Lets get started on the Lenovo Smart Clock 2!

[sammymorrison1]

I used a multimeter testing for continuity between the VBUS, DM, and DP. I tested all of the pads for the microusb location for all three of those and no continuity.

Leads me to believe that if you soldered a micro-usb port on there, it wouldn't give access. But you are right! How the heck did they debug this bad boy? And why would the microusb be there? My best guess is that they had some sort in house made Pin connector, like the dock, but real simple so they could connect to a PC.

Which leads me to thinking I can solder the VBUS, DM, DP, and GND pins on the PCB to the existing USB A connector. I would disconnect the port first and lose the charging functionality through the port but hopefully gain simple access to the clock. Although I like what @Nini00 did with adding the port to his clock.

Getting into that stupid dock was such a pain. They obviously didn't want people in there lol.

Update. So I soldered directly to the pins on the Dock PCB. It did not work. The computer did not recognize the device. I'm assuming this is because there is another power rail that interferes and the dock uses the USB DM and DP values. Either way. Seems like the dock is not the way to go.

I think the best option would be to do what someone else on this thread suggested which is to 3d print a makeshift attachment to the clock, instead of soldering directly to the board. Then plenty of others could join in. I might try to tackle that and develop a model. We have a bunch of these clocks and it would be dope to get other features enabled on this bad boy, like YouTube videos or whatever.

In the mean time I did solder directly to the clock pins and got ADB to work! Will be toying around now.

 

[Nini00]

Hi all,

Some good news here. After a bit of trying, I was able to get a fastboot connection. So after following the guide on this thread we are able to enable adb debugging.

After plugging the device to the PC via the custom usb connector you can access it:

PS C:\Users\**\Downloads\platform-tools_r33.0.3-windows\platform-tools> .\adb.exe devices
List of devices attached
H****PH device

So now we can install apk via adb easily

[EDIT]: Fastboot

After installing Android driver we can reboot in fastboot mode and unlock the bootlaoder:

PS C:\Users\***\Downloads\Cube-AVB-factory-Unlock> fastboot devices
H*****PH fastboot
PS C:\Users\***\Downloads\platform-tools_r33.0.3-windows\platform-tools> fastboot flashing unlock
(bootloader) Start unlock flow

OKAY [ 5.034s]
Finished. Total time: 5.035s

But now, I don't know what we can do ^^

Cheers,

 

[crwb]

Hi all,

Some good news here. After a bit of trying, I was able to get a fastboot connection. So after following the guide on this thread we are able to enable adb debugging.

After plugging the device to the PC via the custom usb connector you can access it:


So now we can install apk via adb easily

[EDIT]: Fastboot

After installing Android driver we can reboot in fastboot mode and unlock the bootlaoder:





But now, I don't know what we can do ^^

Cheers,

Hey, thanks for your effort. Did you get any further with this?

 

[Don Carnage]

I tried mtk-su which unfortunately is patched on the device. I found more guides on how to dump partitions on hovatek.com, which seems to be legit as far as I can tell, never heard of this site before. I didn't have the time the follow these guides yet though. Will report back if I know more.

 

[Cyanyxel]

Hi all,

Some good news here. After a bit of trying, I was able to get a fastboot connection. So after following the guide on this thread we are able to enable adb debugging.

After plugging the device to the PC via the custom usb connector you can access it:


So now we can install apk via adb easily

[EDIT]: Fastboot

After installing Android driver we can reboot in fastboot mode and unlock the bootlaoder:





But now, I don't know what we can do ^^

Cheers,

Basically, I have a launcher, with Aurora and F-Droid, I use it as a Spotify Remote, 2FA generator, calendar, Home Assistant, Unified remote controller

The next step would be to be able to root it to completely uninstall Home and Assistant Core.
And properly remap the button, even installing gesture control.

According to treblecheck, this device is compatible with treble

 

[Nini00]

Basically, I have a launcher, with Aurora and F-Droid, I use it as a Spotify Remote, 2FA generator, calendar, Home Assistant, Unified remote controller

The next step would be to be able to root it to completely uninstall Home and Assistant Core.
And properly remap the button, even installing gesture control.

According to treblecheck, this device is compatible with treble

Hi,

I'm stuck at the same point :

The next step would be to be able to root it to completely uninstall Home and Assistant Core.
And properly remap the button, even installing gesture control.

My use case is to use touch-portal on it, so i'm done with it. I don't have any skills to grant root acess on the device...

I hope someone will be able to do that

 

[Cyanyxel]

Hi,

I'm stuck at the same point :

The next step would be to be able to root it to completely uninstall Home and Assistant Core.
And properly remap the button, even installing gesture control.

My use case is to use touch-portal on it, so i'm done with it. I don't have any skills to grant root acess on the device...

I hope someone will be able to do that

In fact it can be done with ADB, pretty sad I'm bad at soldering very tiny things like this and this doesn't provide wireless adb

 

[Nini00]

In fact it can be done with ADB, pretty sad I'm bad at soldering very tiny things like this and this doesn't provide wireless adb

feel free to share a bit the process and i will make a try

I have tried to uninstall via ADB but as we are not root:

adb shell cmd package uninstall -k --user 0 com.google.assistant.core
Failure [DELETE_FAILED_DEVICE_POLICY_MANAGER]

EDIT: If you nee some more pics to solder the usb port let me know.

 

[Cyanyxel]

And if you try :
adb shell pm disable-user --user 0 com.google.assistant.core

 

[Nini00]

And if you try :
adb shell pm disable-user --user 0 com.google.assistant.core

Unfortunately same issue:

Security exception: Cannot disable a protected package: com.google.assistant.core

 

[flipontheradio]

EDIT: If you nee some more pics to solder the usb port let me know.

Any chance you could post some more pics? It looks like you have soldered to both GND pads? Is one for 12v and another for usb power? I am hoping to try adding some admin permissions to fully kiosk browser. Thanks!

 

[thejaycan]

Hi all,

Some good news here. After a bit of trying, I was able to get a fastboot connection. So after following the guide on this thread we are able to enable adb debugging.

After plugging the device to the PC via the custom usb connector you can access it:


So now we can install apk via adb easily

[EDIT]: Fastboot

After installing Android driver we can reboot in fastboot mode and unlock the bootlaoder:





But now, I don't know what we can do ^^

Cheers,

Hmmm... So unfortunately I'm no expert at this but I have been ROMing since 2010. Seems to me that if you have adb and fastboot, have oem unlock, and fastboot flashing unlock works then I'm wondering if something like Magisk can patch the boot.img*. Then you'd have to copy the patched boot.img to your PC from the internal storage and then flash it in the fastboot environment. That would provide root. I will have to dig into whether Magisk supports this hardware.

I'd really like root so that you could replace Google's Youtube Music with YT Music Vanced (as root) to be able to use voice controls with music (and importantly with no ads). Of course, I would expect YouTube Vanced could do videos with voice controls this way as well (with no ads).

*Edit: just remembered, Magisk needs the boot.img to patch first, so we'd have to extract it from our device's factory image/firmware. Was there a thread on here that linked to the factory image? If not, I wonder if it can be extracted via ADB.

 

[vhDavid]

Hi, I own one of these since a week or so and succeeded in the 'hack' to be able to install apk's. I would like to use it as a music player that can connect to the logitech media server running on a raspberry pi 4. I know there is an android app that can do just that (squeezeplayer) but I have nog clue on how to install that on this clock because I need to log in for that to pay it. Now I found this thread and wonder if I would succeed in connecting to the usb as mentioned here there would be a way to install a linux image on it (for example picoreplayer).

Thank you,
David

 

[bj00rn]

Any progress on this?

I found a link to firmware at https://mirrors.lolinet.com/firmware/lenovo/Lenovo_Smart_Clock2/CD-24502F/

Don't know if this is related/legit though.

Contains an image with instructions on how to flash image using a dock. Dock looks different from the one that comes shipped with the unit.

 

[bj00rn]

feel free to share a bit the process and i will make a try

I have tried to uninstall via ADB but as we are not root:



EDIT: If you nee some more pics to solder the usb port let me know.

Any success on backing up the stock firmware? Maybe this guide will help : https://forum.xda-developers.com/t/...sing-mtk-client-oppo-reno6-5g-mt6877.4406069/

Im new to this stuff, but from what i gather we need to patch the stock boot.img to get root. Getting the stock firmware would be a good first step.

Mtk client: https://github.com/bkerler/mtkclient

 

[dro1dy]

Any progress on this?

I found a link to firmware at https://mirrors.lolinet.com/firmware/lenovo/Lenovo_Smart_Clock2/CD-24502F/

Don't know if this is related/legit though.

Contains an image with instructions on how to flash image using a dock. Dock looks different from the one that comes shipped with the unit.

View attachment 5860503

That sure looks legit and does seem to confirm that there is a way to flash things via the pins on the bottom.
The instructions implying that there's a specific order you need to apply power in could indicate that there's some switching in place on the pogo pcb that only connects the USB data lines when the 5V is applied.

 

[bj00rn]

That sure looks legit and does seem to confirm that there is a way to flash things via the pins on the bottom.
The instructions implying that there's a specific order you need to apply power in could indicate that there's some switching in place on the pogo pcb that only connects the USB data lines when the 5V is applied.

From the pics it seems that the dock is different though. Stock dock might be a dead end. Im going to give ADB a go using the standard usb connection to see if it works.

I just got these compatible pogo pins https://se.rs-online.com/web/p/pcb-headers/7020461 and they fit perfectly. Shame I don't have the means or skills to make a 3D printed dock. Will have to glue something together for now.

 

[cmccambridge]

Hey all, following the investigation in the thread above, I've successfully dumped the stock firmware that my (used) smart clock 2 arrived with, using mtkclient via soldering on to the USB pins!

USB Connection​

Attaching a closer photo for others to reference:

Note that you do not need to solder to both GND pins there- they're connected together on the PCB. I believe the earlier image was using two ground wires mostly because it was easy to do so? (One for the cable/jack shield, and the other for the black ground wire running through the cable.) In my case I crimped some dupont connectors on, so I simply twisted the cable shield and the black ground wire together into a single pin (look closely at bottom of this image):

I've confirmed the following modes:

• MTP: Normally booted up to the "Hi, I'm your Google Assistant" message, the device appears over MTP as shown in previous screen captures. "Lenovo CD-24502F". Appears shortly after the Lenovo boot logo is shown.
• Fastboot(?): Booted with Vol + held down, then selecting Fastboot: Device appears on USB as an Android ADB interface, using the Mediatek vendor ID. I have not yet attempted to connect to this interface... just hit it by accident once and saw it pop up. NOte that in this mode, nothing appears to happen on-screen. Just freezes at the menu selection. Not yet sure whether USB Fastboot access is functional there.
• Mediatek bootloader (for mtkclient): Briefly connects for a second or so, as others have noted. You must be running the mtkclient at this time to complete the handshake, otherwise this will quickly be removed as the boot process continues. Further, I found the mtkclient and boot process to be a little timing-sensitive. I only get a successful connection about 1 in 5 tries, but DID succeed.

Dumping Firmware​

Haven't tried it over fastboot yet, but via mtkclient this definitely succeeds. Partition table:

Spoiler: GPT Table

MTK Flash/Exploit Client V1.6.1 (c) B.Kerler 2018-2023

DAXFlash - HW-CODE         : 0x8167
DAXFlash - HWSUB-CODE      : 0x8A00
DAXFlash - HW-VERSION      : 0xCB00
DAXFlash - SW-VERSION      : 0x1
DAXFlash - CHIP-EVOLUTION  : 0x0
DAXFlash - DA-VERSION      : 1.0

