That is what I understood, yes. Although, it makes ZERO sense:
But it may be an indicator to spot a display that will most likely not work with this guide.
I now went “all-in” on the Sonoff NSPanel Pro, which seems to be identical and doesn’t come in a “newer version” with “Linux”… Bought via blackadders link to https://itead.cc/product/sonoff-nspanel-pro-smart-home-control-panel/ref/34/?campaign=nspanelpro&utm_source=admitad&admitad_uid=47dce73b43ab8a1fb248e9e6ef5589f2&tagtag_uid=47dce73b43ab8a1fb248e9e6ef5589f2
I am confused about which model comes with android.
On Blakadder,s page is listed Avatto, however, buyers above said is on linux. On AliExpress could not find one who is clearly on Android. Also, could not find to buy one from Smatek (min order is two).
Anybody has a link with one tuya t6e on android under 100$?! Thanks
Thinking to go for NS PanelPro. What’s the difference between the two? (Apart from ns panel comes with 2 gb ram)
One indicator could be:
Differences are stated in the original post in this thread this post: Tuya / Smatek "T6E" and ”S6E” 4-inch Control Panels for CCS (Central Control System) Android-based in-wall 4-inch smart display with touch screen now sold under many different brands - #11 by tilaksidduram
Hardware they are almost identical. NSPanel Pro must be running Android.
If you use NSPanel Pro, you need to first bind your eWeLink account, enter the device into developer mode through the eWeLink app, and launch ADB before you can install your small app
Exactly. Like I mentioned above
simply “enable developer mode in eWeLink app Device Settings” followed by “adb connect [ip_address]”
Thanks. I’ll go for Nspanel then, I’l trade RAm over screen considering Nspanel is sold cheaper than T6E, which is odd.
Same problem here, I sent a message to the seller to hopefully get some advice but so far I’m stuck and can’t sideload apps to the panel 
A user has found a way to get adb access to the Shelly Wall displays by soldering wires to the RX/TX pins directly and using a UART-USB adapter: Shelly Wall Display - #16 by zittix
Sadly I can’t find these pins on the TPP001-Z PCB we’re having issues with, as nothing has labellings… I tried to inspect it a bit, but had no luck identifying anything. I know which pins of the BGA of the CPU are the UART pins, but that sadly doesn’t really help
Page 17 and following: https://rockchip.fr/RK3308%20datasheet%20V1.1.pdf
If somebody else has a smart idea on how to find (potential) RX/TX test points on the PCB: Would be worth a try!
I’ve updated my post above with pics from the PCB with the heat cover removed and the back side: Tuya / Smatek "T6E" and ”S6E” 4-inch Control Panels for CCS (Central Control System) Android-based in-wall 4-inch smart display with touch screen now sold under many different brands - #61 by ezcGman
TX pins usually have an high idle-level - so either 1V8 or 3V3. after identifying such a pad, just hook up a matching ttl-uart to usb converter (or whatever flavour you like). no harm in just listening 
there is not much going on here after boot-up. so best reboot the screen after hooking up a receiver.
typically the RX pad is not far from the TX and is high-z - usually just a very low residual voltage or zero.
good hunting!
thx! I’ll give it a try, not sure when tough 
Did some quick poking around. Sadly no easy success.
I first tried the four holes, meant for a (not soldered) pin header ontop. Continuity tests showed that the two outer pins are both GND, middle ones are indeed connected to the MCU through two 22R inline resistors, leading to vias to the MCU. No pullups on those though. So not very promising and indeed silence on both of them.
I continued poking around all TPs with a test lead connected to the RX pin of my USB-UART and a GND wire to a GND pin on the PCB. But only found a single TP giving me any kind of output; everything else was silent. Tested multiple baud rates, all only gibberish. But that one pin also has no pull-up and looking closely, the via it’s connected to sits below the flash-memory, so I expected I was just listening to a traffic line between the MCU and the flash memory.
Again, sadly no other pin gave me any kind of output, tried rebooting it multiple times to poke on it very early, but still… Maybe I was just unlucky, maybe the RX/TX pins are not broken out anymore
I do have a microscope to maybe find TPs connected to vias with a pull-up, but that’s for later or another day…
I multimetered all TPs and marked those giving me 3v3 in red and those giving me 1.8 in pink:
Just in case people may consider the NSPanel now over the T6E, because of the issues sideloading apps to it, but read that people say that the screen of the T6E would be “better”, but not really specify what’s better:
I did an amateur side-by-side comparison and my personal opinion:
So I think if u use a dark theme u won’t really see a difference and if u don’t have a direct comparison or are very sensitive to warmer-whites, u won’t say that the NSPanel’s display is worse.
Maybe I could help!
those ARE the pins for TX and RX
Serial port baudrate 1500000
Here’s the boot message
DDR Version V2.05 20211014
CHIP ID = 0x00003308
REG2C: 0x00000032, 0x00000032
In
589MHz
DDR3
Col=10 Bank=3 Row=13 Size=128MB
OUT: sdram_init finish.
Boot1 Release Time: Oct 14 2021 09:58:10, version: 1.32
ROM VER:0x56323030, 19
chip_id:330800,0
ChipType = 0x13, 471
DPLL = 1300 MHz
...nandc_flash_init enter...
No.1 FLASH ID:ff ff ff ff ff ff
DPLL = 1300 MHz
sfc nor id: ff c8 52
DPLL = 1300 MHz
sfc_nand id: c8 52 c8
SFTL version: 5.0.56 20210329
SdmmcInit=0 NOT PRESENT
StorageInit ok = 269209
SecureMode = 1
Secure read PBA: 0x4
atags_set_pub_key: ret:(0)
SecureInit ret = 0, SecureMode = 1
atags_set_bootdev: ret:(0)
GPT part: 0, name: uboot, start:0x800, size:0x1000
GPT part: 1, name: trust, start:0x1800, size:0x1000
GPT part: 2, name: misc, start:0x2800, size:0x100
GPT part: 3, name: boot_a, start:0x2900, size:0x5800
GPT part: 4, name: boot_b, start:0x8100, size:0x5800
GPT part: 5, name: rootfs_a, start:0xd900, size:0xc800
GPT part: 6, name: rootfs_b, start:0x1a100, size:0xc800
GPT part: 7, name: oem_a, start:0x26900, size:0xf000
GPT part: 8, name: oem_b, start:0x35900, size:0xf000
GPT part: 9, name: factory, start:0x44900, size:0x800
GPT part: 10, name: vbmeta_a, start:0x45100, size:0x800
GPT part: 11, name: vbmeta_b, start:0x45900, size:0x800
GPT part: 12, name: security, start:0x46100, size:0x2000
GPT part: 13, name: userdata, start:0x48100, size:0x2aedf
find part:uboot OK. first_lba:0x800.
find part:trust OK. first_lba:0x1800.
LoadTrust Addr:0x1800
No find bl30.bin
Load uboot, ReadLba = 800
Load OK, addr=0x600000, size=0xebed8
RunBL31 0x40000 @ 540902 us
[01]INFO: Preloader serial: 2
NOTICE: BL31: v1.3(release):d5a5a89b7
NOTICE: BL31: Built : 03:20:20, Oct 18 2021
INFO: Lastlog: last=0x100000, realtime=0x102000, size=0x2000
INFO: ARM GICv2 driver initialized
INFO: Using opteed sec cpu_context!
INFO: boot cpu mask: 1
INFO: plat_rockchip_pmu_init: pd status 0xe b
INFO: BL31: Initializing runtime services
INFO: BL31: Initializing BL32
I/TC:
I/TC: OP-TEE version: 3.13.0-522-g2d3f7fedb #hisping.lin (gcc version 6.3.1 20170404 (Linaro GCC 6.3-2017.05)) #1 Sat Sep 18 03:45:00 UTC 2021 aarch64
I/TC: Primary CPU initializing
I/TC: Primary CPU switching to normal world boot
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x600000
INFO: SPSR = 0x3c9
1
I/TC: Secondary CPU 1 initializing
I/TC: Secondary CPU 1 switching to normal world boot
I/TC: Secondary CPU 2 initializing
I/TC: Secondary CPU 2 switching to normal world boot
I/TC: Secondary CPU 3 initializing
I/TC: Secondary CPU 3 switching to normal world boot
hrrrm, I did not get anything out of it, just silence But great u double checked and confirmed! I’ll do some testing again tonight to see if I can also get something out and maybe access to adb through that.
Thx!
Ok, got the serial connected but it’s not reacting to any cmds I send… Not sure if it really still runs Android… So the idea from the Shelly thread doesn’t work it seems. Or I’m too dumb
Can you interrupt uboot and get to a command line?
Try repeatedly hitting escape during early boot.
Might be worth checking if the tx pin is pulled high.
How would I go about that? My serial tool “just” let’s me send text, but I can’t have my keypresses sent over, so how would I hit ESC repeatedly?
Any good serial tool reccomendation? I first just used ArduinoIDEs Serial Monitor, but that can’t do 1500000 baud rate. So I just googled and found this: https://www.com-port-monitoring.com/
Screen, minicom, or maybe putty if you’re on windows.
For example
screen /dev/ttyUSB0 115200
Ctrl + A, ctrl + D to exit
oh wow, I didn’t even know / never realized PuTTY supports Serial 
Thanks, I’ll give that a try!