Tuya / Smatek "T6E" and ”S6E” 4-inch Control Panels for CCS (Central Control System) Android-based in-wall 4-inch smart display with touch screen now sold under many different brands

ezcGman · March 12, 2024, 11:18am

Did you try turning it off and on again? Joking! Good luck with this!!

hipstercat · March 12, 2024, 3:56pm

Here’s my firmware dump: backup.bin - Google Drive

Binwalk output:

tasty@TASTY-MINT:~/Projects/rkdeveloptool$ binwalk backup.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
163856        0x28010         CRC32 polynomial table, little endian
688144        0xA8010         CRC32 polynomial table, little endian
1684936       0x19B5C8        AES S-Box
1689328       0x19C6F0        AES Inverse S-Box
1700464       0x19F270        CRC32 polynomial table, little endian
1711008       0x1A1BA0        LZO compressed data
1775735       0x1B1877        Android bootimg, kernel size: 1919249152 bytes, kernel addr: 0x5F6C656E, ramdisk size: 1919181921 bytes, ramdisk addr: 0x5700635F, product name: ""
1861291       0x1C66AB        Base64 standard index table
2011648       0x1EB200        Flattened device tree, size: 7168 bytes, version: 17
2733512       0x29B5C8        AES S-Box
2737904       0x29C6F0        AES Inverse S-Box
2749040       0x29F270        CRC32 polynomial table, little endian
2759584       0x2A1BA0        LZO compressed data
2824311       0x2B1877        Android bootimg, kernel size: 1919249152 bytes, kernel addr: 0x5F6C656E, ramdisk size: 1919181921 bytes, ramdisk addr: 0x5700635F, product name: ""
2909867       0x2C66AB        Base64 standard index table
3060224       0x2EB200        Flattened device tree, size: 7168 bytes, version: 17
3566976       0x366D80        DES SP1, little endian
3567232       0x366E80        DES SP2, little endian
3569152       0x367600        DES PC1 table
3569208       0x367638        DES PC2 table
3573792       0x368820        SHA256 hash constants, little endian
3590920       0x36CB08        Unix path: /lib/libtomcrypt/hash.c
4615552       0x466D80        DES SP1, little endian
4615808       0x466E80        DES SP2, little endian
4617728       0x467600        DES PC1 table
4617784       0x467638        DES PC2 table
4622368       0x468820        SHA256 hash constants, little endian
4639496       0x46CB08        Unix path: /lib/libtomcrypt/hash.c
5373952       0x520000        Android bootimg, kernel size: 4581171 bytes, kernel addr: 0x10008000, ramdisk size: 5652951 bytes, ramdisk addr: 0x11000000, product name: ""
5376000       0x520800        LZ4 compressed data
5419543       0x52B217        SHA256 hash constants, little endian
5426334       0x52CC9E        AES S-Box
5426590       0x52CD9E        AES Inverse S-Box
8952942       0x889C6E        AES Inverse S-Box
8985650       0x891C32        AES S-Box
8994130       0x893D52        AES Inverse S-Box
9395113       0x8F5BA9        xz compressed data
9483197       0x90B3BD        Base64 standard index table
9786950       0x955646        gzip compressed data, fastest compression, has header CRC, has comment: "", last modified: 1970-09-18 22:19:55 (bogus date)
9957376       0x97F000        gzip compressed data, maximum compression, from Unix, last modified: 2023-05-11 10:03:28
15613440      0xEE3E00        Flattened device tree, size: 72977 bytes, version: 17
15686656      0xEF5C00        PC bitmap, Windows 3.x format,, 480 x 480 x 8
28442624      0x1B20000       Squashfs filesystem, little endian, version 4.0, compression:xz, size: 24063118 bytes, 2100 inodes, blocksize: 131072 bytes, created: 2023-05-11 10:03:25

seaky · March 12, 2024, 9:57pm

Hi,

Can u dump again because your dump file is corrupt?

thx advance,
seaky

AndyW1 · March 12, 2024, 10:54pm

File backup.bin is corrupted. Only fist 0x1ffffff bytes valid.

hipstercat · March 13, 2024, 6:20pm

I’ve re-downloaded backup.bin and it’s identical to what I dumped from my device.

tasty@TASTY-MINT:~/Projects/rkdeveloptool$ sha256sum backup.bin 
eead5a7a2614284a7cea1d434cbbe027ed2be717b4ce3f9253c53af40c7577ac  backup.bin

Not sure why you say it’s corrupted?
binwalk is able to extract some parts of the dump. The squashfs filesystem inside doesn’t seem to be extractable though.

seaky · March 13, 2024, 6:40pm

Hi,

binwalk is irrelevant it is just searching for signatures does not check the integrity. I extracted the partitions from backup and the rootfs_a which is the squashfs looks like corrupt and also the userdata partition contains only 0xCC.

I wanted to check the fs level of a “linux” based version.

thx,
seaky

hipstercat · March 13, 2024, 7:21pm

Unfortunately that’s all I was able to dump. Now my panel doesn’t boot anymore so my best option will be to create a new image from scratch but I’m not sure how to do that. I think the stock firmware was using u-boot as the bootloader so I might start with that.

ezcGman · March 14, 2024, 2:17pm

fwiw, I got some fitting buttons off aliexpress (https://www.aliexpress.com/item/1005004067514307.html (“3x4x2 Two Feet”)), if I ever need them for anything. I guess the circuit is anyways missing some pull-ups, so not sure if they would do anything at all

mattmon · March 14, 2024, 3:07pm

Of course it is! So frustrating.

The hardware inside these units is just different enough that it seems it would be impossible to create a single image for all t6e style units.

Really a shame, because the form factor is quite nice.

A faster SoC, more RAM, and open firmware would really make this a great, viable device - not just a trinket for experimentation.

I wish Chinese companies would put in that last 5% effort to make thier products great.
(Many do, China is capable of building good stuff, I feel like the Alibaba sales model is an incentive for shadyness)

AndyW1 · March 26, 2024, 11:18pm

Hi, the original firmware can only be downloaded from flash only from “Loader mode”, but original bootloader from tuya firmware is protected, and block export data from flash after 32M. Need to use a different loader. There is hope. I have received a working device and will try to extract the original firmware.

feitingen · April 1, 2024, 11:38am

I have the TPP01-Z_V1.0.4 version with the same bootloader.
It’s blocked from downloading past 32MB as you said.

I was however able to fetch the boot.img and extract the DTB (using extract-dtb):

compatible = "tuya,smart-panel\0rockchip,rk3308";

It would be interesting to build a custom image, I think postmarketos would be perfect for this.

AndyW1 · April 1, 2024, 10:46pm

It is difficult to create alternative software without a schematic diagram of the device. An analysis of the original could help with this. Protection is present in many other recent Rocchips-based devices. They deleted the old versions of the binary files from the public. I plan to remove the flash memory from the device board and read it in the programmer.

feitingen · April 2, 2024, 12:06am

True.

I also have the NSPanel Pro, and that does not have this protection.

It is also based on a slightly different soc, rockchip px30

Do you know what type of flash memory it is?
I have a programmer for SPI chips, but if it’s emmc i won’t be able to.

AndyW1 · April 2, 2024, 9:43pm

Yes, NSPanel Pro is made on a PX30 processor, the base operating system of which is Android and has 8Gb emmc flash memory on NSPanel board. Android does not have export protection, but on the contrary it is its basic function for backup. The type of flash memory can be viewed by disassembling the device. Some EMMC chips support SDIO programming mode, but not SPI. TPP01-Z_V1.0.X is built on an RK3308 processor for which linux is the base operating system. And although after downloading the device is detected via USB as Android compatible, in fact this is not the case.When trying to connect to the shell from windows, it asks for a password, and from linux it says that there is “no secret key”. TPP01-Z_V1.0.X has only 230MB of flash and 128MB of RAM onboard, it is very small to run Android8.

feitingen · April 4, 2024, 1:52am

TPP01-Z_V1.0.4

My MOES-branded one has 256MB SPI flash (Dosilicon DS35Q2GA-IB), and 256MB DDR3L (esmt m15t2g16128a)

I agree, it’s not going to run android (well), but it’s quite capable of running Linux.

Since PostmarketOS is based on Alpine, i think it would be perfect.

Running a browser for displaying homeassistant might be difficult, but maybe we can use this Framebuffer browser by e1z0

It would be a fun platform to make framebuffer apps on, and the rk3308 seems to be quite capable, especially if we get gpu support.

The SPI chip (at least on my board) might need a hot-air station to get out, the datasheet (available here) looks like it has a big pad under the chip.
I don’t have a hot air station, so I probably won’t be able to unsolder it.
I would really appreciate it if you’re able to get a firmware dump!

mattmon · April 4, 2024, 3:38pm

Then maybe check this out… pmOS on a much more capable device, but one that still integrates nicely in the home.

AndyW1 · April 4, 2024, 9:13pm

There is such a project Welcome to ROC-RK3308B-CC-PLUS Manual — Firefly Wiki , there is a Linux build with QT desktop support for it. And there is GitHub - OSSystems/qt-kiosk-browser: Provides a simple but highly configurable browser for use on Kiosk devices ?ysclid=lulq1h5l6u168707923. If we can combine them, it will be very good.

Jinster · April 5, 2024, 4:22am

I have recently fallen prey to this T6E scam also. I think I have worked it out. The actual T6E is properly made by Smatek, and is properly Android only.

But because the form factor is similar, many sellers list TPP01-Z products as T6E - the usual deceptive Aliexpress listing practice (copy and paste everything roughly in the same category, nevermind the accuracy).

The actual full name of TPP01-Z is T1E-TPP01-Z. This likely reflects the much lesser hardware used (T1E vs T6E).

I was able to get Aliexpress to resolve the issue by the way of refund (but it requires I send the unit back in a prepaid by Aliexpress envelope, which I haven’t done yet). I am trying to convince myself that one of my rooms can use this device even if it just has two buttons on the front page - you can use them to trigger a series of scenes using HA so it could probably do at least 4 actions if not more via HA.

ezcGman · April 5, 2024, 9:08am

I mean yes, partly Some sellers, like Moes or others also sold “real” T6E devices, until they released their new version. So there was a time when you could get a “real” one from other sellers than Smatek.

I also did some research about that some time ago and stumbled over their Alibaba store. Sadly the minimum order is 5 or 12pcs and shipping costs are ridiculous. Understandable, as Alibaba is B2B, so…

I’m really also interested in the 6, 8 or even 10.1" display they have, but… way too expensive right now sadly: Tuya Android Panels - SMATEK-Home Automation Smart Control expert

Here are there Alibaba links if somebody cares:

Also @AndyW1, @feitingen and all the others involved: Thanks for all your work here!! If I can help somehow by testing things out or soldering/desoldering things on the Panel: Let me know I’m just not really into the software side of those embedded systems

AndyW1 · April 13, 2024, 11:31am

Hi all! A complete dump of a brand new device right out of the box. It is read by the T48 programmer. It is not suitable for firmware with RockChips utilities. TPP01-Z_V1.0.x — Яндекс Диск . It can be programmed back using the T48 programmer without disassembly flash from board by using a special zond. https://aliexpress.com/item/1005005448080665.html?spm=a2g2w.orderdetail.0.0.20034aa6rlKsN5&sku_id=12000033137757687