Lets get started on the Lenovo Smart Clock 2!

Search This thread
By:
Advanced…
L

LengAwaits

New member
Dec 13, 2021
1
1
New user, here. Long time listener, first time caller. Walmart is selling the Lenovo "Smart Clock 2", in my area, for $24.88 this holiday season. It's bundled with a Lenovo "Smart Bulb Medium", which made it all the more tempting. Of course I didn't resist.

The Smart Clock 2 runs on a Mediatek MT8176 SoC, unlike the previous "Smart Clock", which ran on an Amlogic A113X SoC. Based on the specs I'm seeing, the Bluetooth and WiFi modules have both been downgraded. From BT 5.0 to BT 4.2, and from 801.11AC to 801.11B/G/N, respectively. Hey, you've got to cut costs somewhere if you want to sell it for under $25! I suspect there are more cost-saving "features", but I haven't figured out how to go any deeper in the casing without destroying the innards of the device. Not yet, at least.

Now, I know the bootloader for the original "Smart Clock" was successfully unlocked, and I'm curious what we can do with this device. Lenovo have removed the USB port from the "Smart Clock 2", replacing it with pogo pin pads on the bottom of the unit, which interface with a dock (not included in the bundle, of course). The dock does have a USB A port, but I don't have the dock. We'll have to do this the old fashioned way. Whatever that is. Any tips for non-destructively interfacing with those pads would be welcomed! I'm thinking some blu-tack and a female USB-A pigtail? I suppose I could buy some pogo pins and wire them up to protoboard, but I'm not sure I want to make that investment (in time or money). I suppose I could also just buy the dock, but I'm not nearly that invested, and also they don't seem to sell it without the "Smart Clock 2" itself. Not exactly surprising.

Lenovo have kindly labeled the pads on the PCB inside the unit. Initial disassembly isn't too hard. Remove the rubber gasket from the bottom of the device (it's just held on with some relatively weak adhesive), unscrew the four screws underneath, and gently pry the plastic base-plate up from the front edge (the side facing the screen). Underneath we find a small PCB that looks like this:

PXL_20211213_060806763.jpg


The switch just turns the microphone on and off, so don't get too excited, like I did, at first. DP, DM, GND, and VBUS should get us a USB connection, though, if I'm not mistaken.

Holding the Volume Up button while powering the unit brings us, eventually, to the expected:

PXL_20211213_071810005.jpg


Holding volume down on power-up boots us into "safe mode".

I'd very much like to get this device to do something more than just "be a clock", or "stream audio". Especially considering that system specs like this thing has would've made me lose my mind back when I was 12. Granted, I only had a 386 then. I'd absolutely love to figure out how to get this thing to run Octo4a (Android OctoPrint server for driving a 3D Printer). It's more than capable of it, but I suspect I'm chasing a dream. At least I can repurpose the screen and digitizer, if all else fails.

Information online seems scant, for this device, at this time, but I'm willing to experiment. I'm not the most knowledgeable person, but I have a dusty 20 year old degree in electronic engineering, if that helps? I somehow doubt it.

So, where do I go from here? Figure out how to connect it and then "fastboot flashing unlock" as with the previous "Smart Clock" from Lenovo? All suggestions welcome! Thanks!
 
Last edited:
  • Like
Reactions: Evelknievel
S

ScanuRag

Member
Dec 28, 2019
20
8
Amazon Kindle Fire
Samsung Galaxy Watch 4
I know this is an older thread but I wanted to point out that by following this guide you can install basically any apk on the clock. From that point you can install a launcher and open the real settings app as opposed to the default one. I was able to connect a bluetooth keyboard and also enable developer options the normal way, where an "OEM Unlocking" toggle is present. I was also able to confirm that the charging dock is connected over usb as it shows up under connected devices in settings, however the type-A port on the back doesn't seem to carry data. I tried both a wired keyboard and usb flash drive and neither seemed to work. Hope this info helps!
20220806_113635.jpg
20220806_120029.jpg
 
  • Like
Reactions: Evelknievel and kxyz ccc
Hash.H

Hash.H

Member
Oct 22, 2014
42
9
Boston, MA
ScanuRag said:
I know this is an older thread but I wanted to point out that by following this guide you can install basically any apk on the clock. From that point you can install a launcher and open the real settings app as opposed to the default one. I was able to connect a bluetooth keyboard and also enable developer options the normal way, where an "OEM Unlocking" toggle is present. I was also able to confirm that the charging dock is connected over usb as it shows up under connected devices in settings, however the type-A port on the back doesn't seem to carry data. I tried both a wired keyboard and usb flash drive and neither seemed to work. Hope this info helps!View attachment 5679439View attachment 5679453
Click to expand...
Click to collapse
So I have been trying to follow that guide, and it says to enable the screen-reader in the accessibility settings in the google home app, but that setting isnt anywhere to be found in the google home app (on iOS). How did you do it? Thanks
 
N

nicklas2k

Member
Aug 1, 2010
5
0
ScanuRag said:
I know this is an older thread but I wanted to point out that by following this guide you can install basically any apk on the clock. From that point you can install a launcher and open the real settings app as opposed to the default one. I was able to connect a bluetooth keyboard and also enable developer options the normal way, where an "OEM Unlocking" toggle is present. I was also able to confirm that the charging dock is connected over usb as it shows up under connected devices in settings, however the type-A port on the back doesn't seem to carry data. I tried both a wired keyboard and usb flash drive and neither seemed to work. Hope this info helps!View attachment 5679439View attachment 5679453
Click to expand...
Click to collapse
Now that you have developer options enabled, can you enable ADB over wifi ?
 
Don Carnage

Don Carnage

Senior Member
Mar 23, 2013
127
350
Samsung Galaxy Note 10.1
Samsung Galaxy S5
The guide worked fine, thank you @ScanuRag for pointing me to it. It's a bit trial and error to get the gestures right and the browser is quite painful to use with talkback on, but I managed to install a launcher and access settings, enable developer options and ADB. Next step would be to get a USB connection somehow.

ScanuRag said:
So I 3D printed a small piece that lets me more easily hold some breadboard cables onto the pads. Do you think it's safe to connect the d+ and d- cables to a USB port and plug it into my computer.
Click to expand...
Click to collapse
So did you try it yet?

nicklas2k said:
Now that you have developer options enabled, can you enable ADB over wifi ?
Click to expand...
Click to collapse
No, there is no menu option for ADB over wifi.
 
S

ScanuRag

Member
Dec 28, 2019
20
8
Amazon Kindle Fire
Samsung Galaxy Watch 4
I finally got around to disassembling the wireless charging dock and found some exciting things. Most importantly, there appear to be contacts for a MicroUSB port. I'll have to get one of my friends who's better at soldering than I am to solder one on. I wouldn't be surprised if it gives USB access to the clock because Lenovo had to debug these things somehow.
 

Attachments

  • 20221117_144045.jpg
    20221117_144045.jpg
    1.2 MB · Views: 399
  • 20221117_140340.jpg
    20221117_140340.jpg
    2.8 MB · Views: 401
  • 20221117_140329.jpg
    20221117_140329.jpg
    2.7 MB · Views: 401
  • Like
Reactions: Don Carnage
X

xrintintin

Member
Jun 15, 2011
26
3
Harrisburg, PA
Just dropping a line here and keeping this dev work alive, getting this thing at least with an unlocked bootloader and something stable (not relaying on lenovo or google) is a huge win. I turned of OEM updates do hopefully that works for now.
 
Nini00

Nini00

Member
Dec 7, 2022
7
0
Hppy to see your work guys !

On my side I have directly solder usb connector on it:

1670422282031.png


Now if you plug it to the computer, the device is show as LenovoCD-24502F

1670422293452.png



I'm now able to see preloader boot :


  1. If you start the device with vol- pressed we can see something like an UART Dec 6 15:08:20 AREA51 systemd[1]: systemd-oomd.service: Got notification message from PID 6014 (WATCHDOG=1) Dec 6 15:08:37 AREA51 kernel: [1299860.094549] usb 1-10.1: new high-speed USB device number 72 using xhci_hcd Dec 6 15:08:37 AREA51 kernel: [1299860.195180] usb 1-10.1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice= 1.00 Dec 6 15:08:37 AREA51 kernel: [1299860.195190] usb 1-10.1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 Dec 6 15:08:37 AREA51 kernel: [1299860.195194] usb 1-10.1: Product: MT65xx Preloader Dec 6 15:08:37 AREA51 kernel: [1299860.195197] usb 1-10.1: Manufacturer: MediaTek Dec 6 15:08:37 AREA51 kernel: [1299860.218855] cdc_acm 1-10.1:1.0: Zero length descriptor references Dec 6 15:08:37 AREA51 kernel: [1299860.218867] cdc_acm: probe of 1-10.1:1.0 failed with error -22 Dec 6 15:08:37 AREA51 kernel: [1299860.299163] cdc_acm 1-10.1:1.1: ttyACM1: USB ACM device




  2. [15:27]
    +++++ but the UART is removed once the device is started (modifié)




  3. [15:28]
    ++++ Dec 6 15:08:39 AREA51 systemd[1]: dev-serial-by\x2dpath-pci\x2d0000:00:14.0\x2dusb\x2d0:10.1:1.1.device: Changed plugged -> dead Dec 6 15:08:39 AREA51 systemd[1]: dev-serial-by\x2did-usb\x2dMediaTek_MT65xx_Preloader\x2dif01.device: Changed plugged -> dead Dec 6 15:08:39 AREA51 systemd[1]: dev-ttyACM1.device: Changed plugged -> dead Dec 6 15:08:39 AREA51 systemd[1]: sys-devices-pci0000:00-0000:00:14.0-usb1-1\x2d10-1\x2d10.1-1\x2d10.1:1.1-tty-ttyACM1.device: Changed plugged -> dead Dec 6 15:08:39 AREA51 systemd[1]: sys-devices-pci0000:00-0000:00:14.0-usb1-1\x2d10-1\x2d10.1-1\x2d10.1:1.1-tty-ttyACM1.device: Collecting. Dec 6 15:08:39 AREA51 systemd[1]: dev-ttyACM1.device: Collecting. Dec 6 15:08:39 AREA51 systemd[1]: dev-serial-by\x2did-usb\x2dMediaTek_MT65xx_Preloader\x2dif01.device: Collecting. Dec 6 15:08:39 AREA51 systemd[1]: dev-serial-by\x2dpath-pci\x2d0000:00:14.0\x2dusb\x2d0:10.1:1.1.device: Collecting.




  4. [15:29]
    ===============================================================

But the uart is gone after the boot :(

Any news on your side ?
 
Last edited:
Don Carnage

Don Carnage

Senior Member
Mar 23, 2013
127
350
Samsung Galaxy Note 10.1
Samsung Galaxy S5
I also managed to wire up the pins on the small board to a USB connection and I could adb into the device after enabling usb debugging. There is an OEM unlock option, not sure what I can do afterwards though, have to read about how that all works first before I destroy anything.
 
  • Like
Reactions: Nini00
Don Carnage

Don Carnage

Senior Member
Mar 23, 2013
127
350
Samsung Galaxy Note 10.1
Samsung Galaxy S5
After a bit of trying, I managed to unlock the device. After enabling OEM unlock in the system settings, I did 'adb reboot bootloader' but the screen turned off and I didn't know what was happening. It seemed to be in fastboot mode as it was giving me 'remote: unknown command' after trying 'fastboot oem device-info'. I then tried 'fastboot flashing unlock' which got stuck.

Next I tried rebooting with holding the volume up key and selected fastboot after that. This was fine and it also showed the warning for the unlock but the volume up key wouldn't do anything, I waited a couple of minutes and retried this several times with the same result, which is interesting because I could chose fastboot in the bootloader menu without any issues.

As I knew what was happening in fastboot, I rebooted the device normally and while the boot screen was still visible, I used adb to reboot into the bootloader. Interestingly, the screen stayed on this time and unlocking worked like a charm. Device was reset and now the unlocked warning is shown when booting.

Edit: Does anyone know where to get the firmware files for this thing? Before I continue flashing anything, I'd really like to have a backup at hand that I can use to restore the device in case something goes wrong. I found guides how to backup mtk firmware with wwr_mtk + sp flash tool (on a site called hovatek, is this legit?) - but they are made for phones and I'm not sure if they do work for the clock as there is no battery.
 
Last edited:
S

sammymorrison1

Member
Dec 2, 2016
13
3
I've been following this for a bit, so if you guys have the software unlocked and are able to flash the Gen 1 software, aren't we golden? Because from there I remember many people have hacked the first generation. I might be jumping the gun, I'm not too great at this stuff but I can follow most of what you are all saying so far. Can't we just do that?
 
S

sammymorrison1

Member
Dec 2, 2016
13
3
ScanuRag said:
I finally got around to disassembling the wireless charging dock and found some exciting things. Most importantly, there appear to be contacts for a MicroUSB port. I'll have to get one of my friends who's better at soldering than I am to solder one on. I wouldn't be surprised if it gives USB access to the clock because Lenovo had to debug these things somehow.
Click to expand...
Click to collapse
I used a multimeter testing for continuity between the VBUS, DM, and DP. I tested all of the pads for the microusb location for all three of those and no continuity.

Leads me to believe that if you soldered a micro-usb port on there, it wouldn't give access. But you are right! How the heck did they debug this bad boy? And why would the microusb be there? My best guess is that they had some sort in house made Pin connector, like the dock, but real simple so they could connect to a PC.

Which leads me to thinking I can solder the VBUS, DM, DP, and GND pins on the PCB to the existing USB A connector. I would disconnect the port first and lose the charging functionality through the port but hopefully gain simple access to the clock. Although I like what @Nini00 did with adding the port to his clock.

Getting into that stupid dock was such a pain. They obviously didn't want people in there lol.
 
You must log in or register to reply here.

Similar threads

W
Guide installing android apps on the lenovo smart clock 2.
Replies
151
Views
41K
SmartAlex2010
SmartAlex2010
deadman96385
Lenovo Smart Clock (Bootloader/AVB unlock, Firmware, Region Changer, Kernel Source)
Replies
65
Views
51K
C
C4illin
S
Lenovo Smart Clock details
Replies
16
Views
15K
Iavisek
Iavisek
deadman96385
CD-18781Y (Lenovo ThinkSmart View) Bootloader, Firmware, Zoom/Teams Conversion, Normal Android
Replies
114
Views
36K
protechtedd
protechtedd
deadman96385
(Lenovo Smart Display 8" & 10") (Amber & Blueberry) AVB/Bootloader Unlock, Firmware
Replies
143
Views
22K
jonathanrob
jonathanrob

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 4
    C
    cmccambridge

    Successful root!​


    Took a few false starts, and not yet verified on my vanilla second device... so this would benefit from further refinement. This method mixes together two guides:
    1. Previously linked method for sideloading apps on the Smart Clock 2: https://xdaforums.com/t/guide-installing-android-apps-on-the-lenovo-smart-clock-2.4393271/
    2. This guide for rooting a Mediatek device, demonstrating usage of mtkclient and Magisk: https://xdaforums.com/t/root-mediatek-devices-new-method-works-for-imei-erased-phones-too.4547795/

