logo elektroda
logo elektroda
X
logo elektroda

Battery-powered doorbell with camera and app - inside, what to look out for

p.kaczmarek2 1731 9

TL;DR LABEL_AI_GENERATED

  • A battery-powered video doorbell kit pairs a camera/button unit and USB-powered chime with the Aiwit app over 2.4 GHz Wi‑Fi, not Tuya.
  • The camera sleeps to save battery, wakes on button press, scans a QR code for setup, and then supports live video, two-way talk, and notifications.
  • Inside are a YW 803035 800 mAh 3.7 V 2.96 Wh battery, an XR872AT Wi‑Fi chip, a 2MB 25QH32 flash chip, and a second antenna.
  • The firmware dump was read with CH341 and reprogrammed after adding a capacitor to the power supply, but the camera controller still does not work with OBK.
  • The app was removed from Google Play, and video history is chargeable, which weakens the doorbell’s usefulness.
AI summary based on the discussion. May contain errors.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Listen:
  • Battery-powered doorbell with camera and app - inside, what to look out for
    Ever wondered how it works and how a battery-powered doorbell with a camera is built, in addition to interacting with a mobile app via Wi-Fi? Here, I will try to demonstrate this. I will also see if it is possible to program the microcontroller from inside.
    Battery-powered doorbell with camera and app - inside, what to look out for
    The kit comes with a battery-powered module with camera and button, and a separately USB-powered receiver to play the ringtone.

    Let's start with the pairing.
    Before starting, it is a good idea to connect the product to the power supply. A regular USB C cable will suffice. On your phone we download the app Aiwit . On Google Play at the link com.eken.aiwit we find:
    Battery-powered doorbell with camera and app - inside, what to look out for
    The app has been removed - fortunately it is still possible to download it from the manufacturer:
    Battery-powered doorbell with camera and app - inside, what to look out for
    We launch, register.
    Battery-powered doorbell with camera and app - inside, what to look out for Battery-powered doorbell with camera and app - inside, what to look out for
    We select our product type from the list. You can look by the images:
    Battery-powered doorbell with camera and app - inside, what to look out for Battery-powered doorbell with camera and app - inside, what to look out for
    We follow the instructions:
    Battery-powered doorbell with camera and app - inside, what to look out for
    To enter the pairing state, hold down the button longer. After a moment, the LED will start flashing and we will hear "entering pairing mode".



    The application will ask us for our Wi-Fi details - we need to enter the location of the 2.4 GHz network.
    Battery-powered doorbell with camera and app - inside, what to look out for
    The app will turn our Wi-Fi data into a QR code, which we then have to let the camera scan:
    Battery-powered doorbell with camera and app - inside, what to look out for
    I didn't get it right the first time:
    Battery-powered doorbell with camera and app - inside, what to look out for
    Eventually it should work - the camera connects and the app offers us a paid plan:
    Battery-powered doorbell with camera and app - inside, what to look out for Battery-powered doorbell with camera and app - inside, what to look out for
    You can get one premium day for watching the ad:
    Battery-powered doorbell with camera and app - inside, what to look out for Battery-powered doorbell with camera and app - inside, what to look out for
    The camera can then already transmit images:
    Battery-powered doorbell with camera and app - inside, what to look out for

    Basis of operation
    The camera module is normally asleep and not connected to Wi-Fi. This helps to extend the battery life. Only pressing a button wakes it up. The video shows how quickly the phone responds to a ringtone.



