Battery-powered doorbell with camera and app - inside, what to look out for

Ever wondered how it works and how a battery-powered doorbell with a camera is built, in addition to interacting with a mobile app via Wi-Fi? Here, I will try to demonstrate this. I will also see if it is possible to program the microcontroller from inside.

The kit comes with a battery-powered module with camera and button, and a separately USB-powered receiver to play the ringtone.

Let's start with the pairing.
Before starting, it is a good idea to connect the product to the power supply. A regular USB C cable will suffice. On your phone we download the app Aiwit . On Google Play at the link com.eken.aiwit we find:

The app has been removed - fortunately it is still possible to download it from the manufacturer:

We launch, register.

We select our product type from the list. You can look by the images:

We follow the instructions:

To enter the pairing state, hold down the button longer. After a moment, the LED will start flashing and we will hear "entering pairing mode".

The application will ask us for our Wi-Fi details - we need to enter the location of the 2.4 GHz network.

The app will turn our Wi-Fi data into a QR code, which we then have to let the camera scan:

I didn't get it right the first time:

Eventually it should work - the camera connects and the app offers us a paid plan:

You can get one premium day for watching the ad:

The camera can then already transmit images:


Basis of operation
The camera module is normally asleep and not connected to Wi-Fi. This helps to extend the battery life. Only pressing a button wakes it up. The video shows how quickly the phone responds to a ringtone.

When we pick up, we can see who is ringing the doorbell. There is also an option for two-way communication. If we are late, we have a notification and video footage in the history in the app.

After clicking on the notification, we still have the option to decide if we are sure we want to receive it:

This is the story, unfortunately here it is paid for, which spoils the point of this product somewhat:


Settings in the app
In the app we have control of the volume level, product information (firmware, Wi-Fi, etc.), battery status and the possibility to share:



Camera response time
Let's check how much latency the video sent by the camcorder has;



Interior of the camera
Now perhaps the most interesting part. Inside is a YW 803035 800 mAh 3.7 V 2.96 Wh battery and a single board. You can also see the antenna.

Removing the board. You can already see the XR872AT Wi-Fi chip and the second antenna on the PCB. You can also see the two quartz resonators. It can be judged that probably one chip is the Wi-Fi connectivity and the other is the RF to the module that plays the ringtone.

Here is the Wi-Fi chip section - the software is on a 25QH32 flash bone, which is 2MB in size.

This memory can be soldered out and read using CH341.

Memory in the process of being read out:


Copy of the batch (XR872_Doorbell_T2Kemet_CH341_25QH32CHIG):
https://github.com/openshwprojects/FlashDumps/commit/f91d84604147e8c4b082f8e160d2c815af87a415
There is an interesting problem with this memory - I could not overwrite it (clear and program it) until I added a capacitor to the power supply :

Other side of the plate:

Camera:




The microcontroller from the middle is supported by OBK , but we do not have a camera controller yet. Only the GPIO can be controlled:

Details:
https://www.elektroda.com/rtvforum/find.php?q=XR872
https://www.elektroda.com/rtvforum/find.php?q=XR872AT
The batch can be uploaded directly to Flash memory (via CH341), or via the UART in PhoenixMC (as long as the device has the bootloader enabled).

At this point it is unclear at what stage we will be able to get the camera working.


Summary
The product in question is just more of a curiosity for me. I was interested to check its operation and interior, and even managed to change the batch, but we have not yet launched the camera itself, so its programming is just a curiosity for now.
This removed app from Google Play does not bode well - I wonder what they deleted it for?
From a practical angle, however, I have some doubts here. Firstly, how is this ringtone supposed to be fixed to the wall so that someone malicious doesn't steal it? Secondly, what is the point of a bell that has to be dismantled from time to time for recharging? Thirdly, unless I'm mistaken, video history is chargeable, so why do we need such a doorbell with a camera if we're not going to find out who was at the door when we failed to answer anyway....
Fourthly - and this will be the final nail in the coffin - this product doesn't pair with Tuya, it pairs with Aiwit, so it requires another little-known phone app to operate. And who knows where this video is being streamed....
In summary , this product is for me for the moment a platform for experimentation with the XR872 and we may soon see what comes of it.