Sadly there are no open ports on newer models and they moved away from Tuya. On the plus side, the newer models have easy serial access to root. On newer models it’s all MQTT. You can actually make it connect to your own broker and get messages, at least briefly. Eventually I think some sort of heartbeat function causes the mqtt to stop working.
I got most of it sorted for the newer models, except I am also stuck on the camera.
I think this is pretty close to what is needed for the current models:
They use a GOKE SoC with a GC2503 “image sensor”. That project above I think is the general idea of what needs to be done.
I have a full dump of the newer firmware that I am happy to share, but I don’t know if it will be useful for Tuya models.
So I have seen:
- Tuya driven models with ANYKA SoC
- MQTT driven models with GOKE SoC
I have started to reverse engineer the “application” as well, I can share the IDA project file for that if anyone is interested. I have annotated some of the functionality
EDIT: I went ahead and put the firmware here:
GitHub - taylorfinnell/PLAF203-research. This binary is executed when linux boots up.
It:
- Connects to wifi
- Enable all the GPIO stuff
- Handles the camera feed
The PCB of the model that the application is from has PLAF203 v0.8 silkscreened.
I might open the Tuya model back up…but I don’t think my cat will like it if I put her food machine back on my work bench 
@drcrow Do you see any “ipc” processes in ps on the tuya model?
https://openipc.org/cameras/vendors/anyka