Pan v3 with unlocked soc for sale

[gtxaspec]

https://ronshed.com/product/t31x-wyze-cam-pan-v3-unlocked-soc-with-thingino-firmware/

My buddy Ron does component level electronics work, and has successfully transplanted a non secure boot ingenic CPU to the pan v3.

This unit doesn't run wyze software, it has the thingino custom firmware.

He's only got one right now, but we've confirmed it works well!

Just FYI for anyone interested. The price is fair for the level of work required.

[endertable]

This is very interesting, the question is, can Wyze firmware be burned back onto the camera. I imagine SecureBoot and the Wyze FW are unrelated after the camera gets past the initial boot process ?!?

[endertable]

Hi @CapnRon ,

I just wanted to clarify, I wouldn’t want it back in its original locked state, I was more inferring to be able to put the Wyze firmware back on there, but having a telnet or SSH access to it.

thanks.

[CapnRon]

The firmware doesn't lock the SOC, that requires applying a voltage to a specific pin to damage the e-fuses. The SOC is a brand new T31X that does not have damaged e=fuses so it is capable of running the factory firmware with, or without wz mini, Thingino or any other Ingenic t31 firmware.

It is like you said "SecureBoot and the Wyze FW are unrelated after the camera gets past the initial boot process". The new SOC does not have damaged e-fuses so it accepts any compatible firmware, where the factory SOC with the damaged e-fuses will only accept the factory wyze firmware.

[vasquezmi]

Let me make sure I am reading this correctly.
Wyze purposely applied a specific voltage to a pin on the SOC of their product and then packaged for sale to bypass the ability to right to repair. Like for CA law.

[gtxaspec]

Many vendors do this. They burn a specific encryption key to the device, or in this case, the processor, that can only be written once, so it will only boot their firmware, that they distribute, signed with their matching encryption key. It's a one way process that is irreversible.

I'm not sure what the specifics are in relation to the RTR laws in CA, but that's how the newer wyze devices work.

[CapnRon]

I don't think they are specifically trying to subvert the RTR law, but it is just a beneficial side effect for them. I think their main goal is locking the device to only allow the use of their paid cloud based service. I'm sure if they are called out on it they will claim it is for "safety and security".

[CapnRon]

[occultrefuse]

Hello @CapnRon,

Are these still available? The link above isn't working.

[JoshuaSeidel]

https://ronshed.com/product/t31x-wyze-cam-pan-v3-unlocked-soc-with-thingino-firmware/

The website doesnt work @gtxaspec says error with database connection. are these still available for sale?

[phantum29]

Since url is still down, has any one at least found a source for the non-secure T31x? I can't seem to find just the soc. I might try to grab a board with one from ali and transplant it too, but I'd rather not waste all the other components and subject the soc to at least two heat cycles.

[gtxaspec]

I believe ron is on sabbatical for a while.

https://www.aliexpress.us/item/3256805512975338.html
https://www.aliexpress.us/item/3256806970078742.html
T31ZX or X is preferred.

[endertable]

@phantum29 curious to after you change out the SOC, how will you get in to update the firmware or access the OS? Does this still use the wz_mini option of a kernel on the SD card?

[gtxaspec]

The bootloader/OS doesn't care about the SOC ( as long as it matches, Z/ZX )
Theres no validation from the SOC any longer.

[endertable]

@phantum29 curious to see how your venture goes with changing out the Soc

[phantum29]

I'll definitely post an update. I'm waiting on some T31x's to arrive.

[phantum29]

Replaced the SOC, and had to use the ingenic USB cloner tool. The second photo is of the flash chip, and the pins match the chip referenced in the guide. Fortunately, someone made the wyze cp3 firmware and that worked out of the box, so to speak, for me.

[gtxaspec]

cool! a few handy folks like yourself have done the swap on discord already too, feel free to join in if you like in the conversation. Hope to get some chips and rework equipment to do this myself soon.

[endertable]

@phantum29 that’s cool, so what equipment do you use to be able to take all those little solders off the legs? Also, you were saying you found some Wyze CP3 software to use with cloner tool, can you disclose that location. I am looking at also trying this out depending on the difficulty. I am pretty handy, but also know my limits, lol. Just curious if this project is within those limits

[gtxaspec]

The thingino firmware for the cp3 is available as a precompiled binary ready to flash in the repo.