Power button on this phone feels pretty nice 
I got annoyed because buttons on this phone have terrible quality and don't register presses when case is off.
While poking the board with oscilloscope to find UART I found a testpad that was shorting to ground when I pressed the power button, so here we go.
Also found that shorting two pins around the battery connector makes phone boot with only USB attached (both testpads had same voltage with battery connected and USB cable plugged in) so I can attach a MCU to toggle power on/off and turn phone on/off by setting pins high or low, I should have some octocouplers in parts drawer.
Sadly still no UART, I *really* don't want to deploy a Windows VM just to use some Chinese software to get schematics for this but it should be much easier to find it now.
Someone sent me memory dump from that software and it looks like it opens a tunnel to China (geoblock), authenticates over HTTP with cookie and downloads PDFs from "http://down.dzkj16888.com/down/51/pdf/$VENDOR/$MODEL/$FILE.pdf". I probably could pwn it and archive all pdfs they host on that server but I don't have enough spoons

I got annoyed because buttons on this phone have terrible quality and don't register presses when case is off.
While poking the board with oscilloscope to find UART I found a testpad that was shorting to ground when I pressed the power button, so here we go.
Also found that shorting two pins around the battery connector makes phone boot with only USB attached (both testpads had same voltage with battery connected and USB cable plugged in) so I can attach a MCU to toggle power on/off and turn phone on/off by setting pins high or low, I should have some octocouplers in parts drawer.
Sadly still no UART, I *really* don't want to deploy a Windows VM just to use some Chinese software to get schematics for this but it should be much easier to find it now.
Someone sent me memory dump from that software and it looks like it opens a tunnel to China (geoblock), authenticates over HTTP with cookie and downloads PDFs from "http://down.dzkj16888.com/down/51/pdf/$VENDOR/$MODEL/$FILE.pdf". I probably could pwn it and archive all pdfs they host on that server but I don't have enough spoons


