Tuya Curtain Motor custom component with set position and realtime feedback

Update to the post above i soldered USB-UART to the pin header top right of the board and got this when pressing RF remote (close button, then fully closed, open button, then fully open):

55 AA AA 55 97 22 03 0A - 0A 00 00 00 01 00 64 01    U..U."..  ......d.
01 01 00 01 01 01 55 AA - AA 55 35 22 03 0A 0A 00    ......U.  .U5"....
00 00 01 02 00 01 01 01 - 00 01 01 01 55 AA AA 55    ........  ....U..U
34 22 03 0A 0A 00 00 00 - 01 01 00 01 01 01 00 01    4"......  ........
01 01 55 AA AA 55 99 22 - 03 0A 0A 00 00 00 01 02    ..U..U."  ........
64 01 01 01 00 01 01 01 - 00 03                      d.......  ..

I tried to send 55aa000600056604000100 throug UART but there was no reaction at all.

This UART header is connected to 8 pin connector and UM8005 MCU. Also there is connection between TYWE1S and UM8005.

Example of message when open button is pressed on the remote

55 AA AA 55 34 22 03 0A 0A 00 00 00 01 01 00 01 01 01 00 01 01 01

UPD: As far as i understand there is 3 MCU’s, TYWE1S <-----> UM8005 <-----> ??? (inside of motor case, which i can not open because of secret bolt heads) and i’m spying between UM8005 and ???, there is no communication between TYWE1S and UM8005 at all.

@ps1x Did you ever get this hammered out? I just received a Zemismart curtain motor with this exact board. Thanks!

I just took second attempt, no luck so far, now i scanned wires coming to wifi board with oscilloscope and there is silence. I will research more and update if find a way to make it work.

If you still have original firmware working and can sniff what goes from TYW1S to internals that will help alot, because protocol seems to be much different from what we have in this thread:

55 AA AA 55 64 22 03 0A 0A 00 00 00 01 01 31 01 01 01 00 00 01 01 open
55 AA AA 55 65 22 03 0A 0A 00 00 00 01 02 31 01 01 01 00 00 01 01 stop
55 AA AA 55 63 22 03 0A 0A 00 00 00 01 00 31 01 01 01 00 00 01 01 close

these messages are sent from internals to outside when i press 433mhz remote buttons