    Process:
    1. Solder on to the USB port to connect to a host machine.
    2. Extract the stock boot.img (and IMHO every other partition as well as a backup...) using mtkclient.
    3. While you're here, unlock the bootloader. Could also do it at step 8.
      smart-clock-unlocked.jpg
    4. Set up the device with Google Home and the screen reader based sideloading technique. Get access to Developer Mode and enable USB Debugging.
    5. Transfer your boot.img to the device via ADB
    6. Install Magisk on the device, and use it to patch your boot.img
    7. Transfer the patched boot.img back to your host.
    8. UNTESTED: Using mtkclient, wipe userdata, metadata, md_udc. (NOTE: I have not tried this exact step! I instead left userdata intact, and caused a boot loop into recovery after the following step, and I used Recovery's factory data reset to wipe the device... Don't be me:
      recovery-oops.jpg
      )
    9. UNTESTED: Using mtkclient, write the magisk_patched_... boot partition, and an empty vbmeta. (NOTE: I have not tried this step! I instead booted to fastboot and used fastboot to write the boot partition and then reset the vbmeta, following Magisk's installation instructions.)
    10. Set up the device a second time with Google Home and the screen reader based sideloading technique. This time when you install Magisk, you'll be greeted with "Your device needs additional setup for Magisk to work properly. Do you want to proceed and reboot?" Do so...
      magisk-final-step.jpg
    11. You're in!
      root.jpg
    View
    3
    C
    cmccambridge

    Successful 3D Printed Dock​

    Took a bit to finish the model since I've had limited free time, but here's what I came up with: Lenovo Smart Clock 2 DIY Programming Pogo Pin Dock

    TL;DR: If you have access to a 3D printer, pogo pins, and are willing to do a little wiring to build the dock, you do not need to open the clock to gain access to the USB interface!


    dock.jpg
    connections.jpg


    See the Printables page for more info & photos... short story: the parts fit a little loosely together but they fit the clock really well and the interface I'm using (0.7mm "needle" style pogo pins) works great! I won't have to open or solder on to any of these in the future :-D

    bj00rn said:
    Yes i have the exact part no 813-S1-008-10-016101. A=7, B=4, N=8 in the below schematic. Im really not good at these things. From the looks of it the entire connector height fits inside the slot, a few extra millimeters of housing below the plate to house the cable would probably suffice.
    Click to expand...
    Click to collapse
    I attempted to design a part that's compatible with that exact Preci-Dip connector, based on the schematics above. I gave it zero clearance- just exactly copied the dimensions shown, hoping that it would press fit snugly. If not, may need to sand down the 3D part or glue the connector in place :) ... took my best shot without the part in hand to measure. I generically opened a cavity below it to hopefully allow enough access... you'll have to test and let me know whether it worked!
    1681327186786.png
    1681327204402.png


    Good luck! Let me know any feedback or if folks have questions!
    View
    2
    S
    ScanuRag
    I know this is an older thread but I wanted to point out that by following this guide you can install basically any apk on the clock. From that point you can install a launcher and open the real settings app as opposed to the default one. I was able to connect a bluetooth keyboard and also enable developer options the normal way, where an "OEM Unlocking" toggle is present. I was also able to confirm that the charging dock is connected over usb as it shows up under connected devices in settings, however the type-A port on the back doesn't seem to carry data. I tried both a wired keyboard and usb flash drive and neither seemed to work. Hope this info helps!
    20220806_113635.jpg
    20220806_120029.jpg
    View
    2
    bj00rn
    bj00rn

    Managed to get volume buttons working​

    EDIT: magisk_overlayfs now supports mouting system as r/w

    From what i understand, the problem boils down to
    1. Keymapper needs permission ACCESS_NOTIFICATION_POLICY
    2. The device is "managed". Google assistant is still device admin even after being "removed" by magisk.
    3. On managed devices the ACCESS_NOTIFICATION_POLICY cannot be assigned
    4. An active device manager cannot be removed (unless testOnly=true) is specified in it's manifest.
    Bash: 
    dpm remove-active-admin: Disables an active admin, the admin must have declared android:testOnly in the application in its manifest. This will also remove device and profile owners.

