Pan v3 with unlocked soc for sale

[gtxaspec]

https://ronshed.com/product/t31x-wyze-cam-pan-v3-unlocked-soc-with-thingino-firmware/

My buddy Ron does component level electronics work, and has successfully transplanted a non secure boot ingenic CPU to the pan v3.

This unit doesn't run wyze software, it has the thingino custom firmware.

He's only got one right now, but we've confirmed it works well!

Just FYI for anyone interested. The price is fair for the level of work required.

[endertable]

This is very interesting, the question is, can Wyze firmware be burned back onto the camera. I imagine SecureBoot and the Wyze FW are unrelated after the camera gets past the initial boot process ?!?

[endertable]

Hi @CapnRon ,

I just wanted to clarify, I wouldn’t want it back in its original locked state, I was more inferring to be able to put the Wyze firmware back on there, but having a telnet or SSH access to it.

thanks.

[CapnRon]

The firmware doesn't lock the SOC, that requires applying a voltage to a specific pin to damage the e-fuses. The SOC is a brand new T31X that does not have damaged e=fuses so it is capable of running the factory firmware with, or without wz mini, Thingino or any other Ingenic t31 firmware.

It is like you said "SecureBoot and the Wyze FW are unrelated after the camera gets past the initial boot process". The new SOC does not have damaged e-fuses so it accepts any compatible firmware, where the factory SOC with the damaged e-fuses will only accept the factory wyze firmware.

[vasquezmi]

Let me make sure I am reading this correctly.
Wyze purposely applied a specific voltage to a pin on the SOC of their product and then packaged for sale to bypass the ability to right to repair. Like for CA law.

[gtxaspec]

Many vendors do this. They burn a specific encryption key to the device, or in this case, the processor, that can only be written once, so it will only boot their firmware, that they distribute, signed with their matching encryption key. It's a one way process that is irreversible.

I'm not sure what the specifics are in relation to the RTR laws in CA, but that's how the newer wyze devices work.

[CapnRon]

I don't think they are specifically trying to subvert the RTR law, but it is just a beneficial side effect for them. I think their main goal is locking the device to only allow the use of their paid cloud based service. I'm sure if they are called out on it they will claim it is for "safety and security".

[CapnRon]

[occultrefuse]

Hello @CapnRon,

Are these still available? The link above isn't working.

[JoshuaSeidel]

https://ronshed.com/product/t31x-wyze-cam-pan-v3-unlocked-soc-with-thingino-firmware/

The website doesnt work @gtxaspec says error with database connection. are these still available for sale?

[phantum29]

Since url is still down, has any one at least found a source for the non-secure T31x? I can't seem to find just the soc. I might try to grab a board with one from ali and transplant it too, but I'd rather not waste all the other components and subject the soc to at least two heat cycles.

[gtxaspec]

I believe ron is on sabbatical for a while.

https://www.aliexpress.us/item/3256805512975338.html
https://www.aliexpress.us/item/3256806970078742.html
T31ZX or X is preferred.

[endertable]

@phantum29 curious to after you change out the SOC, how will you get in to update the firmware or access the OS? Does this still use the wz_mini option of a kernel on the SD card?

[gtxaspec]

The bootloader/OS doesn't care about the SOC ( as long as it matches, Z/ZX )
Theres no validation from the SOC any longer.

[endertable]

@phantum29 curious to see how your venture goes with changing out the Soc

[phantum29]

I'll definitely post an update. I'm waiting on some T31x's to arrive.

[phantum29]

Replaced the SOC, and had to use the ingenic USB cloner tool. The second photo is of the flash chip, and the pins match the chip referenced in the guide. Fortunately, someone made the wyze cp3 firmware and that worked out of the box, so to speak, for me.

[gtxaspec]

cool! a few handy folks like yourself have done the swap on discord already too, feel free to join in if you like in the conversation. Hope to get some chips and rework equipment to do this myself soon.

[s00500]

nice stuff, what guide do you refer to ? is there a need to change the flash too ? I just ordered some SOCs, wanna try the replace too

[endertable]

@phantum29 that’s cool, so what equipment do you use to be able to take all those little solders off the legs? Also, you were saying you found some Wyze CP3 software to use with cloner tool, can you disclose that location. I am looking at also trying this out depending on the difficulty. I am pretty handy, but also know my limits, lol. Just curious if this project is within those limits

[gtxaspec]

The thingino firmware for the cp3 is available as a precompiled binary ready to flash in the repo.

[endertable]

@phantum29 How has the cam worked so far. Are you using Wyze system or did you go cloudless? Anything far-fetched in your observations?

[CapnRon]

I’m in Philippines now, but I just ordered some new gear. If there is enough interest I may start making small batches of these again. Let me know what you think

…

On Tue, Mar 11, 2025 at 10:06 PM Lukas Bachschwell ***@***.***> wrote: nice stuff, what guide do you refer to ? is there a need to change the flash too ? I just ordered some SOCs, wanna try the replace too — Reply to this email directly, view it on GitHub <#764 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A2FALFG4HJ4ZXKN3LJWIVTT2T3UWJAVCNFSM6AAAAABG3KDT4WVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENBWGI2DMNI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[shalakolee]

I am interested

[s00500]

I managed to get this to work! took a few tries, but eventually did... will do a second attempt on a new camera in a few weeks I think, maybe video document that one

[gtxaspec]

glad to hear, congrats!

[endertable]

@s00500 I would be interested in that video doc. :) And if not the video doc, maybe some pointers. Did you place Wyze binaries on there or did you go with thingino. I am way invested in Wyze ATM with their remote APP view and their AI works pretty good for me as well, but I also like to supplement with my own stuff that works with theirs as well.

[CapnRon]

The original Wyze FW will still work on the chip swapped camera.

…

On Mon, Apr 7, 2025 at 1:44 PM endertable ***@***.***> wrote: @s00500 <https://github.com/s00500> I would be interested in that video doc. :) And if not the video doc, maybe some pointers. Did you place Wyze binaries on there or did you go with thingino. I am way invested in Wyze ATM with their remote APP view and their AI works pretty good for me as well, but I also like to supplement with my own stuff that works with theirs as well. — Reply to this email directly, view it on GitHub <#764 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A2FALFDRBOWR2NV7TPBCGT32YK2RNAVCNFSM6AAAAABG3KDT4WVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENZVGQ2DCNQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[cmgenius]

I'm super interested in trying this. Any other known sources for getting the proper SOC in the US? Not sure if I can do an AliExpress order with the looming import rule changes ;/

[s00500]

Ok, I finally got around of making a video! so here is how this surgery worked for me:

https://youtu.be/YtA7Fi1IllI

[CapnRon]

Awesome work and nice video, its good to see others doing this hack now!