Camera bricked after downgrading firmware

[BoPeng]

I got this Yi 1080p Home Camera 48US version with the latest firmware 2.1.0.0E_201809191630. Everything worked fine but I wanted to enable RTSP so that I can view the videos from my TV (Roku + IP Cam Viewer). The instruction said that I need to downgrade the firmware so I found a SD card, formatted it in FAT32, downloaded the firmware from here, and booted with it. The yellow light flashed for a while but then turned solid yellow. I waited quite a while, boot the camera but nothing happened.

I tried a few other images from that box folder but nothing worked. I then tried to download the latest firmware from Yi website and flash it according to the instruction, the camera still turned solid yellow after powered on.

Does anyone have any idea how to rescue it?

[xmflsct]

Try push the reset button on the back. Sometime this helps with downgrading.

[BoPeng]

No, it did not help. I posted this question also because I saw this post so maybe this will happen to all recent cameras.

[xmflsct]

Have you tried putting the sd/test content on the SD card? Try it, turn is on for a short while (like 2 minutes or so), then see if you can get a log output on SD card.

[BoPeng]

Just tried. No log file is created. So it looks like the rootfs image is not compatible with this new version of hardware and bricked it.

[BoPeng]

At this point I believe that the only possible way to de-brick the camera is to use a flash tool to flash the ELF of the camera with a USB connection. Do you happen to know such a tool?

[xmflsct]

Seems like there has been already some discussion about 48US cameras on yi-hack-v3 project. Some reported flashing successfully at the end.
USB UART Something like this would work. Just screw off the back and connect the pins.

[BoPeng]

Ohm, what exactly am I supposed to do after connecting the pins? Any reference? I can buy another camera ( I can make use of two) if an intact image is needed.

[xmflsct]

Then you need a serial monitor in your computer, you can find a lot of freeware. By then you would be able to see exactly what caused the problem basically the boot log. I remember we can also flash images but don't remember exactly.

Not sure what is the issue with 48US as image recovery always worked for me and others while developing this project. I have not really worked with any international models, only Chinese models.

[BoPeng]

Will this USB to TTL UART 6PIN Module Serial Converter CP2102 STC PRGMR Free cable work the same as the more expensive one on Amazon?

[xmflsct]

Looks fine. Good luck!

[mvereecken]

Following! :-)

[BoPeng]

TTL cable ordered but has not arrived yet. Just note that https://www.youtube.com/watch?v=fBjKTfWN4TI might be the video I have to follow closely to fix the camera.

[xmflsct]

Exactly!

[Loafdude]

I'm having similar problem. 48US. I have serial console on it.
Sometimes I get solid yellow, sometimes I get flashing yellow.
When solid yellow and it seems to freeze during boot, flashing yellow and it completes boot.
No SD card seems to help with not freezing during boot

I can reliably flash the cam. Tried v3 recover, v3 0.1.6, v4 0.0.3 and v4 0.1.0
The stock image from yi website is malformed, corrupted or plain wrong. The firmware refuses to flash it. (Magic number wrong or bad architecture error)
Be aware you cannot flash the same version of firmware on top of itself.
I suggest flashing back to the recovery image from hack-v3 then flashing to another fw.

Using either v4 version I get error in console
/home/yi-hack-v4/script/check_update.sh: line 36: N_RETRY++: not found

I can get shell on v3 0.1.3
I can bring wifi up.
Still flashing yellow and no way to configure the camera,

v3 Recovery image I can get shell sometimes, sometimes it freezes during boot
root

Here is a log of v3 0.1.6 booting
Y20 BOOT.txt

[BoPeng]

@Loafdude Were you able to find a working ROM for it? I have bought another identical camera so it is possible for me to extract the stock ROM and share it somewhere.

[Loafdude]

Working in what way? I have many semi-working roms
I'm not sure if the problem is rom related as I've tried 4 roms and they all exhibit similar behavior

Its like an eeprom is misconfigured or something.

[BoPeng]

My camera worked perfectly with the stock ROM, so if no third-party ROM works for you, perhaps this camera has some new feature and can only work with the stock ROM (for now).

[Loafdude]

I'm not sure how to extract a flashable image from yours

[BoPeng]

Not sure either. I will need to learn how to flash other images after I get my TTL cable because right now I only see solid yellow and cannot flash anything.

[Loafdude]

I've pinged the creator of v4 hack. He may have thoughts I can persue. He may also have a more current stock fw link

[Loafdude]

Just got it semi-fixed

I flashed hack v3 0.1.6
Got it to boot after a few tries - ended with flashing yellow light.
Showed the wifi config QR code and the camera read it although it wasn't asking for it
Camera configured itself and now connects at boot.

Still have crashes at boot though...

[Loafdude]

rtctime=$(/home/base/tools/rtctool -g time) in /home/base/init.sh is causing bootup to stall
looking for solutions atm

[Loafdude]

I've commented a line that stores the realtime clock into the enviroment variable and have reliable booting again. It seems no functions are relying on that variable? not sure... regardless it is a but tough to pull off without the serial console.

If your camera does not start flashing blue or yellow before 20 seconds reboot it
keep doing this until you get flashing yellow. It usually took me 3 tries
once you have flashing yellow use the yi app and show it the wifi config QR code...
mine took this and configured itself... should get solid blue
you can then SSH into the camera and edit init.sh
comment out the line in the previous post and you should get reliable booting back.

[xmflsct]

You can get back stock ROM once you receive your second camera and TTL cable. issuecomment-291814173

[Loafdude]

how do you wrap the dd output to pass the magic number checks?\

[BoPeng]

I got my TTL cable but saw that @mvereecken got his camera fixed with https://github.com/TheCrypt0/yi-hack-v4/releases/tag/v0.1.1 . I tried it and I can confirm that that version worked and unbricked my camera. Now I need to decide if I should wait for a release from this repo for RTSP support, try the RTSP version of yi-hack-v4, or just stop.

@mvereecken Did you try anything else after you unbricked your camera? Did you get RTSP working?

[mvereecken]

Hi @BoPeng, I donated to the guys and got access to their Discord channel for supporters and have RTSP working now :-). So you should definitely give it a try.

[BoPeng]

Thanks @mvereecken , I will do the same.