I’ve managed to get some info on RS485 it uses RJ45 connector with the following pinout
PIN4 → A/+
PIN5 → B/-
PIN7 → +12V
PIN8 → GND
Regarding the protocol being used for screen is Modbus RTU at 19200
I was able to get some messages decoded with IONinja but modubus message lengths are all wrong most of them have length which is not multiple of 2 bytes and. And messages are somewhat fine until touch screen is connected. Connecting the screen starts returning all sorts of bad data and most of the messages have invalid checksums. But I was able to get some messages decoded when it send the firmware version of the screen on the bus.
Maybe they are using some sort of custom modbus implementation so a further debugging is needed. I’m working for the first time with modbus so any suggestions from someone with experience are welcome
In any way i think modbus is very complex protocol for remote control. Getting info on RS232 will be a way better solution but I don’t have the 4 heat module to be able to sniff the communication.