    When we pick up, we can see who is ringing the doorbell. There is also an option for two-way communication. If we are late, we have a notification and video footage in the history in the app.
    Battery-powered doorbell with camera and app - inside, what to look out for
    After clicking on the notification, we still have the option to decide if we are sure we want to receive it:
    Battery-powered doorbell with camera and app - inside, what to look out for
    This is the story, unfortunately here it is paid for, which spoils the point of this product somewhat:
    Battery-powered doorbell with camera and app - inside, what to look out for

    Settings in the app
    In the app we have control of the volume level, product information (firmware, Wi-Fi, etc.), battery status and the possibility to share:
    Battery-powered doorbell with camera and app - inside, what to look out for Battery-powered doorbell with camera and app - inside, what to look out for


    Camera response time
    Let's check how much latency the video sent by the camcorder has;





    Interior of the camera
    Now perhaps the most interesting part. Inside is a YW 803035 800 mAh 3.7 V 2.96 Wh battery and a single board. You can also see the antenna.
    Battery-powered doorbell with camera and app - inside, what to look out for
    Removing the board. You can already see the XR872AT Wi-Fi chip and the second antenna on the PCB. You can also see the two quartz resonators. It can be judged that probably one chip is the Wi-Fi connectivity and the other is the RF to the module that plays the ringtone.
    Battery-powered doorbell with camera and app - inside, what to look out for
    Here is the Wi-Fi chip section - the software is on a 25QH32 flash bone, which is 2MB in size.
    Battery-powered doorbell with camera and app - inside, what to look out for
    This memory can be soldered out and read using CH341.
    Battery-powered doorbell with camera and app - inside, what to look out for
    Memory in the process of being read out:
    Battery-powered doorbell with camera and app - inside, what to look out for
    Battery-powered doorbell with camera and app - inside, what to look out for
    Copy of the batch (XR872_Doorbell_T2Kemet_CH341_25QH32CHIG):
    https://github.com/openshwprojects/FlashDumps/commit/f91d84604147e8c4b082f8e160d2c815af87a415
    There is an interesting problem with this memory - I could not overwrite it (clear and program it) until I added a capacitor to the power supply :
    Battery-powered doorbell with camera and app - inside, what to look out for
    Other side of the plate:
    Battery-powered doorbell with camera and app - inside, what to look out for
    Camera:
    Battery-powered doorbell with camera and app - inside, what to look out for



    The microcontroller from the middle is supported by OBK , but we do not have a camera controller yet. Only the GPIO can be controlled:



    Details:
    https://www.elektroda.com/rtvforum/find.php?q=XR872
    https://www.elektroda.com/rtvforum/find.php?q=XR872AT
    The batch can be uploaded directly to Flash memory (via CH341), or via the UART in PhoenixMC (as long as the device has the bootloader enabled).

    At this point it is unclear at what stage we will be able to get the camera working.


    Summary
    The product in question is just more of a curiosity for me. I was interested to check its operation and interior, and even managed to change the batch, but we have not yet launched the camera itself, so its programming is just a curiosity for now.
    This removed app from Google Play does not bode well - I wonder what they deleted it for?
    From a practical angle, however, I have some doubts here. Firstly, how is this ringtone supposed to be fixed to the wall so that someone malicious doesn't steal it? Secondly, what is the point of a bell that has to be dismantled from time to time for recharging? Thirdly, unless I'm mistaken, video history is chargeable, so why do we need such a doorbell with a camera if we're not going to find out who was at the door when we failed to answer anyway....
    Fourthly - and this will be the final nail in the coffin - this product doesn't pair with Tuya, it pairs with Aiwit, so it requires another little-known phone app to operate. And who knows where this video is being streamed....
    In summary , this product is for me for the moment a platform for experimentation with the XR872 and we may soon see what comes of it.

    Cool? Ranking DIY
    Helpful post? Buy me a coffee.
    About Author
    p.kaczmarek2
    Moderator Smart Home
    Offline 
    p.kaczmarek2 wrote 14763 posts with rating 12893, helped 659 times. Been with us since 2014 year.
  • ADVERTISEMENT
  • ADVERTISEMENT
  • Aiwit APK decompilation reveals app settings structure

    #3 21732160
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14763
    Help: 659
    Rate: 12893
    Aiwit app backup from APKPure - Aiwit_3.4.8_APKPure.xapk

    Following can be opened with, for example, jadx-gui-1.5.3.exe, to see code.
    jadx-gui IDE showing decompiled Java code and class duplication warning messages

    Some curious settings and stuff:
    Code: Java
    Log in, to see the code
    Attachments:
    • Aiwit_3.4.8_APKPure.zip (61.06 MB) You must be logged in to download this attachment.
    Helpful post? Buy me a coffee.
  • #4 21738177
    akeilox
    Level 2  
    Posts: 3
    found this thread with help of @divadiow

    Please share your further findings as you progress, another curious mind here.
  • ADVERTISEMENT
  • XR872ET variant identified in white doorbell case

    #5 21774125
    divadiow
    Level 38  
    Posts: 5215
    Help: 448
    Rate: 917
    I have one now too. White case, seems to be the Kement type @insmod bought.

    XR872ET variant.

    White box with illustrations and the label “MINI DOORBELL” on top. Video doorbell and receiver in an open box on a desk Label with QR code and markings on a white folded cardboard box Interior of an electronic device showing a 3.7V Li-Po battery and circuit board Electronic module with camera and ICs on black PCB with USB connector Close-up of a PCB with camera lens and XMC microcontroller PCB with electronic components and Wi-Fi module on a blue background PCB section labeled MINI01-ET_MAIN_V3.1 with date 2025-06-26 and connectors

    Camera module with lens on flexible ribbon cable on blue background
  • ADVERTISEMENT
  • Bootloader patch disables flash debug mask logging

    #6 21946440
    divadiow
    Level 38  
    Posts: 5215
    Help: 448
    Rate: 917
    with a little tweak to the bootloader on Kement XR872ET dump we can change
    HAL_Flash_SetDbgMask(0);


    Code: Text
    Log in, to see the code


    this only then gives this log out though

    Code: Text
    Log in, to see the code


    Added after 2 [hours] 47 [minutes]:

    silent no more!

    Code: Text
    Log in, to see the code
  • #7 21946558
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14763
    Help: 659
    Rate: 12893
    Very interesting, how did you find that this exact call is HAL_Flash_SetDbgMask?
    
    A1 F5 39 FE    BL HAL_Flash_SetDbgMask
    

    BL is "branch with link", so basically a call, that's obvious, but how did you determine the rest of it?

    Also, you're lucky no CRC there...
    Helpful post? Buy me a coffee.
  • Label identified from SDK symbol map and bootloader source

    #8 21946629
    divadiow
    Level 38  
    Posts: 5215
    Help: 448
    Rate: 917
    Quote:
    The name came from resolving the branch destination and matching it against the XR872 SDK’s ROM symbol/linker information, then checking the surrounding code against the SDK bootloader source.

    In bl_hw_init(), the SDK calls HAL_Flash_SetDbgMask(0) immediately before flash initialisation, and that sequence matches the disassembly. So the label was based on the symbol map and matching source context, rather than being inferred from the BL instruction itself.


    :)
    Attachments:
    • Kement_XR872ET_APPLOG_snapshot_callback_v9.zip (650.43 KB) You must be logged in to download this attachment.
    • XR872ET_v9_UART_logging_patch_technical_note.txt (8.36 KB) You must be logged in to download this attachment.
  • #9 21946675
    divadiow
    Level 38  
    Posts: 5215
    Help: 448
    Rate: 917
    I'll do your XR872AT Kement next then flash to that T-Mall module I have
  • XR872 doorbell boot log and Wi‑Fi startup details

    #10 21947234
    divadiow
    Level 38  
    Posts: 5215
    Help: 448
    Rate: 917
    your XR872AT Kement:

    Code: Text
    Log in, to see the code


    crash maybe because it's running on this monster and not your hardware

    Battery-powered doorbell with camera and app - inside, what to look out for
Listen:

Topic summary

LABEL_AI_GENERATED
The discussion analyzes the internal construction of a battery-powered Wi‑Fi video doorbell with a camera and separate USB-powered chime receiver, including pairing with a mobile app and the possibility of reprogramming the onboard microcontroller. The app used is Aiwit, which was removed from Google Play but can still be obtained from the manufacturer or APKPure and inspected with JADX. Later posts identify the device as a white Kement-type unit using an XR872ET variant, with photos of the internal hardware shared for further analysis.
AI summary based on the discussion. May contain errors.

FAQ LABEL_AI_GENERATED

TL;DR: This DIY-friendly doorbell runs on an 800 mAh Li‑ion pack, and “the camera module is normally asleep” to save power. Pair via Aiwit with a QR scan; firmware sits on a 2 MB SPI flash you can dump with CH341. [Elektroda, p.kaczmarek2, post #21731897]

Why it matters: If you’re choosing or hacking a battery camera doorbell, this FAQ shows what works, what breaks, and what to avoid for real-world use.

Quick Facts

How do I pair the doorbell with the Aiwit app?

  1. Power the doorbell via USB‑C and install Aiwit. 2. Hold the front button until the LED flashes and you hear “entering pairing mode.” 3. Enter 2.4 GHz Wi‑Fi in Aiwit, show the QR to the camera, and wait for connection. [Elektroda, p.kaczmarek2, post #21731897]

Does it work on 5 GHz Wi‑Fi?

No. The setup flow requires a 2.4 GHz SSID. The app encodes your 2.4 GHz credentials into a QR code that the camera scans to join the network. [Elektroda, p.kaczmarek2, post #21731897]

How quickly does the doorbell wake when pressed?

It sleeps to extend battery life and wakes on button press. The ringtone and phone notification arrive promptly in the author’s tests with two‑way talk available on pickup. “The camera module is normally asleep.” [Elektroda, p.kaczmarek2, post #21731897]

What’s inside this battery doorbell?

A 3.7 V 800 mAh pack, PCB with XR872AT Wi‑Fi SoC, dual antennas, two crystals, and a 25QH32 2 MB SPI flash for firmware. A separate USB‑powered chime handles the ringtone. [Elektroda, p.kaczmarek2, post #21731897]

Can I dump or reflash the firmware?

Yes. You can desolder and read the 25QH32 with a CH341 programmer, or use UART via PhoenixMC if the bootloader is enabled. Note the author needed a supply capacitor to erase/program reliably. [Elektroda, p.kaczmarek2, post #21731897]

What’s OpenBeken (OBK) support like here?

The XR872 microcontroller is supported by OBK for GPIO control. The camera subsystem is not supported yet, so video capture does not work under OBK at this time. [Elektroda, p.kaczmarek2, post #21731897]

What if the Aiwit app disappears from app stores?

The Google Play listing was removed, but the app still installs from the manufacturer’s source used by the author. Keep a local backup in case distribution changes. [Elektroda, p.kaczmarek2, post #21731897]

Is there any code or SDK info from the app?

Yes. A decompile of Aiwit_3.4.8 shows ad/consent logic and reports SDK_VERSION “6.12.1.” This helps assess embedded ad behavior and permissions prompts. [Elektroda, p.kaczmarek2, post #21732160]

How is the indoor chime mounted and secured?

The thread flags a risk: the USB‑powered chime lacks a clear anti‑theft mounting method. Consider placement where unplugging is difficult or use physical retention. [Elektroda, p.kaczmarek2, post #21731897]

Any privacy or data‑routing concerns to know?

Yes. The author questions where Aiwit streams video and highlights reliance on a lesser‑known app and paid cloud. Treat it as a risk until verified. [Elektroda, p.kaczmarek2, post #21731897]

Who is this product best for right now?

Tinkerers and firmware developers. The author uses it as a platform to explore XR872 and flash workflows, since full camera control under OBK is pending. [Elektroda, p.kaczmarek2, post #21731897]

Is anyone working on adding camera support?

Community members expressed interest in developing camera support and following progress, but working video under OBK is not available yet. [Elektroda, divadiow, post #21732101]

What’s a common failure/edge case during flashing?

Erase/program may fail without stable power. The author solved repeated write issues by adding a capacitor to the flash’s supply rail. [Elektroda, p.kaczmarek2, post #21731897]

Can I see latency or responsiveness measurements?

The thread includes latency demonstration videos showing prompt ringtone and notifications after a press. Use them to judge wake‑to‑notify behavior. [Elektroda, p.kaczmarek2, post #21731897]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT