• expired

Lenovo Smart Paper 10.3" E-Ink Paper Tablet $347 Delivered @ Amazon AU

530
Lenovo Smart Paper 10.3" E-Ink Paper Tablet $347 Delivered @ Amazon AUAffiliate
Go to Deal
Cashback
impoze on 21/04/2024 - 10:51 amazon.com.au (3086 clicks)
Last edited 21/04/2024 - 16:53 by 1 other user
This post contains affiliate links. OzBargain might earn commissions when you click through and make purchases. Please see this page for more information.

The Lenovo Smart Paper is still available at Amazon, price matching Officeworks who still seem to have stock online. (Good Guys & JB listings are gone).

A lot of the reviews online are based on the full retail price. I and a few other members have picked it from the previous deals and it's quite good value besides a few software quirks.
Reading manga is much better than on my Kindle PW with the larger screen, and the writing experience is smooth.

Comes with the pen (wacom style) & folio case.

Some Recommended Apps
  • F-Droid
  • KOreader via F-Droid - Much better reader than stock, slight learning curve to set it all up.
  • Aurora - Google Play Store
  • Amazon app store
  • Kindle App
  • EinkBro
  • Shredder Chess
  • Olauncher - Minimal launcher
  • Mihon - Manga, search Keiyoushi
  • Onenote via Aurora - Much better note management than stock
  • Reddit
  • Focus Reader
  • O'Reilly Books
Games
  • Sudoku
  • Chess
  • 2048

There's a lot of other suggestions & feedback in the previous deals:
https://www.ozbargain.com.au/node/840473
https://www.ozbargain.com.au/node/839629
https://www.ozbargain.com.au/node/838168

Also available from Lenovo direct
$349 free shipping
https://www.lenovo.com/au/en/model/tablets/android-tablets/t…

Price History at C CamelCamelCamel.
Electrical & Electronics eBook Reader Lenovo Android

Related Stores

Amazon AU
Amazon AU
Marketplace

Comments

  • helmutiffe on 21/04/2024 - 11:02
    +4

    Can these run OneNote and work ok with the pen?

    • Meron35 on 21/04/2024 - 11:04
      +3

      Yes, you will need to sideload the OneNote .apk and turn on inking mode

      • Tgb on 21/04/2024 - 20:57
        -2

        How much can you trust that though when using for work with work login?

    • impoze on 21/04/2024 - 12:19
      +4

      Yep, just tested that out this morning

  • jaqoozi on 21/04/2024 - 11:34

    OOS…

  • roseyhead on 21/04/2024 - 12:00
    +5

    I got one of these a couple of weeks ago, RRP is absurd but it's a great little device for $350.

    Olauncher

    Can you replace the standard launcher? I've tried another launcher but couldn't get it to stick.

    Onenote

    I find the UI kinda awful, much prefer the inbuilt notes app. Everything is stored under storage/Public/My Device and you can sync it with your PC using Syncthing instead of paying whatever ridiculous price they charge for cloud sync

    • impoze on 21/04/2024 - 12:22
      +1

      Yeah, haven't been able to replace the system swipe up gesture so have to open the launcher every time

      I already run Syncthing so will load it up on this too.

    • impoze on 21/04/2024 - 17:32

      @roseyhead have you figured out a back button? like if you're in syncthing settings, you have to close/open to get out of the settings.

      Edit:

      Oh, just a left swipe…

      • roseyhead on 22/04/2024 - 10:24

        Yeah, I don't think it's explained anywhere but it just uses Android gesture navigation

    • Ronney on 25/04/2024 - 03:13

      @roseyhead Could you please share with me your folder mapping. I can sync the notebooks from the device to the computer but I am not sure how to get the Lenovo Smart Paper App on the desktop to map to the synced folder and open the notes synced from the device.

      • impoze on 26/04/2024 - 19:39

        We are using syncthing

        • Ronney on 26/04/2024 - 23:20

          @impoze, @roseyhead Sorry if I was not clear. I want to know how to sync using Syncthing so that I can see the synced notes in the desktop Lenovo Smart Paper App just like if I had used their own paid sync subscription.

          • impoze on 26/04/2024 - 23:33

            @Ronney: just make sure you set up the sync to use the storage/Public/My Device folder.

            • Ronney on 26/04/2024 - 23:40

              @impoze: @impoze Thanks. Does it sync only the exported notes or would it also sync the notebooks as well?

  • bargainshooter on 21/04/2024 - 12:00
    +1

    It's been this price for weeks right? Lenovo price it at $349. What's the deal?

    • impoze on 21/04/2024 - 12:21

      Same deal, but now available on Amazon.

      Previous GG and JB deals are OOS

  • rowdywabbid on 21/04/2024 - 12:02
    +4

    Was checking for the product page and found the Lenovo shop has the sale as well.

    https://www.lenovo.com/au/en/p/tablets/android-tablets/tab-s…

    • Ozbargainasaurus on 21/04/2024 - 16:18
      +2

      Thanks. I asked them to price match last week. They flat out refused and said their floor price was 620… have $150 reward points to use up ..

      Their price match guarantee is flakey…

  • catmao on 21/04/2024 - 12:03

    It was $347 for at least two weeks. I placed an order this morning literally before this post. Now it is oos within less than 30 minutes. The power of ozbargain

    • bdl on 21/04/2024 - 12:05

      There were only four in stock when the deal was posted

      • impoze on 21/04/2024 - 12:21

        Still showing in stock for me

        • catmao on 21/04/2024 - 12:44

          It seems oos now when you place the order.

  • BartonWest on 21/04/2024 - 12:07
    +6

    would love to see the actual cost to make something like this…..the profit margin gotta be 700%+

    • belongsinforums on 21/04/2024 - 13:25
      +4

      Rnd costs money. Big profit comes from big sales and this is no iPhone

    • plmko on 21/04/2024 - 22:49
      +3

      This would be close to cost. A 10" inch e-ink panel would cost $150+ alone ignoring quality/spec.

    • skillet on 24/04/2024 - 12:43

      Too little devices on e-ink to make a profit.

  • bdl on 21/04/2024 - 12:09

    Good summary here - wonder if the person posting is an Ozbargainer?: https://www.reddit.com/r/eink/comments/1c1edno/comment/kz5fv…

  • chuchrj on 21/04/2024 - 12:24
    +2

    Thanks OP. Just bought. Been sitting on the fence for a while but your suggested sideloads pushed me over.

  • blamechance on 21/04/2024 - 12:35

    Has anyone tried running the Obsidian.md app on the smart paper? If it can sync and view notes without issue, would be a solid use-case for me.

    • impoze on 21/04/2024 - 12:46
      +2

      I'll give it a go, I have my vault synced using SyncThing.

      Update

      Installs fine via Aurora, it would work fine depending on what you want to do, and plugins.

      Wouldn't want to do too much typing unless pairing a keyboard

      • blamechance on 21/04/2024 - 13:03

        you're a legend, thanks OP

  • RolandWaites on 21/04/2024 - 13:02
    +1

    10.3" seems impractical if you're the type of person who wants to read on the train, or anywhere you're likely to have less than an entire couch or table to yourself.

    • impoze on 21/04/2024 - 13:10

      Yeah, this is more for the note taking or larger comic/manga as they have smaller text.

      Use a 7" kindle/kobo or eReader app on your phone if you want portability

    • wearytraveller on 21/04/2024 - 13:49
      +1

      I disagree. I have the kindle scribe and landscape mode with 2 columns is perfect for reading!

  • sutiive on 21/04/2024 - 14:11
    +12

    Don't do it. I bought this from Good Guys last week at $349. Its terrible. Glitchy, slow and has these weird subscription requirements to connect it adequately to the outside world. I sold it for $320 a week later after trying my best to make it work. I feel sorry for the guy who bought it tbh

    • impoze on 21/04/2024 - 14:13

      As in all the deals it's been talked about. Use other apps.

      There are other ways to sync files without paying lenovo for their cloud service.

