Installing 3rd party apps/firmware on Shelly Wall Display

WARNING WARNING WARNING: Under construction.
WARNING: I take no responsibility for ANYTHING that will happen to you or your device.
WARNING: This device have connection to MAINS, so there is a small part of it exposed to 230V, this is dangerous to touch. If you do not feel comfortable either power device with safer source (read below) or get help from electrician.

About the device:
Shelly wall display (from now on “Stargate” that is codename of device) consists of 3 PCB’s. One is PSU and relay located in de-attachable part behind the device, connected via 16 pins to next board, to get to this board de-attach back part, by removing one screw at the bottom of the switch and pulling them apart, then on the side where pins are located remove 3 screws and remove cover. Second one is located inside the main chasing, it is a board that connects to psu and to main board with an FPC, a kind of adaptor (you can get there by de-attaching back one) and then removing 4 screws in the corners on part where there are no pins, then lift the cover, but be careful there is fpc between parts, disconnect FPC from any side. Third one is the only blue board, its a mainboard located under same cover as previous one. It have 3 FPCs: white one is going to adapter and PSU, second is vide black fpc going to display and 3rd, brown FPC is going to temp and humidity sensor. On top there is 1 uFL connector for antenna (antenna itself is located on top plastic insert), and there are 4 wires 2 for speaker and 2 for microphone. Als there is a USB-C connector on left side.

PSU board:


Adapter board:


Main board:

Powering the device:
There are 2 way to power the board:

  1. Connect adapter board to PSU and motherboard supply 230V to PSU, while in general its safe as long as PSU cover is in place, there still is an exposed screw of the psu connector.
  2. You can supply 5v 1A+ to your adapter board yourself, following this image:

    Then you can connect adapter to motherboard.

About stock software:
The firmware is very typical for Mediatek SoC’s there is little kernel based bootloader, and linux 3.18 with android 7 on top. But shelly did preinstall their app as launcher, and re-implemented most settings in it. Belove i will describe a way to get out of the app.

Getting custom software to run on the device without soldering:
This will break stock Shelly app, it is likely trivial to restore but i didn’t try. First of all you will have to disassemble a device to get to usb c hidden inside. Follow instruction in https://github.com/bkerler/mtkclient/blob/main/README.md to install mtkclient, it is avalible for Linux and Windows after doing so run:

/path/to/mtkclient/mtk rl dump

Make sure folder you are currently in have 8GB free space. While that is running connect usb C to a cable to pc and device, after that connect power to device. After that you should see backup progress, it will take a long while, around 20 minutes. Disconnect power, run

/path/to/mtkclient/mtk e metadata,userdata

Connect power back, after that command finished, disconnect usb and reconnect power. Device should show “Erasing” for a moment and reboot itself, after boot you will see shelly app with error message, but this time navigation bar on bottom and status bar on top will appear. Swipe from top to open quick settings, in there on bottom right there is a gear icon, click on it to open android settings, got to the bottom and open “About tablet” click on build number 7 times, go back and open an entry “Developer options” that did just appear. Here you can enable USB debugging, and use adb normally. So you can install apps. To restore shelly app you likely need to copying stuff from your backup, specifically a userdata. It is unencrypted so should be easy. Sorry for bad English. Anyway i will work to make process simpler. And i will likely build custom rom based on newer android, and one that will be easier to work with.

12 Likes

Hi Luka,

I was reading the manual and figured there wasn’t any protection onboard the device itself, relying completely on the breaker instalation to be 5A max to protect the device itself.

manual says "The Device and the load current circuit has to be secured by a
cable protection switch in accordance with EN60898-1 (tripping characteristic
B or C, max. 5 A rated current, min. 6 kA interrupting rating, energy limiting
class 3)"

I am not good at analyzing circuits
I found your post while considering alternatives to protect the device from overload etc.

Relating to your suggested option of powering the device using the pins on the adapter board to power the device.
Is the 5V 1A you mention actually DC (I assumed but did not verify).
Does the AC-DC conversion normally take place on the PSU board?
Is there any protection in place anywhere on the boards?
Is this expected from the DC supply connected to the PINS?

Hope you can inform.

Yes it is DC, AC DC conversion takes place on PSU board. Yes those pins supply power as well as signal for relay and may be current measurement? I would not relay on any protection on board.

1 Like

Im trying to follow https://github.com/bkerler/mtkclient/blob/a89a014f48ed79553dd18c97bd5f380c59eb33cc/README.md.
I use linux. python is installed. However when I try to boot the device with USB cable attached I got garbage on the screen. When I boot the device without cable, Shelly starts. If I connect the USB cable when booted the wall display is seen on both Linux and Windows (tried both).

Any ideas?

Hey,
That also happened to me. But it was just bad contact because i moved the screen a lot to connect the cable. For me, the fix was unplugging usb and power, putting it back together and when taking it apart again being very careful to keep everything as close together as possible.
Hope that does it for you.

I followed this guide and then installed a simple launcher and some apps, but i tried accessing ha thru fully kiosk and it doesn’t work. Fully kiosk says I need to updated the WebView. I tried doing that using the same method as for the tuya S6E (https://www.homeautomationguy.io/blog/home-assistant-wall-panels-with-a-tuya-s6e[https://www.homeautomationguy.io/blog/home-assistant-wall-panels-with-a-tuya-s6e]) but that didn’t work because the modules are for different architectures/android versions.

Anyone manage to run the ha app or fully kiosk? Any ideas?

PS: i did manage to use ha on chrome but I was hopping to take advantage of fully kiosk

Hey,
That also happened to me. But it was just bad contact because i moved the screen a lot to connect the cable. For me, the fix was unplugging usb and power, putting it back together and when taking it apart again being very careful to keep everything as close together as possible.
Hope that does it for you.

I just cut power and remove the USB from the computer. And it boots Shelly.
I enter the USB in the computer (not touching the wall display) it recognize as Stargate / MediaTek.
When I then cut power again with USB attached to the compuer, the screen is garbage again.
And if I remove USB from computer again and cut power it will reboot to Shelly.
Really strange…
In the shelly software I can reboot it without problems, but it boots into Shelly.

Seems like you need to power on the wall display in the exact moment when the python script is searching for the device. :slight_smile:

Port - Device detected :slight_smile:
Preloader - CPU: MT6580()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11005000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x1020ac00
Preloader - Var1: 0xac
Preloader - Disabling Watchdog…
Preloader - HW code: 0x6580
Preloader - Target config: 0x0
Preloader - SBC enabled: False
Preloader - SLA enabled: False
Preloader - DAA enabled: False
Preloader - SWJTAG enabled: False
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - Get Target info
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
DA_handler - Device is unprotected.
DA_handler - Device is in Preloader-Mode :frowning:
DALegacy - Uploading legacy da…
DALegacy - Uploading legacy stage 1 from MTK_AllInOne_DA_5.2152.bin
legacyext - Legacy DA2 is patched.
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DALegacy - Got loader sync !
DALegacy - Reading nand info
DeviceClass - USBError(19, ‘No such device (it may have been disconnected)’)
Traceback (most recent call last):
File “/opt/mtkclient/mtk”, line 740, in
mtk = Main(args).run()
File “/opt/mtkclient/mtkclient/Library/mtk_main.py”, line 556, in run
mtk = da_handler.configure_da(mtk, preloader)
File “/opt/mtkclient/mtkclient/Library/mtk_da_cmd.py”, line 112, in configure_da
if not mtk.daloader.upload_da(preloader=preloader):
File “/opt/mtkclient/mtkclient/Library/mtk_daloader.py”, line 202, in upload_da
return self.da.upload_da()
File “/opt/mtkclient/mtkclient/Library/mtk_dalegacy.py”, line 1103, in upload_da
if self.upload():
File “/opt/mtkclient/mtkclient/Library/mtk_dalegacy.py”, line 1046, in upload
nandinfo = unpack(“>I”, self.usbread(4))[0]
struct.error: unpack requires a buffer of 4 bytes

Some USB error, will try to find the problem.

I just run in in Chrome in fullscreen mode.

  1. Open Chrome.
  2. Navigate to the website or web page you want to pin to your home screen.
  3. Tap the menu icon (3 dots in upper right-hand corner) and tap Add to home screen.
  4. Choose a name for the website shortcut, then Chrome will add it to your home screen.

I found my problem, it was something wrong with the USB port.
I managed to backup the data.
But I cant do the lock.

mtk da seccfg unlock

I get:

Unknown seccfg partition header. Aborting unlock.

Any ideas?

You can do:

mtk e metadata,userdata

instead of unlock

That happens if you boot with usb connected. It do affect only display, and only till next reboot without usb connected

Thanks, it worked! :slight_smile:
Need to figure out how to autostart web browser.

I installed Chrome and then tried:

adb shell am broadcast -a android.intent.action.BOOT_COMPLETED -n com.android.chrome/org.chromium.chrome.browser.ChromeTabbedActivity

But no luck. :-/

I don’t have that option, what version of chrome are you using? And what launcher?

What version of Chrome did you install? I tried several variants: 114-119. The ARM64 variant install ith ADB never ends, I let if for 2 hours but it just stays in “Performing Streamed Install”, and the X86 variant installs but it keep crashing at start. Help please…

This one,

Hi
So can you confirm that if I manage to unlock launcher, I won’t be able to install HA Companion?

Any chance someone managed to update the HTML viewer/WebView component? Due to it being outdated, the HomeAssistant app is not working…
I managed to start Firefox and display HA this way, but it’s not the best - the scrolling display makes the whole UI almost unusable and Firefox does not have something like Kiosk mode…

I managed to update the system’s WebView with a more recent version from Bromite. In fact, I used v93, because that version still had the same package name (com.android.webview) as the pre-installed one. It’s from October 2021, so not brand new, but at least it seems to be working much better that the stock WebView.
(My attempts to update to an even more recent version didn’t work, although I tried to modify the static references to the WebView package name in the device’s framework-res.apk :man_shrugging:)

I’m not using HA, but I had the same problem when running the openHAB client on the display. After upgrading to Bromite WebView v93 everything seems to be working for openHAB, so it might also work with the HA app.

1 Like