BOOX Go Color 7 (Gen II) EDL Mode and Firehose Loader Issues

[chatelp]

Hello MobileRead Community,

I’m reaching out for assistance with my BOOX Go Color 7 (Gen II). I’ve been attempting to interact with the device in EDL (Emergency Download) mode but have encountered several obstacles.

Device Details:
• Model: BOOX Go Color 7 (Gen II)
• Processor: Octa-core (specific chipset not publicly disclosed)
• Operating System: Android 13
• Storage: 64GB 

What I’ve Attempted:
1. Entering EDL Mode:
• Used adb reboot edl to reboot the device into EDL mode.
• Device appears as “Qualcomm HS-USB QDLoader 9008” in Device Manager.
2. Using Renate’s EDL Utility:
• Ran edl.exe /u /r /pboot_a boota.img /t but received the error: Found EDL 9008, configuring... bad XML

• Attempted to load various firehose loaders, including palma2.bin, with the command: edl.exe /lpalma2.bin

• Received the following output:
Found EDL 9008, handshaking... nope, resetting... version 2
HWID: 0013f0e100000000 (x3), JTAG: 0013f0e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending palma2.bin 100% ok, starting... ok, waiting for Firehose... ok

• Subsequent attempts to read partitions resulted in:
Found EDL 9008, configuring... ok
Requesting info on LUN 0... no ack/nak

Challenges:
• Unable to find a compatible firehose loader for the device.
• Uncertain if the device requires a signed loader or specific authentication.
• Limited information available on the device’s chipset and EDL compatibility.

Request:
If anyone has experience with the BOOX Go Color 7 (Gen II) or similar devices, I would greatly appreciate guidance on:
• Identifying the correct firehose loader for this device.
• Understanding if the device requires a signed loader or additional authentication.
• Any alternative methods to interact with the device in EDL mode.

Thank you in advance for your assistance!

[dcarvil]

Originally Posted by chatelp

Hello MobileRead Community,

I’m reaching out for assistance with my BOOX Go Color 7 (Gen II). I’ve been attempting to interact with the device in EDL (Emergency Download) mode but have encountered several obstacles.

Device Details:
• Model: BOOX Go Color 7 (Gen II)
• Processor: Octa-core (specific chipset not publicly disclosed)
• Operating System: Android 13
• Storage: 64GB 

What I’ve Attempted:
1. Entering EDL Mode:
• Used adb reboot edl to reboot the device into EDL mode.
• Device appears as “Qualcomm HS-USB QDLoader 9008” in Device Manager.
2. Using Renate’s EDL Utility:
• Ran edl.exe /u /r /pboot_a boota.img /t but received the error: Found EDL 9008, configuring... bad XML

• Attempted to load various firehose loaders, including palma2.bin, with the command: edl.exe /lpalma2.bin

• Received the following output:
Found EDL 9008, handshaking... nope, resetting... version 2
HWID: 0013f0e100000000 (x3), JTAG: 0013f0e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending palma2.bin 100% ok, starting... ok, waiting for Firehose... ok

• Subsequent attempts to read partitions resulted in:
Found EDL 9008, configuring... ok
Requesting info on LUN 0... no ack/nak

Challenges:
• Unable to find a compatible firehose loader for the device.
• Uncertain if the device requires a signed loader or specific authentication.
• Limited information available on the device’s chipset and EDL compatibility.

Request:
If anyone has experience with the BOOX Go Color 7 (Gen II) or similar devices, I would greatly appreciate guidance on:
• Identifying the correct firehose loader for this device.
• Understanding if the device requires a signed loader or additional authentication.
• Any alternative methods to interact with the device in EDL mode.

Thank you in advance for your assistance!

Try this loader: https://www.temblast.com/download/goco7.bin

[chatelp]

Originally Posted by dcarvil

Try this loader: https://www.temblast.com/download/goco7.bin

Thanks, but I already tried goco7.bin unfortunately (it worked perfectly with my gen 1 though). Except if it is a variant of the usual goco7 ?

[Renate]

Originally Posted by chatelp

Thanks, but I already tried goco7.bin

It's a different processor.
See https://www.temblast.com/ref/onyxldr.htm

[chatelp]

Originally Posted by Renate

It's a different processor.
See https://www.temblast.com/ref/onyxldr.htm

Thanks for the feedback, just tried with this loader but exact same error:
(renamed 0000000000000000_bdaf51b59ba21d8a_fhprg.bin to goco7_gen2.bin for simplicity)

.\edl.exe /lgoco7_gen2.bin
Found EDL 9008, handshaking... version 2
HWID: 0013f0e100000000 (x3), JTAG: 0013f0e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending goco7_gen2.bin 100% ok, starting... ok, waiting for Firehose... ok
.\edl.exe /u /g
Found EDL 9008, configuring... ok
Requesting info on LUN 0... no ack/nak

[chatelp]

I made some progress using the following loader: https://github.com/bkerler/Loaders/b...1d8a_fhprg.bin, but only on Linux and with B. Kerler's Python EDL. I'm now able to read the boot_a partition, patch the boot.img with Magisk, and (supposedly) write it back to boot_a (see log below). However, after rebooting, Magisk doesn't seem to be installed when I launch it (Installed: N/A). This could mean either the flashing didn't work despite the log, the boot_a partition is restored on reboot, or perhaps Magisk doesn't support the latest version of the device/Android/kernel. Has anyone had full success using a different tool or flashing process?

python edl --loader=goco7_gen2.bin --memory=emmc w boot_a magisk_patched-29000_BWlbI.img  edl 11:08:52
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Using loader goco7_gen2.bin ...
main - Waiting for the device
main - Device detected
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara -
Version 0x2
------------------------
HWID: 0x0013f0e100000000 (MSM_ID:0x0013f0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected: "bitra_SDM"
PK_HASH: 0xd40eee56f3194665574109a39267724ae7944134cd53cb76 7e293d3c40497955bc8a4519ff992b031fadc6355015ac87
Serial: 0x3c424cad

sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader goco7_gen2.bin ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose - INFO: Binary build date: Aug 21 2020 @ 09:02:30
firehose - INFO: Binary build date: Aug 21 2020 @ 09:02:30
firehose - INFO: Chip serial num: 1010977965 (0x3c424cad)
firehose - INFO: Supported Functions (17):
firehose - INFO: program
firehose - INFO: read
firehose - INFO: nop
firehose - INFO: patch
firehose - INFO: configure
firehose - INFO: setbootablestoragedrive
firehose - INFO: erase
firehose - INFO: power
firehose - INFO: firmwarewrite
firehose - INFO: getstorageinfo
firehose - INFO: benchmark
firehose - INFO: emmc
firehose - INFO: ufs
firehose - INFO: fixgpt
firehose - INFO: getsha256digest
firehose - INFO: getvar
firehose - INFO: dump
firehose - INFO: End of supported functions 17
firehose
firehose - [LIB]: Couldn't detect MaxPayloadSizeFromTargetinBytes
firehose
firehose - [LIB]: Couldn't detect TargetName
firehose - TargetName=Unknown
firehose - MemoryName=eMMC
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - Storage report:
firehose - total_blocks:122126336
firehose - block_size:512
firehose - page_size:512
firehose - num_physical:4
firehose - manufacturer_id:223
firehose - serial_num:3161457158
firehose - fw_version:48734822444564496
firehose - mem_type:eMMC
firehose - prod_name:SCA64G
firehose_client - Supported functions:
-----------------
program,read,nop,patch,configure,setbootablestorag edrive,erase,power,firmwarewrite,getstorageinfo,be nchmark,emmc,ufs,fixgpt,getsha256digest,getvar,dum p
modules
modules - [LIB]: 'Logger' object has no attribute 'loglevel'
firehose -
Writing to physical partition 0, sector 1311744, sectors 196608
Progress: |██████████| 100.0% Write (Sector 0x30000 of 0x30000, ) 111.20 MB/s
Wrote magisk_patched-29000_BWlbI.img to sector 1311744.

[Renate]

Because you have eMMC memory on this you don't use the /u flag when using my client.

You have an A/B device and you might have modified boot_a but it's probably booting on boot_b.

[chatelp]

Originally Posted by Renate

Because you have eMMC memory on this you don't use the /u flag when using my client.

You have an A/B device and you might have modified boot_a but it's probably booting on boot_b.

Thanks. It worked! What is the principle underlying this A/B boot mode? Is it some kind of fallback? But then why not booting on A first?

[Renate]

The concept is that you have two copies of critical parts of your OS so you can update easily and never fear being stranded.

In practice the super partition is usually only virtual A/B and you really don't have as much protection as you thought.

Got lots of space on a desktop/laptop? Make a full raw backup of your device and you can always return to the exact same state at a future time. Ok, my Go6 is 32 GB which isn't too bad, but if your device is ginormous...

*But never "factory reset" or "wipe" your device or else the encryption keys are erased and your backed-up userdata will be converted instantly to GBs of random noise.

[chatelp]

Originally Posted by Renate

The concept is that you have two copies of critical parts of your OS so you can update easily and never fear being stranded.

In practice the super partition is usually only virtual A/B and you really don't have as much protection as you thought.

Got lots of space on a desktop/laptop? Make a full raw backup of your device and you can always return to the exact same state at a future time. Ok, my Go6 is 32 GB which isn't too bad, but if your device is ginormous...

*But never "factory reset" or "wipe" your device or else the encryption keys are erased and your backed-up userdata will be converted instantly to GBs of random noise.

Thanks for the clarification! In any case, everything is working fine now... thanks to you

[hackoder]

Originally Posted by chatelp

Thanks. It worked! What is the principle underlying this A/B boot mode? Is it some kind of fallback? But then why not booting on A first?

Hi chatelp. Wondering what was the sequence of steps that worked for you? I'm looking to root the Go 7 (BW, not color), preferably on linux but can get access to a windows machine if needed too.

[jsukwon]

Originally Posted by Renate

*But never "factory reset" or "wipe" your device or else the encryption keys are erased and your backed-up userdata will be converted instantly to GBs of random noise.

Hi. Does this means that if I make a full raw backup of my device, I can not factory reset it or that raw backup becomes useless? So everytime I reset my device, I need to make a new raw backup?

[Renate]

Originally Posted by jsukwon

So everytime I reset my device, I need to make a new raw backup?

Yes, but why would you be doing factory resets?