pan v3 work in progress, u-boot, kernel, logs

[gtxaspec]

partial bootlog:

U-Boot SPL 2013.07 (Jun 28 2022 - 07:05:47)
Timer init
CLK stop
PLL init
pll_init:366
pll_cfg.pdiv = 10, pll_cfg.h2div = 5, pll_cfg.h0div = 5, pll_cfg.cdiv = 1, pll_cfg.l2div = 2
nf=116 nr = 1 od0 = 1 od1 = 2
cppcr is 07405100
CPM_CPAPCR 0740510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPMPCR 0640510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPVPCR 0640510d
cppcr 0x9a7b5510
apll_freq 1392000000 
mpll_freq 1200000000 
vpll_freq = 1200000000
ddr sel mpll, cpu ����������1@V��������?|�����������<�<���8@x����?���� � L�A�`����������0�
U-Boot SPL 2013.07 (Jun 28 2022 - 07:05:47)
Timer init
CLK stop
PLL init
pll_init:366
pll_cfg.pdiv = 10, pll_cfg.h2div = 5, pll_cfg.h0div = 5, pll_cfg.cdiv = 1, pll_cfg.l2div = 2
nf=116 nr = 1 od0 = 1 od1 = 2
cppcr is 07405100
CPM_CPAPCR 0740510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPMPCR 0640510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPVPCR 0640510d
cppcr 0x9a7b5510
apll_freq 1392000000 
mpll_freq 1200000000 
vpll_freq = 1200000000
ddr sel mpll, cpu sel apll
ddrfreq 600000000
cclk  1392000000
l2clk 696000000
h0clk 240000000
h2clk 240000000
pclk  120000000
CLK init
SDRAM init
sdram init start
ddr_inno_phy_init ..!
phy reg = 0x00000007, CL = 0x00000007
ddr_inno_phy_init ..! 11:  00000004
ddr_inno_phy_init ..! 22:  00000006
ddr_inno_phy_init ..! 33:  00000006
REG_DDR_LMR: 00000210
REG_DDR_LMR: 00000310
REG_DDR_LMR: 00000110
REG_DDR_LMR, MR0: 00f73011
T31_0x5: 00000007
T31_0x15: 0000000c
T31_0x4: 00000000
T31_0x14: 00000002
INNO_TRAINING_CTRL 1: 00000000
INNO_TRAINING_CTRL 2: 000000a1
T31_cc: 00000003
INNO_TRAINING_CTRL 3: 000000a0
T31_118: 0000003c
T31_158: 0000003c
T31_190: 0000001f
T31_194: 0000001d
jz-04 :  0x00000051 
jz-08 :  0x000000a0 
jz-28 :  0x00000024 
DDR PHY init OK
INNO_DQ_WIDTH   :00000003
INNO_PLL_FBDIV  :00000014
INNO_PLL_PDIV   :00000005
INNO_MEM_CFG    :00000051
INNO_PLL_CTRL   :00000018
INNO_CHANNEL_EN :0000000d
INNO_CWL        :00000006
INNO_CL         :00000007
DDR Controller init
DDRC_STATUS         0x80000001
DDRC_CFG            0x0aa88a42
DDRC_CTRL           0x0000011c
DDRC_LMR            0x00400008
DDRC_DLP            0x00000000
DDRC_TIMING1        0x050f0a06
DDRC_TIMING2        0x021c0a07
DDRC_TIMING3        0x200a0722
DDRC_TIMING4        0x26240031
DDRC_TIMING5        0xff060405
DDRC_TIMING6        0x321c0505
DDRC_REFCNT         0x00910503
DDRC_MMAP0          0x000020f8
DDRC_MMAP1          0x00002800
DDRC_REMAP1         0x030e0d0c
DDRC_REMAP2         0x07060504
DDRC_REMAP3         0x0b0a0908
DDRC_REMAP4         0x0f020100
DDRC_REMAP5         0x13121110
DDRC_AUTOSR_EN      0x00000000
sdram init finished
SDRAM init ok
board_init_r
image entry point: 0x80100000

