gtxaspec/wz_mini_hacks

wz camera mods... make your camera better.

wz_mini_hacks

Ingenic based T20/T31 based devices only!

Run whatever firmware you want on your camera and have root access to the device. Use CAUTION if you are unsure of what you are doing. Permanent damage is possible to your device. No support whatsoever is offered with this release.

Do not contact any manufacturer for information or support, they will not be able to assist or advise you!

Important matters related to security

Using this project can potentially expose your device to the open internet depending on the configuration of your network. You alone are responsible for the configuration and security of your network, make sure you are aware of the risks involved before using.

Features

• No hardware modifications needed to the device!
• Easy uninstall, just remove files from micro-sd card, or don't use a micro-sd card at all!
• Compatability is not guaranteed with really old firmware versions!
• Update to the latest stable or beta firmware, this mod should still work! (most features, see the wiki) Firmware-Support
• Block remote or app initiated firmware updates
• DNS Spoofing or Telnet mod are not required prior to installation
• RTSP Streaming Support:
  • go2rtc
  • v4l2rtspserver (deprecated)
• RTMP Streaming - via go2rtc: Stream live video from the camera to your favorite service, youtube, twitch, or facebook live.
• Networking:
  • Wireguard, IPv6, CIFS/Samba and iptables support enabled
  • File server support to access SD card contents remotely
  • Tether your camera directly to android phones using USB via RNDIS support
  • USB gadget support, connect the camera directly to a supported router to get an internet connection, no USB Ethernet Adapter required, using USB CDC_NCM.
• Supports the following USB Ethernet adapters:
  • ASIX AX88xxx Based USB 2.0 Ethernet Adapters
  • ASIX AX88179/178A USB 3.0/2.0 to Gigabit Ethernet
  • Realtek RTL8152 Based USB 2.0 Ethernet Adapters
  • CDC-Ether Based Adapters
• USB Mass storage enabled, mount USB SSD/HDD/flash drives
• Play audio to the camera speaker from files or streaming audio!
• Webcam Mode - Use your camera as a spare UVC USB Web Camera on your PC, Mac, or AndroidTV!
• Custom boot script support included

Why?

• Most things in life relate to cats somehow. I started this project to track the local feral cat population in my neighborhood using cameras.

Prerequisites

• Person
• Cat ( for emotional support during setup )
• Computer
• 256MB or larger Micro-SD Card is required!
• Higher class Micro-SD cards will ensure better performance

Setup / Configuration / Installation

Visit the Installation & Setup section of the Wiki for details!

HELP! SOMETHING DOESN'T DOESN'T WORK

• If you need assistance, or have general questions, feel free to visit the Discussions area! There are folks always willing to help out.

---

Latest Updates

* Visit the Changelog at the Wiki for the latest update information!

BYO

Build your own!!

https://github.com/mnakada/atomcam_tools has a great repo with docker images which include kernel sources, config, and a whole bunch of other stuff. Check it out.

WARNING

AS WITH ANY UNSUPPORTED SYSTEM MODIFICATIONS, USING THIS MAY LEAD TO A DEVICE BRICK
IF YOU DON'T KNOW WHAT YOU ARE DOING ( HAVEN'T BRICKED MY DEVICE YET! ) PLEASE
BE AWARE THAT NO ONE ON THE INTERNET IS RESPONSIBLE FOR ANY DAMAGE TO YOUR
UNIT. ANY PROBLEMS WILL BE CONSIDERED USER ERROR OR ACTS OF WHATEVER GOD YOU BELIEVE IN.
USE AT YOUR OWN RISK. NO WARRANTY OF ANY KIND IS EXPRESSED OR IMPLIED. 
DO NOT USE THIS SOFTWARE IF YOU ARE NOT CONFIDENT IN RESTORING YOUR DEVICE FROM A FAILED STATE.

Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

Thank You

Inspired by HclX, bakueikozo, and mnakada!

Thank you to everyone who is passionate about Wyze products for making the devices popular, and thank you to Wyze for producing them. Sign up for CamPlus, show some love and support to the company.

Thank you AlexxIT for the amazing go2rtc project! https://github.com/AlexxIT/go2rtc

Thanks for HclX for WyzeHacks! https://github.com/HclX/WyzeHacks

Thank you mnakada for his atomcam_tools fork! https://github.com/mnakada/atomcam_tools

Thank you bakueikozo for his atomcam_tools repo! https://github.com/bakueikozo/atomcam_tools

Thank you to virmaior for the atomcam_tools tip!

wz_mini_hacks's Issues

scp - not found, (Maybe could be added ???) + Best method to upgrade firmware

I flashed one v3 Camera's SD-Card (& of course... you upgraded about an hour afterwards).
But rather than.. Get the ladder-out again, pull down the camera, remove SD-Card etc etc...
I thought...
Perhaps I can just use ssh & scp the most recently altered files?
Obviously I soon noticed there was no scp but that led to me thinking...
'What is the easiest or best method to remotely update your firmware, WITHOUT removing the SD-Card from EACH Camera???"
I noticed there was already wget but thought I'd ask the author himself.

• I already made some changes remotely to certain files via ssh & using nano...
  but what if the changes require copying some binary files?
  Any wisdom would be appreciated.
  Thx

Wyze kernel update

Wyze just released a new update just for the cam V3 (4.36.9.131) and I noticed the kernel was updated in this release. With that, I know this MOD is using it's own kernel, so it's more of a question I would have then so much an issue:

Should we allow the latest update, or is there a risk that the updated Wyze binaries may fault or not work as desired without the proper kernel? Should we wait for an updated factory_t31_ file?

For the first time, I noticed a change in memory and not sure of what significance that may have:

mem=96M@0x0 rmem=32M@0x6000000 to
mem=99M@0x0 rmem=29M@0x6300000

Unable to start RTSP

Seems I am unable to get RTSP to start. I've got this loaded and SSH enabled but when I look in v3_post I don't see RTSP starting up. I would expect to see "echo "load video loopback driver at video1"" but I don't. Am I missing something here?

[root@WCV3:log]# cat v3_post.log
welcome to v3_post.sh
PID 104
+ echo 'v3_post.sh exec'
v3_post.sh exec
+ grep 'RTSP_HI_RES_ENABLED\='
+ cat /opt/wz_mini/run_mmc.sh
' '==' 'RTSP_HI_RES_ENABLED\="true"' ]]
+ grep 'RTSP_LOW_RES_ENABLED\='
+ cat /opt/wz_mini/run_mmc.sh
' '==' 'RTSP_LOW_RES_ENABLED\="true"' ]]

Here is my RTSP block from run_mmc.sh

#####VIDEO STREAM#####
RTSP_LOGIN="xxxx"
RTSP_PASSWORD="xxxx"
RTSP_PORT="8554"

RTSP_HI_RES_ENABLED="true"
RTSP_HI_RES_ENABLE_AUDIO="true"
RTSP_HI_RES_MAX_BITRATE="2048"
RTSP_HI_RES_TARGET_BITRATE="1024"
RTSP_HI_RES_ENC_PARAMETER="2"

RTSP_LOW_RES_ENABLED="false"
RTSP_LOW_RES_ENABLE_AUDIO="false"
RTSP_LOW_RES_MAX_BITRATE=""
RTSP_LOW_RES_TARGET_BITRATE=""
RTSP_LOW_RES_ENC_PARAMETER=""

ENABLE_MP4_WRITE="false"
ENABLE_MP4_WRITE="false"

I am on FW 4.36.9.139

usb-storage devices don't work, no support in kernel

usb-storage is missing from kernel, unable to use USB flash drives/ssd/hdd as storage.
need to include usb-storage, probably scsi subsystem too.

RTSP Server?

I didn't see it mentioned so I'm assuming not, but does this enable RTSP output from the camera without needing Wyze's RTSP firmware?

Camera will not boot after firmware upgrade once memory card is removed

While wz_mini_hacks is installed, and a FW upgrade occurs, the system will flash the new firmware to the backup partitions.

Upon reboot, the bootloader loads the factory file first, skipping the copy routines, so the firmware is never upgraded.

If you reboot again, but this time remove the micro-sd card, the bootloader will attempt to run the copy routines, and will then corrupt something and the system will not boot.

Find the upgrade flag!
FWGRADEUP=kernel+app!
aback flash read...
kenral flash erase...
kernel flash write...
app flash erase...
app flash write...
flag flash earse...
the manufacturer 1c
SF: Detected EN25QH128A

--->probe spend 5 ms
SF: 2031616 bytes @ 0x40000 Read: OK
--->read spend 653 ms
Wrong Image Format for bootm command
ERROR: can't get kernel image!

You can fix this by inserting the memory card again, since the kernel is loaded from the memory card, BUT, the system will not work without the memory card unless you flash demo_wcv3.bin or manually flash the kernel to /dev/mtd1,

Just to be safe, disabling FW Upgrades by default in wz_mini_hacks.

checking the u-boot source code to see why.

side note: this is a working method to get to the u-boot command line, it dumps you to the u-boot command line after it can't find a working kernel image.

add Buy me a Coffee button!

@gtxaspec you are doing incredible job here! Please consider adding Buy me a Coffee button to compensate your time.

Fix for RTSP functionality on 4.36.2.5

wz_mini'd 4.36.2.5 running over USB direct.
with

• RTSP_ENABLED=true
• RTSP_ENABLE_AUDIO=true

in run_mmc.log, I'm getting:

VIDIOC_REQBUFS: Inappropriate ioctl for device
VIDIOC_STREAMOFF: Inappropriate ioctl for device
VIDIOC_REQBUFS: Inappropriate ioctl for device

and no video

if I do

• RTSP_ENABLED=true
• RTSP_ENABLE_AUDIO=false

the same error message and no RTSP

ffmpeg output for video only:

ffmpeg version a4e1dd6 Copyright (c) 2000-2021 the FFmpeg developers
built with gcc 8 (Raspbian 8.3.0-6+rpi1)
configuration: --extra-cflags=-I/usr/local/include --extra-ldflags=-L/usr/local/lib --extra-libs='-lpthread -lm -latomic' --arch=armel --enable-gmp --enable-gpl --enable-libaom --enable-libass --enable-libdav1d --enable-libdrm --enable-libfdk-aac --enable-libfreetype --enable-libkvazaar --enable-libmp3lame --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libopus --enable-librtmp --enable-libsnappy --enable-libsoxr --enable-libssh --enable-libvorbis --enable-libvpx --enable-libzimg --enable-libwebp --enable-libx264 --enable-libx265 --enable-libxml2 --enable-mmal --enable-nonfree --enable-omx --enable-omx-rpi --enable-version3 --target-os=linux --enable-pthreads --enable-openssl --enable-hardcoded-tables
libavutil 56. 70.100 / 56. 70.100
libavcodec 58.134.100 / 58.134.100
libavformat 58. 76.100 / 58. 76.100
libavdevice 58. 13.100 / 58. 13.100
libavfilter 7.110.100 / 7.110.100
libswscale 5. 9.100 / 5. 9.100
libswresample 3. 9.100 / 3. 9.100
libpostproc 55. 9.100 / 55. 9.100
[tcp @ 0x1f91ce0] Connection to tcp://192.168.5.103:8554?timeout=0 failed: Connection refused
rtsp://admin:[email protected]:8554/unicast: Connection refused

ffmpeg output for video+audio:

ffmpeg version a4e1dd6 Copyright (c) 2000-2021 the FFmpeg developers
built with gcc 8 (Raspbian 8.3.0-6+rpi1)
configuration: --extra-cflags=-I/usr/local/include --extra-ldflags=-L/usr/local/lib --extra-libs='-lpthread -lm -latomic' --arch=armel --enable-gmp --enable-gpl --enable-libaom --enable-libass --enable-libdav1d --enable-libdrm --enable-libfdk-aac --enable-libfreetype --enable-libkvazaar --enable-libmp3lame --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libopus --enable-librtmp --enable-libsnappy --enable-libsoxr --enable-libssh --enable-libvorbis --enable-libvpx --enable-libzimg --enable-libwebp --enable-libx264 --enable-libx265 --enable-libxml2 --enable-mmal --enable-nonfree --enable-omx --enable-omx-rpi --enable-version3 --target-os=linux --enable-pthreads --enable-openssl --enable-hardcoded-tables
libavutil 56. 70.100 / 56. 70.100
libavcodec 58.134.100 / 58.134.100
libavformat 58. 76.100 / 58. 76.100
libavdevice 58. 13.100 / 58. 13.100
libavfilter 7.110.100 / 7.110.100
libswscale 5. 9.100 / 5. 9.100
libswresample 3. 9.100 / 3. 9.100
libpostproc 55. 9.100 / 55. 9.100
[udp @ 0x33bf7d0] attempted to set receive buffer to size 393216 but it only ended up set as 360448
[udp @ 0x33cfb10] attempted to set receive buffer to size 393216 but it only ended up set as 360448
Guessed Channel Layout for Input Stream #0.0 : mono
Input #0, rtsp, from 'rtsp://admin:[email protected]:8554/unicast':
Metadata:
title : LIVE555 Streaming Media v2022.04.15
comment : LIVE555 Streaming Media v2022.04.15
Duration: N/A, start: 0.000000, bitrate: 705 kb/s
Stream #0:0: Audio: pcm_s16be, 44100 Hz, mono, s16, 705 kb/s

=only an audio feed.

Do I need to upgrade the base version of the firmware or is something else busted?

Does this work on a wyzehacked v3 firmware 4.36.2.5 ?

For some reason, my SD cards don't read correctly on 4.36.0.280. Did the filesystem change from 4.36.0.280 to 4.36.2.5?

I have my cameras completely disconnected from internet which means no live feed and it'd be nice to get them back to giving a feed (though a bit worried about letting the app even have access to them even with the update blocking feature)

MQTT Support for homeassistant integration

What would it take to add MQTT support

Publishing and subscribing to MQTT bindings will make integration with Homeassistant really useful and eliminate need for frigate or any other host-based accelerated AI detection.

Looking at something similiar in Dafang-Hacks
It seems they have a binary reading state from shared memory that fires off a shell script on motion detection

https://github.com/EliasKotlyar/Xiaomi-Dafang-Software/blob/1cfed9e1735c3bd376f86195318a9067161cb3d3/v4l2rtspserver-master/src/ImpEncoder.cpp#L723

USB hubs/switches/doohickes for USB CDC for multiple cameras

Working off of:

• USB gadget support, connect the camera directly to a supported router to get an internet connection, no USB Ethernet Adapter required, using USB CDC_NCM

I've been trying to figure out if it'd be possible to switch all of my cameras to using a USB hub with ethernet over usb functionality.