      And it is an e-Ink device so there are limits to the screen refresh anyway

      • sutiive on 22/04/2024 - 13:51

        Yep read those comments. Anything where you're immediately on the fix for a new product though should ring alarm bells. I tried a few of these before giving up. It's heavily discounted for a reason but even at that price for me it wasn't worth it. For those who love a fixer upper though, go for your life!

    • zrmx on 21/04/2024 - 14:47

      A friend was in a similar boat, and especially awful if you are in the Google Play Books ecosystem (which isn't available on the device). Like another comment below, if you aren't prepared or fluent in sideloading apps and customising, you are likely better off avoiding it.

    • zhaomh on 21/04/2024 - 18:17

      I am still looking for a good smart paper to buy, any recommendations?

      • impoze on 21/04/2024 - 18:28
        +3

        Boox note 3/3c, remarkable 2, supernote

        • armaboo on 22/04/2024 - 13:42

          Following on from Zhaomh's comment:

          I have a Boox note 2. I find it's slower to use than a native Kobo device (or Kindle presumably) due to needed to navigate multiple menus, but makes up for it with the versatility. If note taking is important to you, I found with a matte screen protector, there is a slightly scratchy texture and friction when using the stylus which resembles paper a bit.

          I've played with a friend's Remarkable 1, which has a great writing experience, much better than my Boox. Unfortunately the Remarkable series is more for writing/note taking and ebook support doesn't seem to be robust and I primarily use my e-ink device for ebook reading rather than writing.

          Reviews suggest Supernote is very good, with a better writing experience than the Boox, however it doesn't support the Kobo store when I last researched it and most of my books are on Kobo. I would really like ot try the Supernote if it ever supports Kobo.

  • Alpine58 on 21/04/2024 - 14:21

    Was looking at the Remarkable before it went all subscription.

    Those with OneNote on it, were you able to login to a Microsoft365 account and sync?

    • impoze on 21/04/2024 - 14:26
      +1

      yeah, installed OneNote via Aurora and logged in this morning.

      Syncs fine.

    • 9hundred on 21/04/2024 - 14:27

      I can sell you the Remarkable with lifetime subscription included.

  • S3ISOR on 21/04/2024 - 14:42
    +3

    I've had this device for about 3 weeks now and really like it, but it took quite a bit of effort to get it from a below average device to a great one.
    If don't really want to tinker with side loading, custom settings and setting up apps like KOReader, etc, I would avoid - you'll just be frustrated and disappointed.
    If you're happy to tinker, I'd say go for it. I was pretty underwhelming at first, but after perservering and a lot of trial and error with apps and custom settings, I think it's brilliant (especially for the price.)

    • Alpine58 on 21/04/2024 - 15:46

      What are you mainly using it for?

      My use case it lots of meeting minutes, scribbling out ideas/notes/schematics and daily to-do.

      Are there any good sort of daily-to-do/planner types with it?

      • S3ISOR on 21/04/2024 - 18:11
        +2

        My primary use is daily at work to record notes, minutes, ideas, etc, and than share a PDF as a record to my Google Drive. I don't use a to-do or planner - I generally write a to-do list in notes with the check-mark template.

        My other use case is as an eReader using KOreader. At first I disliked reading using the stock app, and I preferred the size and display of my 7" Kindle Paperwhite, but after installing and customising KOreader, I've become used to the size and really like it now. I also find the battery life much better compared to the Kindle.

        I don't use any other functions, no emails, no Lenovo account, no web-browsing. I did install sodoku and a chess app, which I've used occasionally.

    • skillet on 24/04/2024 - 12:51

      What's the battery life like? I always wanted to get a e-ink device. I currently have a sammy Tab S6 which serves me very well, impressive battery life for a amoled and only 420grams. While this Lenovo is cheaper and only slightly lighter (408grams) I don't see the reason to get one. Other than the price, and better readability, is there anything that it does better?

  • tawww on 21/04/2024 - 15:05
    +1

    I grabbed one of these from JB a few weeks ago when it was on clearance there. There’s some clear performance limitations to it if you’d like to push it slightly further than a reading/writing device but overall its quite good. Assuming you’re comfortable with sideloading:
    * Readwise Reader’s eink pagination mode makes it really good for reading newsletters and RSS feeds
    * GBoard is a much better keyboard than the system board (once you get the theme right) and the handwriting to text conversion works really well
    * The Kindle app performs quite well (and very similarly to my Kindle Oasis)
    Lenovo’s AOSP implementation is quite locked down, and (i suspect from the device’s unpopularity) there aren’t any obvious avenues for rooting it. Similarly, I was unable to add Google Play Services to the device without it boot looping.
    Overall, pretty happy with this purchase but definitely not for everyone.

    • LastSkywalker on 21/04/2024 - 15:21

      Surprised it doesn't have Google Play frameworks, but if it's only a reader and we only need a few apps on it, surely apkpure or any other 3rd party app store could get it done.

      • impoze on 21/04/2024 - 16:18
        +1

        Get Aurora store from F-droid for some play store apps, easier to update

    • impoze on 21/04/2024 - 17:32
      +1

      have you figured out how to do a 'back' button? in some apps you get stuck in the settings or a menu.

      edit: oh, it's a left swipe…

  • LastSkywalker on 21/04/2024 - 15:18
    +2

    If any one read or learning Chinese, this one could use WeRead too, which is like Kindle Unlimited, but mostly Chinese book:
    https://play.google.com/store/apps/details?id=com.tencent.we…

    And of course, it can convert handwriting to Chinese instantly too.

    I'm really thinking of buying it, even though I bought a XiaoMi reader recently just for WeRead supporting.

  • neptunesdeals on 21/04/2024 - 16:13
    +1

    anyone know how this is for PDFS?

    Really interested in something i can use for reading academic articles.

    • impoze on 21/04/2024 - 16:19

      It's fine with KOreader

      Theres some quirks if you were planning to annotate over it

      • neptunesdeals on 21/04/2024 - 16:21

        na to be honest my handwriting is too awful to care about the pen - i just want an oversized ereader

        • impoze on 21/04/2024 - 16:31

          Yeah works great for reading files

          KOreader is the way to go

  • kanu666 on 21/04/2024 - 16:28

    OOS?

  • paloverde88 on 21/04/2024 - 17:25
    -3

    No colour like kobo

    • impoze on 21/04/2024 - 17:31

      no, but colour has it's own drawbacks at the moment, and also won't be this price for a 10" device

      The now expired deal was a good buy - https://www.ozbargain.com.au/node/841137

    • 0jay on 21/04/2024 - 17:38

      also not 7” max like the colour kobos

      • impoze on 21/04/2024 - 17:42
        +1

        You'd be looking at the Boox Note Air3 C which is around $900

        • 0jay on 21/04/2024 - 18:18

          i’m not looking at anything, just pointing out it’s different class altogether

  • Hugh G Rection on 21/04/2024 - 18:11
    -1

    isn't the amazon one better and cheaper?

    • impoze on 21/04/2024 - 18:22

      Yeah, just says temporarily out of stock

    • Jakal on 21/04/2024 - 20:11
      +1

      If you mean the kindle scribe it’s over twice the price one you add the case and doesn’t run android apps.

  • thespectra on 21/04/2024 - 18:40

    What is its actual weight? Can't be 1.25kg as is listed at Amazon, that must include the box….

    • impoze on 21/04/2024 - 18:47
      +1

      With case & pen: 618g
      Screen only: 410g

      • aec on 22/04/2024 - 00:34

        we have a kindle paperwhite (gen 8, i guess). we dont use it much. i find it is awfully slow to search somethin in the kindle library. how is this lenovo?

        • impoze on 22/04/2024 - 06:54
          +1

          Much quicker

          My Kindle PW11 is quite snappy

  • Romper Stomper on 21/04/2024 - 19:54
    +1

    This is way cheaper than Onyx Boox 10" products.

    • impoze on 21/04/2024 - 19:56
      +2

      Not as easy , need to sideload and the OS is more locked down. If only we could get a Boox 10" at this price

      • Romper Stomper on 21/04/2024 - 20:15

        Is it based on Android OS? Does it come with Google Play installed?

