Last night I spent ages getting nowhere. Software serial on an Arduino Uno connected to TxD and RxD got nowhere.

My only small consolation was that I found the 4 pads near the keypad FFC/ZIF connector on the main PCB were actually breakouts of the buttons and have a pull up resistor on them. When a button was pressed, the line is pulled low. This means it would be easy to remove the keypad and send logic level button presses from a microcontroller. Others have discussed intercepting the LCD display data stream to extract the digital readings if some form of serial communication can't be established.

The pads that are visible from the battery compartment are still intriguing - why would useless pads be designed into both the PCB underneath AND the enclosure moulding? There's too much coincidence to write them off yet. Others think they've characterised the 5 pads as including VCC, GND and Reset/reboot, with two strange pads remaining.

One of these is pulled high and the other is pulled low. Does anyone know of an electrical communication protocol which has these characteristics at rest? Perhaps an industrial protocol designed for long wire transmission distances, with a balanced signal, such as RS485 uses.

An idea I've had today is that the sine wave might not be the input to the laser driver and there's a small (but hopeful) chance that it's a feed from the laser receiver into the main STM32F controller. I'll see if I can find out more later.