GPT Table:
-------------
proinfo:             Offset 0x0000000000080000, Length 0x0000000000300000, Flags 0x00000000, UUID f57ad330-39c2-4488-b09b-00cb43c9ccd4, Type EFI_BASIC_DATA
nvram:               Offset 0x0000000000380000, Length 0x0000000000500000, Flags 0x00000000, UUID fe686d97-3544-4a41-21be-167e25b61b6f, Type EFI_BASIC_DATA
protect1:            Offset 0x0000000000880000, Length 0x0000000000a00000, Flags 0x00000000, UUID 1cb143a8-b1a8-4b57-51b2-945c5119e8fe, Type EFI_BASIC_DATA
protect2:            Offset 0x0000000001280000, Length 0x0000000000a00000, Flags 0x00000000, UUID 3b9e343b-cdc8-4d7f-a69f-b6812e50ab62, Type EFI_BASIC_DATA
persist:             Offset 0x0000000001c80000, Length 0x0000000003000000, Flags 0x00000000, UUID 5f6a2c79-6617-4b85-02ac-c2975a14d2d7, Type EFI_BASIC_DATA
seccfg:              Offset 0x0000000004c80000, Length 0x0000000000040000, Flags 0x00000000, UUID 4ae2050b-5db5-4ff7-d3aa-5730534be63d, Type EFI_BASIC_DATA
lk:                  Offset 0x0000000004cc0000, Length 0x0000000000080000, Flags 0x00000000, UUID 1f9b0939-e16b-4bc9-bca5-dc2ee969d801, Type EFI_BASIC_DATA
lk2:                 Offset 0x0000000004d40000, Length 0x0000000000080000, Flags 0x00000000, UUID d722c721-0dee-4cb8-838a-2c63cd1393c7, Type EFI_BASIC_DATA
boot:                Offset 0x0000000004dc0000, Length 0x0000000002000000, Flags 0x00000000, UUID e02179a8-ceb5-48a9-3188-4f1c9c5a8695, Type EFI_BASIC_DATA
recovery:            Offset 0x0000000006dc0000, Length 0x0000000002000000, Flags 0x00000000, UUID 84b09a81-fad2-41ac-0e89-407c24975e74, Type EFI_BASIC_DATA
para:                Offset 0x0000000008dc0000, Length 0x0000000000080000, Flags 0x00000000, UUID e8f0a5ef-8d1b-42ea-2a9c-835cd77de363, Type EFI_BASIC_DATA
logo:                Offset 0x0000000008e40000, Length 0x0000000000800000, Flags 0x00000000, UUID d5f0e175-a6e1-4db7-c094-f82ad032950b, Type EFI_BASIC_DATA
dtbo:                Offset 0x0000000009640000, Length 0x0000000000800000, Flags 0x00000000, UUID 1d9056e1-e139-4fca-0b8c-b75fd74d81c6, Type EFI_BASIC_DATA
expdb:               Offset 0x0000000009e40000, Length 0x0000000000a00000, Flags 0x00000000, UUID 7792210b-b6a8-45d5-91ad-3361ed14c608, Type EFI_BASIC_DATA
frp:                 Offset 0x000000000a840000, Length 0x0000000000100000, Flags 0x00000000, UUID 138a6db9-1032-451d-e991-0fa38ff94fbb, Type EFI_BASIC_DATA
tee1:                Offset 0x000000000a940000, Length 0x0000000000500000, Flags 0x00000004, UUID 756d934c-50e3-4c91-46af-02d824169ca7, Type EFI_BASIC_DATA
tee2:                Offset 0x000000000ae40000, Length 0x0000000000500000, Flags 0x00000000, UUID a3f3c267-5521-42dd-24a7-3bdec20c7c6f, Type EFI_BASIC_DATA
kb:                  Offset 0x000000000b340000, Length 0x0000000000200000, Flags 0x00000000, UUID 8c68cd2a-ccc9-4c5d-578b-34ae9b2dd481, Type EFI_BASIC_DATA
dkb:                 Offset 0x000000000b540000, Length 0x0000000000200000, Flags 0x00000000, UUID 6a5cebf8-54a7-4b89-1d8d-c5eb140b095b, Type EFI_BASIC_DATA
md_udc:              Offset 0x000000000b740000, Length 0x0000000001600000, Flags 0x00000000, UUID a0d65bf8-e8de-4107-3494-1d318c843d37, Type EFI_BASIC_DATA
metadata:            Offset 0x000000000cd40000, Length 0x0000000002100000, Flags 0x00000000, UUID 46f0c0bb-f227-4eb6-2fb8-66408e13e36d, Type EFI_BASIC_DATA
nvdata:              Offset 0x000000000ee40000, Length 0x0000000000400000, Flags 0x00000000, UUID fbc2c131-6392-4217-1eb5-548a6edb03d0, Type EFI_BASIC_DATA
vbmeta:              Offset 0x000000000f240000, Length 0x0000000000400000, Flags 0x00000000, UUID e195a981-e285-4734-2580-ec323e9589d9, Type EFI_BASIC_DATA
vbmeta_system:       Offset 0x000000000f640000, Length 0x0000000000400000, Flags 0x00000000, UUID e29052f8-5d3a-4e97-b5ad-5f312ce6610a, Type EFI_BASIC_DATA
vbmeta_vendor:       Offset 0x000000000fa40000, Length 0x0000000000400000, Flags 0x00000000, UUID 9c3cabd7-a35d-4b45-578c-b80775426b35, Type EFI_BASIC_DATA
super:               Offset 0x000000000fe40000, Length 0x00000000ab3ff000, Flags 0x00000000, UUID e7099731-95a6-45a6-e5a1-1b6aba032cf1, Type EFI_BASIC_DATA
cache:               Offset 0x00000000bb23f000, Length 0x0000000006e80000, Flags 0x00000000, UUID 8273e1ab-846f-4468-99b9-ee2ea8e50a16, Type EFI_BASIC_DATA
userdata:            Offset 0x00000000c20bf000, Length 0x000000010fec1000, Flags 0x00000000, UUID d26472f1-9ebc-421d-14ba-311296457c90, Type EFI_BASIC_DATA

Total disk size:0x00000001d2000000, sectors:0x0000000000e90000

Rooting​

I have not yet set the device up (never booted past the "hi, i'm your google assistant" prompt), just wanted to capture a full firmware image first as a last resort to return to.