U-Boot 2013.07 (Jun 28 2022 - 07:05:47)

Board: ISVP (Ingenic XBurst T31 SoC)
DRAM:  128 MiB
DTB: 0x8013dd38
Top of RAM usable for U-Boot at: 84000000
Reserving 440k for U-Boot at: 83f90000
Reserving 32800k for malloc() at: 81f88000
Reserving 32 Bytes for Board Info at: 81f87fe0
Reserving 124 Bytes for Global Data at: 81f87f64
Reserving 128k for boot params() at: 81f67f64
Stack Pointer at: 81f67f48
Now running in RAM - U-Boot at: 83f90000
MMC:   msc: 0
Using default environment

In:    serial
Out:   serial
Err:   serial
gpio_request lable = wifi_enable_gpio gpio = 58
gpio_request lable = yellow_gpio gpio = 39
gpio_request lable = blue_gpio gpio = 38
gpio_request lable = night_gpio gpio = 60
gpio_request lable = SPK_able_gpio gpio = 7
gpio_request lable = TF_en_gpio gpio = 47
gpio_request lable = TF_cd_gpio gpio = 48
gpio_request lable = SD_able_gpio gpio = 54
gpio_request lable = wifi_enable_gpio gpio = 58
SD card is not insert
gpio_request lable = sdupgrade gpio = 6
the manufacturer 1c
SF: Detected EN25QH128A

the manufacturer 1c
SF: Detected EN25QH128A

### JFFS2 loading 'upGradeFlag' to 0x82000000
Scanning JFFS2 FS: . done.
find_inode failed for name=upGradeFlag
load: Failed to find inode
### JFFS2 LOAD ERROR<0> for upGradeFlag!
Failed to read upGradeFlag file
the manufacturer 1c
SF: Detected EN25QH128A

--->probe spend 5 ms
SF: 2162688 bytes @ 0x50000 Read: OK
--->read spend 695 ms
## Loading kernel from FIT Image at 80600000 ...
   Using 'conf' configuration
   Verifying Hash Integrity ... sha256,rsa2048:kernel-dev+ sha256,rsa2048:kernel-dev+ OK
   Trying 'kernel' kernel subimage
     Description:  t31 kernel
     Type:         Kernel Image
     Compression:  uncompressed
     Data Start:   0x80600204
     Data Size:    1787817 Bytes = 1.7 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x80f00000
     Entry Point:  0x80f00000
     Hash algo:    sha256
     Hash value:   39e0fcf932b27590a67e1b037543e2c352a84be7e65e0c5f839b6e7b1f47a58a
   Verifying Hash Integrity ... sha256+ OK
## Loading ramdisk from FIT Image at 80600000 ...
   Using 'conf' configuration
   Trying 'ramdisk' ramdisk subimage
     Description:  t31 ramdisk image
     Type:         RAMDisk Image
     Compression:  uncompressed
     Data Start:   0x807b4abc
     Data Size:    225997 Bytes = 220.7 KiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x00000000
     Entry Point:  0x00000000
     Hash algo:    sha256
     Hash value:   c09eff9d5f999155d100f4f7ba48ef1900ea35e668bbfdadd12057b362cc9b1b
   Verifying Hash Integrity ... sha256+ OK
## Loading fdt from FIT Image at 80600000 ...
   Using 'conf' configuration
   Trying 'fdt' fdt subimage
     Description:  t31 kernel dtb
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x806000dc
     Data Size:    72 Bytes = 72 Bytes
     Architecture: MIPS
     Hash algo:    sha256
     Hash value:   4ee48e5ae650ede0b5a3548a1fd60e8aea0e71750ea43f8276ceafcd7cb091e0
   Verifying Hash Integrity ... sha256+ OK
   Loading fdt from 0x806000dc to 0x83000000
   Booting using the fdt blob at 0x83000000
   Loading Kernel Image ... OK
   Loading Ramdisk to 85fc7000, end 85ffe2cd ... OK
   Loading Device Tree to 87ffc000, end 87fff047 ... OK

Starting kernel ...

[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.14__isvp_swan_1.0__ (xiaoyongjian@xiaoyongjian-virtual-machine) (gcc version 4.7.2 (Ingenic r2.3.3 2016.12) ) #3 PREEMPT Mon May 23 16:59:21 CST 2022
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 RESET ERROR PC:719BB215
[    0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)
[    0.000000] FPU revision is: 00b70000
[    0.000000] CCLK:1392MHz L2CLK:696Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 004f4000 @ 00010000 (usable)
[    0.000000]  memory: 0003c000 @ 00504000 (usable after init)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 06000000 @ 00000000 (usable)
[    0.000000] initrd addr is [0x85fc7000] [0x85ffe2cd], mapstart is [0x5fff]
[    0.000000] Initial ramdisk at: 0x85fc7000 (225997 bytes)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x05ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x05ffffff]
[    0.000000] Primary instruction cache 32kB, 8-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 8-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] pls check processor_id[0x00d00100],sc_jz not support!
[    0.000000] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 24384
[    0.000000] Kernel command line: console=ttyS1,115200n8 mem=96M@0x0 rmem=32M@0x6000000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:320K(boot),2112K(fit),6784K(rootfs),6784K(rback),320K(cfg),64K(oem)
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 91144k/98304k available (3745k kernel code, 7160k reserved, 1326k data, 240k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:358
[    0.000000] clockevents_config_and_register success.
[    0.000015] Calibrating delay loop... 1391.00 BogoMIPS (lpj=6955008)
[    0.087832] pid_max: default: 32768 minimum: 301
[    0.092690] Mount-cache hash table entries: 512
[    0.097597] Initializing cgroup subsys debug
[    0.101852] Initializing cgroup subsys freezer
[    0.107210] devtmpfs: initialized
[    0.111982] regulator-dummy: no parameters
[    0.116342] NET: Registered protocol family 16
[    0.145880] bio: create slab <bio-0> at 0
[    0.156292] jz-dma jz-dma: JZ SoC DMA initialized
[    0.161732] usbcore: registered new interface driver usbfs
[    0.167757] usbcore: registered new interface driver hub
[    0.173266] usbcore: registered new device driver usb
[    0.179088]  (null): set:249  hold:250 dev=100000000 h=500 l=500
[    0.185542] media: Linux media interface: v0.10
[    0.190227] Linux video capture interface: v2.00
[    0.195704] Advanced Linux Sound Architecture Driver Initialized.
[    0.203207] cfg80211: Calling CRDA to update world regulatory domain
[    0.210292] Switching to clocksource jz_clocksource
[    0.217532] NET: Registered protocol family 2
[    0.222326] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.229494] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.235917] TCP: Hash tables configured (established 1024 bind 1024)
[    0.242350] TCP: reno registered
[    0.245620] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.251501] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.258143] NET: Registered protocol family 1
[    0.262614] Trying to unpack rootfs image as initramfs...
[    0.436402] Freeing initrd memory: 220K (85fc7000 - 85ffe000)
[    0.442692] freq_udelay_jiffys[0].max_num = 10
[    0.447204] cpufreq  udelay  loops_per_jiffy 
[    0.451538] 12000     59956   59956  
[    0.454804] 24000     119913  119913 
[    0.458340] 60000     299784  299784 
[    0.461702] 120000    599569  599569 
[    0.465261] 200000    999282  999282 
[    0.468765] 300000    1498924     1498924    
[    0.472473] 600000    2997848     2997848    
[    0.476201] 792000    3957159     3957159    
[    0.479890] 1008000   5036385     5036385    
[    0.483686] 1200000   5995696     5995696    
[    0.497663] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.503938] jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
[    0.510060] msgmni has been set to 178
[    0.515613] alg: No test for stdrng (krng)
[    0.519722] io scheduler noop registered
[    0.523682] io scheduler cfq registered (default)
[    0.536178] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[    0.543707] console [ttyS1] enabled, bootconsole disabled
[    0.543707] console [ttyS1] enabled, bootconsole disabled
[    0.563505] brd: module loaded
[    0.571088] loop: module loaded
[    0.575788] zram: Created 2 device(s) ...
[    0.580188] logger: created 256K log 'log_main'
[    0.587108] jz TCU driver register completed
[    0.592432] the id code = 1c7018, the flash name is EN25QH128A
[    0.598607] JZ SFC Controller for SFC channel 0 driver register
[    0.604732] 6 cmdlinepart partitions found on MTD device jz_sfc
[    0.610980] Creating 6 MTD partitions on "jz_sfc":
[    0.615966] 0x000000000000-0x000000050000 : "boot"
[    0.621946] 0x000000050000-0x000000260000 : "fit"
[    0.627960] 0x000000260000-0x000000900000 : "rootfs"
[    0.634171] 0x000000900000-0x000000fa0000 : "rback"
[    0.640359] 0x000000fa0000-0x000000ff0000 : "cfg"
[    0.646347] 0x000000ff0000-0x000001000000 : "oem"
[    0.652249] SPI NOR MTD LOAD OK
[    0.655987] jz-dwc2 jz-dwc2: cgu clk gate get error
[    0.661022] DWC IN OTG MODE
[    0.664698] dwc2 dwc2: Keep PHY ON
[    0.668431] dwc2 dwc2: Using Buffer DMA mode
[    0.672841] dwc2 dwc2: Core Release: 3.00a
[    0.677171] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[    0.683658] dwc2 dwc2: new USB bus registered, assigned bus number 1
[    0.691256] hub 1-0:1.0: USB hub found
[    0.695139] hub 1-0:1.0: 1 port detected
[    0.699370] dwc2 dwc2: DWC2 Host Initialized
[    0.704330] usbcore: registered new interface driver usbserial
[    0.710588] usbcore: registered new interface driver pl2303
[    0.716540] usbserial: USB Serial support registered for pl2303
[    0.722869] usbcore: registered new interface driver emi26 - firmware loader
[    0.731616] device-mapper: ioctl: 4.24.0-ioctl (2013-01-15) initialised: dm-devel@redhat.com
[    0.740752] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[    0.747103] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[    0.752452] jzmmc_v1.2 jzmmc_v1.2.1: vmmc regulator missing
[    0.758531] jzmmc_v1.2 jzmmc_v1.2.1: register success!
[    0.764611] usbcore: registered new interface driver usbhid
[    0.770451] usbhid: USB HID core driver
[    0.777167] dwc2 dwc2: ID PIN CHANGED!
[    0.781118] usbcore: registered new interface driver snd-usb-audio
[    0.787820] TCP: cubic registered
[    0.791245] NET: Registered protocol family 17
[    0.796995] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[    0.803510] ALSA device list:
[    0.806641]   #0: Virtual MIDI Card 1
^@[    0.811983] Freeing unused kernel memory: 240K (80504000 - 80540000)
[    0.829735] verity [rootfs partition], fs type is [squashfs], verity mode is [0]
[    0.850078] bio: create slab <bio-1> at 1
[    0.854703] Verity success, dm device is [/dev/dm-0]
mdev is ok......
 __________________________________
|                                  |
|                                  |
|                                  |
|                                  |
| _   _             _           _  |
|| | | |_   _  __ _| |     __ _(_) |
|| |_| | | | |/ _| | |  _ / _| | | |
||  _  | |_| | (_| | |_| | (_| | | |
||_| |_|\__,_|\__,_|_____|\__,_|_| |
|                                  |
|                                  |
|____2022_WYZE_panv3_@HUALAI___|

WCV3 login: [    1.628962] @@@@ tx-isp-probe ok(version H20211130a), compiler date=Nov 30 2021 @@@@@
[    1.672320] exFAT: Version 1.2.9
[    1.701948] jz_codec_register: probe() successful!
[    2.115511] dma dma0chan24: Channel 24 have been requested.(phy id 7,type 0x06 desc a4a90000)
[    2.124604] dma dma0chan25: Channel 25 have been requested.(phy id 6,type 0x06 desc a4a95000)
[    2.133790] dma dma0chan26: Channel 26 have been requested.(phy id 5,type 0x04 desc a2321000)
[    2.213133] __init
[    2.228171] usbcore: registered new interface driver usb_ch34x
[    2.234190] ch34x: USB to serial driver for USB to serial chip ch340, ch341, etc.
[    2.243547] ch34x: V1.16 On 2020.12.23
[    2.250725] motor_probe [ChenX @ Hualai Technologies]
[    2.257645] Hualai motor driver version: MT20180918g
################## to wait wifi vendor id ####################
[    2.396008] mmc1: new SDIO card at address 0001
################## [vendor:0x007a] atbm603x wifi ###################
[    4.685210] [atbm_log]:rx timeout
Updating device time to:
Sat Aug  6 22:08:37 UTC 2022
===========welcome to ver-comp tool=========
[ver-comp]dbg: appver:  4.50.0.2412
[ver-comp]err: [/usr/app.ver] not exist! set def...
[ver-comp]dbg: rootver: 0.0.0.0
[ver-comp]exec cmd: cp -rf /system/bin/app.ver /configs/
#######################
#   IS USER PROCESS   #
#######################
[FC] cd pin not found tfcard
s:Bus 001 Device 001: ID 1d6b:0002

line_num:1
[FC] not found tfcard or usb store
[FC] Test.tar no exist
[FC] In [user] mode!
kernel.core_pattern = |/system/bin/ucoredmp_collector.sh --pid %p --signal %s --name %e --time %t --output-dir /media/mmc/cores
kernel.core_pipe_limit = 1
net.unix.max_dgram_qlen = 128
[    7.316364] name : i2c0 nr : 0
[    7.405391] i2c i2c-0: i2c_jz_irq 441, I2C transfer error, ABORT interrupt
[    7.412521] i2c i2c-0: --I2C txabrt:
[    7.416292] i2c i2c-0: --I2C TXABRT[0]=I2C_TXABRT_ABRT_7B_ADDR_NOACK
[    7.422859] error: sensor_read,287 ret = -5
[    7.427202]  sensor_read: addr=0x3107 value = 0x0
[    7.432052] err sensor read addr = 0x3107, value = 0x0
[    7.525700]  sensor_read: addr=0xf0 value = 0x20
[    7.530950]  sensor_read: addr=0xf1 value = 0x53
[    7.535770] info: success sensor find : gc2053
[    7.540387] misc sinfo_release
[    7.746239] gc2053 chip found @ 0x37 (i2c0) version H20211111a
[    8.455212] codec_set_device: set device: MIC...
[    8.735292] codec_set_device: set device: speaker...
[    8.746937] SPEAKER CTL MODE3 !
[   12.538999] [motor_speed1078] speed:900, level:15
[   12.543854] motor_ops_reset960

[gtxaspec]

how to open:

the cube with the lens has a black plastic cover, peel this off with a blade, knife or something sharp. Go slow so all the adhesive stays on the cover. Remove the cover, then take the 4 screws off. Pull the front cover off. Pry it out just like on the v3. Serial ports are here: Middle is ground, square is TX, edge is RX.

[gtxaspec]

Camera Board photos

[capncybo]

And I had thought that perhaps you'd given up the tinker'n... Good Luck & Happy New Year !!!

[endertable]

"let's break it open and see."

You weren't kidding. 😭

[dsanner]

Since the wyze pan v3 is a rebranded Atom Swing camera ...is it possible to flash this on it to gain RTSP and SSH? https://github.com/mnakada/atomcam_tools

[endertable]

I think WYZE updated the firmware on it and made it more secure. I am going to guess this is going to use the same FW iteration as the Cam Pro version, which has not been compromised yet, or not that I know.

[virmaior]

@dsanner I think it's more accurate to say they are both white labels from the same Chinese manufacturer. The AtomCams tend to deviate a bit less from the white label product provided.

[mastan30]

@gtxaspec any luck with getting the pan v3 rooted?

[monkollek]

I think WYZE updated the firmware on it and made it more secure. I am going to guess this is going to use the same FW iteration as the Cam Pro version, which has not been compromised yet, or not that I know.

@gtxaspec @virmaior When you have a moment, can you please elaborate on what you need help on? If the above holds true then using factory_t31_ZMC6tiIDQN on the SD card will not work?

[monkollek]

@gtxaspec or anyone else. Do you have a version of the U-boot logs with SD card in? As I'm guessing the SD card was not in with the example you showed above: SD card is not insert

I'm not sure if it looks for things on the SD card if is inserted in but just curious.

[KyloRilo]

Hey everyone, does anyone have an idea of the progress on this? I was looking to set up a livestream of the pan v3 for a local nonprofit using rtsp

[TheCableGuy99]

Same here, bought the Wyze Cam Pan v3 and looking for RTSP hopefully, i'm guessing there's no progress on this thought because no one appears to be replying?

[dstockman]

Hey everyone, does anyone have an idea of the progress on this? I was looking to set up a livestream of the pan v3 for a local nonprofit using rtsp

Hey @KyloRilo, can't speak to the progress on getting support in wz_mini_hacks but as a stop gap, I've had good luck using mrlt8/docker-wyze-bridge to expose RTSP for these cams. HTH.

[TheCableGuy99]

mrlt8/docker-wyze-bridge

I looked at this a while ago but can't think now why I didn't use it. Does it give you an RTSP stream so I can still record it on my NAS?

[dstockman]

Yep!

[TheCableGuy99]

Excellent, i'll take a re-look at it then. I hope it also allows me to control the PTZ manually. I don't use the Wyze cam app because I put my cameras on a vLAN with no internet access after they have been setup as I don't want my feed going through their servers for anyone to peek in on my private life. I've heard stories of companies doing that. My cameras are for my local or secure remote access only.

[TheCableGuy99]

Yep!

ahh I just thought, does it grab the image from the cloud? That might be why I decided didn't use it as I don't stream them.

[gtxaspec]

I think we may be able to make some progress on this, stay tuned.

[TheCableGuy99]

oh great....I have 2 cameras just sat there that I cannot use until there's an RTSP stream :)

[gtxaspec]

As it stands now, the pan v3 won't be supported unless the user re-flashes, or replaces the flash memory chip containing the stock bootloader.

For now, a solution is to re-flash the unit using OpenIPC.

We will keep trying to find an alternate solution to facilitate simple modification.

[gtxaspec]

this camera has secure-boot enabled by the factory, inside the ingenic t31-x cpu, via e-fuse, and can not be disabled. replacing the flash module, SPL, or u-boot results in non-boot.

