How to Root the Onyx Boox Note Air 2 Plus (Windows) - Page 3

Renate · 06-15-2023, 08:34 PM

Those instructions look good!

The only thing that I'll add is that after uploading the boot image you can use this to reboot:

Code:

C:\>edl.exe /z

I've gotten the wrinkles out since then, load a new version.

Chitter · 06-17-2023, 11:10 PM

Quote:

Originally Posted by Renate

Those instructions look good!

The only thing that I'll add is that after uploading the boot image you can use this to reboot:

Code:

C:\>edl.exe /z

I've gotten the wrinkles out since then, load a new version.

Thanks for the tool, feedback, and guidance, Renate.

I've updated that portion of the instructions and replaced them in my post.

nomoi · 10-17-2023, 11:21 AM

Hello @Renate, hello @Chitter, thanks to both of your efforts and thorough descriptions I wrote a script for Linux users (please use at your own risk and go line by line if unsure):

Code:

#!/usr/bin/env bash
read -erp '> please make sure adb and fastboot are working (press <Return>)'

_OLDDIR=$PWD
_WORKINGDIR=na2p
mkdir $_WORKINGDIR
cd $_WORKINGDIR
echo "> using ${_WORKINGDIR}"

### prerequisites
echo '> installing Magisk..'
wget 'https://github.com/topjohnwu/Magisk/releases/download/v26.3/Magisk.v26.3.apk' # get magisk
adb install Magisk.v26.3.apk 

### optional programs
echo '> installing F-Droid..'
wget 'https://f-droid.org/F-Droid.apk'
adb install F-Droid.apk 

echo '> installing AFWall..'
wget 'https://github.com/ukanth/afwall/releases/download/v3.6.0/AFWall_3.6.0_Free.apk'
adb install AFWall_3.6.0_Free.apk 

### EDL
echo '> installing EDL (cf. https://github.com/bkerler/edl)'
git clone https://github.com/bkerler/edl
cd edl
git submodule update --init --recursive
pip3 install -r requirements.txt

### optionally install the following loader (the included EDL loader worked fine for me)
# curl 'https://www.mobileread.com/forums/attachment.php?attachmentid=192603&d=1646588825' --output 662.elf.zip # get EDL loader
# unzip 662.elf.zip

# EDL mode
cd ..
adb reboot edl # reboot to edl
# ./edl/edl --loader=Qualcomm_662_loader.elf &&\
./edl/edl --loader=./edl/Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin &&\
    ./edl/edl r boot_a boot_a &&\
    ./edl/edl reset # use EDL loader, pull boot_a and reset 

t=45; echo "> waiting ${t}s for reboot" && sleep $t
adb push boot_a /sdcard/Download/
read -erp '> please install via Magisk and press <Return> when finished..'
patchedfile=$(adb shell 'ls -1 /sdcard/Download/' | tail -1 | grep patched)
adb pull /sdcard/Download/$patchedfile
adb reboot bootloader
t=15; echo "waiting ${t}s for bootloader" && sleep $t

read -erp '> flash (1); boot only (2): ' prompt
case $prompt in
    1) fastboot flash boot $patchedfile ;;
    2) fastboot boot $patchedfile ;;
    *) echo "no valid option; exiting, but remaining in fastboot mode. You may try 'fastboot flash boot ${patchedfile}' for flashing or 'fastboot boot ${patchedfile}' for testing yourself." && exit 1
esac
echo "> booting $patchedfile"
cd $_OLDDIR
echo "> all done; I hope it worked : )"

parkaymang · 11-21-2023, 05:57 PM

Could this be used to root other Boox devices? I have a new Page that is in need of it, but I cannot find any other guide out there that doesn't involve downloading and decrypting an update image. Thanks!

parkaymang · 11-21-2023, 06:18 PM

Quote:

Originally Posted by nomoi

Hello @Renate, hello @Chitter, thanks to both of your efforts and thorough descriptions I wrote a script for Linux users (please use at your own risk and go line by line if unsure):

Code:

#!/usr/bin/env bash
read -erp '> please make sure adb and fastboot are working (press <Return>)'

_OLDDIR=$PWD
_WORKINGDIR=na2p
mkdir $_WORKINGDIR
cd $_WORKINGDIR
echo "> using ${_WORKINGDIR}"

### prerequisites
echo '> installing Magisk..'
wget 'https://github.com/topjohnwu/Magisk/releases/download/v26.3/Magisk.v26.3.apk' # get magisk
adb install Magisk.v26.3.apk 

### optional programs
echo '> installing F-Droid..'
wget 'https://f-droid.org/F-Droid.apk'
adb install F-Droid.apk 

echo '> installing AFWall..'
wget 'https://github.com/ukanth/afwall/releases/download/v3.6.0/AFWall_3.6.0_Free.apk'
adb install AFWall_3.6.0_Free.apk 

### EDL
echo '> installing EDL (cf. https://github.com/bkerler/edl)'
git clone https://github.com/bkerler/edl
cd edl
git submodule update --init --recursive
pip3 install -r requirements.txt

### optionally install the following loader (the included EDL loader worked fine for me)
# curl 'https://www.mobileread.com/forums/attachment.php?attachmentid=192603&d=1646588825' --output 662.elf.zip # get EDL loader
# unzip 662.elf.zip

# EDL mode
cd ..
adb reboot edl # reboot to edl
# ./edl/edl --loader=Qualcomm_662_loader.elf &&\
./edl/edl --loader=./edl/Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin &&\
    ./edl/edl r boot_a boot_a &&\
    ./edl/edl reset # use EDL loader, pull boot_a and reset 

t=45; echo "> waiting ${t}s for reboot" && sleep $t
adb push boot_a /sdcard/Download/
read -erp '> please install via Magisk and press <Return> when finished..'
patchedfile=$(adb shell 'ls -1 /sdcard/Download/' | tail -1 | grep patched)
adb pull /sdcard/Download/$patchedfile
adb reboot bootloader
t=15; echo "waiting ${t}s for bootloader" && sleep $t

read -erp '> flash (1); boot only (2): ' prompt
case $prompt in
    1) fastboot flash boot $patchedfile ;;
    2) fastboot boot $patchedfile ;;
    *) echo "no valid option; exiting, but remaining in fastboot mode. You may try 'fastboot flash boot ${patchedfile}' for flashing or 'fastboot boot ${patchedfile}' for testing yourself." && exit 1
esac
echo "> booting $patchedfile"
cd $_OLDDIR
echo "> all done; I hope it worked : )"

Thanks for this! Do you think this can be used to root a Boox Page?

parkaymang · 11-25-2023, 07:43 PM

Quote:

Originally Posted by parkaymang

Thanks for this! Do you think this can be used to root a Boox Page?

Can confirm this works on Boox Page 7!

Pentam · 12-09-2023, 11:50 AM

Thanks for the instructions. I had my Note Air 2 Plus rooted. Now I updated it to v3.5 and tried rooting again. However, I am not getting a positive response from EDL. I get the following result:

Quote:

edl.exe /l662.elf
Found EDL 9008, handshaking... nope, resetting...
Could not write device

What's wrong?

Renate · 12-09-2023, 12:02 PM

Quote:

Originally Posted by Pentam

What's wrong?

Leave the USB cable connected, don't ever disconnect.
You need to reset the device and get a fresh start.

Pentam · 12-10-2023, 07:59 AM

Quote:

Originally Posted by Renate

Leave the USB cable connected, don't ever disconnect.
You need to reset the device and get a fresh start.

Thanks for the reply. I did not disconnect the USB cable at any time. Weird...
Did a factory reset and could root now.

Thanks!

Renate · 12-10-2023, 08:25 AM

Quote:

Originally Posted by Pentam

Did a factory reset and could root now.

Err, I didn't mean a factory reset.
I just meant a long power button reset.

The Sahara protocol is a bit backwards in that the device initiates the conversation so that you can't miss its initial "hello" or else everything is talking at cross purposes.

nomoi · 12-12-2023, 04:05 PM

Quote:

Originally Posted by parkaymang

Can confirm this works on Boox Page 7!

Good to hear it worked for you. Did you have to adapt on some steps? Is there anything one needs to know resp. did you have any problems?

---
kind regards, nomoi

dcarvil · 01-18-2024, 04:45 PM

Quote:

Originally Posted by nomoi

Hello @Renate, hello @Chitter, thanks to both of your efforts and thorough descriptions I wrote a script for Linux users (please use at your own risk and go line by line if unsure):

Code:

#!/usr/bin/env bash
read -erp '> please make sure adb and fastboot are working (press <Return>)'

_OLDDIR=$PWD
_WORKINGDIR=na2p
mkdir $_WORKINGDIR
cd $_WORKINGDIR
echo "> using ${_WORKINGDIR}"

### prerequisites
echo '> installing Magisk..'
wget 'https://github.com/topjohnwu/Magisk/releases/download/v26.3/Magisk.v26.3.apk' # get magisk
adb install Magisk.v26.3.apk 

### optional programs
echo '> installing F-Droid..'
wget 'https://f-droid.org/F-Droid.apk'
adb install F-Droid.apk 

echo '> installing AFWall..'
wget 'https://github.com/ukanth/afwall/releases/download/v3.6.0/AFWall_3.6.0_Free.apk'
adb install AFWall_3.6.0_Free.apk 

### EDL
echo '> installing EDL (cf. https://github.com/bkerler/edl)'
git clone https://github.com/bkerler/edl
cd edl
git submodule update --init --recursive
pip3 install -r requirements.txt

### optionally install the following loader (the included EDL loader worked fine for me)
# curl 'https://www.mobileread.com/forums/attachment.php?attachmentid=192603&d=1646588825' --output 662.elf.zip # get EDL loader
# unzip 662.elf.zip

# EDL mode
cd ..
adb reboot edl # reboot to edl
# ./edl/edl --loader=Qualcomm_662_loader.elf &&\
./edl/edl --loader=./edl/Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin &&\
    ./edl/edl r boot_a boot_a &&\
    ./edl/edl reset # use EDL loader, pull boot_a and reset 

t=45; echo "> waiting ${t}s for reboot" && sleep $t
adb push boot_a /sdcard/Download/
read -erp '> please install via Magisk and press <Return> when finished..'
patchedfile=$(adb shell 'ls -1 /sdcard/Download/' | tail -1 | grep patched)
adb pull /sdcard/Download/$patchedfile
adb reboot bootloader
t=15; echo "waiting ${t}s for bootloader" && sleep $t

read -erp '> flash (1); boot only (2): ' prompt
case $prompt in
    1) fastboot flash boot $patchedfile ;;
    2) fastboot boot $patchedfile ;;
    *) echo "no valid option; exiting, but remaining in fastboot mode. You may try 'fastboot flash boot ${patchedfile}' for flashing or 'fastboot boot ${patchedfile}' for testing yourself." && exit 1
esac
echo "> booting $patchedfile"
cd $_OLDDIR
echo "> all done; I hope it worked : )"

Thank you for the script. It is very informative, since I am on Linux. I was hoping it would also work on my Boox NoteAir 3 with 3.5 firmware, but unfortunately the edl commands fail with this error:

sahara - [LIB]: Error: Cannot receive specified number of program headers

I know nothing about edl, but see no obvious errors prior to that. Can you suggest anything else I can try?

The console output is:

Code:

xfx:~/oldhome/Phone/boox/na2p $ adb reboot edl
xfx:~/oldhome/Phone/boox/na2p $ ./edl/edl --loader=./edl/Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Using loader ./edl/Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x2
------------------------
HWID:              0x001b80e100000000 (MSM_ID:0x001b80e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "divar"
PK_HASH:           0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87
Serial:            0xdab958fb

sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader ./edl/Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.


xfx:~/oldhome/Phone/boox/na2p $ ./edl/edl r boot_a boot_a
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x2
------------------------
HWID:              0x001b80e100000000 (MSM_ID:0x001b80e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "divar"
PK_HASH:           0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87
Serial:            0xdab958fb

sahara - Possibly unfused device detected, so any loader should be fine...
sahara - Possible loader available: /ext4-store/home/dcarvil/Phone/boox/na2p/edl/edlclient/../Loaders/lenovo_motorola/001b80e100000000_503b13f78c1e5374_fhprg.bin
sahara - Trying loader: /ext4-store/home/dcarvil/Phone/boox/na2p/edl/edlclient/../Loaders/lenovo_motorola/001b80e100000000_503b13f78c1e5374_fhprg.bin
sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader /ext4-store/home/dcarvil/Phone/boox/na2p/edl/edlclient/../Loaders/lenovo_motorola/001b80e100000000_503b13f78c1e5374_fhprg.bin ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara
sahara - [LIB]: Error: Cannot receive specified number of program headers
Connection detected, quiting.

Thank you for any help you can provide.

Renate · 01-18-2024, 11:24 PM

Sorry, I somehow missed this.

I think that those loaders aren't working with your device.
It showed up again in Sahara mode after ostensibly loading a loader.
The latest generation of Qualcomm SoCs are giving us problems.

Since you're on Linux, can you tell if your NoteAir3 disconnected and reconnected after it said that it loaded the loader? It shouldn't.

I can't find an update for the NoteAir3 right now so decryption won't help. You can still give me the libota_jni.so though.

dcarvil · 01-19-2024, 11:39 AM

Quote:

Originally Posted by Renate

Sorry, I somehow missed this.

I think that those loaders aren't working with your device.
It showed up again in Sahara mode after ostensibly loading a loader.
The latest generation of Qualcomm SoCs are giving us problems.

Since you're on Linux, can you tell if your NoteAir3 disconnected and reconnected after it said that it loaded the loader? It shouldn't.

I can't find an update for the NoteAir3 right now so decryption won't help. You can still give me the libota_jni.so though.

Thank you for your reply. Yes, the NoteAir3 disconnects and reconnects on every edl command. Here is the log output.

Code:

[Fri Jan 19 08:15:49 2024] usb 2-10.4.2: new high-speed USB device number 69 using xhci_hcd
[Fri Jan 19 08:15:49 2024] usb 2-10.4.2: New USB device found, idVendor=18d1, idProduct=4ee2, bcdDevice= 4.19
[Fri Jan 19 08:15:49 2024] usb 2-10.4.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[Fri Jan 19 08:15:49 2024] usb 2-10.4.2: Product: KHAJE-IDP _SN:DAB958FB
[Fri Jan 19 08:15:49 2024] usb 2-10.4.2: Manufacturer: QUALCOMM
[Fri Jan 19 08:15:49 2024] usb 2-10.4.2: SerialNumber: 8863F9C3

adb reboot edl

[Fri Jan 19 08:20:32 2024] usb 2-10.4.2: USB disconnect, device number 69
[Fri Jan 19 08:20:33 2024] usb 2-10.4.2: new high-speed USB device number 70 using xhci_hcd
[Fri Jan 19 08:20:34 2024] usb 2-10.4.2: New USB device found, idVendor=05c6, idProduct=9008, bcdDevice= 0.00
[Fri Jan 19 08:20:34 2024] usb 2-10.4.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Fri Jan 19 08:20:34 2024] usb 2-10.4.2: Product: QUSB_BULK_CID:043A_SN:DAB958FB
[Fri Jan 19 08:20:34 2024] usb 2-10.4.2: Manufacturer: Qualcomm CDMA Technologies MSM
[Fri Jan 19 08:20:34 2024] qcserial 2-10.4.2:1.0: Qualcomm USB modem converter detected
[Fri Jan 19 08:20:34 2024] usb 2-10.4.2: Qualcomm USB modem converter now attached to ttyUSB0

./edl/edl --loader=./edl/Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin

[Fri Jan 19 08:21:28 2024] qcserial ttyUSB0: Qualcomm USB modem converter now disconnected from ttyUSB0
[Fri Jan 19 08:21:28 2024] qcserial 2-10.4.2:1.0: device disconnected
[Fri Jan 19 08:21:29 2024] usb 2-10.4.2: USB disconnect, device number 70
[Fri Jan 19 08:21:30 2024] usb 2-10.4.2: new high-speed USB device number 71 using xhci_hcd
[Fri Jan 19 08:21:30 2024] usb 2-10.4.2: New USB device found, idVendor=05c6, idProduct=9008, bcdDevice= 0.00
[Fri Jan 19 08:21:30 2024] usb 2-10.4.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Fri Jan 19 08:21:30 2024] usb 2-10.4.2: Product: QUSB_BULK_CID:043A_SN:DAB958FB
[Fri Jan 19 08:21:30 2024] usb 2-10.4.2: Manufacturer: Qualcomm CDMA Technologies MSM
[Fri Jan 19 08:21:30 2024] qcserial 2-10.4.2:1.0: Qualcomm USB modem converter detected
[Fri Jan 19 08:21:30 2024] usb 2-10.4.2: Qualcomm USB modem converter now attached to ttyUSB0

./edl/edl r boot_a boot_a

[Fri Jan 19 08:22:24 2024] qcserial ttyUSB0: Qualcomm USB modem converter now disconnected from ttyUSB0
[Fri Jan 19 08:22:24 2024] qcserial 2-10.4.2:1.0: device disconnected

I was unable to attach libota_jni.so due to an upload error - invalid file. You can download it from this URL.

https://drive.google.com/file/d/1pnY...ew?usp=sharing

Thanks again for your response.

Renate · 01-19-2024, 01:06 PM

Google wants me to login.
Just rename the file libota_jni.prc and post it here.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Sell ONYX BOOX Stylus Pen 2 PRO & ONYX BOOX Note Air Protective Sleeve	readandread	Flea Market	0	03-08-2022 03:09 PM
TWRP*on Onyx Boox Note Air ?	Émile	Onyx Boox	0	09-29-2021 02:58 PM
Onyx Boox Note Air+	ayme08	Onyx Boox	25	07-19-2021 05:41 AM
Rooting Onyx Boox Note Air	afainber	Onyx Boox	8	01-04-2021 10:03 AM
Onyx Boox Note Air Hands on Review	ottischwenk	Onyx Boox	4	12-28-2020 12:58 AM

06-15-2023, 08:34 PM	#31
Renate Wizard Posts: 2,318 Karma: 9999999 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5	Those instructions look good! The only thing that I'll add is that after uploading the boot image you can use this to reboot: Code: C:\>edl.exe /z I've gotten the wrinkles out since then, load a new version.

11-21-2023, 05:57 PM	#34
parkaymang Member Posts: 23 Karma: 10 Join Date: Nov 2023 Device: Boox Page	Could this be used to root other Boox devices? I have a new Page that is in need of it, but I cannot find any other guide out there that doesn't involve downloading and decrypting an update image. Thanks!

01-18-2024, 11:24 PM	#43
Renate Wizard Posts: 2,318 Karma: 9999999 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5	Sorry, I somehow missed this. I think that those loaders aren't working with your device. It showed up again in Sahara mode after ostensibly loading a loader. The latest generation of Qualcomm SoCs are giving us problems. Since you're on Linux, can you tell if your NoteAir3 disconnected and reconnected after it said that it loaded the loader? It shouldn't. I can't find an update for the NoteAir3 right now so decryption won't help. You can still give me the libota_jni.so though.

01-19-2024, 01:06 PM	#45
Renate Wizard Posts: 2,318 Karma: 9999999 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5	Google wants me to login. Just rename the file libota_jni.prc and post it here.

Advert

Advert