    Workaround
    Modify /system/etc/device_policies.xml and /system/etc/device_owner_2.xml to specify keymapper as device owner.

    Steps
    1. Install magisk module https://github.com/HuskyDG/magisk_overlayfs to mount /system partition try to mount /system as r/w.

    Reboot device

    2. Unfortunately r/w mounting will fallback to read-only because /data partition type is unsupported by overlayfs. But we still end up with an upper directory which can be used to overlay files in /system at boot time.
    3. Create etc directory in upper system upper dir
    Bash: 
    adb shell
cd /data/adb/overlay/upper/system
mkdir etc
    4. Pull device_policies.xml and device_owner_2.xml using adb
    Bash: 
    adb pull /system/etc/device_policies.xml
adb pull /system/etc/device_owner_2.xml
    5. Edit files and replace google assistant with keymapper package like so:

    device_owner_2.xml
    XML: 
    <?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<root>
<device-owner package="io.github.sds100.keymapper" name="" component="io.github.sds100.keymapper/.system.DeviceAdmin" userRestrictionsMigrated="true" canAccessDeviceIds="true" />
<device-owner-context userId="0" />
</root>

    device_policies.xml
    XML: 
    <?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<policies setup-complete="true">
<admin name="io.github.sds100.keymapper/.system.DeviceAdmin">
<policies flags="16" />
<strong-auth-unlock-timeout value="0" />
<cross-profile-calendar-packages />
</admin>
<lock-task-features value="16" />
</policies>
    6. Push files to /data/adb/overlay/upper/system/etc /system/etc
    7. Reboot device
    8. Mapping volume keys will now work since Google Assistant is no longer device owner.

    Maybe there is a proper way of doing this..
    View
    2
    gfluf
    gfluf
    Just made this account to thank @cmccambridge and @bj00rn. I messed around with mtkclient, but reading/writing most partitions would just fail at 50% progress. If you hadn't posted your steps I would still assume that this just won't work as I expect it to.
    The actual problem was flaky contact due to the makeshift Frankenstein adapter I soldered. So after also directly soldering an USB cable to the PCB and ordering some pogo pins, I now have two fully rooted and (mostly) functioning devices.
    So thank you for the motivation to continue :)

    bj00rn said:
    • Gesture navigation. At least swipe back would be nice.
    Click to expand...
    Click to collapse
    To enable gesture navigation I used Fluid Navigation Gestures. Although you cannot grant the permission to display over other apps via GUI, it still is possible to do so via shell/ADB. I used the following command and now the app works without any issues:
    Bash: 
    pm grant com.fb.fluid android.permissions.SYSTEM_ALERT_WINDOW allow

    Has anybody managed to rebind the volume keys to their original purpose? Using Key Mapper doesn't work as granting the permission to modify the DnD-State fails and cannot be done using ADB.


    bj00rn said:
    • Wireless ADB. Device is running Android 10 and should at least in theory support wireless adb, however the option is missing in developer settings. I tried setprop service.adb.tcp.port 5555 but adb is unable to connect and nmap shows no open ports on device.
    Click to expand...
    Click to collapse

    I could not find an actual way to enable wireless ADB, but wirelessly connecting to ADB worked for me. Although you have to bootstrap the connection via USB:
    Bash: 
    # while connected via USB:
adb tcpip 5555
# USB may be disconnected now
adb connect $SMART_CLOCK_IP:5555
# from here on all usual ADB commands should work
adb devices
adb shell


    Currently I'm trying to find a solution to get the microphone working as good as it was before. Since removing the Google/Lenovo stuff the microphone level is extremely low and the recordings sound distorted. Something to the likes of a proximity sensor seems to be involved as the level of the recorded/played audio rises as soon as I hold it up to my face.
    Does anybody have the same issue?
    The intended use case for these devices is adding them as satellites to my Rhasspy setup to allow using voice commands for home automation . At the moment it doesn't even register that I'm talking at all.

    Cheers :)
    View

New posts