Locked/broken bootloader solutions/suggestions

[chrismyers81]

First off...thank you all very much for this fantastic project. It's breathed new life and opportunities for several of our cameras that would have otherwise had no purpose following changes that Wyze has made.

In that vein of new life into old products, I'm wondering if anyone has figured out solutions to the bootloader issues that Wyze has introduced (accidentally or intentionally) with at least some of their older products. My situation specifically surrounds the Cam Pan v1, but I'm not sure if there are other impacted models. In this case it was with a brand new (old stock) camera.

With our camera, I started out with the steps laid out here - https://thingino.com/wyze-cp1

At first it seemed like things were going ok; the first two steps I'd end up with a blue light for a bit, but not as long as I expected. At the time I didn't think anything of it. When I got to step 3, nothing happened; I'd go through the process but nothing would be saved to the SD card afterwards. I thought that maybe this was expected, but moving on to step 4 wouldn't result in a thingio wireless network either. I tried repeating the process a few times in case I'd done a step incorrectly but the result was the same.

I did more searching and came across an alternate version of the same process, with a few different steps - https://github.com/themactep/thingino-firmware/wiki/Camera:-Wyze-v2-%E2%80%90-Neos-SmartCam-%E2%80%90-ATOM-Cam-1 (operating under the assumption that the CP1 and Wyze v2 were similar enough, since the instructions for several products seemed the same.)

I walked through that process, and had a similar outcome. Doing some random tests it appeared that it still had the regular Wyze firmware on it (eg. short-pressing the setup button would result in the usual Wyze setup voice.)

I decided to pop the back cover off to try the manual firmware update, but didn't find the chip mentioned in the instructions...it looked like I had a new hardware revision possibly? This started me doing more web searches, which led to an increasingly discouraging thread of discoveries. One, apparently there are two hardware revisions, which can be distinguished by the text of the QR code. I was unlucky enough to have the FOO variant. However, even if I'd had the older DOO variant, based on comments I've seen it appears that Wyze intentionally or unintentionally broke the bootloader along the way (around firmware revision 4.10.6.156) which prevented folks from doing further manual updates. https://forums.wyze.com/t/cant-flash-firmware-to-cam-pan/95238/34

Based on comments in that Wyze thread I spiraled through a number of other threads on their site and other github projects which make it seem as if this is a bit hopeless at this point -
EliasKotlyar/Xiaomi-Dafang-Hacks#1563
https://github.com/agent86ix/wyze-cam-pan-sd-flash-fix

ending with

HclX/WyzeUpdater#9

Apparently Wyze is working on blocking this hack from both server side and device side. So we need to accept the fact that whatever new loopholes we discover, they will be blocked again by Wyze. OTA installation is pretty much dead.

So I guess the summary of this is -- for devices that Wyze has intentionally or unintentionally broken the bootloader itself...are there any options or tricks to get Thingio working on it? I know that this wouldn't be likely for devices with secureboot, but I'm thinking more of older devices like the CP1 I'm trying to breathe new life into.

Thanks all!

[gtxaspec]

The wyze devices can typically always be restored via USB, using the cloner utility. Have you read the Ingenic Cloner wiki article if you are still having issues?