a rotating camera-and-microphone that watches over an aging parent, detects falls on-device, and texts the family
Taking firmware from Wyze ROM
Our rig: ESP32, Raspberry Pi, sensors, mic, speaker, and a stepper that aims the camera.
Wyze Human Detection
Wyze Cam v4 firmware booting under emulation on hardware we control.

Inspiration

Your home security camera records the most private rooms in your house, uploads that video to a company's cloud, and decides there what counts as an event. We wanted to see how far that really goes, so we took two popular cameras apart and then built the private one they should have shipped.

What it does

Wyzer is a home-safety camera for older adults who live alone. It detects falls and emergencies on the device, in the home, and the video never leaves the room. On a possible fall it speaks to the person and asks if they are okay. If there is no clear answer, it alerts family. A dashboard shows live status, the camera view, and the room's sensors, and a motorized head can turn the camera toward sound.

How we built it

Reverse engineering, Wyze Cam v4. We did a full flash dump and analysis of the firmware (Ingenic T41, version 4.52.4.9887). Its motion detection is classical computer vision, frame to frame differencing in libmove_inf.so, not on-device AI, and it uploads video to AWS over Kinesis Video Streams and Wyze's REST API signed with AWS SigV4. We then got Wyze's own firmware to boot outside their ecosystem, under emulation on hardware we control.

Reverse engineering, TP-Link Tapo TCW61. We interrupted the bootloader during its autoboot window over the serial port to get a root shell, and confirmed we could read its flash directly. It defends itself with signed firmware verification and an encrypted root filesystem, and we documented how it resists.

Our rig. Original hardware: an ESP32, a camera, a PIR motion sensor, infrared, a MAX4466 microphone, a speaker, and a stepper motor that turns the head. Our own fall-detection model runs locally on a Raspberry Pi. No cloud. A local pipeline moves camera frames through the model, drives a family dashboard, publishes events over MQTT, runs a phone-based voice check-in, and aims a sound-seeking head.

Challenges we ran into

Booting proprietary firmware without the original hardware: it stalls at hardware init because user-mode emulation has no image sensor to read, so there are no live frames. The Tapo defends itself with firmware verification and encryption. Running everything offline over a single camera Wi-Fi link caps the frame rate. And we worked to keep every technical claim precise and defensible.

Accomplishments that we're proud of

We ran a commercial camera's own firmware outside its cloud. We built an original, fully local fall-detection camera from scratch. And it is private by construction: a camera with nowhere to send your footage cannot leak it.

What we learned

A lot of what is marketed as AI in consumer cameras is classical computer vision plus a cloud. Secure boot and firmware encryption raise the bar, but boot-time attack surfaces remain. On-device inference is practical for safety use cases, and it removes the privacy cost of the cloud.

What's next for Wyzer

Harden the sensor suite, including microphone direction-finding and the motion sensor. Expand the on-device models to seizure and distress detection. Build a proper enclosure and a simple setup flow for families.