Zemismart Z1 Remote Control HD Touch Screen Zigbee WiFi BLE

I managed to get a shell through the UART.

Experience with the device is very similar to the device in this thread.

The bootloader is uboot, but doesn’t have the shell enabled, so stopping autoboot just results in a boot loop until you stop interrupting it.

The linux shell requires a login, which I don’t have, but the folks in that thread were able to dump the flash to retrieve it.

Will keep poking around the user interface and UART and see what I can find, otherwise will dump the flash and go from there.

Things of note I found:

  • There is a test menu if you go to settings > About Device and tap the logo 5 times. Doesn’t seem to yield much though.
  • There are two buttons on the side of the board, one reboots the device, the other seems to disconnect the NAND flash, which when held during boot gives a boot rom shell via serial, but it seems to want a password via serial asap.

Wait input password…:
Timout Exit.
SUNDANCE4_Massboot>#

If I press one key while it’s waiting for the password I get ‘Wrong’ then the shell. Either way the shell doesn’t respond to anything and no key presses are echoed back.