Wyze Cam Pan v1 support

[mwhdc]

Support original Pan camera if possible. Please label as enhancement.

I own 3 but unfortunately all are on current stock firmware (4.10.8.1002) which AFAIK doesn't have a working hack to get a root shell. @gtxaspec would dmesg output from Xiaomi-Dafang-Hacks custom firmware be helpful? I believe it's still usable on the older cams. It requires flashing a modified bootloader and I forget which distro it's based on.

[gtxaspec]

@mwhdc, I can create a modified version of the stock firmware for the pan v1 with telnet enabled. you can flash it, telnet in and grab some logs, if you are up to testing it ... need the logs from the stock, since dafang changes a bunch of stuff in both the kernel and rootfs.

[gtxaspec]

demonew.bin.zip you can flash this, just rename the bin to demo.bin. root password is blank, and telnet should be enabled once network is up on the camera... Since i don't have a panv1 to test, if something goes wrong you can always flash the stock demo.bin and all will be well again.

[mwhdc]

@gtxaspec Just flashed and the camera did not like that file... Shutter clicked only once on boot, solid yellow light, not responding to pings.

[gtxaspec]

hmm... strange. The next thing I can think of is, try to flash the wz_mini demo.bin that is for the V2, and see if that boots...

[mwhdc]

The wz_mini demo.bin didn't work either, but I managed to get telnet by flashing an ancient firmware build from the Wyze forums and installing WyzeHacks on it. Here's the dmesg output:

[root@WyzeCamPAN-32B4:~]# dmesg
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.14 (root@ubuntu) (gcc version 4.7.2 (Ingenic r2.3.3 2016.12) ) #21 PREEMPT Thu Oct 19 11:38:16 CST 2017
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 RESET ERROR PC:801CB704
[    0.000000] [<801cb704>] __delay+0x4/0x10
[    0.000000] CPU0 revision is: 00d00101 (Ingenic Xburst)
[    0.000000] FPU revision is: 00b70000
[    0.000000] cgu_get_rate, parent = 860160000, rate = 0, m = 0, n = 0, reg val = 0x000020ff
[    0.000000] CCLK:860MHz L2CLK:430Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 00535000 @ 00010000 (usable)
[    0.000000]  memory: 0003b000 @ 00545000 (usable after init)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 06800000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x067fffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x067fffff]
[    0.000000] On node 0 totalpages: 26624
[    0.000000] free_area_init_node: node 0, pgdat 80541cd0, node_mem_map 81000000
[    0.000000]   Normal zone: 208 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 26624 pages, LIFO batch:7
[    0.000000] Primary instruction cache 32kB, 8-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 8-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] pls check processor_id[0x00d00101],sc_jz not support!
[    0.000000] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 26416
[    0.000000] Kernel command line: console=ttyS1,115200n8 mem=104M@0x0 ispmem=8M@0x6800000 rmem=16M@0x7000000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),2048k(kernel),3392k(root),640k(driver),4736k(appfs),2048k(backupk),640k(backupd),2048k(backupa),256k(config),256k(para),-(flag)
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 99300k/106496k available (4025k kernel code, 7196k reserved, 1304k data, 236k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:418
[    0.000000] clockevents_config_and_register success.
[    0.000025] Calibrating delay loop... 858.52 BogoMIPS (lpj=4292608)
[    0.087753] pid_max: default: 32768 minimum: 301
[    0.092738] Mount-cache hash table entries: 512
[    0.097840] Initializing cgroup subsys debug
[    0.102102] Initializing cgroup subsys freezer
[    0.109182] regulator-dummy: no parameters
[    0.113471] NET: Registered protocol family 16
[    0.135462] bio: create slab <bio-0> at 0
[    0.141794] jz-dma jz-dma: JZ SoC DMA initialized
[    0.147054] SCSI subsystem initialized
[    0.150985] usbcore: registered new interface driver usbfs
[    0.156558] usbcore: registered new interface driver hub
[    0.161993] usbcore: registered new device driver usb
[    0.167295] i2c-gpio i2c-gpio.1: using pins 57 (SDA) and 58 (SCL)
[    0.173502]  (null): set:249  hold:250 dev=100000000 h=500 l=500
[    0.179649] media: Linux media interface: v0.10
[    0.184202] Linux video capture interface: v2.00
[    0.190997] Switching to clocksource jz_clocksource
[    0.195952] cfg80211: Calling CRDA to update world regulatory domain
[    0.203028] jz-dwc2 jz-dwc2: cgu clk gate get error
[    0.207966] jz-dwc2 jz-dwc2: regulator vbus get error
[    0.213050] DWC IN OTG MODE
[    0.366304] sft id =========================off
[    0.370921] dwc2 dwc2: Keep PHY ON
[    0.374313] dwc2 dwc2: Using Buffer DMA mode
[    0.578460] dwc2 dwc2: Core Release: 3.00a
[    0.582582] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[    0.588912] dwc2 dwc2: new USB bus registered, assigned bus number 1
[    0.596301] hub 1-0:1.0: USB hub found
[    0.600042] hub 1-0:1.0: 1 port detected
[    0.604204] dwc2 dwc2: DWC2 Host Initialized
[    0.608701] NET: Registered protocol family 2
[    0.613678] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.620705] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.627184] TCP: Hash tables configured (established 1024 bind 1024)
[    0.633636] TCP: reno registered
[    0.636834] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.642788] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.649391] NET: Registered protocol family 1
[    0.654106] RPC: Registered named UNIX socket transport module.
[    0.660039] RPC: Registered udp transport module.
[    0.664872] RPC: Registered tcp transport module.
[    0.669574] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.676619] freq_udelay_jiffys[0].max_num = 10
[    0.681046] cpufreq  udelay  loops_per_jiffy
[    0.685513] dwc2 dwc2: ID PIN CHANGED!
[    0.689291] init DWC as A_HOST
[    0.692392] 12000     59885   59885
[    0.695615] 24000     119771  119771
[    0.699059] 60000     299428  299428
[    0.702695] 120000    598857  598857
[    0.706153] 200000    998095  998095
[    0.709685] 300000    1497142         1497142
[    0.713427] 600000    2994285         2994285
[    0.717101] 792000    3952457         3952457
[    0.720809] 1008000   5030400         5030400
[    0.724619] 1200000   5988571         5988571
[    0.734019] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.740869] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    0.747470] msgmni has been set to 193
[    0.752719] io scheduler noop registered
[    0.756655] io scheduler cfq registered (default)
[    0.763331] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[    0.771520] console [ttyS1] enabled, bootconsole disabled
[    0.786758] brd: module loaded
[    0.792026] loop: module loaded
[    0.796174] zram: Created 2 device(s) ...
[    0.800411] logger: created 256K log 'log_main'
[    0.805813] jz SADC driver registeres over!
[    0.811137] jz TCU driver register completed
[    0.816363] the id code = c84018, the flash name is GD25Q127C
[    0.822322] JZ SFC Controller for SFC channel 0 driver register
[    0.828529] 11 cmdlinepart partitions found on MTD device jz_sfc
[    0.834793] Creating 11 MTD partitions on "jz_sfc":
[    0.839854] 0x000000000000-0x000000040000 : "boot"
[    0.845408] 0x000000040000-0x000000240000 : "kernel"
[    0.851071] 0x000000240000-0x000000590000 : "root"
[    0.856627] 0x000000590000-0x000000630000 : "driver"
[    0.862314] 0x000000630000-0x000000ad0000 : "appfs"
[    0.867989] 0x000000ad0000-0x000000cd0000 : "backupk"
[    0.873807] 0x000000cd0000-0x000000d70000 : "backupd"
[    0.879591] 0x000000d70000-0x000000f70000 : "backupa"
[    0.885441] 0x000000f70000-0x000000fb0000 : "config"
[    0.891181] 0x000000fb0000-0x000000ff0000 : "para"
[    0.896785] 0x000000ff0000-0x000001000000 : "flag"
[    0.902263] SPI NOR MTD LOAD OK
[    0.905639] tun: Universal TUN/TAP device driver, 1.6
[    0.910877] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    0.917434] usbcore: registered new interface driver zd1201
[    0.923288] usbcore: registered new interface driver r8152
[    0.929061] usbcore: registered new interface driver usb-storage
[    0.935439] usbcore: registered new interface driver usbserial
[    0.941521] usbcore: registered new interface driver usbserial_generic
[    0.948353] usbserial: USB Serial support registered for generic
[    0.954629] usbcore: registered new interface driver ch341
[    0.960357] usbserial: USB Serial support registered for ch341-uart
[    0.966909] usbcore: registered new interface driver cp210x
[    0.972732] usbserial: USB Serial support registered for cp210x
[    0.978910] usbcore: registered new interface driver pl2303
[    0.984737] usbserial: USB Serial support registered for pl2303
[    1.491844] i8042: i8042 controller selftest timeout
[    1.497507] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[    1.542514] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[    1.547902] jzmmc_v1.2 jzmmc_v1.2.1: vmmc regulator missing
[    1.593435] jzmmc_v1.2 jzmmc_v1.2.1: register success!
[    1.598918] hidraw: raw HID events driver (C) Jiri Kosina
[    1.604806] usbcore: registered new interface driver usbhid
[    1.610581] usbhid: USB HID core driver
[    1.614668] Netfilter messages via NETLINK v0.30.
[    1.619601] nf_conntrack version 0.5.0 (1551 buckets, 6204 max)
[    1.626356] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.631973] TCP: cubic registered
[    1.635460] NET: Registered protocol family 17
[    1.641073] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[    1.648320] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[    1.659558] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    1.667367] Freeing unused kernel memory: 236K (80545000 - 80580000)
[    1.815752] dwc2 dwc2:  ++OTG Interrupt: A-Device Timeout Change++
[    4.092747] register all isp device successfully!
[    4.102512] @@@@ tx-isp-probe ok @@@@@
[    4.171811] exFAT: Version 1.2.9
[    4.251334] motor_probe743
[    4.290712] request spk en gpio 63 ok!
[    4.290726] jz_codec_register: probe() successful!
[    4.295960] cgu_set_rate, parent = 860160000, rate = 2048000, n = 420, reg val = 0x000021a4
[    4.295976] cgu_enable,cgu_i2s reg val = 0x200021a4
[    4.642818] dma dma0chan24: Channel 24 have been requested.(phy id 7,type 0x06 desc a4835000)
[    4.652078] dma dma0chan25: Channel 25 have been requested.(phy id 6,type 0x06 desc a4834000)
[    5.172433] RTL871X: module init start
[    5.176330] RTL871X: rtl8189es v4.3.18.3_20185.20161116_pmpinclu_mac_monitor_minMem_EDCA542B_pbyr
[    5.185627] RTL871X: build time: Aug  9 2018 15:49:14
[    5.190870] wlan power on
[    5.213123] RTL871X: module init ret=0
[    5.224092] jz_pwm_probe[198] d_name = tcu_chn0
[    5.239521] request pwm channel 0 successfully
[    5.246683] pwm-jz pwm-jz: jz_pwm_probe register ok !
[    5.269580] mmc1: new SDIO card at address 0001
[    5.285002] bFWReady == _FALSE call reset 8051...
[    5.317503] RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=c0:6d:1a:f8:56:7d
[    7.163506] jffs2: warning: (56) jffs2_do_read_inode_internal: Truncating ino #66 to 268672 bytes failed because it only had 24923 bytes to start with!
[    8.903425] name : i2c-gpio1 nr : 1
[    8.910043] name : i2c0 nr : 0
[    8.973707]  sensor_read: addr=0xa value = 0xf
[    8.978710]  sensor_read: addr=0xb value = 0x22
[    8.983427] info: success sensor find : jxf22
[    8.988116] misc sinfo_release
[    9.011863] zram0: detected capacity change from 0 to 16777216
[    9.030791] Adding 16380k swap on /dev/zram0.  Priority:-1 extents:1 across:16380k SS
[    9.962587] ==> rtl8188e_iol_efuse_patch
[   10.189988] RTL871X: rtw_cmd_thread: DriverStopped(True) SurpriseRemoved(False) break at line 564
[   10.210434] RTL871X: rtw_dev_unload: driver not in IPS
[   10.812600] ==> rtl8188e_iol_efuse_patch
[   12.392128] codec_codec_ctl: set repaly channel...
[   12.392183] codec_codec_ctl: set sample rate...
[   12.392471] codec_codec_ctl: set device...
[   12.393735] codec_codec_ctl: set sample rate...
[   12.394197] codec_codec_ctl: set device...
[   12.514638] set sensor gpio as PA-low-10bit
[   12.525640] probe ok ------->jxf22
[   12.551516] -----jxf22_detect: 432 ret = 0, v = 0x0f
[   12.551932] -----jxf22_detect: 440 ret = 0, v = 0x22
[   12.551946] jxf22 0-0040: jxf22 chip found @ 0x40 (i2c0)
[   12.560753] tx_isp: Registered sensor subdevice jxf22 0-0040
[   12.577604] do not support ctrl->cmd ====1
[   12.577629] do not support ctrl->cmd ====0
[   12.589116] do not support ctrl->cmd ====1
[   12.632473] codec_set_device: set device: speaker...
[   12.661566] RTL871X: rtw_cmd_thread: DriverStopped(True) SurpriseRemoved(False) break at line 564
[   12.700794] RTL871X: rtw_dev_unload: driver not in IPS
[   12.792464] codec_set_device: set device: MIC...
[   13.190483] do not support ctrl->cmd ====1
[   13.193344] jxf22 stream on
[   13.238361] ###### image_tuning_v4l2_open 4219 #######
[   13.250755] Warn:----------------fps   983041  ----------------
[   13.271867] before register 0x1f value : 0x00
[   13.272191] after register 0x1f value : 0x80
[   13.272208] do not support ctrl->cmd ====1
[   13.395708] &&& chan1  scaler.max_width = 1920 max_height = 1080  min_width = 128 min_height = 128 &&&
[   13.440996] &&& chan2  scaler.max_width = 800 max_height = 800  min_width = 128 min_height = 128 &&&
[   13.992722] ==> rtl8188e_iol_efuse_patch
[   14.296154] &&& chan1  scaler.max_width = 1920 max_height = 1080  min_width = 128 min_height = 128 &&&
[   14.491591] &&& chan2  scaler.max_width = 800 max_height = 800  min_width = 128 min_height = 128 &&&
[   14.648551] RTL871X: rtw_cmd_thread: DriverStopped(True) SurpriseRemoved(False) break at line 564
[   14.677271] RTL871X: rtw_dev_unload: driver not in IPS
[   15.572699] ==> rtl8188e_iol_efuse_patch
[   17.216375] motor_ops_reset468
[   19.290010] RTL871X: rtw_set_802_11_connect(wlan0)  fw_state=0x00000008
[   19.606468] RTL871X: start auth
[   19.622630] RTL871X: auth success, start assoc
[   19.630502] RTL871X: assoc success
[   19.635566] RTL871X: recv eapol packet
[   19.666966] RTL871X: send eapol packet
[   19.677169] RTL871X: recv eapol packet
[   19.695894] RTL871X: send eapol packet
[   19.703938] RTL871X: set pairwise key camid:4, addr:84:16:f9:a0:0d:23, kid:0, type:AES
[   19.729350] RTL871X: set group key camid:5, addr:84:16:f9:a0:0d:23, kid:1, type:AES

[gtxaspec]

can you share cat /proc/mtd please

[mwhdc]

dev:    size   erasesize  name
mtd0: 00040000 00008000 "boot"
mtd1: 00200000 00008000 "kernel"
mtd2: 00350000 00008000 "root"
mtd3: 000a0000 00008000 "driver"
mtd4: 004a0000 00008000 "appfs"
mtd5: 00200000 00008000 "backupk"
mtd6: 000a0000 00008000 "backupd"
mtd7: 00200000 00008000 "backupa"
mtd8: 00040000 00008000 "config"
mtd9: 00040000 00008000 "para"
mtd10: 00010000 00008000 "flag"

[gtxaspec]

couple more if you can:

cat /etc/init.d/rcS cat /system/init/app_init.sh

[mwhdc]

Looks like everything in app_init.sh is from WyzeHacks.

[root@WyzeCamPAN-32B4:~]# cat /etc/init.d/rcS
#!/bin/sh

# Set mdev
echo /sbin/mdev > /proc/sys/kernel/hotplug
/sbin/mdev -s && echo "mdev is ok......"

# create console and null node for nfsroot
#mknod -m 600 /dev/console c 5 1
#mknod -m 666 /dev/null c 1 3

# Set Global Environment
export PATH=/bin:/sbin:/usr/bin:/usr/sbin
export PATH=/system/bin:$PATH
export LD_LIBRARY_PATH=/system/lib
export LD_LIBRARY_PATH=/thirdlib:$LD_LIBRARY_PATH

# networking
ifconfig lo up
#ifconfig eth0 192.168.1.80

# Start telnet daemon
telnetd &

# Set the system time from the hardware clock
#hwclock -s

#set the GPIO PC13 to high, make the USB Disk can be use
cd /sys/class/gpio
echo 77 > export       #申请GPIO
cd gpio77
echo out > direction   #设置为输出模式
echo 0 > active_low    #value是0,表示低电平。value是1,表示高电平
echo 1 > value         #设置电平（输出模式）

# Mount driver partition
mount -t squashfs /dev/mtdblock3 /driver

# Mount system partition
mount -t jffs2 /dev/mtdblock4 /system

# Mount backup partition
#mount -t jffs2 /dev/mtdblock5 /backupk

# Mount backup partition
#mount -t jffs2 /dev/mtdblock6 /backupd

# Mount backup partition
mount -t jffs2 /dev/mtdblock7 /backupa

# Mount configs partition
mount -t jffs2 /dev/mtdblock8 /configs

# Mount params partition
mount -t jffs2 /dev/mtdblock9 /params

# Format system patition if it is invalid
if [ ! -f /system/.system ]; then
    echo "Format system partition..."
    umount -f /system
    flash_eraseall /dev/mtd4
    mount -t jffs2 /dev/mtdblock4 /system
    cd /system
    mkdir -p bin init etc/sensor lib/firmware lib/modules
    echo "#!/bin/sh" > init/app_init.sh
    chmod 755 init/app_init.sh
    touch .system
    cd /
    echo "Done"
fi

# Run init script
if [ -f /system/init/app_init.sh ]; then
    /system/init/app_init.sh &
fi

[root@WyzeCamPAN-32B4:~]# cat /system/init/app_init.sh
#!/bin/sh
export THIS_BIN=$(readlink -f $0)
export THIS_DIR=$(dirname $THIS_BIN)
export THIS_MD5=`md5sum $THIS_BIN | grep -oE "^[0-9a-f]*"`
export THIS_VER=0.5.08

ACTION=${1:-run}
[ "$#" -gt 1 ] && shift

WYZEHACK_DIR=${TMP:-/tmp}/wyze_hack/$ACTION
mkdir -p $WYZEHACK_DIR

PAYLOAD_START=`awk '/^#__PAYLOAD_BELOW__/ {print NR + 1; exit 0; }' $0`
tail -n+$PAYLOAD_START $0 | gzip -cd | tar x -f - -C $WYZEHACK_DIR

exec sh $WYZEHACK_DIR/main.sh $ACTION $@
#__PAYLOAD_BELOW__
[...]

[gtxaspec]

i think its /system/init/app_init.orig...or something like that, check the dir

[mwhdc]

#!/bin/sh

cd /system
if [ -f /system/.upgrade ]; then
    cd /backupa
    echo "init upgrading!!!!!!!!!!!!"
    ./upgrade.sh
    rm /system/.upgrade
fi

echo 61 > /sys/class/gpio/export
echo "out" > /sys/class/gpio/gpio61/direction
echo 1 > /sys/class/gpio/gpio61/value
sleep 1
echo 0 > /sys/class/gpio/gpio61/value

#insmod /lib/modules/tx-isp.ko isp_clk=100000000
#insmod /lib/modules/sensor_imx323.ko
#insmod /lib/modules/sensor_jxf22.ko
#insmod /lib/modules/sensor_ps5230.ko
#insmod /lib/modules/exfat.ko
#insmod /lib/modules/sample_motor.ko
#insmod /lib/modules/audio.ko
#insmod /lib/modules/sinfo.ko
#insmod /lib/modules/8189es.ko

insmod /driver/tx-isp.ko isp_clk=100000000
#insmod /driver/sensor_imx323.ko
#insmod /driver/sensor_jxf22.ko
#insmod /driver/sensor_ps5230.ko
insmod /driver/exfat.ko
insmod /driver/sample_motor.ko
insmod /driver/audio.ko
insmod /driver/sinfo.ko
insmod /driver/8189es.ko
insmod /driver/sample_pwm_core.ko
insmod /driver/sample_pwm_hal.ko
#insmod /driver/rtl8189ftv.ko

#wpa_supplicant -Dwext -i wlan0 -c /system/etc/wpa_supplicant.conf -B
#udhcpc -i wlan0 -s /system/etc/udhcpc.script -q

#ifconfig eth0 up
#udhcpc -i eth0 -s /system/etc/udhcpc.script -q
#ifconfig eth0 10.0.22.199
#route add default gw 10.0.22.1

# open ircut
#cp /system/bin/setir /tmp/
#config ip address

#/system/bin/carrier-server --st=imx322
/system/bin/singleBoadTest
/system/bin/iCamera &

[gtxaspec]

great thanks i'll start working on support soon!

