CY365 BK7252NQN481 Tiny WiFi Camera Teardown, Internal Photos, OpenBK7252N, GC0311

divadiow 06 Dec 2025 14:42 0 102 Cool? (+2)

📢 Listen (AI):

Hi, here's a peak at a tiny little Beken BK7252N 'Xiaomi' '4k' Rear View Car IP camera bought from Ali Express.

https://www.aliexpress.com/item/1005010353283701.html

It's far from a full rear-view camera car kit, more like another cheap Chinese mini cam packaged with standard micro USB cable. No mounting options are supplied.

The case is pried open very easily with only 4 plastic corner pips holding the two main parts together.

then the insides. toothbrush for scale

To break it down a little, on this side we have the 5v micro USB port, a blue LED (connected to P13 of the BK7252N) a 26 MHz oscillator (LK26 9AH), and the now quite-familiar top-lock FPC/FFC, 18-pin, 0.5 mm pitch connector for the cam sensor.

on the other side, the 2mb Beken BK7252NQN481 MCU (also seen https://www.elektroda.com/rtvforum/topic4118499.html) (datasheet attached)

an analogue electret microphone

a standard tactile push button (connected to P7 of the BK7252N)

LTH7R SOT-223-5 (?) 3.3v LDO - supplies 3.3v to the MCU from 5v USB input. Googling seems to suggest it's a Li-ion battery charger chip, but this device was not supplied with battery.

The only test pads on the PCB are P10 and P11, which are good for programming

From P11 we also get this log out at 115200 baud

no log from P0 (UART1_TX)

With Easy Flasher the BK7252N 2mb flash is read with ease.

Regarding the CY365 app (Shix Zhao shix.cy.camera) referenced in the 'manual' to be used when pairing device with phone

The sensor itself, labelled as LT1823-0311 V1.0-V1, is a GalaxyCore GC0311 640x480 model.

Camera module with lens and ribbon connector on blue background

And tracing from each of the pins on the 18-pin FPC connector we determine the following:

DVP interface connection diagram with pin mapping for connector J1

So P0 is used for SCL. I'm not sure of the role of PWDN/RESET at this stage, but it doesn't directly route to an IO on the BK7252N but rather has continuity to the top contact of these two components on the reverse

Close-up of a PCB with two SMD components circled in red

Flashing OpenBK7252N means a cloud-free device, but currently no cam or mic support

Easy Flasher interface with Write success! message and flash writing log

OpenBK7252N interface with chip data and configuration options displayed

Flash backup: https://github.com/openshwprojects/FlashDumps/commit/b0b370f5244e4b6c42d77cebf199a4c5a36c0c8c

Device ID:
EEE-249530-GDVHL
name: Camera
V1.7.0 Jul 30 2025
No new versions

Strings of possible note

xref:
https://www.elektroda.com/rtvforum/topic4154701.html

About Author

divadiow wrote 4074 posts with rating 712 , helped 346 times. Live in city Bristol. Been with us since 2023 year.

Comments

Add a comment

FAQ

TL;DR: Tiny CY365 “rear-view” IP cam uses a 2 MB BK7252N SoC with a 640×480 GC0311; “Flashing OpenBK7252N means a cloud-free device, but currently no cam or mic support.” [Elektroda, divadiow, post #21772962]

Why it matters: This FAQ helps tinkerers identify pins, flash firmware, and harden security on a cheap Wi‑Fi camera.

Quick Facts

- MCU: Beken BK7252NQN481 with 2 MB flash, 26 MHz crystal; blue LED on P13. [Elektroda, divadiow, post #21772962]
- Sensor: GalaxyCore GC0311, 640×480 via 18‑pin 0.5 mm FPC; SCL on P0. [Elektroda, divadiow, post #21772962]
- Power: 5 V micro‑USB input, LTH7R SOT‑223‑5 LDO to 3.3 V; no battery included. [Elektroda, divadiow, post #21772962]
- Debug: Test pads P10/P11 used for programming; UART log at 115200 baud observed. [Elektroda, divadiow, post #21772962]
- Stock app/firmware: CY365 app; device showed V1.7.0 (Jul 30, 2025) and P2P/cloud strings plus weak defaults. [Elektroda, divadiow, post #21772962]

What exactly is the CY365 BK7252NQN481 tiny Wi‑Fi camera?

It’s a low-cost IP camera sold as a mini “rear‑view” unit. Inside is a Beken BK7252NQN481 Wi‑Fi SoC and a GC0311 VGA sensor. It ships with a micro‑USB cable, no mounting hardware, and minimal packaging. The enclosure separates with four plastic corner pips, making teardown easy for repairs or mods. Photos and logs confirm the platform components and pad access for firmware work. [Elektroda, divadiow, post #21772962]

Which image sensor does it use and what resolution can I expect?

