No such luck yet, but I haven’t really done too much more work on account of opening the device constantly is a pain in the neck.
The most I managed to get out of it is that the TSW boot hangs persisted through factory resets - basically everything short of actually performing a firmware restore. Which brings me cleanly to…
My theory is once TSS is hacked you may need to run a firmware update at that point.
This is effectively what I did from recovery mode. The device thought it was a TSW, but the firmware update from recovery wiped out my patch changes and restored normal functionality. I suspect that either UBoot itself will need to be patched, or we figure out what/where that value comes from, and how to access it.
That being said, I do want to ask why we need to convert a TSS into a TSW. Other than the entire cool factor, does it (somehow) make working with the device more reasonable?
At what point would it be easier to just figure out how to run LineageOS and write new (Home Assistant friendly) control code for the hardware buttons and the backlights? Web portals are nice and all, but if we could actually start leveraging their hardware accordingly (especially getting button presses), it’d be far more useful I’d think.