U-Boot SPL 2013.07 (Jun 28 2022 - 07:05:47)
Timer init
CLK stop
PLL init
pll_init:366
pll_cfg.pdiv = 10, pll_cfg.h2div = 5, pll_cfg.h0div = 5, pll_cfg.cdiv = 1, pll_cfg.l2div = 2
nf=116 nr = 1 od0 = 1 od1 = 2
cppcr is 07405100
CPM_CPAPCR 0740510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPMPCR 0640510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPVPCR 0640510d
cppcr 0x9a7b5510
apll_freq 1392000000 
mpll_freq 1200000000 
vpll_freq = 1200000000
ddr sel mpll, cpu sel apll
ddrfreq 600000000
cclk  1392000000
l2clk 696000000
h0clk 240000000
h2clk 240000000
pclk  120000000
CLK init
SDRAM init
sdram init start
ddr_inno_phy_init ..!
phy reg = 0x00000007, CL = 0x00000007
ddr_inno_phy_init ..! 11:  00000004
ddr_inno_phy_init ..! 22:  00000006
ddr_inno_phy_init ..! 33:  00000006
REG_DDR_LMR: 00000210
REG_DDR_LMR: 00000310
REG_DDR_LMR: 00000110
REG_DDR_LMR, MR0: 00f73011
T31_0x5: 00000007
T31_0x15: 0000000c
T31_0x4: 00000000
T31_0x14: 00000002
INNO_TRAINING_CTRL 1: 00000000
INNO_TRAINING_CTRL 2: 000000a1
T31_cc: 00000003
INNO_TRAINING_CTRL 3: 000000a0
T31_118: 0000003c
T31_158: 0000003c
T31_190: 0000001e
T31_194: 0000001c
jz-04 :  0x00000051 
jz-08 :  0x000000a0 
jz-28 :  0x00000024 
DDR PHY init OK
INNO_DQ_WIDTH   :00000003
INNO_PLL_FBDIV  :00000014
INNO_PLL_PDIV   :00000005
INNO_MEM_CFG    :00000051
INNO_PLL_CTRL   :00000018
INNO_CHANNEL_EN :0000000d
INNO_CWL        :00000006
INNO_CL         :00000007
DDR Controller init
DDRC_STATUS         0x80000001
DDRC_CFG            0x0aa88a42
DDRC_CTRL           0x0000011c
DDRC_LMR            0x00400008
DDRC_DLP            0x00000000
DDRC_TIMING1        0x050f0a06
DDRC_TIMING2        0x021c0a07
DDRC_TIMING3        0x200a0722
DDRC_TIMING4        0x26240031
DDRC_TIMING5        0xff060405
DDRC_TIMING6        0x321c0505
DDRC_REFCNT         0x00910503
DDRC_MMAP0          0x000020f8
DDRC_MMAP1          0x00002800
DDRC_REMAP1         0x030e0d0c
DDRC_REMAP2         0x07060504
DDRC_REMAP3         0x0b0a0908
DDRC_REMAP4         0x0f020100
DDRC_REMAP5         0x13121110
DDRC_AUTOSR_EN      0x00000000
sdram init finished
SDRAM init ok
board_init_r
verify_buf_equal!
verify signature uboot error!

[endertable]

This means can’t use openipc, either?

[gtxaspec]

Unfortunately at the moment, no.

[sasdallas]

Oh, unfortunate. Just got one of these and hoped it would be supported. That's not on devs though, it's on me for not checking - thankfully I can return it and hopefully get a better one. I doubt there's gonna be an easy way to do this, especially with that sort of chip-level protection, but good luck to you anyways!

[gtxaspec]

closing for now until a solution is found. feedback and additional testing is welcome

[pzich]

Has anyone managed to get their hands on one of the atom cams? Do they have the same limitations? Has anyone managed to figure out the white label vendor?

[virmaior]

both myself and @gtxaspec have atomcam 2s (https://www.atomtech.co.jp/products/atomcam2) in addition to wyze cams ... but do you mean a specific model?

I'm using atomcam_tools on that. It probably can run wz_mini but for my purposes I don't need it to.

[gtxaspec]

@virmaior I think he's referring to the atom cam swing. The wyze version in the US has a locked SOC, and there is significant demand for a model that can be unlocked, like the atomcam swing or personalcam of Latin America which all share the same body.

The OEM is hualai.

[pzich]

Whoops sorry for the delay here. @gtxaspec has it right, I was referring to the atom cam swing and it hopefully being unlocked (or in some way more hackable) than the wyze variant.

[Sparpet]

Only way to bypass secure boot on thi camera is performing an SoC swap, i have performed one myself so i can actually test code with it. Unfortunately I dont have a dump of the original flash and flashed thingino instead so i cannot boot wyze firmware any more, but I can confirm that after SoC swap Wyze firmware boots normally.

Here are some photos of the process: