I have been poking around in the camera’s console and found some interesting things. When the camera boots up, it attempts to read a config file but fails due to some missing entries. Here is a screenshot:
At this point I’m taking shots in the dark trying to see if I can get anywhere but I don’t have a plan for now. Considering taking apart my new working camera in order to copy the config file from it to this one and see if that fixes it
Looks like I’m SOL since part of my poking and prodding led to me changing /configs/.product_config and now the version of it in the configs partition that he dd copied from is the same broken one that I modified… I suppose this camera might be dead for good.
Even if you modified /configs/.product_config, it is not that critical. Jffs2 filesystem tries not to overwrite files when you modify them, but instead it marks them deleted and creates a new file in a new flash location (this is done to reduce flash wearing). So that partition is still likely to have all the previous versions of the .product_config file, including the correct one.
Ah, gotcha. I’ll have to figure out how to extract older versions of files then. Lots of reading to do! Did you end up writing a script to accomplish this or do you already know of a utility?
Edit: Sorry, I need to read more before jumping into things… I will look through what you’ve posted previously and ask questions if I’ve got any. Would be nice to create a firmware image that people can flash on working cameras that makes a backup of everything just in case, and then should a failiure occur just reflash the same image but if a certain file is present on the root of the SD card it will overwrite the camera’s configs with the backup.
Really appreciate the details you have provided. I have tried to follow your instruction and I was able to copy the image of the Cam V3 flash to my SDcard. I was able to run jefferson to restore the files but I only saw .product.config with 0 version and the file is blank.
Does that mean there is no prior version of this file I can recover from?
If I am wrong, can you share the code that tell jefferson to print out all the versions of a file?
Also, is it possible to share the .product_config? Or try to generate a valid .product.config file?
Hi @simplelifebaltimore, you need to modify jefferson in order to see the previous versions. Unfortunately I don’t have a clean code that would extract the previous version of a file automatically. I just added a bunch of debug prints and commented out some checks and that is what I used, I can send you the modifications, but you’ll have to figure out how to make it work. Or you could send me the partition image and I could see if I can extract anything from there.
It is not possible to generate a valid .product.config file yourself because it contains keys that are used to allow the camera to connect to the cloud. Only wyze can do it. They are different on each camera so you can’t copy them from another camera that will be connected to the cloud too.
Possible solution?
Had the same issue, solid red light, dead v3.
Was planning to try the rollback on the firmware but couldn’t find my SD card reader, so I took the camera to work with me. I plugged the camera directly into the computer with the usb plug, and the red/blue lights flashed. I hit the setup button and got the “ready to connect” prompt. Didn’t want to hook to that network, so when I got home, I plugged it in. Solid red light again. Took it to my home computer, plugged it in, and got the red/blue flash. It allowed me to go thru the setup again. Now it’s working!
You had good reason to remain cautiously optimistic. One of my V3 cams bricked again with the zero byte ,product_config file even though I am running the latest firmware on all my cameras… Thankfully I didn’t take any chance and saved a backup of that file for all my cams just in case. So the cam is back up but now I am fully expecting the others to act up eventually too.
@IIW Wondering what to expect when using jefferson to see the jffs2 content. One of my solid red light cameras doesn’t have .product_config, nor the MD5xxxxx file. Without modifying jefferson, the content of dumped jffs2 partition doesn’t have the file either. Using the ‘-v’ option, I do see this inode info that contains a filename ‘.product_config’:
0x00000000: Jffs2_raw_dirent(magic=6533, nodetype=57345, totlen=55, hdr_crc=1743357633, pino=1, version=0, ino=2, mctime=1620493210, nsize=15, type=8, unused=[0, 0], node_crc=3465825035, name_crc=50016756, name=b'.product_config', node_offset=0)```
Wondering how to write the content out.
The other solid red light v3 does have the .product_config. Do not understand why it was bricked.
For people without coding experience, probably using binwalk is much easier to recover the missing file than messing with jefferson. This is the sample command:
It will put all extracted files in a directory named _part.dat.extracted. You will see files with names like 49A4.zlib and 49A4. The 49A4 is the human readable file. Then you can use grep to look for keyword in your file of interest. For example, .product_config has ‘HUALAI’ in it, the following Linux command will give you all files that have this keyword: for f in ls *.zlib;do echo ${f/.zlib/}; grep HUALAI ${f/.zlib/};done
Just go through the filtered list to find the file that you want. There are files whose ‘KEY’ value is set to null. You should ignore these and use a file with a key.
Yes, thanks @IIW . However, I need some confirmation on two issues:
I have two versions of .product_config recovered, one with a section with
[TUYA]
CONFIG_INFO_UUID=Xxxxxxx
Not sure if I should use the one with the ‘TUYA’ section or the one without it.
2. Not sure how to get the recovered .product_config back to the camera. Just use ‘cp’? E.g., modify v3_init.sh to add cp /opt/.product_config /config/; sync
Yes, to copy the file you can use “cp” command, but the destination path is “/configs/.product_config”, not “/config/.product_config”
Also make sure you are inserting this command in the boot script (v3_init.sh) late enough so that at that moment the flash drive filesystem in already mounted. You can check it by adding mount > /opt/mount_info.txt and checking that you have a line /dev/mtdblock6 on /configs type jffs2 (rw,relatime) there.
Thanks @IIW. Good catch of the typo. I assume the location in v3_init.sh where you instructed to add ls -al /configs is late enough?
However, after reading your instructions, along with comments from folks that successfully revived their cameras, I feel that I might have a different issue than you do. I see in your case, you had a /configs/.product_config with zero size. I.e., there is an entry under /configs for this file. In the camera that I am working on, I do not have this entry at all. I.e., when doing ‘ls’, I do not see .product_config in the list. Wondering if this makes any difference.
