Can't flash firmware to Cam Pan

The one in the camera right now is wyze’s own 32gb card. Are you saying the card has to be formatted (and blank) when running for the log file to be created? I haven’t tried that yet if so, I’ll give it a shot first thing in the morning though for sure.

As for the shell commands, really I’m open to anything. I already extracted the files because I was curious to see what they were doing. Shell scripts, something like this would be a good start to read?

Success! Thanks so much jmach314. I was away for a few weeks and didn’t get to try this until I returned. Made the edits to the two sh files, added the -p parameter and followed the firewall instructions for both my router (port forward) and Windows system. I had the same results as you. I was able to see where the changes were made in the log file. After that I was able to successfully install the RTSP firmware from the SD card. I had previously updated this camera to the firmware so this fix works even with that.

So I think I’ve got progress, hopefully someone can make sense of these logs that got produced?
I have two log files after trying to replace the bootloader:

The command I’m running from the wyze_updater folder:
c:\python38\python.exe update -p 18080 -d -f "\fix-pan.tar

When I run that now I get the same results as everyone else; the command appears to have worked and the cmd prompt window sits for a while until I stop it with ctrl+c. When I stop it I find those two log files in the root directory on the SD card. The first log file contains endless pages of gibberish, I assume its some kind of code notepad and notepad++ can’t interpret. I can post the first one as well if anyone thinks that would help. The second log file (starts with tutk_log) shows this:

{“IOTC Version”:“”,
“System Time”:“20-09-24 11:55:07”,
“TCP Relay Status”:“OFF”,
“My Nat Type”:2,
“Login Protocl”:“UDP”,
“Master Resolve Status”:“RESOLVE_SUCCESS”,
“P2PServerList Exist”:“YES”,
“MSG_HELLO1_R Received”:“YES”,
“IOTC_Device_Login() Return”:“0”,
“Port Change Count”:0,
“Remote Version”:“3.1.10.-23”,
“NAT type”:2,
“TX Packetcount”:2586,
“RX Packetcount”:2204
“Current Session Count”:1,
“connectionHandler Alive”:“Y”,
“tutk_SockTaskMng Alive”:“Y”,
“Server ip”:“”,
“Last RTT(ms) of login”:115,
“Send count of login msg”:6,
“Recv count of login resp”:6,
“Lost rate of login msg”:0,
“Last return value of _IOTC_SendDeviceLogin()”:288,
“Last login msg send time”:“11:55:07.017”,
“Last login_R msg recv time”:“11:55:07.133”,
“Server ip”:“”,
“Last RTT(ms) of login”:56,
“Send count of login msg”:12,
“Recv count of login resp”:12,
“Lost rate of login msg”:0,
“Last return value of _IOTC_SendDeviceLogin()”:288,
“Last login msg send time”:“11:55:07.017”,
“Last login_R msg recv time”:“11:55:07.074”,
“Server ip”:“”,
“Last RTT(ms) of login”:78,
“Send count of login msg”:6,
“Recv count of login resp”:6,
“Lost rate of login msg”:0,
“Last return value of _IOTC_SendDeviceLogin()”:288,
“Last login msg send time”:“11:55:07.017”,
“Last login_R msg recv time”:“11:55:07.096”}

Can anyone make heads or tails of that?

Hi everyone, I guess no bites on my mess of a log file there.

New question, how did you determine you needed to use port 18080 ? I downloaded an app called tinycam and it looks like my can pan is using port 53443, does that make sense? Is there another way to determine what port my camera is using or is 18080 the port for the machine I’m running the python script from?

That’s the port you are telling python / WyzeUpdater to use to serve the file to your camera, it could be any port you want to use, so long as it is reachable, that is, not blocked by your machine or your router, etc.

Interesting, both ports I mentioned appear to be blocked when I do a port scan on them even though I have forwarded both of them and disabled windows firewall. I’ve read my ISP could have me behind a group NAT which would prevent me from opening up any ports they decide to lock. I see I have some common ports available, Do you think I could push the update down 80 or 3389 even though those ports are typically used for HTTP and RDP?

you can use absolutely any port that can be opened in your machine and is not blocked by your local network, I used 80 for the first update I did on my camera

Anyone else that is still stuck like me FYI the fix-pan file was updated recently ( Correct me if I’m wrong but you shouldn’t have to edit either .SH file. doesn’t have a mountpoint listed anymore and has both mount points scripted:
set -e


echo “Using backup directory: $BACKUP_DIR”

echo “Changing to upgrade directory.”
cd /tmp/Upgrade
echo “Verifying file integrity.”
md5sum -c wyzecam_v2_stock_bootloader.bin.md5
echo “Backing up current bootloader.”
dd if=/dev/mtd0 of=$BACKUP_DIR/wyze-cam-pan-fix-old-bootloader.bin
echo “Erasing bootloader flash.”
flash_eraseall /dev/mtd0
echo “Installing replacement bootloader.”
dd if=wyzecam_v2_stock_bootloader.bin of=/dev/mtd0
set -e

if [ -d “/media/mmcblk0p1/” ]
elif [ -d “/media/mmc/” ]
BACKUP_DIR=mount | grep mmc | grep -v -e /root -e /etc -e /bin | cut -d ' ' -f 3

if [ ! -d $BACKUP_DIR ]
exit 1

sh /tmp/Upgrade/ $BACKUP_DIR &> $BACKUP_DIR/wyze-cam-pan-fix.log

Still stuck at this step myself… and I was so optimistic given all the work that everyone has put into this. Using a ‘FOO…’ pan cam here, have tried the Python/OTA method as listed above, including the manually modified and later editions of and Everything seems to work, logs later show the new bootloader image on the device:

Changing to upgrade directory.
Verifying file integrity.
wyzecam_v2_stock_bootloader.bin: OK
Backing up current bootloader.
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.128093 seconds, 2.0MB/s
Erasing bootloader flash.

Erasing 32 Kibyte @ 0 - 0% complete.
Erasing 32 Kibyte @ 8000 - 12% complete.
Erasing 32 Kibyte @ 10000 - 25% complete.
Erasing 32 Kibyte @ 18000 - 37% complete.
Erasing 32 Kibyte @ 20000 - 50% complete.
Erasing 32 Kibyte @ 28000 - 62% complete.
Erasing 32 Kibyte @ 30000 - 75% complete.
Erasing 32 Kibyte @ 38000 - 87% complete.
Erasing 32 Kibyte @ 40000 - 100% complete.
Installing replacement bootloader.
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.668604 seconds, 382.9KB/s

But when I go to manually load any firmware (Wyze RTSP, Xiaomi Hack, etc.) I still cannot get it to recognize the SD card. I will see if I can find some more cards to try (have two 64Gb cards partitioned to 512mb FAT32) but starting to lose hope.

It really shouldn’t be this difficult!

Well, I have no idea how or why this ended up working, but after doing all the bootloader stuff, and trying to flash the RTSP beta firmware, Xiaomi Hack firmware, and a few other older Wyze Pan firmwares, it finally read one of them from the SD card:

Once I had that, I was able to repeat with the RTSP beta, and it’s good to go.

No idea…

Wow! Lucky you! I’ve got the ‘push’ to work when using python/OTA but I’ve never seen output log files like what you have there.