Bricked Boox Poke 3 - How to boot to bootloader/recovery?

[cosmicvoid]

I've been having some issues with my Onyx Boox Poke 3. I won't get into the details, that's another story, but I was trying to factory reset the device from fastboot. Like a complete idiot, I ran a command without fully understanding what it did and ran the command

fastboot erase system

, which basically erased the system partition along with the OS. As it stands, only the "ONYX" screen is displayed and won't show anything else regardless if it's powered on or off.

I think I can restore, however I'm having trouble booting to the bootloader or recovery since the button the device has is a power button.

I found some instructions here for the Boox Note Air, which states to power of the device, then hold down the power button for 7 seconds until the blue light comes on, and then tap the power button 5 times. I've tried this about a dozen times, and can't get it to boot to recovery.

Any suggestions would be appreciated.

[Renate]

Originally Posted by cosmicvoid

fastboot erase system

Narrator: "This was not a good idea."
Do you have any idea what version you were on? 3.3.1? 3.3.2?
Does anybody have a direct link to the Poke3 3.3.2 update?

Unfortunately the Poke3 doesn't respond to the EDL cable.
When it stalls is it showing any USB activity?
When you unplug/plug the USB cable does Windows for "bong"?

I have a custom recovery for the Poke3 (since I own one).
But you have to get this thing into EDL mode or else fastboot mode.

[cosmicvoid]

Originally Posted by Renate

Narrator: "This was not a good idea."

Indeed. I thought "this is probably going to literally erase the system partition" and did it anyways. A stupid choice and powerful lesson to not do technical things when I'm tired.

Originally Posted by Renate

Do you have any idea what version you were on? 3.3.1? 3.3.2?

I'm fairly sure it was 3.3.2. I had recently re-rooted the device and pulled the 3.3.1 firmware (which I have). Once it booted I updated it to via Update Firmware in settings which I assume was 3.3.2 and didn't lose root access.

Originally Posted by Renate

When you unplug/plug the USB cable does Windows for "bong"?

I'm using Linux and not seeing any activity. I'll fire up a spare SSD with Windows on it and see if I can see anything different.

I recently had to get into EDL mode to restore stock firmware on a OnePlus device which required a Windows only program. With the OnePlus, there was no clear indication that it was in EDL mode other than the software running on the Windows machine. Is it the same situation with the Poke 3? Does the LED do anything different when it's in EDL mode?

[cosmicvoid]

I should also note that I can't seem to actually power off the Poke 3. Holding the power button for 10 seconds, the blue LED turns off then back on and the Onyx logo flashes on the screen.

Does erasing the system partition prevent me from getting to the bootloader/fastboot/recovery screen?

[Renate]

Do:

lsusb -v

Look for 05c6/9008
You can use "bkerler edl" (Google it) in Linux.

Erasing /system leaves you in purgatory.
PBL (ok) -> xbl (ok) -> abl (ok) -> boot (ok) -> "Hey, where's /system?"
At that point it can't backtrack to abl fastboot.

[cosmicvoid]

Really appreciate the responses. Running lsusb in Linux, the ereader is popping up as "ID 05c6:900e Qualcomm, Inc. QUSB_BULK_SN:EC395883" (and in Windows 10 as well as "QUSB_BULK_SN:EC395883".

Regarding bkerler edl, I've installed it on my Linnux system and I'm reading through "edl -h" trying to figure out how to use it. TBH, this is a bit over my head. I just ran "edl" and it gave me a dump in /memory.

Do you have any suggestions on what to run?

[Renate]

Originally Posted by cosmicvoid

Do you have any suggestions on what to run?

900e is the idiot cousin of 9008, incapable of doing anything useful.
900e usually pops up when it kind of boots but doesn't.
You want the real article, 9008.

[cosmicvoid]

Do you know of any method of booting into EDL (9008) on the Poke 3?

In terms of recovery, I've tried a few variations of holding power for 7, 8, 9, and 10 seconds and tapping the power button 5 times within two seconds of releasing. From what I understand, the /recovery partition should still be intact despite /system partition being missing. Unless I'm misunderstanding. I'm also seeing if any of these can trigger a different lsusb output other than 900e.

I can't seem to get it to power off either. Holding the power button, the LED turns off for a half a second, then the Onyx logo disappears and reappears. I'm interpreting as a power off then on and implementing the recovery trick above.

[Renate]

On the Poke3:
EDL cables don't work.
There is no button-ism to force it to EDL or fastboot.
There is that recovery button-ism, but timing is difficult (at least for me).

If you open up your device there are easy possibilities:
The EDL test points are right there and you just need to short them and long power press.
The 1.8V UART interface is there. It responds to more than 50 rubout (0x7f) characters in the right timing.
Fortunately the timing can be detected by the logging coming from the abl.
I've even a little program for that.

C:\>abltest com3
Listening...
Starting
Jabbering...
Detecting...
Going to EDL mode!
Done

Of course on my Poke3 I have installed a magnetic reed switch so that I can activate EDL mode by an external magnet.
The UART also has a connector so I can plug in without removing the back.
I hate removing backs.

My suggestion: Remove the back.