        • Agret on 21/04/2024 - 20:26
          +1

          Yes runs Android OS. No Google Play, need Aurora Store + microg

  • floralivings on 22/04/2024 - 10:54
    -1

    Temporarily out of stock.
    Order now and we'll deliver when available. We'll e-mail you with an estimated delivery date as soon as we have more information. Your account will only be charged when we ship the item.

    • impoze on 22/04/2024 - 11:12

      Can use officeworks or lenovo links too

      • Ozbargainasaurus on 22/04/2024 - 11:27

        Lenovo you'll get $5 rewards credit too for next purchase

  • flubba86 on 22/04/2024 - 14:38
    +8

    I have just bit the bullet on this. I've been eying off a Remarkable2 or Supernote or Kindle Scribe for the last 18 months but they've always been out of reach. I had a $50 officeworks gift card sitting here unused, so I used the linked Officeworks $347 deal, thats still working in QLD, with the gift card it brought it into the region of good value for me.

    I'm pretty experienced with modifying android software (eg, jailbreaking bootloaders, etc), and I'm keen to see if I can get some form of third-party GApps working on this, it seems to be the number one thing everyone is asking for, but nobody is working on it. The system uses the very common RK3566 CPU, bootloader is bog-standard uboot, and OS is literally AOSP, so it can't be too hard.

    • bonechiller on 22/04/2024 - 15:02

      it would be amazing if we can get this rooted!

    • impoze on 22/04/2024 - 15:51

      yes please!

      • flubba86 on 23/04/2024 - 22:00
        +3

        @impoze @bonechiller
        Its done.
        I received the device at 10.30am today. Unboxed it at 12pm. Played with it stock for an hour, then went to town on its OS.
        I was in meetings through most of the afternoon so I was going slow.
        As of 9pm tonight, I now have a rooted Lenovo Smart Paper (potentially the first in the world?).
        I've got Magisk installed, working magisk payload, real magisk root, magisk modules.
        Enabled ADB, can connect from the PC, ADB shell, and su all work as expected.
        I even managed to install GApps Core bundle, that has Google Services Framework, Google Play Services, GMScore.
        I added my Google acount through google play services, so Play Store (real Play Store, not Aurora) is now working, and I installed GMail too, that's working.

        Is there anything else anyone wants me to try to run on it? For now I just want to load up some books and use it as an ereader, the poor beast has had a rough day.

        • impoze on 23/04/2024 - 23:17

          Wow, amazing effort!

          How easy is it to do?

          Checked out magisk, seems straight forward. Haven't played with custom roms since the original Oneplus One.

          • flubba86 on 24/04/2024 - 08:00
            +5

            @impoze: Actually it was harder than I thought. The two main issues are Lenovo has replaced the regular android Settings app with a simplified cut down version, and secondly there's no way to turn on Developer mode to enable ADB.

            The settings app doesn't have the feature of tapping the build number 7 times to enable developer mode. So you can't connect via USB to send commands.

            Finally, you can't enter Download Mode on the device by holding the volume down key or volume up key while pressing power. There's no volume keys! Just the power button is the only button on the whole device.

            So there were a few extra steps involved, I plan to do a write up of the whole process later this week.

            • impoze on 24/04/2024 - 08:16

              @flubba86: That's exactly what I realised when I was looking at it yesterday.

              Looking forward to the write up.
              I'm sure the e-ink community will appreciate it.

            • Ronney on 24/04/2024 - 11:23

              @flubba86: @flubba86 I am new to the Android eco system though I have dabbled in custom ROMs for Windows Pocket PC devices decades ago.
              I have one questions. Will the device still get the Lenovo updates once you root the device?

              • impoze on 24/04/2024 - 11:28
                +1

                @Ronney: at this point, I don't think the Lenovo updates matter much. They already seem to be clearing this model out so I doubt they would continue to develop it much further. The last update was Oct 2023.

                • Ronney on 24/04/2024 - 14:33

                  @impoze: @impoze The latest update was in January 2024.

              • flubba86 on 24/04/2024 - 11:38
                +2

                @Ronney: It will still be able to get updates, but you'll need to re-root it after you update.

                • Ronney on 24/04/2024 - 14:25

                  @flubba86: @flubba86 Thank you very much. Looking forward to your writeup.

        • bonechiller on 24/04/2024 - 13:48
          +1

          You are a legend! Looking forward to the writeup :)

        • flubba86 on 24/04/2024 - 20:45

          Does anyone think, if I offered this one-of-a-kind rooted Smart Paper up for sale to the ozbargain community, would it be worth much more than a stock one? Just thinking, before I do the write up, I could sell this one, buy a new one, and document the process of rooting the new one.

        • Ostrich on 29/04/2024 - 21:27
          +2

          @flubba86
          I just bought this from officeworks. Yet to pickup, but have xp on rooting android devices (have legion y700 and xiaomi pad pro both rooted with magisk).

          Would you mind sharing your guide when you get a chance to write up? Keen to get adb running.

          Thanks

        • flubba86 on 01/05/2024 - 20:21
          +9

          @impoze @Ronney @Ostrich @bonechiller

          Sorry for the delay, I've been crazy busy at work and I haven't had a chance to document the process. However, I can list out the basic steps here if someone is brave enough to try it out before my full guide is written.

          The basic steps are:
          1) Get a copy of the Lenovo firmware image corresponding to your current firmware version.
          2) Boot into Rockchip SoC "Loader" mode
          3) Use rkdeveloptool to extract uboot.img from the correct A/B slot.
          4) Use Hexdiff to verify your uboot.img matches the uboot.img in your downloaded firmware.
          5) Use Python library FDT to unpack uboot.img to get uboot.bin
          6) Decompile uboot.bin using Ghidra (its ARM64 v8a) to patch/remove the flash dumper filesize limit.
          7) Use python library FDT to repack uboot.bin into uboot.img file and update the sha1 checksum in the DTB img
          8) Use rkdeveloptool to flash the modified uboot.bin back onto the correct A/B slot
          9) Reboot back into (the now modified) "Loader" mode
          10) Use rkdeveloptool to extract boot.img from the correct A/B slot
          11) Use Hexdiff to verify your boot.img matches the boot.img in your downloaded firmware.
          12) Use Magisk Manager to patch your boot.img with root.
          13) Use rkdeveloptool to flash the rooted boot.img back into the correct A/B slot
          14) Reboot, verify Magisk is reporting operating correctly. Well done!

          Lucky breaks:
          The bootloader is not locked! This includes the uboot and android boot.img. We can modify them, and as long as the SHA1 signatures are correct, it will boot.
          The Android OS (like most modern Android builds) uses "ramdisk" system-overlay mode, that makes it compatible with the Magisk patch-boot.img root.

          Unlucky:
          We can't access developer mode my tapping "build number" 7 times, Lenovo patched that out
          We cannot enable ADB mode before root is achieved, because we need root to enable ADB.
          There is no modified Recovery image for this device, so can't boot to recovery and flash image.zip files.

          More detailed steps:

          First you'll need a copy of the Lenovo firmware distribution that matches the firmware you are running. It will have a filename something like "SP101FU_S001320_240115_ROW.zip" The fields in the filename are Model Number = SP101FU (this is the same model number for the Chinese Lenovo Yoga Paper, and the global Lenovo Smart Paper). Next is firmware revision version (1320), and finally release date (2024-Jan-15). This is the most recent release. I can't tell you where to download this file. SHA1 checksum is 0c1bb89608240779d5ee5092d7b4be00fe579844

          Unzip the file, you should have a file named update_nowaveform.img. This is a "Rockchip Image File", its a special packed format specifically for use with devices running Rockchip CPUs. If you have a Rockchip SDK for RK3566 you can use the unpacker utility to unpack it, but for the rest of us there is a russian tool named imgRePackerRK you can find it on Russian forums, or the English thread on XDA forums. Lenovo is using a very new version of the Rockchip image format, so you need imgRepackerRK version "1.0.7.7_test" or newer.

          Unpack the update_nowaveform.img file with imgRePackerRK. It will complain about mismatched CRC32 and SHA1 signatures, that's because this version of the img is too new for the imgRePackerRK tool. But it will still unpack the needed parts properly. The parts we're specifically interested in are in the "Image" subfolder, called "uboot.img" and "boot.img". Don't get these mixed up. uboot is an embedded bootloader (used on things like Raspberry Pis, and Android TV boxes), "boot.img" is the Android boot loader, quite different, it runs much later in the boot process and is specific to the Android version used.

          The Lenovo Smart Paper uses the A/B firmware layout. That means it has two copies of uboot, two copies of android bootloader, two copies of other system firmware, etc. When you do a firmware update, if you're using slot A, it will add the firmware into slot B, then it will boot using slot B, next update will go into slot A, etc. That prevents bricking by interrupted or corrupted flashing.

          There is a secret hidden button on the device, behind the tiny hole along the bottom edge. Use a sim-eject tool or similar to gently press in there until you feel a click. Don't poke anything in the other two tiny holes, they are microphones.

          If the device is off, you can hold the hidden button and the power button down together until it turns on, release the power button but continue to hold the hidden button and you'll get into Recovery mode (now release the hidden button). Unfortunately recovery mode isn't useful to us because it doesn't work well with the eink screen, and we have no buttons for navigating the menus.

          If the device is off, USB cable unplugged, hold the hidden button while you insert the USB-C data cable (attached to your PC) you should hear a USB device sound from your PC, but eink screen still shows "Powered off". Release the hidden button. Checking kernel dmesg (or device manager on Windows) should show a new Rockchip USB device attached. This is "Loader" mode, similar to Fastboot mode (aka Download mode) on Android phones, but this is a firmware mode specific to Rockchip devices.

          If you have the Rockchip SDK, you can use "rkdeveloptool" utility to connect to the device while in "Loader" mode. For the rest of us, luckily the lads at Pine64 maintain their own up-to-date branch here you can build yourself: https://gitlab.com/pine64-org/quartz-bsp/rkdeveloptool

          Use rkdeveloptool to read the two different uboot slots, name them uboot_a.img and uboot_b.img
          ./rkdeveloptool read-partition uboot_a uboot_a.img
          ./rkdeveloptool read-partition uboot_b uboot_b.img

          Both should be 4MB files, and weirdly, both actually have two identical copies of a 2MB image. To work out which is the right one, use a hex editor to open both files find some ascii text that shows the build date, find the one that has the more recent build date, and matches the date of the firmware image you downloaded earlier. For mine it was Slot B, and I will use uboot_b in my examples. You can't use file checksums to verify your uboot_b.img matches the uboot.img in the dowloaded firmware, because the dumped uboot_b.img from the device will have lots of padding on it.

          We can't immediately dump the android boot.img from the device, because "Loader" has a 32MB file size limit. Unlucky, boot.img is a 100MB partition (with padding, the unpadded version is still around 60MB). If you try to dump a partition larger than 32MB, the loader will reply with a file filled with all 0xCC. Lucky, we have the technology, we can modify the uboot file to remove that limitation. We can't directly open uboot_b.img in ghidra for two reasons, firstly, as mentioned above, its actually two 2MB files stacked on top of each other. Secondly, its a packed DTB file.

          So split the uboot_b.img file in half, and whip up a quick python script using the FDT library to parse the DTB file. From that you can isolate the "images/uboot" node, get its size, offset, and checksum, save it out to a new uboot.bin file. Verify your uboot.bin matches the saved checksum.

          Then load uboot.bin in ghidra. I followed this guide to find the relevant section and patch it: https://github.com/DorianRudolph/pinenotes (See the section under "fix uboot"). When you open it in ghidra, choose ARM64 v8a architecture for reverse-engineering analysis. Ours is a little harder because our uboot.bin doesn't have debugging symbols left in like that in the guide. Find the section, patch it out as described in the guide, and export the binary back to a new "uboot-patched.bin" file. Verify with hexdiff that the only difference in uboot.bin and uboot-patched.bin is the one single instruction change.

          Whip up another script in Python using the FDT library, replace the "image/uboot" region of uboot.img DTB file with your new uboot-patched.img file. Get the sha1 sum of your new uboot-patched.bin file, and replace the old sha1 sum with the new sha1 sum. Finally, when saving the uboot_b-patched.img file back out, make sure it is still 4MB and it is actually two identical copies of the same DTB file. Check with hexdiff against the original uboot_b.img to ensure the only differences are the patched instruction, and the new SHA1 checksum (and the same two again in the second half of the file).

          Double check everything up until this step, make sure everything is done absolutely correctly, if you flash a bad uboot_b-patched.img you may brick your device.
          Use rkdeveloptool to flash the uboot_b-patched.img back onto the device (put it in the same slot you got it from!)
          ./rkdeveloptool write-partition uboot_b uboot_b-patched.img
          after its done, reboot:
          ./rkdeveloptool reboot
          make sure it still boots into android. Breathe a sign of relief. That's the hardest part done.
          Power off, and get back into "Loader" mode (unplug the USB, while off hold the hidden button while plugging in the USB-C).

          Now dump the boot_b partition (or boot_a if that's your slot).
          ./rkdeveloptool read-partition boot_b boot_b.img

          This should be a 100MB file. Use a hexeditor or hexdiff to verify this boot_b.img matches the boot.img in your downloaded firmware image. You can't use file checksums to or file size to verify it matches because the dumped boot_b.img from the device will have 40MB of padding on it.

          Boot into Android and sideload install the latest version of Magisk Manager, also copy boot.img (not uboot.img!) into the Downloads/ directory on your device internal storage. (Note, as long as you've verified its the same file, you can use the one you extracted from the firmware download, instead the boot_b.img one from your device, because it doesn't have the extraneous padding). Use Magisk Manager to patch the boot.img file. It should succeed fine. Copy the patched boot-magisk.img back off the device onto your PC.

          Use rkdeveloptool to flash the boot-magisk.img back onto the device (put it in the same slot you got boot.img from!)
          ./rkdeveloptool write-partition boot_b boot-magisk.img
          after its done, reboot:
          ./rkdeveloptool reboot
          Make sure it gain boots back into Android. Breathe another sign of relief, that's the second hardest part.

          Open Magisk Manager again, double check its says Magisk loaded, with the right version. You're rooted.

          To get Google Play Services, Google Services Framework, GmsCore, and Google Play installed, you need a GApps package. Unfortunately I couldn't find a version of OpenGApps or Nikgapps that worked because they use .zip installers designed for flashing in Recovery mode, and we don't have a modified Recovery for this device. Lucky, we have Magisk, so we can find a version of MagiskGApps that can be installed as a Magisk module.
          Unfortunately because we're on Android 11, we need a pretty old version of MagiskGApps, I used "MagiskGApps-core-V1.1.zip", install that in Magisk Manager, and reboot. Then you will have working Play store, and all Google apps will work include Gmail, Google Drive, Google Maps, Google Books, etc.

          To get ADB: Use the IzzyOnDroid repo in FDroid to install Shizuku https://apt.izzysoft.de/fdroid/index/apk/moe.shizuku.privile…
          Start Shizuku, grant it root permission, and set it running in the background.
          Use the IzzyOnDroid repo in FDroid to install SystemUI Tuner. https://apt.izzysoft.de/fdroid/index/apk/com.zacharee1.syste…
          Open SystemUI Tuner, agree to the terms, grant it access to Shizuku, grant it Root permission, then click "Developer" section, and enable the "ADB" toggle.
          (Note, that does not work before the tablet is rooted, I tried).

          • impoze on 01/05/2024 - 20:26
            +1

            @flubba86: wow, amazing effort.

            Take your time on the full guide.

            • Ozbargainasaurus on 01/05/2024 - 22:06

              @impoze: @flubba Legend for posting. Seems too complicated for me, but appreciate the effort

            • impoze on 01/05/2024 - 22:22

              @impoze: @flubba86 clues on where to get the stock firmware or is this something you can DM?

Login or Join to leave a comment
Login Join