• expired

Lenovo Smart Paper 10.3" E-Ink Paper Tablet $347 Delivered @ Amazon AU

530
Lenovo Smart Paper 10.3" E-Ink Paper Tablet $347 Delivered @ Amazon AUAffiliate
Go to Deal
Cashback
impoze on 21/04/2024 - 10:51 amazon.com.au (3150 clicks)
Last edited 21/04/2024 - 16:53 by 1 other user
This post contains affiliate links. OzBargain might earn commissions when you click through and make purchases. Please see this page for more information.

The Lenovo Smart Paper is still available at Amazon, price matching Officeworks who still seem to have stock online. (Good Guys & JB listings are gone).

A lot of the reviews online are based on the full retail price. I and a few other members have picked it from the previous deals and it's quite good value besides a few software quirks.
Reading manga is much better than on my Kindle PW with the larger screen, and the writing experience is smooth.

Comes with the pen (wacom style) & folio case.

Some Recommended Apps
  • F-Droid
  • KOreader via F-Droid - Much better reader than stock, slight learning curve to set it all up.
  • Aurora - Google Play Store
  • Amazon app store
  • Kindle App
  • EinkBro
  • Shredder Chess
  • Olauncher - Minimal launcher
  • Mihon - Manga, search Keiyoushi
  • Onenote via Aurora - Much better note management than stock
  • Reddit
  • Focus Reader
  • O'Reilly Books
Games
  • Sudoku
  • Chess
  • 2048

There's a lot of other suggestions & feedback in the previous deals:
https://www.ozbargain.com.au/node/840473
https://www.ozbargain.com.au/node/839629
https://www.ozbargain.com.au/node/838168

Also available from Lenovo direct
$349 free shipping
https://www.lenovo.com/au/en/model/tablets/android-tablets/t…

Price History at C CamelCamelCamel.
Electrical & Electronics eBook Reader Lenovo Android

Related Stores

Amazon AU
Amazon AU
Marketplace

Comments

            • impoze on 24/04/2024 - 08:16

              @flubba86: That's exactly what I realised when I was looking at it yesterday.

              Looking forward to the write up.
              I'm sure the e-ink community will appreciate it.

            • Ronney on 24/04/2024 - 11:23

              @flubba86: @flubba86 I am new to the Android eco system though I have dabbled in custom ROMs for Windows Pocket PC devices decades ago.
              I have one questions. Will the device still get the Lenovo updates once you root the device?

              • impoze on 24/04/2024 - 11:28
                +1

                @Ronney: at this point, I don't think the Lenovo updates matter much. They already seem to be clearing this model out so I doubt they would continue to develop it much further. The last update was Oct 2023.

                • Ronney on 24/04/2024 - 14:33

                  @impoze: @impoze The latest update was in January 2024.

              • flubba86 on 24/04/2024 - 11:38
                +2

                @Ronney: It will still be able to get updates, but you'll need to re-root it after you update.

                • Ronney on 24/04/2024 - 14:25

                  @flubba86: @flubba86 Thank you very much. Looking forward to your writeup.

        • bonechiller on 24/04/2024 - 13:48
          +1

          You are a legend! Looking forward to the writeup :)

        • flubba86 on 24/04/2024 - 20:45

          Does anyone think, if I offered this one-of-a-kind rooted Smart Paper up for sale to the ozbargain community, would it be worth much more than a stock one? Just thinking, before I do the write up, I could sell this one, buy a new one, and document the process of rooting the new one.

        • Ostrich on 29/04/2024 - 21:27
          +2

          @flubba86
          I just bought this from officeworks. Yet to pickup, but have xp on rooting android devices (have legion y700 and xiaomi pad pro both rooted with magisk).

          Would you mind sharing your guide when you get a chance to write up? Keen to get adb running.

          Thanks

        • flubba86 on 01/05/2024 - 20:21
          +15

          @impoze @Ronney @Ostrich @bonechiller

          Sorry for the delay, I've been crazy busy at work and I haven't had a chance to document the process. However, I can list out the basic steps here if someone is brave enough to try it out before my full guide is written.

          The basic steps are:
          1) Get a copy of the Lenovo firmware image corresponding to your current firmware version.
          2) Boot into Rockchip SoC "Loader" mode
          3) Use rkdeveloptool to extract uboot.img from the correct A/B slot.
          4) Use Hexdiff to verify your uboot.img matches the uboot.img in your downloaded firmware.
          5) Use Python library FDT to unpack uboot.img to get uboot.bin
          6) Decompile uboot.bin using Ghidra (its ARM64 v8a) to patch/remove the flash dumper filesize limit.
          7) Use python library FDT to repack uboot.bin into uboot.img file and update the sha1 checksum in the DTB img
          8) Use rkdeveloptool to flash the modified uboot.bin back onto the correct A/B slot
          9) Reboot back into (the now modified) "Loader" mode
          10) Use rkdeveloptool to extract boot.img from the correct A/B slot
          11) Use Hexdiff to verify your boot.img matches the boot.img in your downloaded firmware.
          12) Use Magisk Manager to patch your boot.img with root.
          13) Use rkdeveloptool to flash the rooted boot.img back into the correct A/B slot
          14) Reboot, verify Magisk is reporting operating correctly. Well done!

          Lucky breaks:
          The bootloader is not locked! This includes the uboot and android boot.img. We can modify them, and as long as the SHA1 signatures are correct, it will boot.
          The Android OS (like most modern Android builds) uses "ramdisk" system-overlay mode, that makes it compatible with the Magisk patch-boot.img root.

          Unlucky:
          We can't access developer mode my tapping "build number" 7 times, Lenovo patched that out
          We cannot enable ADB mode before root is achieved, because we need root to enable ADB.
          There is no modified Recovery image for this device, so can't boot to recovery and flash image.zip files.

          More detailed steps:

          First you'll need a copy of the Lenovo firmware distribution that matches the firmware you are running. It will have a filename something like "SP101FU_S001320_240115_ROW.zip" The fields in the filename are Model Number = SP101FU (this is the same model number for the Chinese Lenovo Yoga Paper, and the global Lenovo Smart Paper). Next is firmware revision version (1320), and finally release date (2024-Jan-15). This is the most recent release. I can't tell you where to download this file. SHA1 checksum is 0c1bb89608240779d5ee5092d7b4be00fe579844

          Unzip the file, you should have a file named update_nowaveform.img. This is a "Rockchip Image File", its a special packed format specifically for use with devices running Rockchip CPUs. If you have a Rockchip SDK for RK3566 you can use the unpacker utility to unpack it, but for the rest of us there is a russian tool named imgRePackerRK you can find it on Russian forums, or the English thread on XDA forums. Lenovo is using a very new version of the Rockchip image format, so you need imgRepackerRK version "1.0.7.7_test" or newer.

          Unpack the update_nowaveform.img file with imgRePackerRK. It will complain about mismatched CRC32 and SHA1 signatures, that's because this version of the img is too new for the imgRePackerRK tool. But it will still unpack the needed parts properly. The parts we're specifically interested in are in the "Image" subfolder, called "uboot.img" and "boot.img". Don't get these mixed up. uboot is an embedded bootloader (used on things like Raspberry Pis, and Android TV boxes), "boot.img" is the Android boot loader, quite different, it runs much later in the boot process and is specific to the Android version used.

          The Lenovo Smart Paper uses the A/B firmware layout. That means it has two copies of uboot, two copies of android bootloader, two copies of other system firmware, etc. When you do a firmware update, if you're using slot A, it will add the firmware into slot B, then it will boot using slot B, next update will go into slot A, etc. That prevents bricking by interrupted or corrupted flashing.

          There is a secret hidden button on the device, behind the tiny hole along the bottom edge. Use a sim-eject tool or similar to gently press in there until you feel a click. Don't poke anything in the other two tiny holes, they are microphones.

          If the device is off, you can hold the hidden button and the power button down together until it turns on, release the power button but continue to hold the hidden button and you'll get into Recovery mode (now release the hidden button). Unfortunately recovery mode isn't useful to us because it doesn't work well with the eink screen, and we have no buttons for navigating the menus.

          If the device is off, USB cable unplugged, hold the hidden button while you insert the USB-C data cable (attached to your PC) you should hear a USB device sound from your PC, but eink screen still shows "Powered off". Release the hidden button. Checking kernel dmesg (or device manager on Windows) should show a new Rockchip USB device attached. This is "Loader" mode, similar to Fastboot mode (aka Download mode) on Android phones, but this is a firmware mode specific to Rockchip devices.

          If you have the Rockchip SDK, you can use "rkdeveloptool" utility to connect to the device while in "Loader" mode. For the rest of us, luckily the lads at Pine64 maintain their own up-to-date branch here you can build yourself: https://gitlab.com/pine64-org/quartz-bsp/rkdeveloptool

          Use rkdeveloptool to read the two different uboot slots, name them uboot_a.img and uboot_b.img
          ./rkdeveloptool read-partition uboot_a uboot_a.img
          ./rkdeveloptool read-partition uboot_b uboot_b.img

          Both should be 4MB files, and weirdly, both actually have two identical copies of a 2MB image. To work out which is the right one, use a hex editor to open both files find some ascii text that shows the build date, find the one that has the more recent build date, and matches the date of the firmware image you downloaded earlier. For mine it was Slot B, and I will use uboot_b in my examples. You can't use file checksums to verify your uboot_b.img matches the uboot.img in the dowloaded firmware, because the dumped uboot_b.img from the device will have lots of padding on it.

          We can't immediately dump the android boot.img from the device, because "Loader" has a 32MB file size limit. Unlucky, boot.img is a 100MB partition (with padding, the unpadded version is still around 60MB). If you try to dump a partition larger than 32MB, the loader will reply with a file filled with all 0xCC. Lucky, we have the technology, we can modify the uboot file to remove that limitation. We can't directly open uboot_b.img in ghidra for two reasons, firstly, as mentioned above, its actually two 2MB files stacked on top of each other. Secondly, its a packed DTB file.

          So split the uboot_b.img file in half, and whip up a quick python script using the FDT library to parse the DTB file. From that you can isolate the "images/uboot" node, get its size, offset, and checksum, save it out to a new uboot.bin file. Verify your uboot.bin matches the saved checksum.

          Then load uboot.bin in ghidra. I followed this guide to find the relevant section and patch it: https://github.com/DorianRudolph/pinenotes (See the section under "fix uboot"). When you open it in ghidra, choose ARM64 v8a architecture for reverse-engineering analysis. Ours is a little harder because our uboot.bin doesn't have debugging symbols left in like that in the guide. Find the section, patch it out as described in the guide, and export the binary back to a new "uboot-patched.bin" file. Verify with hexdiff that the only difference in uboot.bin and uboot-patched.bin is the one single instruction change.

          Whip up another script in Python using the FDT library, replace the "image/uboot" region of uboot.img DTB file with your new uboot-patched.img file. Get the sha1 sum of your new uboot-patched.bin file, and replace the old sha1 sum with the new sha1 sum. Finally, when saving the uboot_b-patched.img file back out, make sure it is still 4MB and it is actually two identical copies of the same DTB file. Check with hexdiff against the original uboot_b.img to ensure the only differences are the patched instruction, and the new SHA1 checksum (and the same two again in the second half of the file).

          Double check everything up until this step, make sure everything is done absolutely correctly, if you flash a bad uboot_b-patched.img you may brick your device.
          Use rkdeveloptool to flash the uboot_b-patched.img back onto the device (put it in the same slot you got it from!)
          ./rkdeveloptool write-partition uboot_b uboot_b-patched.img
          after its done, reboot:
          ./rkdeveloptool reboot
          make sure it still boots into android. Breathe a sign of relief. That's the hardest part done.
          Power off, and get back into "Loader" mode (unplug the USB, while off hold the hidden button while plugging in the USB-C).

          Now dump the boot_b partition (or boot_a if that's your slot).
          ./rkdeveloptool read-partition boot_b boot_b.img

          This should be a 100MB file. Use a hexeditor or hexdiff to verify this boot_b.img matches the boot.img in your downloaded firmware image. You can't use file checksums to or file size to verify it matches because the dumped boot_b.img from the device will have 40MB of padding on it.

          Boot into Android and sideload install the latest version of Magisk Manager, also copy boot.img (not uboot.img!) into the Downloads/ directory on your device internal storage. (Note, as long as you've verified its the same file, you can use the one you extracted from the firmware download, instead the boot_b.img one from your device, because it doesn't have the extraneous padding). Use Magisk Manager to patch the boot.img file. It should succeed fine. Copy the patched boot-magisk.img back off the device onto your PC.

          Use rkdeveloptool to flash the boot-magisk.img back onto the device (put it in the same slot you got boot.img from!)
          ./rkdeveloptool write-partition boot_b boot-magisk.img
          after its done, reboot:
          ./rkdeveloptool reboot
          Make sure it gain boots back into Android. Breathe another sign of relief, that's the second hardest part.

          Open Magisk Manager again, double check its says Magisk loaded, with the right version. You're rooted.

          To get Google Play Services, Google Services Framework, GmsCore, and Google Play installed, you need a GApps package. Unfortunately I couldn't find a version of OpenGApps or Nikgapps that worked because they use .zip installers designed for flashing in Recovery mode, and we don't have a modified Recovery for this device. Lucky, we have Magisk, so we can find a version of MagiskGApps that can be installed as a Magisk module.
          Unfortunately because we're on Android 11, we need a pretty old version of MagiskGApps, I used "MagiskGApps-core-V1.1.zip", install that in Magisk Manager, and reboot. Then you will have working Play store, and all Google apps will work include Gmail, Google Drive, Google Maps, Google Books, etc.

          To get ADB: Use the IzzyOnDroid repo in FDroid to install Shizuku https://apt.izzysoft.de/fdroid/index/apk/moe.shizuku.privile…
          Start Shizuku, grant it root permission, and set it running in the background.
          Use the IzzyOnDroid repo in FDroid to install SystemUI Tuner. https://apt.izzysoft.de/fdroid/index/apk/com.zacharee1.syste…
          Open SystemUI Tuner, agree to the terms, grant it access to Shizuku, grant it Root permission, then click "Developer" section, and enable the "ADB" toggle.
          (Note, that does not work before the tablet is rooted, I tried).

          • impoze on 01/05/2024 - 20:26
            +2

            @flubba86: wow, amazing effort.

            Take your time on the full guide.

            • Ozbargainasaurus on 01/05/2024 - 22:06

              @impoze: @flubba Legend for posting. Seems too complicated for me, but appreciate the effort

            • impoze on 01/05/2024 - 22:22

              @impoze: @flubba86 clues on where to get the stock firmware or is this something you can DM?

              • jag121 on 01/05/2024 - 22:37

                @impoze: Have you tried looking at the Lenovo support site?

                • impoze on 01/05/2024 - 23:14

                  @jag121: yes, I don't think it's that simple.

                  • jag121 on 02/05/2024 - 00:24

                    @impoze: I guess that means we have to trust the other places that are offering the rom. Which version does the device ship with?

                  • flubba86 on 02/05/2024 - 07:21

                    @impoze: @impoze Thats right, Lenovo doesn't make them available from their support site, and the only places I found it were pretty dodgy, that's why I don't include instructions how to get it. I provided the checksum because regardless where you get the file from, you can check if its the correct and untampered.

                    • impoze on 02/05/2024 - 08:11

                      @flubba86: got it, thanks for sharing the SHA1.

                      A lot of places had older versions but only one place which seems to be the more common one had the latest firmware.

          • bonechiller on 01/05/2024 - 23:27

            @flubba86: Thank you so much! You are a legend!

          • Ronney on 02/05/2024 - 00:02

            @flubba86: @flubba86 Wow! This is amazing. Thank you very much. I just can't believe that you managed to figure out all this in such a short amount of time.

          • flubba86 on 02/05/2024 - 09:26
            +2

            @flubba86: If you're following along closely, you might be thinking…
            So we extract the uboot.img, so we can get the uboot.bin, so we can patch the uboot.bin so we can remove the uboot limit so we can dump the android boot.img so we can verify we have the right one, but we don't use that file, because we already have the right file. Why go through all that just to get a boot.img file we already have in the firmware download?

            Thats a great question! I did it that way when I rooted my device because I was not positive the imgRePackerRK tool had extracted the boot.img correctly (CRC and SHA1 errors etc) There was no way of knowing the boot.img in the firmware download was the exact boot.img the device was actually running, plus after its patched I need to know which slot to write it back into. Plus I thought I'd need to modify uboot.img to include the new sha1 checksum of the magisk-modified rooted android boot.img, but turns out thats not needed because uboot doesn't validate the checksum of the android bootloader.

            If you're absolutely positive you already have the correct boot.img from the firmware dump, then you can skip most of the steps above, start at the magisk step, patch the boot.img, and flash it into the boot partition using rkdeveloptool, achieve the same outcome.

            • impoze on 02/05/2024 - 10:33

              @flubba86: So if we've got the stock firmware with the matching SHA1 we can be pretty confident that we have the correct boot.img and we can go straight to the Masgisk step and flash after checking which A/B slot.

              • flubba86 on 02/05/2024 - 10:39
                +1

                @impoze: Thats entirely up to you, based on your confidence and ability, and your risk tolerance regarding the device. (That should be said for the whole guide posted above too).

                • impoze on 02/05/2024 - 14:03

                  @flubba86: yep, I can follow pretty much everything until it gets to the Python stage.

                  • flubba86 on 02/05/2024 - 15:57
                    +1

                    @impoze: If you can wait, my full guide will have the complete python code snippets and downloadable python scripts for those steps.

                    • impoze on 02/05/2024 - 16:25

                      @flubba86: awesome, yep, I'll be waiting for the full guide, just excited.

                      Appreciate the effort, I'm sure the wider e-ink community will appreciate it as well.

                • Ostrich on 02/05/2024 - 22:31
                  +2

                  @flubba86: It appears this is the fasttrack approach and probably the one i will take - once you validate A/B slot, magisk the boot.img and flash.

                  Fantastic write-up @flubba86, amazing effort in short period of time!

                  • impoze on 08/05/2024 - 13:58

                    @Ostrich: did you do the fasttrack approach?

  • dm09 on 22/04/2024 - 19:34
    +4

    Cashrewards has 14% discount if you buy in Lenovo website. I ended up paying $300.14 ($349 - $48.86).

    • Ronney on 22/04/2024 - 21:07

      @dm09 could you please confirm that the 14% is including GST?

      • dm09 on 22/04/2024 - 21:52
        +1

        Frankly, not sure about it. I need to wait for 90 days. Even if it excludes or include the GST, the different of cash-back might be around $1 or $2.

        • Ronney on 22/04/2024 - 22:10

          Thanks @dm09.

    • bdl on 23/04/2024 - 00:26
      +1

      be aware to get the $349 price it applies a SMTPAPER eCoupon, which isn't listed as a valid coupon on CR's website… so YMMV with regards to the CB

      see: https://i.imgur.com/clUj8by.png

      • Ronney on 23/04/2024 - 01:31
        +2

        From terms:
        Cashback is eligible on codes generated by Lenovo on its website, even though they may not be listed on Cashrewards, provided last click before purchase is from Cashrewards.

        • bdl on 23/04/2024 - 09:11
          +1

          Also says on CB FAQ (https://www.cashrewards.com.au/store/lenovo) for Lenovo:

          "How to enter a Lenovo coupon code?
          Lenovo coupon codes can be applied at checkout. However, only coupons listed on Cashrewards are eligible for cashback." lol

          I did use a coupon when buying a laptop late last year and still received CR CB however from memory it was listed on the CR page.

          • Ronney on 23/04/2024 - 11:27
            +2

            @bdl: LOL. Both mentioned on the same page.

    • Sezgin999 on 24/04/2024 - 16:20

      @dm09 I can only see 3.3% cashreward on the website. When did you made the purchase ? Thanks

      • Ronney on 24/04/2024 - 16:39
        +2

        I think it was a special promotion on 22nd. The next day (23rd) I saw it at 13%.

  • carrie810 on 24/04/2024 - 13:46

    can somebody kindly share the link for instruction of how to install app?

    • Ronney on 24/04/2024 - 16:48
      +1

      Which app are you after? Generally you use a Google Play store alternate app like F-Droid or Aurora. You can also run a .apk file either by downloading it from the web or transferring it to the device through file transfer and then running it on the device.

    • impoze on 24/04/2024 - 17:36
      +1

      Its listed in order in the OP

      Start with F-Droid
      Then you can look af aurora store

  • BeefBiryani on 24/04/2024 - 16:15

    This seems like expired. Showing up for 499

    • Ronney on 24/04/2024 - 16:50

      Yes, Amazon is out of stock. $499 is from a third party seller.

    • impoze on 24/04/2024 - 17:35
      +1

      Marked it expired

    • Agret on 25/04/2024 - 04:04

      The link at the bottom to Lenovo site appears to still be active for $349. Just need someone to edit the deal and replace with that.

Login or Join to leave a comment
Login Join