The module is labeled LT1823‑0311 and uses the GalaxyCore GC0311 sensor. Resolution is 640×480 (VGA). The camera connects through an 18‑pin, 0.5 mm pitch FPC to the main board for data and control. Strings in the dump also reference other sensors, but this unit identifies GC0311. [Elektroda, divadiow, post #21772962]

How do I open the case without damage?

Pry along the seam at the four corners. Only four plastic pips hold the halves together. Work slowly with a thin spudger to avoid marring the shell or flexing the FPC. The board and lens module lift out once the clips release. A toothbrush in the photos shows the compact scale. [Elektroda, divadiow, post #21772962]

How do I flash OpenBK7252N onto this camera?

Use the accessible test pads and a supported flasher.

Connect to P10/P11 pads as the programming interface.
Use Easy Flasher to read and back up the 2 MB flash.
Write OpenBK7252N, then power‑cycle and test basic GPIO. [Elektroda, divadiow, post #21772962]

Which pads and UART settings should I use for debugging?

Use P11 to view logs at 115200 baud. The captured boot shows firmware versioning and OTA recovery behavior. UART1_TX on P0 did not output in tests. Keep ground reference stable and avoid long leads. Short jumpers reduce noise on high‑speed lines. [Elektroda, divadiow, post #21772962]

Does OpenBK7252N currently support the camera and microphone?

Not yet on this platform. As the post notes, “Flashing OpenBK7252N means a cloud‑free device, but currently no cam or mic support.” You can still exercise GPIOs, LEDs, and buttons while sensor and audio drivers mature. Monitor project updates before relying on video. [Elektroda, divadiow, post #21772962]

What mobile app does stock firmware use, and what firmware version was seen?

The included leaflet references the CY365 app (package shix.cy.camera). The examined device reported firmware V1.7.0 dated July 30, 2025. UI screenshots and strings show P2P and push paths tied to cloud services. Always change any exposed default credentials. [Elektroda, divadiow, post #21772962]

What are the power requirements and regulators on the board?

Input is 5 V via micro‑USB. An LTH7R SOT‑223‑5 regulator derives 3.3 V for the BK7252N and peripherals. No battery was supplied. Despite some search results listing LTH7R as a charger, the board uses it as an LDO for system power. Verify 3.3 V rail before flashing. [Elektroda, divadiow, post #21772962]

How is the camera FPC wired? Any notable control lines?

The 18‑pin 0.5 mm FPC carries pixel data, clock, and control. SCL is on P0. PWDN/RESET does not route directly to a BK7252N IO; it ties through discrete parts on the reverse. Inspect those two components when troubleshooting sensor wake or reset behavior. [Elektroda, divadiow, post #21772962]

Are there security concerns like default passwords or cloud endpoints?

Yes. String dumps show usernames “admin,” passwords like “6666” and “123456789,” and cloud push URLs and P2P identifiers. Change credentials immediately and consider replacing stock firmware. Blocking outbound ports or using OpenBK7252N reduces unsolicited cloud exposure. [Elektroda, divadiow, post #21772962]

Why does the boot log say OTA verify failed and revert to factory?

The serial output at 115200 shows RT‑Thread OTA initializing, then “App verify failed! Need to recovery factory firmware.” This indicates a signature or integrity check failure. The bootloader then jumps to a known‑good partition at 0x10000 for recovery. [Elektroda, divadiow, post #21772962]

Can I reuse the on‑board microphone, LED, and button with custom firmware?

Yes. The electret mic connects to the analog front end. The blue LED maps to P13, and the tactile button connects to P7. You can control these with OpenBK7252N GPIO features even while camera and audio streaming are unsupported. Document states exact pin ties. [Elektroda, divadiow, post #21772962]

Which image sensors are referenced by the firmware strings?

Strings mention GC0312, HI704, OV7670, OV7673, and SP0A38 in addition to the installed GC0311. This suggests a shared codebase supporting multiple VGA‑class sensors. Your board identifies the attached model during init. Replace modules carefully if experimenting. [Elektroda, divadiow, post #21772962]

What is OpenBeken (OpenBK7252N) in simple terms?

OpenBeken is community firmware for Beken Wi‑Fi MCUs, offering local control without vendor clouds. On this camera, flashing it enables GPIO control and configuration, but camera and microphone support are not implemented yet. It’s valued for privacy and flexibility. [Elektroda, divadiow, post #21772962]