Can't flash firmware to Cam Pan

Omgosh… what a dummy. Thanks so much @jmach314 I had to double check and I had a capital on my password that didn’t need to be there.

Unfortunately it looks like my pan already updated to 4.10.6.156 so I may be out of luck to sideload the firmware until they update the firmware with a flash fix :frowning: oh well, small victories! Thanks again!

You’re welcome, I’m glad I was able to help. Hopefully someone finds a method to get this to work if FW 4.10.6.156 or greater is installed.

Check comment by riorescue above, he found a modification to the payload that appears to make it successful even with the latest FW

1 Like

Thanks @sa-pr and @riorescue, somehow I missed that. I was able to apply the fix on my Cam Pan with FW 4.10.6.156. Below are the modified 4.10.6.156 steps I used if it helps anyone else:

  1. Opened fix-pan.tar using 7Zip
  2. Navigated to fix-pan.tar\Upgrade\
  3. Modified upgradrun.sh and flash_bootloader.sh with the new mountpoint: from /media/mmcblk0p1 to /media/mmc
  4. Saved directly into the archive
  5. Ran: python wyze_updater.py update -p 18080 -d <MyMAC> -f "<FirmWarePath>\fix-pan.tar"
  6. My camera never rebooted, however the fix was applied. I waited 5 minutes after getting the below message:
    192.168.2.184 - - [16/Sep/2020 11:07:24] "GET /firmware.bin HTTP/1.1" 200 - Press Ctrl+C when all the updates are done...
  7. After waiting 5 minutes, I checked the SD Card and confirmed in the wyze-cam-pan-fix.log that the bootloader was replaced

I’m now able to manually update the FW using the demo.bin and the push button method.

Hi @jmach314, did you ctrl+c to end the upgrade or did you just take the SD card out? I’ve tried running the command a few times (I get the same message you do that the update is running), but I’m not seeing a log file in the root directory.

Hi @im.mjb83, I modified my previous steps, main changes are in step 1 and step 8. My best guess would be the router or firewall is blocking port 18080.

  1. Added a port 18080 forward rule to my routers and turned off Windows Firewall temporally
  2. Opened fix-pan.tar using 7Zip
  3. Navigated to fix-pan.tar\Upgrade\
  4. Modified upgradrun.sh and flash_bootloader.sh with the new mountpoint: from /media/mmcblk0p1 to /media/mmc
  5. Saved directly into the archive
  6. Ran: python wyze_updater.py update -p 18080 -d <MyMAC> -f "<FirmWarePath>\fix-pan.tar"
  7. My camera never rebooted, however the fix was applied. I waited 5 minutes after getting the below message:
    192.168.2.184 - - [16/Sep/2020 11:07:24] "GET /firmware.bin HTTP/1.1" 200 - Press Ctrl+C when all the updates are done...
  8. After waiting 5 minutes, I ctrl+c to end the upgrade. I unplugged the camera and removed the SD card. I checked the root of the SD Card and confirmed in the wyze-cam-pan-fix.log that the bootloader was replaced.

Hmm. I just cannot get this to go. I tried opening up port to the IP of the camera, and then the computer acting as server, and then both at the same time and I get all the other steps done but I’m not getting a log file after 5 minutes and a ctrl + c. Windows firewall is disabled, I get no type of error message or any feedback anything is incorrect.

Hi Riorescue, any thoughts of what else to do if I am seeing the ‘GET /firmware.bin HTTP/1.1’ 200 -’ message? @jmach314 modified his command line to use port 18080 which I’ve done as well but I’ll let the updater run for 5, 10, even 20 minutes and it just keeps spinning those dots in the dos prompt and when I unplug the camera and remove the SD card, no log file.

@im.mjb83 I’ve heard of various problems with SD cards if not using a brand size that’s commonly used with these cameras. Is your SD card 32GB and formatted FAT32? If you are comfortable with shell scripts you can extract the .tar and use a simple echo command to the SD card without running the boot loader update. A simple shell script would help you identify where the failure is occurring.

The one in the camera right now is wyze’s own 32gb card. Are you saying the card has to be formatted (and blank) when running wyze_updater.py for the log file to be created? I haven’t tried that yet if so, I’ll give it a shot first thing in the morning though for sure.

As for the shell commands, really I’m open to anything. I already extracted the files because I was curious to see what they were doing. Shell scripts, something like this would be a good start to read? https://www.shellscript.sh/

Success! Thanks so much jmach314. I was away for a few weeks and didn’t get to try this until I returned. Made the edits to the two sh files, added the -p parameter and followed the firewall instructions for both my router (port forward) and Windows system. I had the same results as you. I was able to see where the changes were made in the log file. After that I was able to successfully install the RTSP firmware from the SD card. I had previously updated this camera to the 4.10.6.156 firmware so this fix works even with that.

So I think I’ve got progress, hopefully someone can make sense of these logs that got produced?
I have two log files after trying to replace the bootloader:
log_2CAA8E99F3CB_20200924155507_s.txt
tutk_log_2CAA8E99F3CB_20200924155507.txt

The command I’m running from the wyze_updater folder:
c:\python38\python.exe wyze_updater.py update -p 18080 -d -f "\fix-pan.tar

When I run that now I get the same results as everyone else; the command appears to have worked and the cmd prompt window sits for a while until I stop it with ctrl+c. When I stop it I find those two log files in the root directory on the SD card. The first log file contains endless pages of gibberish, I assume its some kind of code notepad and notepad++ can’t interpret. I can post the first one as well if anyone thinks that would help. The second log file (starts with tutk_log) shows this:

{“IOTC Version”:“3.1.10.15”,
“System Time”:“20-09-24 11:55:07”,
“TCP Relay Status”:“OFF”,
“My Nat Type”:2,
“Login Protocl”:“UDP”,
“LANConnectionTimeout(ms)”:1500,
“P2PConnectionTimeout(ms)”:1500,
“SessionAliveTimeout(ms)”:30000,
“Master Resolve Status”:“RESOLVE_SUCCESS”,
“P2PServerList Exist”:“YES”,
“VPG”:[53252,260,260],
“MSG_HELLO1_R Received”:“YES”,
“MSG_DEVICE_LOGIN_R Received”:“YES”,
“IOTC_Device_Login() Return”:“0”,
“Port Change Count”:0,
“SessionInfo”:{
“SID”:1,
“Mode”:“LAN”,
“Remote Version”:“3.1.10.-23”,
“Address”:“192.168.2.172:46470”,
“NAT type”:2,
“TX Packetcount”:2586,
“RX Packetcount”:2204
},
“Current Session Count”:1,
“connectionHandler Alive”:“Y”,
“tutk_SockTaskMng Alive”:“Y”,
“Server ip”:“147.135.36.161:10001”,
“Last RTT(ms) of login”:115,
“Send count of login msg”:6,
“Recv count of login resp”:6,
“Lost rate of login msg”:0,
“Last return value of _IOTC_SendDeviceLogin()”:288,
“Last login msg send time”:“11:55:07.017”,
“Last login_R msg recv time”:“11:55:07.133”,
“Server ip”:“158.69.252.241:10001”,
“Last RTT(ms) of login”:56,
“Send count of login msg”:12,
“Recv count of login resp”:12,
“Lost rate of login msg”:0,
“Last return value of _IOTC_SendDeviceLogin()”:288,
“Last login msg send time”:“11:55:07.017”,
“Last login_R msg recv time”:“11:55:07.074”,
“Server ip”:“38.132.103.114:10001”,
“Last RTT(ms) of login”:78,
“Send count of login msg”:6,
“Recv count of login resp”:6,
“Lost rate of login msg”:0,
“Last return value of _IOTC_SendDeviceLogin()”:288,
“Last login msg send time”:“11:55:07.017”,
“Last login_R msg recv time”:“11:55:07.096”}

Can anyone make heads or tails of that?

Hi everyone, I guess no bites on my mess of a log file there.

New question, how did you determine you needed to use port 18080 ? I downloaded an app called tinycam and it looks like my can pan is using port 53443, does that make sense? Is there another way to determine what port my camera is using or is 18080 the port for the machine I’m running the python script from?

That’s the port you are telling python / WyzeUpdater to use to serve the file to your camera, it could be any port you want to use, so long as it is reachable, that is, not blocked by your machine or your router, etc.

