Teardown of the Wyze Outdoor Camera (after a hurricaine)

My parents were hit by Hurricane Ian. They're okay, their dog is okay, their house is mostly okay. But they had a Wyze Outdoor Cam stationed outside. Long story short, it didn't make it. But it's somewhat hard to find a guide for tearing the Wyze Outdoor Cam down. So I decided to document some of the internal stuff.

To get entry to the camera, you have to poke through the rubber on the bottom with a Phillips head screwdriver. There are four screws on the bottom. Here's an image from u/Gristle_1's comment on a Reddit thread that guided me to the screws:

Once those are out, you're able to remove the bottom plate and reveal the insides:

You can immediately see that water entered the device and caused a lot of rusting and corrosion. Our first victim is the power board. This board appears to be responsible for battery management and power delivery. You can see on the bottom that there's some corrosion, but the other side looks... well... really bad. Two screws to remove this board, as well as a flip-up ribbon connector and a pull out battery connector.

Yeah, that's not good. while cleaning it, I knocked off a resistor, so the corrosion is bad enough to cause solder joints to fail. That's not a good sign.

Removing the battery cover is the next step. It's held in with two clips on the sides. You can avoid breaking them by squeezing the camera body a bit so the things they hold on to let go. There's also a rubber thing attached to this part as well. It can just be looped out. It doesn't hold the battery cover to the body, it's just in the way. Once the clips are handled, the plastic battery cover can be removed.

The battery pack underneath is a 19.24Wh 7.4V LiPo pack. It's attached to the back wall with adhesive. Use a pry tool to remove it, but be careful not to damage the structure of the battery itself.

The next (and last) thing to come out of the camera body is the PCB sandwich. All the way inside the camera body, there's a screw. As someone on the Wyze Forums doing the same thing points out:

There is one screw that can be difficult to remove. It is down inside the camera. The printed circuit boards are attached to a carrier which slides out of the housing once this screw is removed. Don’t use a Philips screwdriver with a pointed end. The drive is very shallow compared to the other screws, so a nice pointy Philips screwdriver will bottom out and the head will be damaged

Once this screw is out, grab a small towel, put it over the lens on the outside of the camera, and push in with your thumb until the rubber seal gives way. The entire assembly should slide right out after that. While I was doing this, the ribbon connector for the PIR sub-board literally flaked off the main PCB. So that's just great.

On the front we can see some more corrosion, this time to the microSD card bay. The rest of the board seems intact, though. We can see the hole for the PIR sensor (which I removed and pictured below) as well as the main camera lens. 

The back of the assembly shows us the back of the main board. The main IC of interest is the wireless looking one: the Azurewave AW-NB197SM. This handles multiple modes of Wi-Fi and Bluetooth and FM communication. Some more passives here, as well as the extensive damage to the bottom left corner where you can see the PIR ribbon cable just came off in my hand (well, most of it at least).

To remove the PIR sensor, you (normally) have to disconnect the thin ribbon connector and remove the main backboard from the sandwich. Only undo the big screws, the small screws toward the center of the board hold the lens to the camera sensor.

There's a significant amount of crud around the PIR sensor - not sure how water got here. The PIR sensor interfaces through a thin piece of plastic on the front of the camera. Ingress must have occurred at the charge port and really got through the camera.

Removing the front board with the IR LEDs is easy. It reveals the processor trapped under the lens assembly:

The processor is an Ingenic T20 - a popular SoC among cheap security cameras - that features a 1.25GHz MIPS processor, 512MB or 1GB of RAM, video hardware to encode H.264 video as well as provide some of Wyze's Features like face and figure recognition as well as some other stuff you'd expect from this class of SoC in terms of peripherals.

Maybe you can see it in the picture above, but there's something wrong with the SoC. Let's zoom in a bit:

It looks like something happened inside the chip - perhaps it shorted so badly that an internal voltage regulator overheated and blew the epoxy covering the chip. Either way, there's so much wrong with this camera - including stuff I didn't even picture (some of the PCB around the aforementioned ribbon connector was flaking off, it was bad) - that it's likely not going to turn on ever again. Such a shame, but I certainly didn't need another project to work on.

In terms of what could be salvaged from this... passive generally aren't worth it. The Azurewave IC could be interesting, and the two chips on the front of the mainboard that may be SPI Flash that contains firmware could be interesting to dump. If my battery pack was in better shape, that's a good salvage. The speaker is probably destroyed, but the microphone might still be good. The majority of this, however, is unfortunately e-scrap.

So take it from me: Wyze Outdoor Cameras might be waterproof, but they're not hurricane proof. My dad said it was dead long before Ian came through, but the hurricane certainly didn't help things.