Camera: Hualai (Wyze, Atom, Neos, Personal) - themactep/thingino-firmware GitHub Wiki

Thingino supports a variety of Wyze / Atom / Personal branded Hualai based ODM devices.

Supported Features

  • Spotlight Control: Supported (Note: This is specifically for the spotlight, not the floodlight)
  • Doorbell Chime: Supported
  • Garage Door Controller: Not supported yet
  • Floodlight: Not supported yet

[!IMPORTANT] Beginning with the Wyze Cam Pan 3, Wyze has implemented secure boot on their SoC chips. For more details, please refer to the Secure Boot section.

[!WARNING] Wyze Cam Pan v3: GitHub release downloads and thingino.com website builds will NOT boot on this camera — the SPL dies right after clock init. Secure-boot locked devices need current master branch builds. Use the Image Builder with branch master and model wyze_campan3_t31x_gc2053_atbm6031. Confirmed working 2026-10-12.

UART

The Wyze Cam Pan v3 exposes its serial console on the J1 3-pin header — unpopulated (no pins installed), at the bottom-left corner of the board directly below the J5 connector:

Pin Function
Nearest J5 RX (presumed, unconfirmed)
Center GND
Outer (away from J5 connector) TX

Connect adapter RX to TX and adapter GND to GND — TX alone is enough for console output. Settings: 115200 8N1. Do NOT connect the adapter's VCC.

Don't confuse J1 with the white J5 connector above it — that's the ribbon-cable header for the pan base/motor board, not serial. An alternative ground reference is available at the labeled GND via in the top-right corner of the board. The BOOTSEL pads (bottom-right corner) are a boot-mode strap, not serial.

USB boot via OTG adapter (no flash-chip shorting)

The Pan v3 can enter USB boot (cloner) mode without touching the flash chip — but not through its external power pigtail:

[!WARNING] The external micro-USB pigtail is power-only — it carries no data lines, so an OTG adapter plugged into it will never enumerate. The data-capable connector is inside the pan base.

Procedure (confirmed by gtxaspec, 2026-10-20):

  1. Remove the oval base/stand cover from the pan base
  2. Unplug the power pigtail from its internal connector
  3. Plug a micro-USB OTG adapter (ID pin grounded, data lines intact) directly into that internal base connector — not into the pigtail's connector — and run a USB A-to-A data cable from the adapter to your computer
  4. With the camera unpowered, connect the cable so it powers up from the PC — the boot ROM drops into USB boot mode ("Ingenic USB Boot Device")
  5. Open the Web Flasher, make a full backup, then flash

No full disassembly needed — the base cover comes off without touching the pan assembly or board. The flash-pin short method below remains the fallback.

OTA install through the stock update channel (no disassembly)

For a Pan v3 still running stock firmware, the community tool joeblack2k/wyze-v3-ota installs Thingino through Wyze's own OTA update mechanism — no disassembly, no flash-chip shorting. The repo reports the flow verified end-to-end on two Pan v3 units; both booted Thingino, joined WiFi, and produced a working 1080p H.264 + AAC RTSP stream.

Not in a rush? An SD-card installer for the Pan v3 (with automatic factory firmware backup) is in the works at wltechblog/thingino-installers — simpler than the OTA route. If you can wait, prefer it.

How it works:

  • The camera's DNS names (aws-iot.wyzecam.com, wyze-firmware-upgrade-service.wyzecam.com, s3-us-west-2.amazonaws.com) are redirected to a host you control, which runs the tool's minimal MQTT-over-TLS broker (port 8883) and HTTPS payload server (port 8443).
  • The stock firmware trusts that broker; the tool sends the vendor upgrade command with an operator-supplied payload URL.
  • The stock updater downloads a .tar and runs its upgraderun.sh as root, which the tool uses to expose the MTD devices, read a verified full backup (every partition twice through independent paths, byte-compared), and then flash Thingino partition by partition — cfg, oem, rootfs, rback, fit, and boot last. It refuses to run unless /proc/mtd matches the known stock 16 MiB layout.
  • A matching autoupdate-full.bin recovery image is built alongside (usable once Thingino U-Boot is in place; the stock bootloader ignores it).

Requirements:

  • Camera still running stock firmware, on a network you control (DNS redirection + firewall rules for TCP 8883/8443)
  • A TLS certificate chain and key for the redirected hostnames (supplied by the operator — see the repository README, which publishes its lab chain under pki/public/ and a ready-to-run kit in release v0.3.0). Note that the author's published chain is not rooted in a public CA — it is a self-made lookalike of a real intermediate (serial MITN), valid 2026-10-25 → 2027-10-25, and the camera evidently accepts it after the DNS redirect, which is what makes this method work without a genuine publicly-trusted certificate.
  • A master-branch Pan v3 image — see the warning at the top of this page. This method only changes how the image is delivered; it does not defeat secure boot. The flashed image itself must still satisfy the SoC's secure-boot check, which master builds do via the secureboop-patched SPL (vendor RSA modulus included). GitHub release builds will not boot on the Pan v3 through this path any more than through a glitch install.

[!WARNING] This leans on undocumented vendor behavior that Wyze can change or shut off at any time. Without a verified full-flash backup there is no way back to stock Wyze firmware.

Walkthrough: prepare → serve → sessions → upgrade → backup → flash (see the repository README).

Disassembly

Tips from community members who flashed Pan v3 units (cmgenius, 2026-10-21; first-try success):

  • Check for a microSD card FIRST before opening anything — a card installed in the head can crack when the pan assembly is pulled out. It happens.
  • Heat the black plastic faceplate before prying. A mild heat gun softens the foamy double-sided tape holding it around the lens; pry gently from one side. A thin guitar-pick style tool avoids scratching.
  • Remove the four corner screws of the plastic housing below the faceplate, then pull the housing out with gentle force/wiggle — it has a rubber grommet and two snap/clip holders on the sides. No internal cables need disconnecting — just hold the ribbons/wires aside.
  • On the board with the camera/lens, remove the two screws and lift the board up at an angle to see its underside.
  • All screws in this camera are the same type. Reassembly is the reverse: board back in flat (watch for cable snags), its two screws, snap the housing back on, its four screws, re-stick the faceplate.

With the flash chip exposed, follow the pin-short procedure in Unbricking to force the boot ROM into USB DFU mode. Pan v3 specifics:

  • The chip is the only IC on the board with 8 legs (SOIC-8, 16MB SPI NOR, XT25F128B-class), near the board edge, on the underside of the camera board.
  • You are shorting the chip legs themselves, not test pads on the PCB.
  • Pin 1 is at the chip's dot marker. Pins 5+6 are the corner diagonal from the dot — with the dot at top-left, that's the bottom-right pin pair. Shorting pins 7+8 (the wrong adjacent pair) does nothing: the short must be 5+6. A community-drawn diagram is attached below this section.
  • Hold the short with a skinny conductive tool, then plug in the USB cable while holding it — a normal (non-OTG) data cable to the PC works fine. Remove the short as soon as the device appears, within ~3 seconds of power.
  • Best done with the Web Flasher already open (Chrome/Edge serial device picker waiting) and the cable pre-connected to the camera, so one hand holds the short and the other plugs into the PC — a helper makes it easier.
  • Success = "Ingenic USB Boot Device" enumerates. Make the full stock backup before writing anything — it is per-camera unique and the only road back to Wyze firmware.

Installation

Thingino has great support for the Wyze Cam V2 and Wyze Cam V3.

[!CAUTION] If you don't perform a full backup of your camera's flash storage, installation on Wyze devices is a one-way process. Without a backup, you won't be able to restore Wyze services on the device, ever. The flash storage holds your unique information needed to connect to the Wyze cloud.

  1. Follow the steps in Getting Started to install Thingino.
  2. Configure the camera with the following settings to best mimic stock behavior by editing /etc/prudynt.conf and rebooting:
    • Motion Settings:
      • sensitivity: 8

Alternatively, we have personally tested the following devices and can confirm their functionality. The documentation provided below is for reference:

Device Info

MODEL FCC ID PCB VER SoC WIFI
WYZEC2 2ANJHWYZEC2 2019-06-38 T20X SDIO: RTL8189FTV
WYZECP1 2ANJHHWYZECP1 DF3-IFPM01 V1.4 T20X SDIO: RTL8189ES
WYZEC3 2AUIUWYZEC3 WYZEV3_T31GC2053 V1.4_20201010 T31ZX SDIO: RTL8189FTV
WYZEC3 2AUIUWYZEC3A WYZEV3_T31GC2053 V1.2_20200715 T31X SDIO: RTL8189FTV
WYZEC3 2AUIUWYZEC3A WYZEV3_T31GC2053 V2.02_20210523 T31ZX SDIO: ATBM6031
WYZEC3 2AUIUWYZEC3A WYZEV3_T31GC2053 V2.03_20211206 T31X SDIO: ATBM6031
WYZEC3 2AUIUWYZEC3B WYZEV3_T31GC2053 V2.02_20210523 T31ZX SDIO: RTL8189FTV
WYZEC3 2AUIUWYZEC3B WYZEV3_T31GC2053 V2.03_20211206 T31X SDIO: RTL8189FTV
WYZEC3 2AUIUWYZEC3F WYZEV3_T31AGC2053 V3.2_20210714 T31AL SDIO: ATBM6031
WVDBV1 2AUIUWVDB1A WYZEDB3_MB_T31_2.2 T31X SDIO: RTL8189FTV
WVDWDV2 2AUIUWVDWDV2 WYZE_DOORBELL_V2_PWR_V2.5 T31X SDIO: ATBM6031
WYZECP2 2AUIUWYZECP2 DF3-MCU-S01-V2.2 T31X SDIO: ATBM6031
WYZECPAN3 2AUIUWYZECPAN3 WYZE PAN V3 MB V 1.3 T31X SDIO: ATBM6031
ATOMCAM2 V3C_T31GC2063 V1.1_202001110 T31ZX SDIO: ATBM6031
PERSONALCAM T31X SDIO: ATBM6031

GPIO:

MODEL IRCUT1 IRCUT2 IR LED1 IR LED2 WIFI LED1 LED2 SPEAKER TF_EN TF_CD SD_ABLE SD_PWR BUTTON1 BUTTON2 SUB1G USB
WYZEC2 GPIO25 GPIO26 GPIO49 GPIO62 GPIO38 GPIO39 GPIO63 GPIO54 GPIO48 GPIO47 GPIO46 GPIO47
WYZECP1 GPIO26 GPIO25 GPIO49 GPIO62 GPIO38 GPIO39 GPIO63 GPIO54 GPIO48 GPIO47 GPIO46 GPIO47
WYZEC3 GPIO53 GPIO52 GPIO47 GPIO49 GPIO57 GPIO38 GPIO39 GPIO63 GPIO50 GPIO62 GPIO48 GPIO51
WYZEDBV1 GPIO53 GPIO52 PWM2 GPIO57 GPIO38 GPIO39 GPIO58 GPIO62 GPIO06 GPIO07 GPIO61
WYZECP2 GPIO49 GPIO50 GPIO60 GPIO58 GPIO38 GPIO39 GPIO07 GPIO47 GPIO48 GPIO54 GPIO06
WYZECPAN3
WYZEC3PRO GPIO118 GPIO119 GPIO66 GPIO67 GPIO57 GPIO105 GPIO106 GPIO63 GPIO58 GPIO70 GPIO71 GPIO121 GPIO107
WVOD2
ATOMCAM2 GPIO53 GPIO52 GPIO26 GPIO57 GPIO38 GPIO39 GPIO63 GPIO50 GPIO59 GPIO48 GPIO51 GPIO47
PERSONALCAM GPIO14 GPIO?? GPIO47 GPIO48 GPIO63 GPIO50 GPIO59 GPIO39

MOTORS:

MODEL HST1 HST2 HST3 HST4 VST1 VST2 VST3 VST4 HMAX VMAX MAX SPEED
WYZECP1 GPIO54 GPIO53 GPIO52 GPIO51 GPIO75 GPIO76 GPIO79 GPIO80 2590 720 900
WYZECP2 GPIO52 GPIO53 GPIO57 GPIO51 GPIO59 GPIO61 GPIO62 GPIO63 2540 720 900
WYZECPAN3 GPIO52 GPIO53 GPIO57 GPIO51 GPIO59 GPIO61 GPIO62 GPIO63 3050 1550 900
PERSONALCAM GPIO54 GPIO51 GPIO49 GPIO57 GPIO60 GPIO61 GPIO62 GPIO63 2130 1600 900