MobileRead Forums - View Single Post - Palma 2 Pro

amperage4255 · 12-29-2025, 11:39 AM

Quote:

Originally Posted by Kisuke-CZE

Oh, thank you guys very much. Last comment put me on right track. My Palma 2 Pro is now unlocked and rooted.

Working procedure is this.

BEWARE - THIS PROCEDURE WILL WIPE YOUR DATA!

Preparing tools

Get edl utility

Get Palma loader file for EDL utility:

Code:

wget -O palma2pro.bin 'https://github.com/bkerler/Loaders/raw/refs/heads/main/lenovo_motorola/0000000000000000_bdaf51b59ba21d8a_fhprg.bin'

Get latest available eOS build for Fairphone 4 Android 15 from eOS site. I used this specifically.

From that Fairphone 4 image, extract abl.img somewhere. I will reference it as abl-fp4.img in the process.

Reboot phone into bootloader with

Code:

adb reboot bootloader

then issue

Code:

fastboot getvar current-slot

Note down that letter. For me it was and rest of the guide I will be using slot `a`. Do adjust those commands for your active slot.

Backing up data

Put the device into EDL mode with

Code:

adb reboot edl

Now do the backup of the device. Best way how to do that is backing up all partitions.
This takes about 1 hour and backup is about 128GB in size.
It is optional, but highly recommended. Can be done with command (folder stock_partitions_backup must exists):

Code:

edl --loader=palma2pro.bin --memory=ufs rl stock_partitions_backup/

Now let's backup the important stuff only. This cannot be skipped:

Code:

mkdir stock_backup
edl --loader=palma2pro.bin --memory=ufs r devinfo stock_backup/devinfo.img
edl --loader=palma2pro.bin --memory=ufs r boot_a stock_backup/boot_a.img
edl --loader=palma2pro.bin --memory=ufs r boot_b stock_backup/boot_b.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_a stock_backup/vbmeta_a.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_b stock_backup/vbmeta_b.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_system_a stock_backup/vbmeta_system_a.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_system_b stock_backup/vbmeta_system_b.img
edl --loader=palma2pro.bin --memory=ufs r recovery_a stock_backup/recovery_a.img
edl --loader=palma2pro.bin --memory=ufs r recovery_b stock_backup/recovery_b.img
edl --loader=palma2pro.bin --memory=ufs r abl_a stock_backup/abl_a.img
edl --loader=palma2pro.bin --memory=ufs r abl_b stock_backup/abl_b.img

Unlocking bootloader

Unfortunately Boox firmware does not allow unlocking device. But since hardware is similar to Fairphone 4 we will take Fairphone image to help.

Get into edl mode again with

Code:

adb reboot edl

Then issue those commands to write FP4 ABL into Palma (not sure why, but for me it was needed to write into both slots):

Code:

edl --loader=palma2pro.bin --memory=ufs w abl_a abl-fp4.img
edl --loader=palma2pro.bin --memory=ufs w abl_b abl-fp4.img

Now use your activeslot you noted before (my palma was not booting without this) and reboot device:

Code:

edl --loader=palma2pro.bin setactiveslot a
edl --loader=palma2pro.bin reset

Go into android settings.

Select System submenu.

Then select Developer options.

In those go to Developer options enable OEM unlocking.

Reboot the device.

Now we will proceed to unlocking bootloader. Your data will be WIPED from the device. There is no going back! Ready?

Reboot into bootloader with

Code:

adb reboot bootloader

You should get BOOX logo on screen and command

Code:

fastboot devices

should see the device.

Issue

Code:

fastboot flashing unlock

to begin unlocking.

On screen there will still bee BOOX logo, nothing visible.
Press Vol Up once, and then Power button.
Now device will automatically reboot few times and wipes all your data.

Now you are with clear device in defaults. Enable ADB in settings again. And issue

Code:

adb reboot bootloader

Issue

Code:

fastboot flashing unlock_critical

AGAIN: On screen there will still bee BOOX logo, nothing visible.
Press Vol Up once, and then Power button.
Device will automatically reboot few times and wipes all your data once again.

Now you have unlocked device.
Issuing fastboot oem device-info should say something like:

Code:

(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: true
(bootloader) Charger screen enabled: true

Rooting with Magisk

From now the rooting procedure can be done as on Palma 2.

Install Magisk to your Palma

Push your backed up boot image for your activeslot onto Palma

Code:

adb push stock_backup/boot_a.img /sdcard/

Patch the boot image using Magisk in your phone. Note the filename and use it in next command.

Then download it back to your computer

Code:

adb pull /sdcard/Download/magisk_patched-30600_x1Hl9.img boot_a_patched.img

Reboot Palma into EDL mode

Code:

adb reboot edl

Write modified image into Palma and reboot it:

Code:

edl --loader=palma2pro.bin --memory=ufs w boot_a boot_a_patched.img
edl --loader=palma2pro.bin reset

Congrats! Your Palma is rooted now!

If you want, you can now flash back the stock ABL images back into Palma.
I do recommend it, because without it, device was kinda unstable and for example launching Onyx settings from top-tray did not worked (after flashing original ABL it did worked)

Code:

edl --loader=palma2pro.bin --memory=ufs w abl_a stock_backup/abl_a.img
edl --loader=palma2pro.bin --memory=ufs w abl_b stock_backup/abl_b.img

Procedure is described in Github repository.

Would this also be a viable solution for the Air 4C, I am currently stuck using what appears to be a old github for root instruction. Any assistance is much appreciated. I just want to debloat my boox so it doesn't sound off on the internet.

Thank you