Cove/Kami/Yi Battery powered outdoor cameras

[rfam13]

Hello, I recently got a bunch of cameras from cove security when they had a deal going on, the cameras are Kami/Yi just not branded. I received in home cameras which I used this hack and it worked great on all of them. However I also received outdoor battery powered cameras, which I can't seem to find a hack for or a compatible one. I tried to do a backup of the camera but it seems like the script is not run, just blinks blue light. Is there another way I should try and run it? I've included some pictures hopefully someone knows if this board is compatible or can direct me in getting the correct information to find out. I can order a USB to TTL and solder it on and do whatever is needed to find out. Thank you for any assistance.

Model: YWS12020 on camera
On board: W12GA_MB_G53_V1_3
DID: LFUSY7520N
Firmware: 9.2.02.08_202110201607

Firmware for the in home cameras was newer than listed on supported cameras but worked fine, I notice this firmware is a bit newer than what's on the supported list as well.

[roleoroleo]

Firmware 9.2...
It could be a completely new model.
If you are able to dump the XMC flash, I could try to support it.
A serial connection is available (printed labels RX-TX-GND), you could try to get inspiration from here:
https://github.com/roleoroleo/yi-hack-Allwinner-v2/wiki/Unbrick-the-cam
and dump the flash to the sd card.

[roleoroleo]

Press enter when you switch on the cam.
The bootloader should stop.

[rfam13]

It continues to produce a log even when I press enter, which is non stop due to the battery it always says
[00006180][1970-01-01 00:00:07 0390][APP::ERROR::MAIN] Invalid battery percent => percent = 100 soc = 65535 fcc = 65535
Until it goes to sleep, at which point I can't type/paste anything. I can copy and paste commands while it is logging, but fdt isn't a recognized command so I'm guessing I am in the wrong place. When I type "ls" it shows the root files, just not sure how to get them off.

[roleoroleo]

If you are in a shell where ls command works, probably you don't need to stop the cam at boot.
Type the command
cat /proc/mtd
and
dump the content of the listed partitions with dd
dd if=/dev/mtdblockX of=/tmp/sd/mtdblockX.bin

Check if /dev/mtdblockX is the correct name/path of the block files.
Check if your sd card is mounten on /tmp/sd

[rfam13]

"cat /proc/mtd" results in Open /proc/mtd failed

Here are the commands I can use
https://pastebin.com/Sf7ipU8Z

ls results in
dev root data tmp mnt/B mnt/E <- (sd card is mnt/E)

contents of dev
pipe3 pipe2 pipe1 pipe0 B
v4l-subdev13 v4l-subdev12 v4l-subdev11 v4l-subdev10 v4l-subdev9
v4l-subdev8 v4l-subdev7 v4l-subdev6 v4l-subdev5 v4l-subdev4
v4l-subdev3 v4l-subdev2 v4l-subdev1 v4l-subdev0 video3
video2 video1 video0 media0 sunxi_eise
spi3 spi2 spi1 spi0 ram0
ram hwcryto g2d sdmmc UDISK
data configure board ROOTFS env
bootA boot0 spinor pwm twi4
twi3 twi2 twi1 twi0 uart3
uart2 uart1 uart0

contents of root
.gitignore apps audio_w12ga ca.crt etc
iso8859-1-24x48.bin iso8859-1-8x16.bin main.bmp net_hd02_wt_bs.bin res

contents of data
.gitignore factory isp0_1920_1080_20_ctx_saved.bin isp0_1920_1080_20_reg_saved.bin isp0_1920_1080_30_ctx_saved.bin
isp0_1920_1080_30_reg_saved.bin isp0_1936_1096_20_ctx_saved.bin isp0_1936_1096_20_reg_saved.bin online_key period_times
sdio_reg.bin tnp_info tz_zone wifi_data.bin yi_cfg.ini

[113]GPT load from sector:0x60, sectors: 0x20, save in dram: 0x40800010
[123]---------------------------
[126]GPT:bootA: 0x80 0x307f
[128]GPT:env: 0x3080 0x3087
[131]GPT:ROOTFS: 0x3088 0x4487
[134]GPT:board: 0x4488 0x44c7
[137]GPT:configure: 0x44c8 0x4547
[140]GPT:data: 0x4548 0xe547
[143]GPT:UDISK: 0xe548 0xffff

[roleoroleo]

It's a completely new interface.
Never seen.
There are a lot of interesting commands.
Try $ (panic mode) or telnet_server to start a telnet server.
Maybe the 1st command opens a linux shell.
Maybe the 2nd command starts a telnet server and you can connect to it with putty.