Can't flash firmware to Cam Pan

Cameras
,
103

The one in the camera right now is wyze’s own 32gb card. Are you saying the card has to be formatted (and blank) when running wyze_updater.py for the log file to be created? I haven’t tried that yet if so, I’ll give it a shot first thing in the morning though for sure.

As for the shell commands, really I’m open to anything. I already extracted the files because I was curious to see what they were doing. Shell scripts, something like this would be a good start to read? https://www.shellscript.sh/

104

Success! Thanks so much jmach314. I was away for a few weeks and didn’t get to try this until I returned. Made the edits to the two sh files, added the -p parameter and followed the firewall instructions for both my router (port forward) and Windows system. I had the same results as you. I was able to see where the changes were made in the log file. After that I was able to successfully install the RTSP firmware from the SD card. I had previously updated this camera to the 4.10.6.156 firmware so this fix works even with that.

105

So I think I’ve got progress, hopefully someone can make sense of these logs that got produced?
I have two log files after trying to replace the bootloader:
log_2CAA8E99F3CB_20200924155507_s.txt
tutk_log_2CAA8E99F3CB_20200924155507.txt

The command I’m running from the wyze_updater folder:
c:\python38\python.exe wyze_updater.py update -p 18080 -d -f "\fix-pan.tar

When I run that now I get the same results as everyone else; the command appears to have worked and the cmd prompt window sits for a while until I stop it with ctrl+c. When I stop it I find those two log files in the root directory on the SD card. The first log file contains endless pages of gibberish, I assume its some kind of code notepad and notepad++ can’t interpret. I can post the first one as well if anyone thinks that would help. The second log file (starts with tutk_log) shows this:

{“IOTC Version”:“3.1.10.15”,
“System Time”:“20-09-24 11:55:07”,
“TCP Relay Status”:“OFF”,
“My Nat Type”:2,
“Login Protocl”:“UDP”,
“LANConnectionTimeout(ms)”:1500,
“P2PConnectionTimeout(ms)”:1500,
“SessionAliveTimeout(ms)”:30000,
“Master Resolve Status”:“RESOLVE_SUCCESS”,
“P2PServerList Exist”:“YES”,
“VPG”:[53252,260,260],
“MSG_HELLO1_R Received”:“YES”,
“MSG_DEVICE_LOGIN_R Received”:“YES”,
“IOTC_Device_Login() Return”:“0”,
“Port Change Count”:0,
“SessionInfo”:{
“SID”:1,
“Mode”:“LAN”,
“Remote Version”:“3.1.10.-23”,
“Address”:“192.168.2.172:46470”,
“NAT type”:2,
“TX Packetcount”:2586,
“RX Packetcount”:2204
},
“Current Session Count”:1,
“connectionHandler Alive”:“Y”,
“tutk_SockTaskMng Alive”:“Y”,
“Server ip”:“147.135.36.161:10001”,
“Last RTT(ms) of login”:115,
“Send count of login msg”:6,
“Recv count of login resp”:6,
“Lost rate of login msg”:0,
“Last return value of _IOTC_SendDeviceLogin()”:288,
“Last login msg send time”:“11:55:07.017”,
“Last login_R msg recv time”:“11:55:07.133”,
“Server ip”:“158.69.252.241:10001”,
“Last RTT(ms) of login”:56,
“Send count of login msg”:12,
“Recv count of login resp”:12,
“Lost rate of login msg”:0,
“Last return value of _IOTC_SendDeviceLogin()”:288,
“Last login msg send time”:“11:55:07.017”,
“Last login_R msg recv time”:“11:55:07.074”,
“Server ip”:“38.132.103.114:10001”,
“Last RTT(ms) of login”:78,
“Send count of login msg”:6,
“Recv count of login resp”:6,
“Lost rate of login msg”:0,
“Last return value of _IOTC_SendDeviceLogin()”:288,
“Last login msg send time”:“11:55:07.017”,
“Last login_R msg recv time”:“11:55:07.096”}

Can anyone make heads or tails of that?

106

Hi everyone, I guess no bites on my mess of a log file there.

New question, how did you determine you needed to use port 18080 ? I downloaded an app called tinycam and it looks like my can pan is using port 53443, does that make sense? Is there another way to determine what port my camera is using or is 18080 the port for the machine I’m running the python script from?

107

That’s the port you are telling python / WyzeUpdater to use to serve the file to your camera, it could be any port you want to use, so long as it is reachable, that is, not blocked by your machine or your router, etc.

108

Interesting, both ports I mentioned appear to be blocked when I do a port scan on them even though I have forwarded both of them and disabled windows firewall. I’ve read my ISP could have me behind a group NAT which would prevent me from opening up any ports they decide to lock. I see I have some common ports available, Do you think I could push the update down 80 or 3389 even though those ports are typically used for HTTP and RDP?

109

you can use absolutely any port that can be opened in your machine and is not blocked by your local network, I used 80 for the first update I did on my camera

110

Anyone else that is still stuck like me FYI the fix-pan file was updated recently (GitHub - agent86ix/wyze-cam-pan-sd-flash-fix). Correct me if I’m wrong but you shouldn’t have to edit either .SH file. flash_bootloader.sh doesn’t have a mountpoint listed anymore and upgraderun.sh has both mount points scripted:

flash_bootloader.sh:
#!/bin/sh
set -e

BACKUP_DIR=$1

echo “Using backup directory: $BACKUP_DIR”

echo “Changing to upgrade directory.”
cd /tmp/Upgrade
echo “Verifying file integrity.”
md5sum -c wyzecam_v2_stock_bootloader.bin.md5
echo “Backing up current bootloader.”
dd if=/dev/mtd0 of=$BACKUP_DIR/wyze-cam-pan-fix-old-bootloader.bin
echo “Erasing bootloader flash.”
flash_eraseall /dev/mtd0
echo “Installing replacement bootloader.”
dd if=wyzecam_v2_stock_bootloader.bin of=/dev/mtd0
reboot

upgraderun.sh:
#!/bin/sh
set -e

if [ -d “/media/mmcblk0p1/” ]
then
BACKUP_DIR=/media/mmcblk0p1/
elif [ -d “/media/mmc/” ]
then
BACKUP_DIR=/media/mmc/
else
BACKUP_DIR=mount | grep mmc | grep -v -e /root -e /etc -e /bin | cut -d ' ' -f 3
fi

if [ ! -d $BACKUP_DIR ]
then
exit 1
fi

sh /tmp/Upgrade/flash_bootloader.sh $BACKUP_DIR &> $BACKUP_DIR/wyze-cam-pan-fix.log

Pan RTSP Firmware Wont Flash
Cam Pan serial number starting with F00 incorrect bootloader
111

Still stuck at this step myself… and I was so optimistic given all the work that everyone has put into this. Using a ‘FOO…’ pan cam here, have tried the Python/OTA method as listed above, including the manually modified and later editions of flash_bootloader.sh and upgraderun.sh. Everything seems to work, logs later show the new bootloader image on the device:

Changing to upgrade directory.
Verifying file integrity.
wyzecam_v2_stock_bootloader.bin: OK
Backing up current bootloader.
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.128093 seconds, 2.0MB/s
Erasing bootloader flash.

Erasing 32 Kibyte @ 0 - 0% complete.
Erasing 32 Kibyte @ 8000 - 12% complete.
Erasing 32 Kibyte @ 10000 - 25% complete.
Erasing 32 Kibyte @ 18000 - 37% complete.
Erasing 32 Kibyte @ 20000 - 50% complete.
Erasing 32 Kibyte @ 28000 - 62% complete.
Erasing 32 Kibyte @ 30000 - 75% complete.
Erasing 32 Kibyte @ 38000 - 87% complete.
Erasing 32 Kibyte @ 40000 - 100% complete.
Installing replacement bootloader.
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.668604 seconds, 382.9KB/s

But when I go to manually load any firmware (Wyze RTSP, Xiaomi Hack, etc.) I still cannot get it to recognize the SD card. I will see if I can find some more cards to try (have two 64Gb cards partitioned to 512mb FAT32) but starting to lose hope.

It really shouldn’t be this difficult!

112

Well, I have no idea how or why this ended up working, but after doing all the bootloader stuff, and trying to flash the RTSP beta firmware, Xiaomi Hack firmware, and a few other older Wyze Pan firmwares, it finally read one of them from the SD card: 4.10.3.50

Once I had that, I was able to repeat with the RTSP beta, and it’s good to go.

No idea…

113

Wow! Lucky you! I’ve got the ‘push’ to work when using python/OTA but I’ve never seen output log files like what you have there.

114

I could really use some help. I have spent hours trying to get this to work. I have run Wyze Updater but cannot get the GET message. I just get dots forever. I used Wireshark to sniff the traffic and found out that the Wyze is denying the connection due to an unknown certificate authority. Has something changed where this will not work anymore? Any workarounds?

Packet TLS data: TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Unknown CA).

Currently on Firmware v4.9.6.241(latest). FOO model.

115

Sorry @r.mler2000 I gave up on this myself. Pan seems to be hit and miss for OTA updates you may just be like me and stuck without RTSP support. I did manage somewhat of a workaround using an Android app called tinycam. There is a pro version that allows you to run a ‘server’ that you can connect to via IP address to any other web browser connected to the same home network.

Tinycam is here:

Costs a bit for the PRO upgrade but it’s what I settled on when RTSP couldn’t function and wyze didn’t seem interested in supporting, good luck!

116

Just chiming in to say I got this working on a Mac with Python Launcher/MacOS Terminal and 3 of my Wyze Cam Pans. Big thanks to @sa-pr and the folks on the GitHub links for this. I’m actually shocked that people went this far to solve the problem but am grateful they did!

I am completely new to Python so it took a while to learn what some of these steps actually meant but after I figured out what/how to enter the commands that were listed here it got it working without issue.

The key was understanding what commands to run at the same time vs what worked separately and in what order. What I did was:

Install Python (Mac)
Install get-pip via python
Install the python “request” module
Run the wyze_updater.py list command that starts the server and gets you to log into your wyze account and list the devices
use the update command that pushes the update using the fix-pan.tar file

Best part about this is you won’t need to do this for future updates because it allows you to use the official method of updating firmware with the SD card from now on. THANK YOU!

118

Was this with FOO model as well?

119

I gave up on the cam pan.

120

I have the cam/pan and it will not update the firmware. I say to in the app and it fails everytime, for months now…Any help would be greatly appreciated. I am a little lost with all the talk in the post, I am not a programmer, I just want it to work and record and events

121

Sorry Wolfwalker, I think the general consensus here is that it will not work on the cam pan. I myself have given up on it. I’ll probably be replacing where I’m using the pan with a v2 or v3 soon and just sell the pan.

There are quite a few things you could try for your model based on all the information in this thread but if you have serial number FOO you’re pretty much out of luck.

It looks like for the v3 wyze is providing beta RTSP support which is good news. The easiest / best solution here might be done with the pan and get a v3. Sorry if its not the news you wanted, but I think its the truth - the pan won’t work.