not working on latest frmware update

[ahmedshabrawy]

i used this hack on a couple of my Tuya RTS3903N and works like a charm, but another one which was updated to the latest firmware done not work and even backup was not created, did anyone face that issue ?

[cjj25]

Can you access telnet? What's the exact model or your camera?

[ahmedshabrawy]

telnet is not working, the camera Model is SC-WA002 the brand name is LARKKEY, i have 2 other cameras from the same model (with never updated to last firmware) is working fine where i can telnet and get the local RTSP stream

[cjj25]

What's the firmware / mcu version in the Tuya APP for this camera?

It's also worth formatting the SD via the Tuya APP, then downloading the payload on to that. The partition could be dirty in some way and not being mounted.

[cjj25]

I've just discovered a way to downgrade these cameras if you're willing to give it a try?

[ahmedshabrawy]

What's the firmware / mcu version in the Tuya APP for this camera?

It's also worth formatting the SD via the Tuya APP, then downloading the payload on to that. The partition could be dirty in some way and not being mounted.

Tuya App doesn't show the firmware version any more only indicates latest firmware install

i did formatted the SD card using the Tuya App and even used an SD card which is already working with other camera with old firmware but never worked with this camera with latest firmware

[ahmedshabrawy]

I've just discovered a way to downgrade these cameras if you're willing to give it a try?

indeed, i will love to give a try

[cjj25]

There is a huge risk of bricking the camera so I want try make sure the correct firmware is loaded as its pretty dumb and will allow you to write anything to it.

Could you send a copy of mtdblock0 and mtdblock6 from one of the working cameras as you mentioned it's exactly the same device, this gives us a much greater chance of it working.

[dd32]

I have a "Lenovo Smart Indoor Camera K1" (board marked SC002-WA2) which I believe is the same as the Tuya model in this repo, I believe it's running the latest firmware (can't see in App and haven't spotted it in a firmware dump), no backup/telnet access, despite the camera detecting the card and creating the DCIM folders.

I've already dumped/backed-up the SPI flash rom, Happy to test anything. Don't really know how to make my own images or edit the existing squashfs/jffs through SPI though, but not afraid to partially brick it in the process.

edit: Apologies, Appears to be Firmware 1.1.4(?), found it via the App eventually under Other; No updates available.

And the cause of it no longer running appears to be this (I'm making the assumption of the previous contents)

$ grep ty_sdcard_check_upgrade.sh ./squashfs-root-1/skyeye/script/sdcard/automount.sh -A3 -B3
        [ -L /mnt/sdcard ] && rm -fr /mnt/sdcard
        ln -s ${destdir_sd} /mnt/sdcard

-       [ -x ${SDCARDDIR}/ty_sdcard_check_upgrade.sh ] && ${SDCARDDIR}/ty_sdcard_check_upgrade.sh ${destdir_sd}
+       #[ -x ${SDCARDDIR}/ty_sdcard_check_upgrade.sh ] && ${SDCARDDIR}/ty_sdcard_check_upgrade.sh ${destdir_sd}

    # udisk
    elif echo $1 | grep "sd" > /dev/null 2>&1; then

[cjj25]

@dd32 I didn't know Lenovo used Tuya! You've correctly identified the reason it's not working, our payload isn't being executed.

Could you send a flash dump?

I've discovered a new method three days ago which involves overwriting parts of the flash, I'm about 70% sure your camera will also have this way in too.

[dd32]

Could you send a flash dump?

Added you to a private Github repo with my backup rom and extracted firmware;

[kr105]

Hello, I found this same problem on a Nexxt camera, it is using a Tuya firmware v1.1.12 and I noticed (via a SPI dump) that the line executing the ty_sdcard_check_upgrade.sh file was commented out as @dd32 discovered before.

You mentioned that you had discovered a new method, what it is about? I'd like to give it a try before going the easy route to modify the squashfs dumped firmware.