I can find the spec and wikipedia, openWRT's guide for doing networking over usb etc, but I can't figure out if any hub supports this (i.e. plug the hub directly into a RPI and give each port CDC-based ethernet over USB).

Can anyone point me in the right direction?

cannot create directory ‘./tmp_root/4.36.8.32_ext

Hi
I`m very exited to try your hack! trying to compile the SD card FW part using Windows 10 and GIT installed and the code gives me this error.

I will try later today to run this in VM Ubuntu

`Copy locla utilities to SD_ROOT
Download latest rootfs firmware 4.36.3.19
./setup.sh: line 27: wget: command not found
mkdir: cannot create directory ‘./tmp_root/4.36.3.19_ext’: No such file or directory
tar: ./tmp_root/4.36.3.19.tar: Cannot open: No such file or directory
tar: Error is not recoverable: exiting now
Download latest stable firmware 4.36.8.32
mkdir: cannot create directory ‘./tmp_root/4.36.8.32_ext’: No such file or directory
./setup.sh: line 34: wget: command not found
tar: ./tmp_root/4.36.8.32.tar: Cannot open: No such file or directory
tar: Error is not recoverable: exiting now
Extract rootfs, prepare for modification
./setup.sh: line 38: unsquashfs: command not found
mkdir: cannot create directory ‘./tmp_root/4.36.3.19_ext/Upgrade/rootfs_dir/.ssh’: No such file or directory
Change unknown stock password to WYom2020 in /etc/shadow
./setup.sh: line 46: ./tmp_root/4.36.3.19_ext/Upgrade/rootfs_dir/etc/shadow: No such file or directory
chmod: cannot access './tmp_root/4.36.3.19_ext/Upgrade/rootfs_dir/etc/shadow': No such file or directory
Add run_mmc.sh to rootfs rcS init.d script
sed: can't read ./tmp_root/4.36.3.19_ext/Upgrade/rootfs_dir/etc/init.d/rcS: No such file or directory
repack rootfs for flashing
./setup.sh: line 53: mksquashfs: command not found
copy latest appfs and kernel to SD_ROOT
cp: cannot stat './tmp_root/4.36.8.32_ext/Upgrade/app': No such file or directory
cp: cannot stat './tmp_root/4.36.8.32_ext/Upgrade/kernel': No such file or directory
extract run_mmc.sh script to SD_ROOT

`

Feature Request: Fall back to wifi if ethernet fails

First of all, this repo (and its ongoing evolution) is amazing and appreciated. This request would be icing on the cake, not at all a complaint!

I'm troubleshooting my ethernet connection (pretty sure it's my micro USB extension that's the problem since it works without). Unfortunately if ethernet fails to connect for any reason, I can't SSH in to debug since there's no network connection, requiring me to get to the mounted camera and get the card out, change the variable in run_mmc.sh, and connect via wifi.

Would it be possible to attempt the ethernet connection, then after a number of seconds (configurable in run_mmc.sh, perhaps?) reset the wlan0 to its original setup?

Thanks again!

Problems getting started. Nothing is executing.

Camera:
Wyze Pan V2
Firmware: 4.49.1.20 and tried the original firmware the device had out of the box.

I've copied the SD_ROOT to the SD card (exFAT Format)

SD Card Specs: ScanDisk Ultra Micro SDxc I, Class 10 1u (~128gb)

Fresh Install Filesystem looked like:
/wz_mini/
/factory_t31_ZMC6tiIDQN

Letting the camera boot, I'm able to access from the wyze app, see it's recognized the micro card, recording is turned off.
Nothing happens that is supposed too. Port scan (nmap, and nettools on android) shows no port 22, and attempting to connect is futile.

I've even modified the /wz_mini/run_mmc.sh script to try and see if it was executing at all. I put a curl https://myserver.com/hello-from-wyze; above the syslog message command echo "run_mmc.sh start" > /dev/kmsg. The curl call never made it. (Assuming busybox has curl enabled)

After boot and examining the drive again the usual suspects show up file wise.
/log/...txt
/time_lapse/
/wz_mini/
/factory_t31_ZMC6tiIDQN
/time.ini

I'm not sure how to get a serial command line going, I connected the camera over USB to my machine, and neither Putty or screen could make a serial connection.

This is cool development for these cameras. and am really excited for the work that has been done by everyone to get here.

I'm unsure how to proceed / debug what is wrong.
Any insights / hints in to how to get started would be greatly appreciated. Wrong partition type?

ASIX AX88179 USB 3.0 Gigibit Ethernet

RTSP: 4.61.03
adapter: ASIX AX88179 USB 3.0 Gigibit Ethernet
it takes ~ 2-3 minutes before LED lights go ON on the adapter, but when they do I`m unable to connect on WYZE app, on Frigate not I see the device on DHCP, or SSH

dmesg:

