Another weird cursed e-ink gadget from Lenovo. Seems to have already been discontinued? withdrawn? from sale and is being sold off cheapish in various places. It seems like it was manufactured by BOE Technology for Lenovo.

I dumped various things from the eMMC on my unit.

Is it a PineNote?

A bit?

Same:

• Rockchip RK3566 SoC
• Broadcom BCM43455 WiFi and Bluetooth shipset on the MMC bus
• Most likely the same e-ink panel?
• Possibly the same or very similar Wacom digitiser at /sys/devices/platform/fe5c0000.i2c/i2c-3/3-0009. Using a “wacom_pencil” driver in Android, I will try the Linux hid-over-i2c driver.
• Warm / cool backlight, though it looks to be on a GPIO rather than a dedicated chip
• Externally accessible “boot to loader” switch
• U-Boot 2017.09 with the familiar “can’t read past 32MiB with rkdeveloptool” problem
• Linux 4.19 kernel in supplied Android

Different:

• Touch controller, seems to be a Goodix GT8X at /sys/devices/platform/fe5a0000.i2c/i2c-1/1-005d. The kernel has baked in drivers for several touch digitisers but this is the one that is actually bound during boot.
• Ambient light sensors
• 64GiB eMMC instead of 128GiB
• No obvious external UART :(
• Fewer microphones

Should I buy one?

Probably not unless you plan on hacking it. The included software is quite bad and Lenovo seems to have already abandoned it even before they ran out of stock to sell :(

Android rooting

I used rkdeveloptool to dump the uboot_a partition then applied the same patch documented by Dorian for the PineNote to remove the 32MiB partition download limit. You can download my patched uboot_a image which is likely to work on any other Smart Paper.

Once the 32MiB limit is removed you can dump the boot_a partition, sideload Magisk and copy the boot_a dump to the device using MTP (gMTP or Dolphin both work). Use Magisk to root the boot_a image, copy it back off the device and re-flash it. Booting the modified image and re-running Magisk allows finishing the rooting process.

Alternatively it’s probably possible to just flash my patched boot_a image though I’m less confident this will work on any given device, especially if it’s had Android upgraded at any point.

Hardware

The tablet is difficult to take apart without destroying the display / digitiser. The top layer of glass is held on to the chassis with adhesive around the periphery, the glass is a very thin panel with a plastic textured sheet adhered over it. The “pen holder” to the left of the display is plastic and held down with screws that can’t be acessed until the panel is removed.

I really munted up my panel getting it off, I think more heat and possibly careful use of isopropyl alcohol around the edges to loosen the adhesive would help.

After lifting up the panel and unplugging the board to board connectors the tablet looks like this:

Motherboard and UART pins

The top side of the motherboard is acessed by removing it from the case, although there’s not much of actual interest here:

A 3.3v TTL UART is present on these test points, and runs at 1.5 megabaud: