Inside the SwitchBot AI Art Frame

Reverse-engineering a Tuya-OEM e-ink frame: the BLE protocol, a public S3 bucket, a hardcoded AES key for cloud creds, and why the firmware blob is a dead end.