wz_mini_hacks

v3/PANv2 devices ONLY

Run whatever firmware you want on your v3/PANv2 and have root access to the device. This is in early stages of testing, use CAUTION if you are unsure of what you are doing. No support whatsoever is offered with this release.

Do not contact the manufacturer for information or support, they will not be able to assist or advise you!

Important matters related to security

Using this project can potentially expose your device to the open internet depending on the configuration of your network. You alone are responsible for the configuration and security of your network, make sure you are aware of the risks involved before using.

Related Projects:

• wz_mini_debian: run full debian in a chroot, on the camera!
• wz_mini_utils: various statically compiled binaries for use with the camera (mipsel)

Features

• No modification is done to the device filesystem. Zero!

• Custom kernel loads all required files from micro-sd card at boot time

• Wireguard and IPv6 support enabled

• Supports the following USB Ethernet adapters:

  • ASIX AX88xxx Based USB 2.0 Ethernet Adapters
  • ASIX AX88179/178A USB 3.0/2.0 to Gigabit Ethernet
  • Realtek RTL8152 Based USB 2.0 Ethernet Adapters

• USB gadget support, connect the camera directly to a supported router to get an internet connection, no USB Ethernet Adapter required, using USB CDC_NCM.

• Easy uninstall, just remove files from micro-sd card, or don't use a micro-sd card at all!

• Add your own changes to run at boot into the script on the micro sd card located at /media/mmc/run_mmc.sh, mount nfs, run ping, whatever you want

• Ability to update to the latest stable or beta firmware, this mod should survive updates as long as the bootloader remains the same

• Ability to block remote AND app initiated firmware updates

• Works on ANY firmware release (so far!)

• DNS Spoofing or Telnet mod are not required prior to installation

• RTSP Server included, stream video and or audio over LAN

• Tethering to android phones via RNDIS

• USB Mass storage enabled, mount USB SSD/HDD/flash drives

• CIFS Supported

• Play .WAV files using "aplay " command

• iptables included

• Inspired by HclX and WyzeHacks! Bless you for all your work! You are the master!

Coming Soon

• ???

How you can help!

• Vertical Tilt on the PANv2 doesn't work properly. Only does this on the modified kernel. Need investigation why this happens.

Prerequisites

• Person
• Computer
• 256MB or larger Micro-SD Card is required!

What Works / What Doesn't Work

• Everything works except:

  1. PAN v2:
     • Tilt (Vertical) only works at motor speed 9

Setup

1. git clone the repo or download the repo zip
2. format micro-sd card as fat-32 ( this is a hard requirement, the bootloader does not support ex-fat or ext, and thus will not load wz_mini ), volume name does not matter.
3. copy all the files inside of SD_ROOT to your micro sd card
4. SSH is enabled, but is secured using public key authentication for security. Edit the file wz_mini/etc/ssh/authorized_keys and enter your public key here. If you need a simple guide, how to use public key authentication

Installation

1. Turn off the camera
2. Insert the micro sd memory card into the camera
3. Turn on the camera
4. The camera will proceed to boot, then you may connect via the IP address of your device using SSH, port 22. The username is root. It may take a few minutes for the device to finish booting and connect to Wi-Fi, then launch the SSH server. Be patient.
5. You may also login via the serial console, password is WYom2020

Removal

1. Delete the files you copied to the memory card, or remove the memory card all together. The next time you boot the camera, you will return to stock firmware.

Customization

Edit run_mmc.sh, this is a script stored on the micro sd card that is run when the camera boots. You can change the hostname of the camera, mount NFS, add ping commands, anything you like.

---

Wireguard support is available as a kernel module:

ENABLE_WIREGUARD="true"

Use the command wg to setup. See https://www.wireguard.com/quickstart/ for more info.

Some users have asked about tailscale support, I have tested and it works. See the issue #30 for further information.

---

Disable automatic firmware updates:

DISABLE_FW_UPGRADE="true"

If a remote or app update is initiated, the camera will reboot due to the failure of the update. The firmware update should not proceed again for some time, or at all.

When a firmware update is initiated, due to a bootloader issue (bug?), we intercept the update process and flash it manually. This should now result in a successful update, if it doesn't, please restore the unit's firmware manually using demo_wcv3.bin on the micro sd card.

---

USB Ethernet Adapter support:

ENABLE_USB_ETH="true"

the next time you boot your camera, make sure your USB Ethernet Adapter is connected to the camera and ethernet. The camera has to be setup initially with Wi-Fi for this to work. After setup, Wi-Fi is no longer needed, as long as you are using the USB Ethernet Adapter. Note that using USB Ethernet disables the onboard Wi-Fi.

---

USB Direct Support:

ENABLE_USB_DIRECT="true"

the next time you boot your camera, make sure your USB cable is connected to the router. Remember, the camera has to be setup initially with Wi-Fi for this to work. After setup, Wi-Fi is no longer needed. Note that using USB Direct disables the onboard Wi-Fi. Change the MAC Address if you desire via USB_DIRECT_MAC_ADDR variable.

Connectivity is supported using a direct USB connection only... this means a single cable from the camera, to a supported host (An OpenWRT router, for example) that supports the usb-cdc-ncm specification. (NCM, not ECM) If you have an OpenWrt based router, install the kmod-usb-net-cdc-ncm package. The camera should automatically pull the IP from the router with most configurations. You can also use any modern linux distro to provide internet to the camera, provided it supports CDC_NCM. enjoy!

Note: In my testing, the micro-usb cables included with the various cameras do not pass data, so they will not work. Make sure you have a micro-usb cable that passes data!

---

Remote Accessories:

When USB Direct connectivity is enabled, the camera will be unable to communicate with accessories. To enable remote spotlight accessory support, enable the following variable and set the IP Address of the host as follows:

REMOTE_SPOTLIGHT="true"
REMOTE_SPOTLIGHT_HOST="0.0.0.0"

Then, run the following command on the host where the spotlight is attached to:

socat TCP4-LISTEN:9000,reuseaddr,fork /dev/ttyUSB0,raw,echo=0

Change /dev/ttyUSB0 to whatever path your spotlight enumerated to if necessary. The camera will now be able to control the spotlight.

---

USB Mass Storage Support:

ENABLE_USB_STORAGE="true"

If you would like to mount an EXT3/4 filesystem, also change:

ENABLE_EXT4="true"

---

CIFS is now supported:

ENABLE_CIFS="true"

---

iptables (ipv4 and ipv6) is available:

ENABLE_IPTABLES="true"

---

NFSv4 support is available:

ENABLE_NFSv4="true"

---

RTSP streaming: You can choose to enable or disable audio. Set your login credentials here, you can also change the port the server listens on.

RTSP_ENABLED="true"
RTSP_ENABLE_AUDIO="true"
RTSP_LOGIN="admin"
RTSP_PASSWORD=""
RTSP_PORT="8554"

the stream will be located at rtsp://login:password@IP_ADDRESS:8554/unicast

Notes: If you don't set the password, then the password will be the unique MAC address of the camera, in all uppercase, including the colons... for example:. AA:BB:CC:00:11:22. It's typically printed on the camera. VLC seems to work fine for playback, ffmpeg and others have severe artifacts in the stream during playback.

Huge credit to @mnakada for his libcallback library: https://github.com/mnakada/atomcam_tools

---

Latest Updates

• 05-08-22: update libcallback sources with patch to enable pan v2 rtsp functionality.
• 05-08-22: Include iptables and NFSv4 kernel modules, enable swap ON by default.
• 05-07-22: RTSP Server fixed, ported latest full libcallback from @mnakada with modifications.
• 05-01-22: Removed dropbearmulti, replaced with individual binaries. dropbear dbclient dropbearkey dropbearconvert scp now included.
• 04-30-22: Recompiled uClibc with LD_DEBUG enabled. Enable in v3_post.sh, for debugging.
• 04-30-22: Move built-in kernel stuff to modules, usb_direct kernel no longer needed, modules now included. Added usb-storage support for usb hdd/ssd/flash drive, cifs support, and rndis support for tethering camera directly to a mobile device.
• 04-26-22: Add customization of PATH via hook in v3_init.sh, and add audioplay_t31 binary for playing audio files before iCamera loads.
• 04-21-22: Add authentication to rtsp server. use default password as unique device mac address.
• 04-21-22: Updated dropbear ssh, enabled public key authentication, disable password auth.
• 04-21-22: wz_mini/tmp folder was missing in git, preventing the camera from booting. Fixed.
• 04-21-22: Workaround for bootloader F/W upgrade bug, F/W blocking is now disabled by default.
• 04-19-22: Add RTSP Server functionality
• 04-17-22: Add remote spotlight accessory capability
• 04-15-22: Enable USB Direct functionality. Allows you to connect camera using a USB cable to a device supporting CDC_NCM devices to get an internet connection, no USB Ethernet Adapter required.
• 04-14-22: Fix kernel command line memory mappings, resolves stability issues
• 04-14-22: Possible memory leak with some USB adapters used, added 128MB swap file and logic as workaround to prevent oom killing
• 04-13-22: Firmware updates are disabled by default, there is a bug in the bootloader that corrupts the kernel partition requiring the re-flash of the camera if an update is processed and the memory card is removed before next boot. The bootloader proceeds to copy the partitions and the system will not boot unless re-flashed. pending investigation.
• 04-12-22: Updated, custom kernel loads all required items from micro sd card. System modification no longer needed.
• 04-05-22: Update readme to indicate that telnet mod nor DNS spoofing is required for installation, and add pre-requisites section.
• 04-02-22: Update to automatic install method, remove manual install.

BYO

Build your own!!

https://github.com/mnakada/atomcam_tools has a great repo with docker images which include kernel sources, config, and a whole bunch of other stuff. Check it out.

WARNING

AS WITH ANY UNSUPPORTED SYSTEM MODIFICATIONS, USING THIS MAY LEAD TO A DEVICE BRICK
IF YOU DON'T KNOW WHAT YOU ARE DOING ( HAVEN'T BRICKED MY DEVICE YET! ) PLEASE
BE AWARE THAT NO ONE ON THE INTERNET IS RESPONSIBLE FOR ANY DAMAGE TO YOUR
UNIT. ANY PROBLEMS WILL BE CONSIDERED USER ERROR OR ACTS OF WHATEVER GOD YOU BELIEVE IN.
USE AT YOUR OWN RISK. NO WARRANTY OF ANY KIND IS EXPRESSED OR IMPLIED. 
DO NOT USE THIS SOFTWARE IF YOU ARE NOT CONFIDENT IN RESTORING YOUR DEVICE FROM A FAILED STATE.

Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

Thank You

Thank you to everyone who is passionate about Wyze products for making the devices popular, and thank you to Wyze for producing them. Sign up for CamPlus, show some love and support to the company.

Thanks for HclX for WyzeHacks! https://github.com/HclX/WyzeHacks/

Thank you mnakada for his atomcam_tools fork! https://github.com/mnakada/atomcam_tools

Thank you bakueikozo for his atomcam_tools repo! https://github.com/bakueikozo/atomcam_tools

Thank you to virmaior for the atomcam_tools tip!