Let's take a quick peak at what makes the Xiaomi Aqara Temperature sensor tick, and get an overview of some of the available test pads
The Aqara Temperature, Humidity and Pressure sensor is a small battery-powered Zigbee sensor that sends periodic information to a central Zigbee hub.
The official claim is that this device will run off of a single CR2032 battery for up to 2 years.
Opening the clam shell
The unit is held together with plastic clips in a clam-shell construction. The easiest way to get it apart that I've found is to use a box knife on one of the corners to get some leverage, and then use a thin metal prying tool to break it open.
The unit is comprised of 4 parts - the clam shells, a button and the PCB.
I saved images of each side of the PCB
The main microcontroller is an NXP JN5169 which contains a 32-bit RISC processor, 512 kB embedded flash, 32 kB RAM and 4 kB EEPROM memory.
The temperature/humidity sensor is an Sensiron SHT30 which has a typical %RH resolution of ±2 at 10-90% RH and ±0.3°C in the range of 0-65°C
Since the SHT30 doesn't feature integrated pressure sensing, there's also this
6A2 sensor which I haven't been able to identify.
Tracing out some test pads
I went ahead and traced out some of the many test pads on the PCB, including the ones needed to put it into serial programming mode. I haven't attempted to see if it's possible to do so, so I don't know if it's locked or not.
I made an annotated image with the pads I identified after a quick 5 minute tracing: