An update file (for use with WyzeUpdater) that fixes a bootloader issue with certain Wyze Cam Pan models that keeps them from being able to flash firmware from the SD card.
This script takes (what I consider to be) appropriate precautions, but since it flashes your bootloader, there is a non-zero chance it will brick your camera. The only way to recover from this state would be to desolder the flash chip and program it manually. By using this software, you understand and accept the risk of this issue happening to you.
wyze_updater.py list
. Then you can download the latest release of the binary bundle from this page, and tell WyzeUpdater to push it to your camera. The instructions may vary if WyzeUpdater changes, but as of this writing:
python wyze_updater.py update -p 18080 -d $CAMERA_MAC -f path/to/pan-fix.tar
This will start a small web server on your machine, and then attempt to trigger the same update flow as the app on your camera. You should see a couple of requests printed from the camera, (one ending in firmware.bin
). Afterwards, the camera should reboot shortly after. Once it has, you can exit (Ctrl-C) the WyzeUpdater program. Otherwise, it will run forever.
I am not the author of WyzeUpdater so I'm not the best person to ask for support if you have trouble running the tool. If you have issues serving this update file to a particular model camera or a particular firmware revision, I may or may not be able to help.
WARNING: Do not modify the tar file unless you are very sure you know what you are doing. The binary file inside the tar file is NOT a demo.bin
image. It is a bootloader image. Replacing it with something that is not a bootloader binary (ie, demo.bin
) will brick your unit.
The binary bundle is a simple .tar file of the Upgrade
directory in this repository. You can modify the script, change the bootloader image, etc. However, the Upgrade/upgraderun.sh
script is the main entry point for the app-based updater, and the Upgrade/PARA
file appears to be mandatory.
When you're done making modifications, just tar it up again:
tar -cvf pan-fix.tar Upgrade/
According to this thread on the Wyze forums the impacted cameras have a QR code on the back of the camera (and the box) that contains the substring F00
. There may be other variants of the camera that are also impacted.
The symptoms of this issue are that even if you properly follow the instructions for manually flashing, the camera will reboot quickly after the flash process starts, and will still have the same firmware version it had before.
The short answer is "No." The longer answer is "Well, not really."
This doesn't install any 3rd party software (ie, this does not install Dafang Hacks) on your camera. It simply installs another official Wyze bootloader, one taken from a Wyze Cam v2, supplied by @tachang as part of openmiko.. I have confirmed that this is the same bootloader image (same md5sum) as an older Wyze Cam Pan that did not have this issue.
Once this "fix" has been applied, you should be able to flash any Wyze firmware or any compatible "hacked" firmware using the "demo.bin
on the SD card" method.
The flash is very fast, as it is only erasing/rewriting 256k of data. The camera reboots itself at the end of the upgrade, so when it comes back up on your WiFi, the operation is done.
The update process writes 2 files to the SD card. (You did put a FAT32 formatted SD card in the camera, right?) One file is a backup of the old bootloader. The other is a log file.
I'm probably the wrong person to ask about this, since all the Python code belongs to HclX's WyzeUpdater tool. It is possible to use this tool on Windows, but you will have to install Python (and probably run pip install
to get the packages WyzeUpdater requires).
It appears that some Wyze Cam Pan units shipped from the factory with a bootloader that is incapable of flashing even official Wyze firmware binaries from their website. Despite having the same flashing instructions as other Wyze cameras (including other Pans), these units can't accept a firmware file if it is placed on the SD card. However, the in-app updater works, presumably because it uses a different system for flashing.
After disassembling my camera and soldering the serial headers, I discovered that regardless of the demo.bin
, the bootloader's flash routine consistently failed. With a combination of assistance from the Gitter chat room for Dafang Hacks, a fair bit of experimentation, and comments on my issue, I learned that:
demo.bin
structure that the SD-card based updater usesFrom here, it was pretty straightforward to craft an update package that could be used to replace the "broken" bootloader.