[gtxaspec]

@mwhdc, If you can, try flashing the latest release's demo.bin on the PanV1. See if it boots. If it doesn't, can you see if there is anything in the /opt/wz_mini/log/ directory?

thanks!

[mwhdc]

@mwhdc, If you can, try flashing the latest release's demo.bin on the PanV1. See if it boots. If it doesn't, can you see if there is anything in the /opt/wz_mini/log/ directory?

Pan v1 doesn't seem to recognize the latest wz_mini compiled demo.bin as a flashable file. It ignores the reset button and does a standard boot. I'll try adding your v2_kernel to the latest stock Pan demo.bin (vs the v2's) in case there's a difference.

[gtxaspec]

i've ordered a PanV1 (i hope it's a v1) so hopefully I can get this working quickly

[gtxaspec]

@mwhdc the latest release includes an updated compile_image.sh script.

try ./compile_image.sh pan to create a demo.bin for the pan. it works on my test unit.

[mwhdc]

try ./compile_image.sh pan to create a demo.bin for the pan. it works on my test unit.

Bonehead mistake on my part, I thought the Pan v1 had a white LED in front like the v2 cube that would indicate when the firmware was being updated. It doesn't, the orange just stays lit during flashing and boot, then blinks while the camera tries to bring up a network connection. So I've been able to flash your kernel successfully on two Pan v1s now.

Current issue is that both Pans seem to have forgotten their Wi-Fi credentials. Going back through network setup in the Wyze app hasn't helped as the cameras claim they can't find the specified (2.4) network. I'm assuming this is more PEBCAK of mine - I'll tinker further and report back.

[gtxaspec]

if you ever upgraded beyond 1002 firmware, you need to add them back to wifi, they encrypt the ssid and password now in the configuration files.

[mwhdc]

if you ever upgraded beyond 1002 firmware, you need to add them back to wifi, they encrypt the ssid and password now in the configuration files.

I've tried a few times on both cams and still no luck. Is it possible that the right credentials are in place but the new Wi-Fi drivers aren't loading? Getting endless loops of this in the log...

+ grep 'inet addr'
+ ifconfig wlan0
+ grep 'inet addr'
+ ifconfig wlan0
+ echo ' wlan0 not ready yet...'
 wlan0 not ready yet...
+ sleep 5
+ true

[gtxaspec]

when you push the setup button, do you hear the ready to connect prompt?

[gtxaspec]

I don't have the new wifi-drivers in place for the panv1 yet, so wifi drivers shouldn't be an issue...

[gtxaspec]

can you share the wz_init, wz_post, and dmesg logs?

[mwhdc]

when you push the setup button, do you hear the ready to connect prompt?

Yes, and the cams are reading the QR code, but then claiming they can't find the SSID.

I had the new drivers enabled in wz_mini.conf, but disabling them doesn't seem to make a difference.

Logs are attached from a boot with drivers disabled. There wasn't a dmesg.log on the card.

wz_init.log wz_post.log

[gtxaspec]

it seems I can't connect this wyze pan to my wifi, even flashing back to stock. It refuses to connect to my wifi router... have you tried to flash your back to stock?

[gtxaspec]

It works when I configure it manually, flashing stock again...

[gtxaspec]

looks like the stock wifi driver does not like our kernel. I will update the release to include a new wifi driver which does work with the pan.

[gtxaspec]

latest release includes a new v2_kernel.bin and SD_ROOT including new modules.

[mwhdc]

Success! Had to re-add the cam one last time after first wz_mini boot, now online and working well.

By the way, I've been making one change to fw_tool.sh after each revision to allow it to run under darwin - "stat -c %s" changes to "stat -f %z". If you add a uname -s to fork that command, the script will work for Mac users. (Homebrew install of u-boot-tools and any dependencies is also required.)

[gtxaspec]

fixed in https://github.com/gtxaspec/wz_mini_hacks/commit/f4245747f3ff597b1ba94bb0f87be93e887637a1 thanks for the testing @mwhdc

[mwhdc]

fixed in f424574 thanks for the testing @mwhdc

Thanks for buying the outdated device to debug! Don't forget to add Pan v1 to README.md.