I will take a swing at getting root via Magisk today with the boot.img I extracted. If all goes well, I've got a second smart clock 2 new-in-box to play with as well to confirm the process. It may also have different firmware version on it, i'll take a look.

I'm hoping to explore options between the stock ROM with a few troublesome apps stripped out / extra permissions available via root, versus replacing with a GSI, given folks' reports above that treble check looked good.... but it's been maybe 8 years since I've had any android devices to mess with, so I'm relearning everything as I go here.

Anyone have advice on ROMs or requests on things they'd like to see tried?

 

[cmccambridge]

Successful root!​

Took a few false starts, and not yet verified on my vanilla second device... so this would benefit from further refinement. This method mixes together two guides:

1. Previously linked method for sideloading apps on the Smart Clock 2: https://forum.xda-developers.com/t/...oid-apps-on-the-lenovo-smart-clock-2.4393271/
2. This guide for rooting a Mediatek device, demonstrating usage of mtkclient and Magisk: https://forum.xda-developers.com/t/...hod-works-for-imei-erased-phones-too.4547795/

Process:

1. Solder on to the USB port to connect to a host machine.
2. Extract the stock boot.img (and IMHO every other partition as well as a backup...) using mtkclient.
3. While you're here, unlock the bootloader. Could also do it at step 8.
   
4. Set up the device with Google Home and the screen reader based sideloading technique. Get access to Developer Mode and enable USB Debugging.
5. Transfer your boot.img to the device via ADB
6. Install Magisk on the device, and use it to patch your boot.img
7. Transfer the patched boot.img back to your host.
8. UNTESTED: Using mtkclient, wipe userdata, metadata, md_udc. (NOTE: I have not tried this exact step! I instead left userdata intact, and caused a boot loop into recovery after the following step, and I used Recovery's factory data reset to wipe the device... Don't be me:
   
   )
9. UNTESTED: Using mtkclient, write the magisk_patched_... boot partition, and an empty vbmeta. (NOTE: I have not tried this step! I instead booted to fastboot and used fastboot to write the boot partition and then reset the vbmeta, following Magisk's installation instructions.)
10. Set up the device a second time with Google Home and the screen reader based sideloading technique. This time when you install Magisk, you'll be greeted with "Your device needs additional setup for Magisk to work properly. Do you want to proceed and reboot?" Do so...
    
11. You're in!
    

 

[Syco54645]

Successful root!​

Took a few false starts, and not yet verified on my vanilla second device... so this would benefit from further refinement. This method mixes together two guides:

1. Previously linked method for sideloading apps on the Smart Clock 2: https://forum.xda-developers.com/t/...oid-apps-on-the-lenovo-smart-clock-2.4393271/
2. This guide for rooting a Mediatek device, demonstrating usage of mtkclient and Magisk: https://forum.xda-developers.com/t/...hod-works-for-imei-erased-phones-too.4547795/

Process:

1. Solder on to the USB port to connect to a host machine.
2. Extract the stock boot.img (and IMHO every other partition as well as a backup...) using mtkclient.
3. While you're here, unlock the bootloader. Could also do it at step 8. View attachment 5875719
4. Set up the device with Google Home and the screen reader based sideloading technique. Get access to Developer Mode and enable USB Debugging.
5. Transfer your boot.img to the device via ADB
6. Install Magisk on the device, and use it to patch your boot.img
7. Transfer the patched boot.img back to your host.
8. UNTESTED: Using mtkclient, wipe userdata, metadata, md_udc. (NOTE: I have not tried this exact step! I instead left userdata intact, and caused a boot loop into recovery after the following step, and I used Recovery's factory data reset to wipe the device... Don't be me: View attachment 5875713)
9. UNTESTED: Using mtkclient, write the magisk_patched_... boot partition, and an empty vbmeta. (NOTE: I have not tried this step! I instead booted to fastboot and used fastboot to write the boot partition and then reset the vbmeta, following Magisk's installation instructions.)
10. Set up the device a second time with Google Home and the screen reader based sideloading technique. This time when you install Magisk, you'll be greeted with "Your device needs additional setup for Magisk to work properly. Do you want to proceed and reboot?" Do so... View attachment 5875715
11. You're in! View attachment 5875717

This is great news, nice work. It seems we may finally be able to remove the google assistant with what you have done. I have a clock but have not opened it yet. Do we know the pinouts for the pads on the bottom of the clock, when assembled that is. I would like to try this with pogo pins and breadboard.