To open the speaker you have to unglue the back plastic cover, to do so I have use ad heat gun ando some IPA, unfortunatly i don't had the correct nozzle/temperature combination and during the removal the back cover is now bended.

Below the cover you can find the scrws that keep the speaker together as a bick.

Once you remove the screws you have to apply some force to remove the back lid. The borders of that lid have a foam coating/tape to create a air tight chamber.

In the folowing photo you can see with a bit more details the foam thy used to close all the gaps:

Thoose are all the main parts of the speaker, you will see that it have a bass-reflex design instead of the more common passive woofer type.

There are two PCB, the main one have the class D or AB, the charge circuit and other misc stuff. The other is the BT module.

Lets analyze the PCB in more details

On the right we can see a OTP microcontroller, it just take some inputs and control the status of the BT module via some GPIOs, it also manage the STATUS (White) LED. The BT module can trigger two LED blynk pattern but I cannot find a way to create a real world case for the slow blynk pattern.

They opted for another chip instead of "programming" the CSR8615 built-in LEDs controller. (Please note that the CSR BT chip has a OTP memory for the firmware that is set during manufacturing of the chip itself. The configuration is stored inside a SPI flash)

In the middle we can see the Amplifier the CS8323S it is a hybrid class D and AB amplifier, toggling a pin it can be turned into a different class (it is configured as D-Class) . This chip also have a DC-DC Buck controller in it, it is able to boost the input voltage to a higher value. There are two modes, it is configured to run at 6.5V
The MUTE pin is connected and controlled by the BT module. (There is a voltage divider mady by R32 and R33 even if the)

On the top left we can find a standard CN3085 Nickel-Metal Hydride Battery Charger IC, around it there are also some transistors, for now I don't have fully traced the charge circuit. Looks like that is present a Bypass MOSFET to connect directly the USB to the aplifier if the external supply is connected.

The charger have also thermal detection, so a proper NI-MH charge profile is used:

Both the MCU and the BT module runs at 3V3. IC5 is the regulator.

I have spent more time tracing the BT module and the connector between the two boards.

The result is the following diagram:

The line input and the MIC input is mixed/muxed somewhere and I still cannot figure out how they made it. IC7 and IC8 are (probably) OP-AMPs.

Unfortunatly after a lot of test and probing I have damaged something, a solder joint or the connector and now I get crappy noisy audio aut of the speaker.

The interesting part is the fact that both the BT module and the amplifier board have a lot of test point to hack into:

My initial idea was to modify the charge circuit to add a lipo/lion battery but the hole in the middle used by the stand make quite hard to find a god suitable battery.

More study is needed!

Useful links & Datasheets: