WYZEDB3 /OG

[ju5t3nc4s3]

Can u share any info on the internal flashing. I hace multipal programers and been working on the new OG model. I found all the datasheets on the chip thats being used. I know we can help each other out.

[gtxaspec]

Working on the doorbell ( non pron) and the new og?

[ju5t3nc4s3]

Is the doorbell a arm based chip same as the OG. Like to work out a way to flash the OG it has some HS usb pins on the board. Og is using the realtek chip RTL8735bm same as a dev board RTL-amb82 and i obtained the datasheet. And other docs. This would be handy for your hacks to ne able to use on the OG

[gtxaspec]

Yeah, that's the new platform, used on the doorbell pro and og cams. They don't run Linux, they run a custom rtos, so no wz_mini. You can dump the flash but you'll need the SDK to make heads or tails.

[ju5t3nc4s3]

Heres the sdk for rhe same chip used in the OG https://github.com/ambiot/ambpro2_arduino

[ju5t3nc4s3]

if you can dump the flash are u able to flash back or is it right protected? with the sdk it can just be programmed in ArduinoIDE. and theres already code i found to work with the chip. im looking for what programming hookup ur using

[ju5t3nc4s3]

So if i get the SDk for the chip we should be a go.. rigjt now i just want a way to run rtsp and block all internet access. The OG can be baught for 20$ and its way better video quality then others.

[gtxaspec]

ehh... i think it varies on setup. the gc2053 in the wyze v3 is pretty solid. the gc4653 in the v3 pro is great too.

maybe not the way wyze sets the video settings up, but you could always try openipc on the v3.

[ju5t3nc4s3]

just dumped the boot log from the OG . looks like i will have this wide open soon. And will be prograbable throw Arduino.

[ju5t3nc4s3]

located test mode image downloading
== Rtl8735b IoT Platform ==
Chip VID: 0, Ver: 0
ROM Version: v3.0

[Normal mode]
BootFromNORFlash
[SPIF Err]Invalid ID
[Start Boot ROM...]
=== Load PARTBL ===
=== Load Done ===
=== Load ISP_IQ ===
[fcs�
== Rtl8735b IoT Platform ==
Chip VID: 0, Ver: 0
ROM Version: v3.0
Test Mode: boot_cfg1=0x0

[test mode PG]
test_mode_img_download
Download Image over UART1[tx=4,rx=3] baud=115200

[bchase-woot]

Any updates on this? Just got an OG and love the pic quality but would love RTSP to integrate into NVR

[ju5t3nc4s3]

I was able to get a shell using uart connection. And theres a cmd to enable rtsp, but hevent been able to get working yet. And theres a cmd to update over UrL. I would need soneone with html exsperiance and somthing to maybe load to get root.

[dashxdr]

WTZECGS-RTL8735BM.bin.gz
@ju5t3nc4s3 how did you get the shell using the uart connection? What is the login password?
BTW I attached a gzip of the cFeon QX128A-104HIP firmware I managed to read out, in case it is of use

[ju5t3nc4s3]

the tx and rx are on the opisite side of the board next to the wifi antenna

[ju5t3nc4s3]

to get the shell theres a pad u need to connect to 3.3v and hold down on boot. and as soon as u see any output in terminal smash the enter button. didnt use a password. but dont have root shell

…

On Sat, Dec 2, 2023 at 8:22 PM Dave ***@***.***> wrote: @ju5t3nc4s3 <https://github.com/ju5t3nc4s3> how did you get the shell using the uart connection? What is the login password? — Reply to this email directly, view it on GitHub <#638 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AS5A6MEDTWL34FNHKIAEXQLYHPO5HAVCNFSM6AAAAAA6C4SYYKVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TONBRGU2TC> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[ju5t3nc4s3]

i have to order a new pic chip programmer, and ill dump the flash that way

[dashxdr]

@gtxaspec I posted a gzip of the 16 mbyte flashrom contents I managed to read out, is that what you wanted? It is in a post earlier in this discussion.

@ju5t3nc4s3 I have a datasheet from realtek named 1700953835000_RTL8735B_Datasheet_1_0_Lite.pdf but it is watermarked with my email address and doesn't go into any details. If you have better docs or just the filenames I can get from realtek either would be great, or links to where they can be downloaded.

I have asked for support from realtek and am waiting for a response: https://forum.amebaiot.com/t/rtl8735bm-programming-not-working-with-uartfwburn-linux-ping-failure/2483

I've determined while the module is in the "BootFromUART" mode it is sending a 0x15 byte every 1.6 seconds or so. It sends 60 of them over a period of 96 seconds before giving up.

[gtxaspec]

@dashxdr thanks, I had missed that post! I'll take a look.

[dashxdr]

I was able to read it out by using an old raspberry pi model b and wiring the gpio pins to the chip. Pin 7 must be pulled up to 3.3V otherwise the chip won't respond. I used SPI mode with /ENABLE, CLK, DI, DO implemented in software. I got the same checksum after two reads so I think it's a good copy.

[ju5t3nc4s3]

did u run throw binwalk?

[dashxdr]

@ju5t3nc4s3 Can you provide more details about the pad you need to ground then bring up to 3.3V in order to get into the AT command menu?

[ju5t3nc4s3]

theres a pic attached in that poast

[ju5t3nc4s3]

i beleve the pin is marked burn on the board.

[dashxdr]

Hmmm, I'm not able to reproduce your process. I have wired a button so I can route 3.3V to the "BURN" pad (which is normally floating, it seems) but it doesn't make any difference. I've tried with and without grounding pin 7 of the flashrom (grounding pin 7 disables the flashrom boot).

[ju5t3nc4s3]

[ju5t3nc4s3]

[dashxdr]

Yeah that's the same datasheet I got. You should probably delete the attachment since it's got a watermark with your email address on it, sharing it probably will annoy realtek (and probably isn't in keeping with the agreements we had to click through to create the account).

[ju5t3nc4s3]

o well. not the first one .. lol

[ju5t3nc4s3]

└─$ binwalk -e WTZECGS-RTL8735BM.bin

DECIMAL HEXADECIMAL DESCRIPTION

508879 0x7C3CF Unix path: /var/run/rtsisp.sock
536514 0x82FC2 Unix path: /usr/lib/rtsisp/algos/librts_algo_awb.so
536732 0x8309C Unix path: /usr/lib/rtsisp/algos/librts_algo_ae.so
4178895 0x3FC3CF Unix path: /var/run/rtsisp.sock
4206530 0x402FC2 Unix path: /usr/lib/rtsisp/algos/librts_algo_awb.so
4206748 0x40309C Unix path: /usr/lib/rtsisp/algos/librts_algo_ae.so

[dashxdr]

Those are the same ones I tracked down. I attached a datasheet that was useful in reading out the flashrom.

w25q128jv_revf_03272018_plus-1489608.pdf

[ju5t3nc4s3]

EN25Q16A.PDF
this was the rom chip datasheet on my device

[dashxdr]

I wonder what the clock rate is on the SPI

[ju5t3nc4s3]

@dashxdr join that telagram

[ju5t3nc4s3]

• High performance

• 104MHz clock rate for one data bit
• 80MHz clock rate for two data bits
• 80MHz clock rate for four data bits

[ju5t3nc4s3]

[ju5t3nc4s3]

this might be easyer to comunicate on telagram . should just make a fourm for the OG

[gtxaspec]

https://t.me/wzmods

[dashxdr]

I won't use anything that requires me to install anything. Web based discussions are better anyway, they're searchable and useful for the general public.

[ju5t3nc4s3]

U do know i can see ur location on here right?

[dashxdr]

What location are you speaking of?

[dashxdr]

The Ardruino IDE image just doesn't work, I'm pretty sure it gets programmed correctly but during boot I get this:

== Rtl8735b IoT Platform ==
Chip VID: 0, Ver: 0
ROM Version: v3.0

[Normal mode]
BootFromNORFlash
[Start Boot ROM...]
=== Load CERTI ===
[BOOT Err][vrf pbk fail]
[BOOT Err]StartUp@0x0: Invalid RAM Img Signature!Boot_err(0x11)

The IDE doesn't use the uartfwburn.linux program directly, it uses another tool that isn't user friendly. uartfwburn.linux has help options:

PG Tool 1.4.3 - Jun 16 2023
Help for Realtek firmware download command
image_tool/uartfwburn.linux -p [/dev/ttyXX or /dev/cu.XXX] -f [firmware filename] -l [log filename] -v -r
OR
image_tool/uartfwburn.linux -p [/dev/ttyXX or /dev/cu.XXX] -e chip
Necessary options - download mode
-p [port] : use UART communicatioin port /dev/ttyXX or /dev/cu.XXX
-f [firmware filename] : firmware filename for download
-b [baud rate] : baud rate during uart download firmware. for handshaking use 115200
Necessary options - erase mode
-e chip : do chip erase, only work with option "-i flash pin index"
-e [start] [end] : do sector erase from start to end-1, only work with option "-i flash pin index"
Optional options
-s [offset] : image download offset(hex, eg, 0x100000)
-m [start] [end] : masked area, program will skip this area, start and end are hex format
-i [flash pin idx] : flash pin index
-d [z2,p2m] : enter download mode by software method, current support chip, z2, p2m(pro2mini)
-T [timeout(ms)] : overwrite chip erase timeout
-v [pro2] : hash verify download result, support chip pro2
-r : reset device after download finish
-n [pro2] : pro2 nand flash image download
-t [type_id] : pro2 nand flash partial image download
-w [block_s] [block_bs] : pro2 nand FTL write, block_s is block start, block_bs is block backup start
-o [block_os] [block_e] : pro2 nand dump flash, block_os is block start, block_e is block end
-U : Uart boot - load flash loader
-G : pro2 nand generate mp flash image
-x : xmodem TX mode 1:1K 16:16K 32:32K
-h : show this help

I can definitely reprogram the bootrom. I'm not sure how to disable the certification step or whatever.

When I try adding "-v pro2" to the uartfwburn.linux command it always reports

hashq cmd fail, recv x

It seemed to take twice as long to execute the command... about 7.5 minutes total. I had been using a virtualbox setup since my desktop OS is out of date and can't run the arduino IDE toos properly... I get the GLIBC 2_34 error missing.

I want to see if I can get into that AT command mode now.

[ju5t3nc4s3]

@dashxdr what firmware version do u have on ur device. This could be the reason im getting shell and ur not.. ill let u know my version

[dashxdr]

During boot I get this:

sdio_sd_host_init_combine ret = 0
hw_ver:394497

Oct 17 2023 07:33:18
EMB-202204-new-233
1.0.7
sdio_sd_card_combine again ret = 5
try 0 times

The 16 megabyte firmware file is the one I attached earlier in this thread.

[ju5t3nc4s3]

I made a spi programmer from a pico rp2040. And for some reason no matter what i do i cant get 2 matching dumps.

[dashxdr]

I had a similiar problem, it helped to add a pullup resistor on the DO line from the flashrom. I assume you're keeping it in the 1 bit mode for simplicity.

I should clarify, I was using an old raspberry pi model B to drive the pins. You can activate a pullup resistor in software on the raspberry pi as part of their GPIO functionality, and that's what I used. A 10k ohm resistor up to 3.3V would do as well.
ETA: Actually I looked at my code and I don't think there's any pullup involved... I think I was mixing it up with another project. I attached my code as reference, it's in 'c'.
reader.c.gz

[dashxdr]

Also verify you can read out the device ID and the manufacturer ID just as a sanity check

[ju5t3nc4s3]

@dashxdr what tool u using to get uart out put in terminal. i just tryed picocom and couldent get shell eather.. after going back to screen it worked.. try (screen -L -Logfile wyze_OG-$(date +%s).log /dev/ttyUSB0 115200) wile holding burn pin and smashing enter on boot..

[ju5t3nc4s3]

certs and keys

Init Cert:AQEAAAAAIACWZSmgJPQwSkY2sm83UVcTomtIIW9HOF0Uh/aLuIL4nVYA1XOW1YA40GFniHGugzDeMdgg6+8zuVibKSnZCk69GhLG1BirL2WNLlkUuzXinEn7hfKymJt6yEboh3gg2490Lw2Uin8F869Lj9KHwFmj2uoGdevLB1d1DqlchrmXw50i8j6QwM0r
Active Cert:Α�!h�ra���lSʚ�!un�x�
p���ʙM^�����Q���/��7+GW_GC1_D03F27758F5B
did:gw_429728658762293
pid:wyze_429730805317735
wyze_id:GW_GC1_D03F27758F5B
wyze_key:c33b937538570714045a4e0c12d67f9f
confirm_key:ff4ad083bb914819aa5316045ad7e795

[carTloyal123]

Hi there, just curious if there has been any update on this? I have an OG and am looking to flash custom firmware or something similar if possible to get video streams out.