Interesting, both ports I mentioned appear to be blocked when I do a port scan on them even though I have forwarded both of them and disabled windows firewall. I’ve read my ISP could have me behind a group NAT which would prevent me from opening up any ports they decide to lock. I see I have some common ports available, Do you think I could push the update down 80 or 3389 even though those ports are typically used for HTTP and RDP?

you can use absolutely any port that can be opened in your machine and is not blocked by your local network, I used 80 for the first update I did on my camera

Anyone else that is still stuck like me FYI the fix-pan file was updated recently (https://github.com/agent86ix/wyze-cam-pan-sd-flash-fix). Correct me if I’m wrong but you shouldn’t have to edit either .SH file. flash_bootloader.sh doesn’t have a mountpoint listed anymore and upgraderun.sh has both mount points scripted:

flash_bootloader.sh:
#!/bin/sh
set -e

BACKUP_DIR=$1

echo “Using backup directory: $BACKUP_DIR”

echo “Changing to upgrade directory.”
cd /tmp/Upgrade
echo “Verifying file integrity.”
md5sum -c wyzecam_v2_stock_bootloader.bin.md5
echo “Backing up current bootloader.”
dd if=/dev/mtd0 of=$BACKUP_DIR/wyze-cam-pan-fix-old-bootloader.bin
echo “Erasing bootloader flash.”
flash_eraseall /dev/mtd0
echo “Installing replacement bootloader.”
dd if=wyzecam_v2_stock_bootloader.bin of=/dev/mtd0
reboot

upgraderun.sh:
#!/bin/sh
set -e

if [ -d “/media/mmcblk0p1/” ]
then
BACKUP_DIR=/media/mmcblk0p1/
elif [ -d “/media/mmc/” ]
then
BACKUP_DIR=/media/mmc/
else
BACKUP_DIR=mount | grep mmc | grep -v -e /root -e /etc -e /bin | cut -d ' ' -f 3
fi

if [ ! -d $BACKUP_DIR ]
then
exit 1
fi

sh /tmp/Upgrade/flash_bootloader.sh $BACKUP_DIR &> $BACKUP_DIR/wyze-cam-pan-fix.log

Still stuck at this step myself… and I was so optimistic given all the work that everyone has put into this. Using a ‘FOO…’ pan cam here, have tried the Python/OTA method as listed above, including the manually modified and later editions of flash_bootloader.sh and upgraderun.sh. Everything seems to work, logs later show the new bootloader image on the device:

Changing to upgrade directory.
Verifying file integrity.
wyzecam_v2_stock_bootloader.bin: OK
Backing up current bootloader.
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.128093 seconds, 2.0MB/s
Erasing bootloader flash.

Erasing 32 Kibyte @ 0 - 0% complete.
Erasing 32 Kibyte @ 8000 - 12% complete.
Erasing 32 Kibyte @ 10000 - 25% complete.
Erasing 32 Kibyte @ 18000 - 37% complete.
Erasing 32 Kibyte @ 20000 - 50% complete.
Erasing 32 Kibyte @ 28000 - 62% complete.
Erasing 32 Kibyte @ 30000 - 75% complete.
Erasing 32 Kibyte @ 38000 - 87% complete.
Erasing 32 Kibyte @ 40000 - 100% complete.
Installing replacement bootloader.
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.668604 seconds, 382.9KB/s

But when I go to manually load any firmware (Wyze RTSP, Xiaomi Hack, etc.) I still cannot get it to recognize the SD card. I will see if I can find some more cards to try (have two 64Gb cards partitioned to 512mb FAT32) but starting to lose hope.

It really shouldn’t be this difficult!

Well, I have no idea how or why this ended up working, but after doing all the bootloader stuff, and trying to flash the RTSP beta firmware, Xiaomi Hack firmware, and a few other older Wyze Pan firmwares, it finally read one of them from the SD card: 4.10.3.50

Once I had that, I was able to repeat with the RTSP beta, and it’s good to go.

No idea…

Wow! Lucky you! I’ve got the ‘push’ to work when using python/OTA but I’ve never seen output log files like what you have there.