[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 3.10.14__isvp_swan_1.0__ (root@5997f1cc9594) (gcc version 4.7.4 (Buildroot 2016.02) ) #28 PREEMPT Wed Apr 13 06:47:11 UTC 2022
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 RESET ERROR PC:005214B5
[ 0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)
[ 0.000000] FPU revision is: 00b70000
[ 0.000000] cgu_get_rate, parent = 1392000000, rate = 0, m = 0, n = 0, reg val = 0x081000ff
[ 0.000000] cgu_get_rate, parent = 1392000000, rate = 0, m = 0, n = 0, reg val = 0x081000ff
[ 0.000000] CCLK:1392MHz L2CLK:696Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 005c5000 @ 00010000 (usable)
[ 0.000000] memory: 0007b000 @ 005d5000 (usable after init)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 05000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x04ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x04ffffff]
[ 0.000000] On node 0 totalpages: 20480
[ 0.000000] free_area_init_node: node 0, pgdat 805d1a00, node_mem_map 81000000
[ 0.000000] Normal zone: 160 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 20480 pages, LIFO batch:3
[ 0.000000] Primary instruction cache 32kB, 8-way, VIPT, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 8-way, VIPT, no aliases, linesize 32 bytes
[ 0.000000] pls check processor_id[0x00d00100],sc_jz not support!
[ 0.000000] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping off. Total pages: 20320
[ 0.000000] Kernel command line: console=ttyS1,115200n8 mem=80M@0x0 rmem=48M@0x5000000 rdinit=/init mtdparts=jz_sfc:256K(boot),1984K(kernel),3904K(rootfs),3904K(app),1984K(kback),3904K(aback),384K(cfg),64K(para)
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 72860k/81920k available (4584k kernel code, 9060k reserved, 1321k data, 492k init, 0k highmem)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] Preemptible hierarchical RCU implementation.
[ 0.000000] NR_IRQS:358
[ 0.000000] clockevents_config_and_register success.
[ 0.000014] Calibrating delay loop... 1391.00 BogoMIPS (lpj=6955008)
[ 0.087830] pid_max: default: 32768 minimum: 301
[ 0.092689] Mount-cache hash table entries: 512
[ 0.097608] Initializing cgroup subsys debug
[ 0.101864] Initializing cgroup subsys freezer
[ 0.107315] devtmpfs: initialized
[ 0.111478] regulator-dummy: no parameters
[ 0.115724] NET: Registered protocol family 16
[ 0.131160] bio: create slab at 0
[ 0.136652] jz-dma jz-dma: JZ SoC DMA initialized
[ 0.141572] usbcore: registered new interface driver usbfs
[ 0.147158] usbcore: registered new interface driver hub
[ 0.152555] usbcore: registered new device driver usb
[ 0.157723] (null): set:249 hold:250 dev=100000000 h=500 l=500
[ 0.163806] media: Linux media interface: v0.10
[ 0.168374] Linux video capture interface: v2.00
[ 0.173182] Advanced Linux Sound Architecture Driver Initialized.
[ 0.180510] Switching to clocksource jz_clocksource
[ 0.185438] cfg80211: Calling CRDA to update world regulatory domain
[ 0.192489] dwc2 otg probe start
[ 0.192514] jz-dwc2 jz-dwc2: cgu clk gate get error
[ 0.197434] DWC IN OTG MODE
[ 0.200830] dwc2 dwc2: Keep PHY ON
[ 0.204208] dwc2 dwc2: Using Buffer DMA mode
[ 0.208522] dwc2 dwc2: Core Release: 3.00a
[ 0.212714] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[ 0.219040] dwc2 dwc2: new USB bus registered, assigned bus number 1
[ 0.226194] hub 1-0:1.0: USB hub found
[ 0.229927] hub 1-0:1.0: 1 port detected
[ 0.234028] dwc2 dwc2: DWC2 Host Initialized
[ 0.238312] dwc2 otg probe success
[ 0.238442] NET: Registered protocol family 2
[ 0.243224] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 0.250232] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.256731] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.263159] TCP: reno registered
[ 0.266372] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.272315] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.278839] NET: Registered protocol family 1
[ 0.283446] RPC: Registered named UNIX socket transport module.
[ 0.289374] RPC: Registered udp transport module.
[ 0.294191] RPC: Registered tcp transport module.
[ 0.298910] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.312711] dwc2 dwc2: ID PIN CHANGED!
[ 0.503662] freq_udelay_jiffys[0].max_num = 10
[ 0.508088] cpufreq udelay loops_per_jiffy
[ 0.512576] 12000 59956 59956
[ 0.515770] 24000 119913 119913
[ 0.519213] 60000 299784 299784
[ 0.522677] 120000 599569 599569
[ 0.526188] 200000 999282 999282
[ 0.529720] 300000 1498924 1498924
[ 0.533508] 600000 2997848 2997848
[ 0.537137] 792000 3957159 3957159
[ 0.540845] 1008000 5036385 5036385
[ 0.544679] 1200000 5995696 5995696
[ 0.552614] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.559116] jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
[ 0.564946] msgmni has been set to 142
[ 0.569606] io scheduler noop registered
[ 0.573613] io scheduler cfq registered (default)
[ 0.580079] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[ 0.587736] console [ttyS1] enabled, bootconsole disabled
[ 0.602052] brd: module loaded
[ 0.606879] loop: module loaded
[ 0.610611] zram: Created 2 device(s) ...
[ 0.614943] logger: created 256K log 'log_main'
[ 0.620030] jz TCU driver register completed
[ 0.624791] the id code = 1c7018, the flash name is EN25QH128A
[ 0.630817] JZ SFC Controller for SFC channel 0 driver register
[ 0.636984] 8 cmdlinepart partitions found on MTD device jz_sfc
[ 0.643124] Creating 8 MTD partitions on "jz_sfc":
[ 0.648071] 0x000000000000-0x000000040000 : "boot"
[ 0.653532] 0x000000040000-0x000000230000 : "kernel"
[ 0.659121] 0x000000230000-0x000000600000 : "rootfs"
[ 0.664722] 0x000000600000-0x0000009d0000 : "app"
[ 0.669995] 0x0000009d0000-0x000000bc0000 : "kback"
[ 0.675535] 0x000000bc0000-0x000000f90000 : "aback"
[ 0.681022] 0x000000f90000-0x000000ff0000 : "cfg"
[ 0.686384] 0x000000ff0000-0x000001000000 : "para"
[ 0.691753] SPI NOR MTD LOAD OK
[ 0.695077] tun: Universal TUN/TAP device driver, 1.6
[ 0.700292] tun: (C) 1999-2004 Max Krasnyansky [email protected]
[ 0.706831] usbcore: registered new interface driver zd1201
[ 0.712669] usbcore: registered new interface driver r8152
[ 0.718370] usbcore: registered new interface driver asix
[ 0.724010] usbcore: registered new interface driver ax88179_178a
[ 0.730411] usbcore: registered new interface driver usbserial
[ 0.736515] usbcore: registered new interface driver pl2303
[ 0.742305] usbserial: USB Serial support registered for pl2303
[ 0.748714] wait stable.[289][cgu_msc0]
[ 0.752718] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[ 0.758691] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[ 0.764030] jzmmc_v1.2 jzmmc_v1.2.0: card inserted, state=0
[ 0.769863] jzmmc_v1.2 jzmmc_v1.2.1: vmmc regulator missing
[ 0.775649] usb 1-1: new high-speed USB device number 2 using dwc2
[ 0.782249] jzmmc_v1.2 jzmmc_v1.2.1: register success!
[ 0.789661] wireguard: WireGuard 1.0.20200712 loaded. See www.wireguard.com for information.
[ 0.798428] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld [email protected]. All Rights Reserved.
[ 0.808529] TCP: cubic registered
[ 0.812312] NET: Registered protocol family 10
[ 0.817516] sit: IPv6 over IPv4 tunneling driver
[ 0.822768] NET: Registered protocol family 17
[ 0.828032] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[ 0.835202] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[ 0.841723] ALSA device list:
[ 0.844841] #0: Loopback 1
[ 0.849715] Freeing unused kernel memory: 492K (805d5000 - 80650000)
[ 1.021881] mmc0: new high speed SDHC card at address 0001
[ 1.027799] mmcblk0: mmc0:0001 SD 29.1 GiB
[ 1.033201] mmcblk0: p1
[ 2.304673] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0002: -143
[ 2.322675] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0002: -143
[ 2.541968] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0001: -143
[ 2.608783] @@@@ tx-isp-probe ok(version H20200506a), compiler date=May 6 2020 @@@@@
[ 2.648489] exFAT: Version 1.2.9
[ 2.651937] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to read reg index 0x0006: -143
[ 2.661103] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0005: -143
[ 2.674365] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0001: -143
[ 2.683750] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0001: -143
[ 2.693279] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0001: -143
[ 2.703101] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0001: -143
[ 2.712899] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0002: -143
[ 2.722693] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0001: -143
[ 2.732531] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0002: -143
[ 2.742331] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to read reg index 0x0001: -143
[ 2.752058] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0001: -143
[ 2.761922] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to read reg index 0x0000: -143
[ 2.780394] ax88179_178a 1-1:2.0 eth0: register 'ax88179_178a' at usb-dwc2-1, ASIX AX88179 USB 3.0 Gigibit Ethernet, 92:61:30:2e:c6:c0
[ 2.808032] jz_codec_register: probe() successful!
[ 2.813280] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0002: -143
[ 2.824111] cgu_set_rate, parent = 1392000000, rate = 2048000, n = 10875, reg val = 0x01002a7b
[ 2.824124] cgu_enable,cgu_i2s_spk reg val = 0x21002a7b
[ 2.824144] cgu_set_rate, parent = 1392000000, rate = 2048000, n = 10875, reg val = 0x01002a7b
[ 2.824151] cgu_enable,cgu_i2s_mic reg val = 0x21002a7b
[ 2.824195] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0002: -143
[ 3.232182] dma dma0chan24: Channel 24 have been requested.(phy id 7,type 0x06 desc a2439000)
[ 3.241304] dma dma0chan25: Channel 25 have been requested.(phy id 6,type 0x06 desc a25b2000)
[ 3.250514] dma dma0chan26: Channel 26 have been requested.(phy id 5,type 0x04 desc a247b000)
[ 3.324644] __init
[ 3.330526] jz_pwm_probe[255] d_name = tcu_chn0
[ 3.336882] The version of PWM driver is H20180309a
[ 3.347577] request pwm channel 0 successfully
[ 3.353971] pwm-jz pwm-jz: jz_pwm_probe register ok !
[ 3.367795] mmc1: card claims to support voltages below the defined range. These will be ignored.
[ 3.386998] usbcore: registered new interface driver usb_ch34x
[ 3.394702] ch34x: USB to serial driver for USB to serial chip ch340, ch341, etc.
[ 3.402576] ch34x: V1.16 On 2020.12.23
[ 3.412864] mmc1: new SDIO card at address 0001
[ 3.672080] RTL871X: module init start
[ 3.675963] RTL871X: rtl8189ftv v4.3.24.7_21113.20170208.nova.1.02
[ 3.683696] RTL871X: build time: Dec 18 2020 16:40:08
[ 3.688924] wlan power on by hualai
[ 3.712027] RTL871X: ++++++++rtw_drv_init: vendor=0x024c device=0xf179 class=0x07
[ 3.748113] RTL871X: HW EFUSE
[ 3.751201] RTL871X: hal_com_config_channel_plan chplan:0x20
[ 3.843054] RTL871X: rtw_regsty_chk_target_tx_power_valid return _FALSE for band:0, path:0, rs:0, t:-1
[ 3.853693] RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=78:f2:35:6c:b6:9c
[ 3.871035] RTL871X: module init ret=0
[ 6.118395] name : i2c0 nr : 0
[ 6.202037] i2c i2c-0: i2c_jz_irq 441, I2C transfer error, ABORT interrupt
[ 6.209159] i2c i2c-0: --I2C txabrt:
[ 6.212870] i2c i2c-0: --I2C TXABRT[0]=I2C_TXABRT_ABRT_7B_ADDR_NOACK
[ 6.219589] error: sensor_read,285 ret = -5
[ 6.223946] sensor_read: addr=0x3107 value = 0x0
[ 6.228835] err sensor read addr = 0x3107, value = 0x0
[ 6.322375] sensor_read: addr=0xf0 value = 0x20
[ 6.327635] sensor_read: addr=0xf1 value = 0x53
[ 6.332460] info: success sensor find : gc2053
[ 6.337071] misc sinfo_release
[ 6.428829] set sensor gpio as PA-low-10bit
[ 6.434613] probe ok ------->gc2053
[ 6.512371] -----gc2053_detect: 832 ret = 0, v = 0x20
[ 6.512861] -----gc2053_detect: 838 ret = 0, v = 0x53
[ 6.512870] gc2053 chip found @ 0x37 (i2c0)
[ 6.730396] gc2053 stream on
[ 6.819466] Err [VIC_INT] : hor err ch3 !!!!!
[ 6.955357] cgu_set_rate, parent = 1392000000, rate = 4096000, n = 10875, reg val = 0x22002a7b
[ 6.955369] codec_codec_ctl: set sample rate...
[ 6.955964] codec_codec_ctl: set device...
[ 7.371900] codec_set_device: set device: MIC...
[ 7.378100] codec_codec_ctl: set repaly channel...
[ 7.378146] cgu_set_rate, parent = 1392000000, rate = 4096000, n = 10875, reg val = 0x22002a7b
[ 7.378154] codec_codec_ctl: set sample rate...
[ 7.378457] codec_codec_ctl: set device...
[ 7.611892] codec_set_device: set device: speaker...
[ 7.619208] SPEAKER CTL MODE3 !
[ 8.042019] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0001: -145
[ 8.963445] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 10.443161] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 12.916157] RTL871X: rtw_set_802_11_connect(wlan0) fw_state=0x00000008
[ 12.943070] RTL871X: start auth
[ 13.161946] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to read reg index 0x0006: -145
[ 16.175482] RTL871X: rtw_set_802_11_connect(wlan0) fw_state=0x00000008
[ 16.424685] RTL871X: start auth
[ 16.441725] RTL871X: auth success, start assoc
[ 18.172014] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0005: -145
[ 19.999313] RTL871X: rtw_set_802_11_connect(wlan0) fw_state=0x00000008
[ 20.216717] RTL871X: start auth
[ 20.517578] RTL871X: auth success, start assoc
[ 20.534454] RTL871X: assoc success
[ 20.538445] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 20.545240] RTL871X: recv eapol packet
[ 21.050244] RTL871X: send eapol packet
[ 21.066586] RTL871X: recv eapol packet
[ 21.165883] RTL871X: recv eapol packet
[ 21.365628] RTL871X: send eapol packet
[ 21.370849] RTL871X: set pairwise key camid:4, addr:14:cc:20:da:4b:89, kid:0, type:AES
[ 21.389656] RTL871X: send eapol packet
[ 21.398193] RTL871X: set group key camid:5, addr:14:cc:20:da:4b:89, kid:1, type:AES
[ 23.201986] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0001: -145
[ 28.212632] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0001: -145
[ 32.361749] run_mmc.sh start
[ 33.241968] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0001: -145
[ 38.252309] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0001: -145
[ 43.261990] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0002: -145
[ 48.281998] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0001: -145
[ 53.292026] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0002: -145
[ 58.301975] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to read reg index 0x0001: -145
[ 63.311944] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0001: -145
[ 68.331967] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to read reg index 0x0000: -145
[ 68.346470] ax88179_178a 1-1:2.1 eth1: register 'ax88179_178a' at usb-dwc2-1, ASIX AX88179 USB 3.0 Gigibit Ethernet, 92:61:30:2e:c6:c0
[ 68.362227] usb 1-1: USB disconnect, device number 2
[ 68.377613] ax88179_178a 1-1:2.0 eth0: unregister 'ax88179_178a' usb-dwc2-1, ASIX AX88179 USB 3.0 Gigibit Ethernet
[ 68.412003] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0002: -19
[ 68.432259] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0001: -19
[ 68.445930] ax88179_178a 1-1:2.0 (unregistered net_device): Failed to write reg index 0x0002: -19
[ 68.457336] ax88179_178a 1-1:2.1 eth1: unregister 'ax88179_178a' usb-dwc2-1, ASIX AX88179 USB 3.0 Gigibit Ethernet
[ 68.502058] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0002: -19
[ 68.511703] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0001: -19
[ 68.532280] ax88179_178a 1-1:2.1 (unregistered net_device): Failed to write reg index 0x0002: -19
[ 68.891957] usb 1-1: new high-speed USB device number 3 using dwc2
[ 69.893582] ax88179_178a 1-1:1.0 (unregistered net_device): Failed to read reg index 0x0040: -32
[ 70.026910] ax88179_178a 1-1:1.0 eth0: register 'ax88179_178a' at usb-dwc2-1, ASIX AX88179 USB 3.0 Gigibit Ethernet, f8:e4:3b:2d:c1:17

v2 support?

Saw this posted on reddit where someone said the v2 was also supported, but I don't see any mention of the v2.

Would I just follow the instructions for the v3?

RTSP - low bitrate

researching

Doorbell (non pro) compatibility

status:

• 2k image sensor, yet resolution is not 2K, currently scaled to 1728x1296
  -- find function that enables the scaler, and disable it. add it to libcallback
• can't turn off the front yellow/purple LEDs
• no sd card slot (there are pins for one I believe)
• otg does not work via hardware, as in the panv2 (microusb connector soldered directly on pcb)
• 2 uart, one for debug pins on pcb, the other one should be for the wireless chime dongle
• zram enabled

[    0.000000] Kernel command line: console=ttyS1,115200n8 mem=82M@0x0 rmem=46M@0x5200000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),2048k(kernel),3392k(root),640k(driver),4736k(appfs),4736k(backupa),256k(config),256k(para),-(flag)
[    3.760049] zram0: detected capacity change from 0 to 16777216
[    3.771916] Adding 16380k swap on /dev/zram0.  Priority:-1 extents:1 across:16380k SS
[    0.373904] jz-uart.0: ttyS0 at MMIO 0x10030000 (irq = 59) is a uart0
[    0.380558] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[    0.388120] console [ttyS1] enabled, bootconsole disabled


############## framesource 0 ###############
chan status: running
output pixformat: NV12
output resolution: 1728 * 1296
scaler : enable
scaler width: 1728
scaler height: 1296
crop : disable
the state of buffers:
queue count: 3
queue addr: 0x06301100
queue addr: 0x06635300
queue addr: 0x06969500
done count: 0
the output buffers is: 0
the losted buffers is: 0
ch0_pre_dequeue_drop is: 0
ch0_pre_dequeue_intc_ahead_cnt is: 0
pdq cnt: 0, pdq intc cnt:0, pdq intc cnt1:0
---------------------------
buf:0, state:3, buf_state:30, buf_qcnt:342, buf_dqcnt:341
buf:1, state:3, buf_state:30, buf_qcnt:342, buf_dqcnt:341
buf:2, state:3, buf_state:30, buf_qcnt:342, buf_dqcnt:341

****************** ISP INFO **********************
Software Version : H20210615a
SENSOR NAME : sc4236
SENSOR OUTPUT WIDTH : 2048
SENSOR OUTPUT HEIGHT : 1536
ISP OUTPUT FPS : 20 / 1
SENSOR OUTPUT RAW PATTERN : BGGR
ISP Top Value : 0xb570224d
ISP Runing Mode : Night
ISP Custom Mode : Disable
ISP WDR Mode : Disable
SENSOR Integration Time : 1596 lines
SENSOR Max Integration Time : 1596 lines
SENSOR analog gain : 48
MAX SENSOR analog gain : 125
SENSOR digital gain : 0
MAX SENSOR digital gain : 0
ISP digital gain : 0
MAX ISP digital gain : 64
ISP Tgain DB : 1
ISP EV value: 4646
ISP EV value log2: 798358
ISP EV value us: 49875
ISP EV min int: 3
ISP EV min again: 1024
ISP WB weighted rgain: 245
ISP WB weighted bgain: 356
ISP WB color temperature: 3010
ISP AWB Start rgain 175: bgain 239
Saturation : 128
Saturation : 128
Sharpness : 128
Contrast : 128
Brightness : 128
Antiflicker : 0
Mirror: Disable, Flip: Disable
debug : ch0 done 1403,ip done 1404,0,0,0,0,0,0
debug1 : 0,0,900

ssh root@<deviceIP> -> Connection closed by <deviceIP> port 22

First of all, HUGE thanks for your efforts here. Excited about the potential!

Device Model: Wyze Cam v3
MAC: 7C7...
Firmware Version: 4.61.0.3 (Factory RTSP firmware)
Plugin Version: 2.29.7

> ssh root@<deviceIP>
Connection closed by <deviceIP> port 22

Did a git clone today (4/13 at 3pm CST) and copied contents of SD ROOT to the root of SD card.

I didn't wipe the card first - had WyzeHacks on the same firmware prior to a factory reset. Attempted this hack after the factory reset.

The camera booted right up - didn't seem to take more time to install anything. RTSP at the is functioning. All signs seem to point to the auto-installation not happening.

Stuck at debug1: expecting SSH2_MSG_KEX_ECDH_REPLY

Hi, finally I made a fresh install, in a new SD formatted as FAT. After the boot, I've wait at least 5 minutes to give time to the ssh server to load, and when I try to ssh it gives me this error.

juan@calisto:~$ ssh 192.168.1.30 -vvv
OpenSSH_8.2p1 Ubuntu-4ubuntu0.4, OpenSSL 1.1.1f  31 Mar 2020
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolve_canonicalize: hostname 192.168.1.30 is address
debug2: ssh_connect_direct
debug1: Connecting to 192.168.1.30 [192.168.1.30] port 22.
debug1: Connection established.
debug1: identity file /home/juan/.ssh/id_rsa type 0
debug1: identity file /home/juan/.ssh/id_rsa-cert type -1
debug1: identity file /home/juan/.ssh/id_dsa type -1
debug1: identity file /home/juan/.ssh/id_dsa-cert type -1
debug1: identity file /home/juan/.ssh/id_ecdsa type -1
debug1: identity file /home/juan/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/juan/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/juan/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/juan/.ssh/id_ed25519 type -1
debug1: identity file /home/juan/.ssh/id_ed25519-cert type -1
debug1: identity file /home/juan/.ssh/id_ed25519_sk type -1
debug1: identity file /home/juan/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/juan/.ssh/id_xmss type -1
debug1: identity file /home/juan/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.4
debug1: Remote protocol version 2.0, remote software version dropbear_2022.82
debug1: no match: dropbear_2022.82
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.1.30:22 as 'juan'
debug3: hostkeys_foreach: reading file "/home/juan/.ssh/known_hosts"
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,[email protected]
debug2: host key algorithms: ssh-ed25519,ecdsa-sha2-nistp256,rsa-sha2-256,ssh-rsa,ssh-dss
debug2: ciphers ctos: [email protected],aes128-ctr,aes256-ctr
debug2: ciphers stoc: [email protected],aes128-ctr,aes256-ctr
debug2: MACs ctos: hmac-sha1,hmac-sha2-256
debug2: MACs stoc: hmac-sha1,hmac-sha2-256
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
Connection closed by 192.168.1.30 port 22

I've tried changing some HostKeyAlgorithms but no luck, do you have any idea?
Thanks!

View Playback does not work with this installed

First, this hack is amazing, I am rtsp-ing to VLC as I type this! But, the normal wyze app will not record to the SD card now. Is this a known thing? Or is it a normal wyze bug and I need a different SD card or something? Can anyone confirm that they have the continuous record to SD card while using this hack? THANKS!

Working on 4.36.8.32?

Shut down my V3, pulled the SD card, put into my computer and copied the files to the root of the SD card, put back in camera and turned it on. Unable to connect to SSH, connection refused. Pulled card and the wz_mini_hacks.log file is empty. Put the card back in and tried again, same issue. Does anyone have this working on 4.36.8.32 (latest version)?

Edit: I waited 5 minutes the first time to try SSH, waited 15 minutes the second time. I would assume that should be more than enough waiting time, correct?

Trouble installing, pls help I'm confused (Solved: see last post)

Wyze Cam V4, firmware: 4.36.8.3

• 1st Attempts realized my SD-Card was likely TOO Big (It was 128GB & formatted via extFAT)
• Located another SD-Card (16GB), used Gparted to delete previous Raspberry Pi NOOBS partitions & then reformatted in FAT32
  I did this after reading the success of the previous closed Issues pertaining to Wyze firmware: 4.36.8.3
  We are not supposed to format the SDcard in ext3 or something are we???

Also noticed that secure ssh was just added overnight (while I slept).
So I'm not sure if the old method of...
logging in via SSH on port 22 as "root" & password "WYom2020" still works?
Or is it now ONLY possible to ssh in after adding the secure SSH?

FOUND:
SSH is enabled, but is secured using public key authentication for security. Edit the file wz_mini/etc/ssh/authorized_keys and enter your public key here. If you need a simple guide, how to use public key authentication

I was expecting to be able to at least see a closed port 22 (But perhaps that's not how secure SSH works & it fails silently).
Any advise would be appreciated
Thanks

tailscale support

a few users have mentioned tailscale (client?) support. Since Wireguard is built in, and they have mipsel binaries available:
https://pkgs.tailscale.com/stable/#static

would any tailscale users be willing to test?

Possible to setup this camera on wifi without a Wyze app account?

I'm wondering if this is possible to setup without a Wyze account.
I tried creating a wpa_supplicant.conf and placing it inside the /wz_mini/etc/ directory but no joy.

Internet access required ?

I installed the SD CARD made all the rtsp edits and booted up ... seems this still requires access to wyze for authorization before anything else works?

Is this possible to run local only on home subnet w/o any Internet access to the CAM?

List of working LAN adapters

if you have working adapter with this hack please share direct link on Amazon, eBay etc.. thx

Camera will not boot with wz_mini_hacks

First of all, thanks for the great project! I have a new Wyze Cam v3 (MAC D0:3F:27:xx:xx:xx), but it will not boot with wz_mini_hacks (commit 26af3aa). It shows the red light for 5 seconds then blinks, shows the red light etc.

I used a16 GB microsd card, formatted fat32,

• added the content of SD_ROOT so the root of the card contains

    wz_mini (folder)
    factory_t31_ZMC6tiIDQN

• set RTSP_ENABLED="true" in run_mmc.sh
• turned off the camera, inserted the microSD card, turned on camera

but it just does the red light , blink 5 second cycle. After 10 minutes, I turned it off.

Am I missing something? Thanks!

easiest way to upgrade

Since I have SSH working, what's the easiest way to upgrade the camera to the latest version? Thanks

EDIT - easiest as in "over the air" instead of pulling the card. So by uploading files to replace existing ones.

Camera will not boot when files are present

WyzeCam v3 running firmware 4.36.8.32 and a 32gb SD card formatted for FAT32.

Camera will boot normally without an SD card installed or with a newly formatted empty card. Upon adding the wz_mini folder and the factory_t31_ZMC6tiIDQN to the root directory the camera fails to connect to WiFi and a solid red light appears. I've re-flashed the latest firmware as well to "start fresh". The log file also is empty.

I've waited as long as 30 minutes and nothing else has happened.

Block Wyze streaming at camera level

Create ability to block Wyze cam contacting Amazon Kinesis server "c1ybkrkbr1j10x.credentials.iot.us-west-2.amazonaws.com" at camera level in order to reduce Internet/Lan traffic

c1ybkrkbr1j10x.credentials.iot.us-west-2.amazonaws.com

403 on Wyze 360024852172-Release-Notes-Firmware page?

In compile_image.sh I am getting an empty string for DL_URL,

wget https://support.wyze.com/hc/en-us/articles/360024852172-Release-Notes-Firmware

seems to return 403, though I can load it in a browser ok.

wget https://support.wyze.com/hc/en-us/articles/360024852172-Release-Notes-Firmware
--2022-05-25 21:16:26-- https://support.wyze.com/hc/en-us/articles/360024852172-Release-Notes-Firmware
Resolving support.wyze.com (support.wyze.com)... 104.16.51.111, 104.16.53.111
Connecting to support.wyze.com (support.wyze.com)|104.16.51.111|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2022-05-25 21:16:26 ERROR 403: Forbidden.

wget --user-agent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" -qO https://support.wyze.com/hc/en-us/articles/360024852172-Release-Notes-Firmware

( Silently fails )

Is this just me?

V2 compatibility

uboot sources support loading kernel factory file, but is disabled on production models.

also, compiling uboot from source doesn't boot on camera, need to reflash via spi programmer.

hmm... has anyone compiled uboot successfully for the v2?

PI-hole blocks and wyze calling home

not an issue just an observation. This week I have finally installed Pi-Hole on my homelab and noticed that Wyze cams are generating enormous amount of traffic

c1ybkrkbr1j10x.credentials.iot.us-west-2.amazonaws.com

this represents 50% of all my queries outside my netwrk after just 4 days and all came from Wyzecams

I have just blocked this server this morning will see what oi does. Frigate ,RTMP WZ_mini and stream in Wyze app still works.

Edit1: google revealed that this server belongs to Amazon Kinesis service which provides streaming analysis service for Wyze is my quess, probably the online AI recognition etc.. . This should have been blocked a long time ago! ( for those who are not interested in Wyze ecosystem )

Edit2: I have everything turned off in Wyze app yet the Amazon upstream is still ON.

wz_mini seems to not run on WyzeCam v3

I've just set up a new WyzeCam v3 through the Wyze app (linked it, updated firmware), and am now trying to run this on it - I'm very excited! However, the camera doesn't seem to be running the files after following the instructions. I have:

1. Confirmed with GParted that the 32GB microSD is fat-32 formatted (plus the camera makes some folders on the sd, so it seems to be capable of read/write)
2. Copied the files within SD_ROOT to the root of the sd card
3. Written my public key to the authorized users file
4. Set a password for the rtsp server "tmp_test"
5. Turned off the camera, plugged in the sd card, turned on the camera (Is this really all it takes to set up/install?)
6. Verified the IP via router (only one WyzeCam device, which disconnects when I turn off the camera)
7. Waited 10 minutes
8. Tried SSHing [email protected], got ssh: connect to host 192.168.86.47 port 22: Connection refused
9. Tried connecting to the rtsp server with VLC at rtsp://admin:[email protected]:8554/unicast and failed with the log message:

live555 error: Failed to connect with rtsp://192.168.86.47:8554/unicast    
main error: connection failed: Connection refused    
print(len(view_names[0]))    
satip error: Failed to connect to RTSP server 192.168.86.47:8554

Maybe a FPS Problem???

Perhaps I'm misunderstanding or doing something wrong... but after launching:
ffplay -x 640 -y 360 -top 641 -left 646 -window_title Front-Yard -rtsp_transport tcp rtsp://myname:[email protected]:8554/video1_unicast

I'm still seeing...
Metadata:
title : LIVE555 Streaming Media v2022.04.26
comment : LIVE555 Streaming Media v2022.04.26
Duration: N/A, start: 0.000000, bitrate: N/A
Stream #0:0: Video: h264 (Main), yuv420p(tv, bt709, progressive), 1920x1080, 20 fps, 20 tbr, 90k tbn, 40 tbc
Stream #0:1: Audio: pcm_s16be, 16000 Hz, 1 channels, s16, 256 kb/s

I was expecting a FPS=15 With the following settings in my [wz_mini.conf]

RTSP_HI_RES_ENABLED="true"
RTSP_HI_RES_ENABLE_AUDIO="true"
RTSP_HI_RES_MAX_BITRATE="2048"
RTSP_HI_RES_TARGET_BITRATE="1024"
RTSP_HI_RES_ENC_PARAMETER="2"
RTSP_HI_RES_FPS="15"

90° Video Rotation

Using my Wyze cam as part of a Homekit video doorbell. Would be awesome if we could somehow rotate the video feed by 90°.

Status of WyzeCamLiveStream hack on V3.

I know some people were interested in getting my hack running again on V3.

The hack relies on changing LD_LIBRARY_PATH and intercepting
calls to IMP_Encoder_GetStream which lives in /system/lib/libimp.so.
This sort of worked on V3 under WyzeHacks but it was tenuous. I remember
being convinced at one time that iCamera relied on C "undefined behavior".

I can't currently get it to work reliably on V3. If I create a libimp.so
that contains only this...

    #define LIB "/system/lib/libimp.so"

    static void *sym = 0;

    void  __attribute__((constructor)) foo(void) {
            printf("CRBMIN constructor");
            if(sym) return;
            sym = dlopen(LIB, RTLD_GLOBAL|RTLD_NOW);
            printf("CRBMIN sym = %p", sym);
    }

    void _init(void) {
            printf("CRBMIN _init");
            foo();
    }

.. the camera runs for awhile but eventually gets errors and reboots.
What could account for this? I have some ideas:

    1. My toolchain is not exactly compatible with the toolchain iCamera was compiled with.
    2. Bug in the dynamic loader that ships with the camera. ( Doubtful. )
    3. iCamera relying on undefined behavior.

I don't think it's failing because of anything Wyze the company is doing intentionally. I can look at
the stdout of iCamera with and without the hack above and see minor differences in error reporting. So
this hack that shouldn't change any behavior is causing iCamera to fail. A long time ago, on V3 under
WyazHacks I think I observed the dynamic loader stepping on the memory of static strings.

The loader that ships with the camera doesn't have the usual LD_DEBUG stuff compiled in. That would
have been nice.

That's the status, I don't know if anyone out there is interested enough and/or has the expertise
to take this to the next level. I am open to suggestions. I will continue to think about it.

Thanks,

Charlie ( FiveLeavesLeft )

ps: Thanks for the great work.

USB Ethernet - How to connect

Dumb question, how exactly are you connecting a USB Ethernet adaptor to the WyzeCam v3? Are you using like a hub to connect both power and the adapter to the single port in the back?

Not persistant after reboot

Fails to load after a soft reload either via the Wyze App or command line. Need to hard power cycle the camera to get it to operate again.

wyze cam v3 rtsp audio no video

When playing back via vlc or scrypted the rtsp feed I am only getting camera audio and no video. My rtsp settings are below

RTSP_HI_RES_ENABLED="true"
RTSP_HI_RES_ENABLE_AUDIO="true"
RTSP_HI_RES_FPS=""
RTSP_HI_RES_MAX_BITRATE="1920"
RTSP_HI_RES_TARGET_BITRATE="1080"
RTSP_HI_RES_ENC_PARAMETER="8"

v2 webcam mode

does flashing the v2 webcam firmware work for anyone? it doesn't work for me, even with no modifications at all...ucamera segfaults and reboots the camera.

Official RTSP firmware + wz_mini_hacks

I didn't bother reflashing my v3 cams to a non-RTSP firmware before attempting to use wz_mini_hacks. I found that in this case the camera will run both the Wyze RTSP server on port 554, as well as the wz_mini_hacks RTSP server on 8554. Both streams function, though performance may not be the best.

I don't know if anyone would intentionally do this, but I figured I'd share my experience. After realizing this, I went around and flashed the cameras back to a non-RTSP Wyze firmware. and confirmed the "official" RTSP server was no longer running on port 558.

How to add user for non-root NFS mounts

remote NFS v4 volume requires specific UID/GID (1007/1007), does not allow root. How can NFS mounts be configured / executed from your script with the correct UID/GID to allow access?

RTSP - modify libcallback to inject both streams, 1080p and 360p

hook the callback's to each stream,

Apr 15 00:04:43 iCamera: enc func injection save video_encode_cb=0x48b59c
Apr 15 00:04:43 iCamera: enc func injection save video_encode_cb=0x48b5fc

to have them available to the rtsp server

support for LAN - Realtek RTL8153

adding this info just in case it might be possible to add support for Realtek RTL8153

Bus 001 Device 006: ID 0bda:8153 Realtek Semiconductor Corp. RTL8153 Gigabit Eth ernet Adapter
Couldn't open device, some information will be missing
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0bda Realtek Semiconductor Corp.
idProduct 0x8153 RTL8153 Gigabit Ethernet Adapter
bcdDevice 30.00
iManufacturer 1 Realtek
iProduct 2 USB 10/100/1000 LAN
iSerial 6 000000
bNumConfigurations 2
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0027
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 350mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0002 1x 2 bytes
bInterval 8
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0050
bNumInterfaces 2
bConfigurationValue 2
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 350mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 2 Communications
bInterfaceSubClass 6 Ethernet Networking
bInterfaceProtocol 0
iInterface 5
CDC Header:
bcdCDC 1.10
CDC Union:
bMasterInterface 0
bSlaveInterface 1
CDC Ethernet:
iMacAddress 3 (??)
bmEthernetStatistics 0x00000000
wMaxSegmentSize 1514
wNumberMCFilters 0x0000
bNumberPowerFilters 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0010 1x 16 bytes
bInterval 8
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 0
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 1
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0

RTSP High + Low Resolution Streams Port and URL configuration

Reference: https://ipcamtalk.com/threads/adding-camera-that-the-substream-are-on-a-different-ports.59539/

I'm attempting to set up Blue Iris to use the low resolution stream for detection and only switching to the high resolution stream when necessary. According to the thread above, most IP cameras use the same port number for their low and high resolution streams, and use a different URL to separate the streams. Is this possible to implement on wz_mini_hacks?

The URLs could look something like this:
192.168.2.17:8554/unicast
192.168.2.17:8554/unicastlow

rtmp streaming to youtube/twitch/facebook

does the cam have enough cpu power to do this? test ffmpeg.

PanV2: Vertical Tilt not stable on custom kernel

Using our custom kernel, Vertical Tilt on the PANv2 is unstable...unless you have the motor speed in the app set to 9, it barely moves. Confirmed this is not a HW issue, using the stock kernel it works fine.

Horizontal movement works fine.

Is this an I2C problem? Need to investigate how the motor kernel module interfaces with the kernel. The I2C settings in our kernel config match the stock config supplied by wyze...

USB OTG Doesn't power HL_PANv2... solved.

Curiously, using a USB OTG adapter or micro usb hub, doesn't power the PanV2 at all.

Inspecting the unit inside, the connector has 5 wires coming from the base to the board. if the ID pin is shorted for OTG, could this be preventing the camera from booting?