Tuya / Smatek "T6E" and ”S6E” 4-inch Control Panels for CCS (Central Control System) Android-based in-wall 4-inch smart display with touch screen now sold under many different brands

Download this tool

Unzip it then use the following:

C:\Users\myuser\Downloads\PCBA打包工具\PCBA打包工具\小固件>RKImageMaker.exe -unpack ./DeviceImage.img ./
********RKImageMaker ver 1.6********
Unpacking image, please wait...
Exporting boot.bin
Exporting firmware.img
Unpacking image success.

C:\Users\myuser\Downloads\PCBA打包工具\PCBA打包工具\小固件>AFPTool.exe -unpack firmware.img ./
Check file... OK
------- UNPACK ------
package-file    0x00000800      0x000002AC
Image/MiniLoaderAll.bin 0x00001000      0x0005614E
Image/parameter.txt     0x00057800      0x000002AA
Image/trust.img 0x00058000      0x00400000
Image/uboot.img 0x00458000      0x00400000
Image/misc.img  0x00858000      0x0000C000
Image/resource.img      0x00864000      0x005EEE00
Image/kernel.img        0x00E53000      0x01215814
Image/boot.img  0x02069000      0x00168708
Image/recovery.img      0x021D1800      0x01E24BFC
Image/system.img        0x03FF6800      0x3F3D80F4
Image/vendor.img        0x433CF000      0x0D74307C
Image/oem.img   0x50B12800      0x250AE0AC
Unpack firmware OK!
------ OK ------

You can download images of some of the devices from here
https://drive.google.com/drive/folders/1AaquZup3S_6s3Dvf34f8d4gabYQihUSN?usp=drive_link

Thanks for all the help @yabdali!! Sadly, I still can’t get passed the initial issue of not being able to switch it into the loader mode, or any mode that allows me to flash it… The issue is the same as I posted above, even with newer versions of the tool:

  1. I open the tool, it detects an “ADB” device.
  2. I click “Switch”, the device reboots but gets unresponsive / is not detected anymore / gets stuck in that screen:

I hooked it up to external power supply, yes. Not via the 230V backplate, because then I can’t access the USB anymore. But to my bench PSU, providing the 5V that the backplate would also provide, so no change really:

It seems that something is missing to make it enter any of those boot modes…

[EDIT]

I just made the effort to use a Dremel an modify the case so I can connect have the ribbon cables connect while connecting the USB cable, just for the minimal super slight chance that it doesn’t continue booting because of these… But no change: After hitting “Switch”, it’s just not showing up anymore…

Also, where did you get those two screenshots from and which tool does it reference? I have a couple of versions now of the “RKDevTool” (or “AndroidTool”) and none of them offer options to switch the device specifically into these Android boot modes :confused: It always only has the “Switch” button to switch it to “RockUSB” mode

Your device is TPP01-Z, right? This is a Linux powered device according to this link!

The screenshots were generated by Bard as I see many people don’t have knowledge about Android systems I thought it might be helpful.

Running this command with Windows command line should put reboot an Android device with ADB enabled into bootloader mode
adb reboot bootloader

Correct, that’s the device I have. I’m still confused that it says “Linux”, but apparently answers to adb commands. I know that Android is based on Linux, but why does it call out to be “Linux”? it apparently is running Android still…

I also tried “adb reboot bootloader” which works, but again: It makes the device reboot and go into that screen below and neither “adb devices” will list it, nor does the “RkDevelopTool” or “AndroidTool” see it anymore… It’s just gone / unresponsive. So I don’t know how I would be able to flash anything to it in that state :frowning:

When you use “adb reboot bootloader” do you see any new device/drivers in your Windows Device Manager?

Nope, not seeing any rockusb devices or anything else suspicious. Also nothing under “other devices” or anywhere else I think it could be :frowning:
image

I obviously do see an Android ADB interface device before I do “adb reboot bootloader”, but after I do it it also disappears / gets hidden, as you can see :frowning:

THX AGAIN at this point for your tremendous effort / help here!!!

There seems to be a lot of variation in the hardware of these t6e style devices.

While it’s possible to liberate and flash these things, I’m not sure it could be done in such a way to make it easily installable across the different ‘revisions’.

I’ve kinda fallen out of love with these units because of the low ram and messy hardware situation.

While hacking on the rom, I created a home assistant themed boot animation. If anyone wants that, lmk and I’ll post the bin.

@ezcGman - wish i could be more helpful with the hardware… were you able to try flashing the dump from my android unit?

Sadly no, see above :frowning: I’m unable to get it into loader mode to be able to flash it… I tried a lot, also with help of @yabdali, but device won’t be reachable after trying to switch it into “rockusb” mode…

If you have any more ideas, happy to help!

I’m also basically giving up on these. I’ve kinda settled with the NSPanel Pro now. Got two of them, could sideload apps pretty easy and have those now installed in two rooms.
The only thing I’m missing that the S6E would have are the integrated relays. Those I’m missing also in the T6E… Would super nice to switch floor heating on and off :wink: I’ve installed the NSPanel in the wall socket here where the floor heating control used to be. So floor heating now is no more in that room… BUT: If I would have the S6E with relays, I could still use it has heater control, combined with a tiny Bluetooth Temperature meter…

Ah well, maybe I get an S6E one day and try it out, hoping it didn’t get that crappy new update, also locking it down… :slight_smile:

Hi! Your backup file is 7G in size, but the size of the SPI flash in T6E is only 2G

My t6e has 8gb emmc

Have a wonderful good day. We are buying our house soon and I would really like to buy touch panels for the individual rooms. I find it very confusing which models have which functions.

I hope someone can tell me which model I need to buy in Germany so that I can display the home assistant dashboards on the panels and also have Alexa on them at the same time.

I hope someone can help me and maybe provide an aliexpress link. Or if it’s cheaper somewhere else, please use another link.

Stay away from these here, as they changed the OS on these, so you can’t sideload apps anymore, so they are nothing more than an expensive dust collector.

I use the NSPanel Pros in my house in Germany, can recommend them. Very similar features and can still be sideloaded! Can be ordered from their official shop: https://itead.cc/product/sonoff-nspanel-pro-smart-home-control-panel/ref/34/

Can’t help but agree.

Like many Chinese products, these could have been great, but arent.

1 Like

NSPanel Pro as I mentioned above (don’t know about Alexa though)…
https://www.aliexpress.com/item/1005005279486104.html

@ezcGman I believe I have the exact same device as yours. FYI I was able to dump the firmware with these steps (I’m using Linux):

  1. Let the panel boot normally with USB connected to computer
  2. Run “adb reboot bootloader”: my panel shows the Moes logo which is where I bought it from, and is stuck in this state
  3. From my computer, rkdevtool now shows:
tasty@TASTY-MINT:~/Projects/rkdeveloptool$ ./rkdeveloptool  ld
DevNo=1	Vid=0x2207,Pid=0x330d,LocationID=102	Loader
  1. Dump the firmware:
tasty@TASTY-MINT:~/Projects/rkdeveloptool$ ./rkdeveloptool rfi
Flash Info:
	Manufacturer: SAMSUNG, value=00
	Flash Size: 218 MB
	Flash Size: 447488 Sectors
	Block Size: 512 KB
	Page Size: 2 KB
	ECC Bits: 0
	Access Time: 40
	Flash CS: Flash<0> 
tasty@TASTY-MINT:~/Projects/rkdeveloptool$ sudo ./rkdeveloptool rl 0 447488 backup.bin
Read LBA to file (100%)
tasty@TASTY-MINT:~/Projects/rkdeveloptool$ ls -lh backup.bin 
-rw-r--r-- 1 root root 219M Mar 10 13:56 backup.bin

Now I gotta find a way to modify the firmware to allow adb in normal mode so I can sideload apps to it. Will let you know if I find anything.

You dump original firware? Please share it. I try to extract rootfs.

Mine posted above is the android rom with adb.

It’s all one big :poop:, but you can still extract the partitions. Use binwalk to find the offset and dd to extract.

I don’t have the Moes one, I have the one from Avatto: https://www.aliexpress.com/item/1005005906086740.html

If you don’t manage to modify yours somehow, try to flash @mattmon’s dumped firmware and hope it boots :slight_smile: As he still has “the good one” with adb enabled

I tried reflashing my panel with the dump I extracted earlier just to make sure I can revert to stock firmware in case flashing another firmware doesn’t work.
Unfortunately the panel doesn’t boot anymore and is stuck in Maskrom mode. rkdeveloptool does not allow me to write firmware anymore in this mode so I gotta find a way to fix that issue first before trying @mattmon dump.