sd-flash-fix

Which worked for my two "incorrect bootloader" Pans.

Thanks for the tools and the help!