Rooting Note Air 3. Is there a guide ?

[BiduleMachin]

Hi,

A few months ago, I rooted my Note Air 3, on firmware 3.5.4. I don't remember at all how I did it.

Now, I see that firmware 4 is available. OTA update from the settings fails.
I would like to first clean update to firmware v4, cleaning all data. And then, I want to root it again.

I have seen that Onyx made it harder to root by removing commands from fastboot. If I understood correctly, now the way to do is through EDL. I am not familiar at all with that method, so I am looking for an up to date guide.

I have found this guide for Note Air 4 which looks very complete https://github.com/jdkruzr/BooxPalma...main/README.md , but I don't if it is applicable to Note Air 3 too. So I would have the following questions:

1. Is this guide still valid for Note Air 2 ?
2. If yes, what will be different for my device ? What loader will I use, which commands will be different ?
3. If I want to clean update to v4 first and then root, how do I do it and when ?

Thanks in advance for any answer, have a nice day.

[dcarvil]

Originally Posted by BiduleMachin

Hi,

A few months ago, I rooted my Note Air 3, on firmware 3.5.4. I don't remember at all how I did it.

Now, I see that firmware 4 is available. OTA update from the settings fails.
I would like to first clean update to firmware v4, cleaning all data. And then, I want to root it again.

I have seen that Onyx made it harder to root by removing commands from fastboot. If I understood correctly, now the way to do is through EDL. I am not familiar at all with that method, so I am looking for an up to date guide.

I have found this guide for Note Air 4 which looks very complete https://github.com/jdkruzr/BooxPalma...main/README.md , but I don't if it is applicable to Note Air 3 too. So I would have the following questions:

1. Is this guide still valid for Note Air 2 ?
2. If yes, what will be different for my device ? What loader will I use, which commands will be different ?
3. If I want to clean update to v4 first and then root, how do I do it and when ?

Thanks in advance for any answer, have a nice day.

1. That guide should also work for the Note Air 3. Patching both boot images is a bit overkill, but shouldn't cause problems.
2. This loader (https://www.temblast.com/download/goco7.bin) should work for the Note Air 3. All commands remain the same, except for the loader file.
3. I don't have the instructions off the top of my head, but I'm sure Renate will provide them.

[Renate]

I'm not sure if we have a report back from the NoteAir3 on which processor it has.
Yes, the NoteAir3C uses the GoCo7 loader.
The first step is getting your device in EDL mode.
Don't worry, you don't have to risk anything.

adb reboot edl
edl /l
-- copy/paste what it prints out --
-- hold power button until it resets normally, ~10 secs --

Yes, you have to load the WinUsb driver with Zadig like in the instructions.

[BiduleMachin]

Thanks a lot for your answer.

Here is the result of the command:

PS D:\Downloads> .\edl.exe /l
Found EDL 9008, handshaking... version 2.1
HWID: 001b80e100000000 (x3), JTAG: 001b80e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)

I confirm that I have a Note Air 3, not Air 3 C.

I would like to be sure what files to use, which ones change compared to the guide so I am sure to not risk anything.

Thanks in advance for any answer, have a nice day !

[Renate]

Originally Posted by BiduleMachin

JTAG: 001b80e1

I confirm that I have a Note Air 3, not Air 3 C.

Thanks for the info.
So it's the same processor as the NoteAir3C.
You need the Firehose loader for the GoCo7
http://www.temblast.com/download/goco7.bin
If you have the space and are the nervous type you can backup your whole device.
Then it's impossible to kill. (Although in absolute worst case you might have to open it up.)

edl /lgoco7.bin
edl /u0 /r backup0.img
edl /u1 /r backup1.img
edl /u2 /r backup2.img
edl /u3 /r backup3.img
edl /u4 /r backup4.img
edl /u5 /r backup5.img

[BiduleMachin]

Thanks a lot for your answer !
I am indeed the nervous type and I am currently doing the backup of the whole device.

I will then follow the guide to root but first, I would like to update to the latest v4 firmware from Onyx, as I am currently on v3.5.4. But the OTA from the device's settings fails.

I have successfully downloaded the firmware from Onyx servers using the following URL: http://data.onyx-international.cn/api/firmware/update?where={%22buildNumber%22:0,%22buildType%22: %22user%22,%22deviceMAC%22:%22%22,%22lang%22:%22en _US%22,%22model%22:%22NoteAir3%22,%22submodel%22:% 22%22,%22fingerprint%22:%22%22}
(Can I ask if you can confirm that it is the right firmware ? Apart from the device name, is there something else I should be careful about, for example if there is different regional versions of the firmwares ?)

And then I have decrypted it using https://github.com/Hagb/decryptBooxUpdateUpx .

I could do it because I remembered it from the time I rooted my device months ago. But I don't remember how to flash the firmware. What do I do with the decrypted files ? Can they still be flashed through fastboot, or should it be done through EDL now ?

Thanks in advance for any answer, have a nice day !

[Renate]

I can only see 3.5.4
If you are on a beta program you can PM me your WiFi MAC.

If you have an (encrypted) update.upx you can park it on /sdcard/

adb push update.upx /sdcard/

It might eventually discover it or you can poke it:

adb shell am start -a onyx.settings.action.firmware

If you are doing something "against the grain" (rollback or changing Chinese <-> Int'l) then you need stock recovery and adb sideload or else a custom recovery.

[BiduleMachin]

When I go to the link I provided, it shows me the following build : 2025-03-27_10-47_v4.0-rel_2aa96eb60

So I guess what I am downloading is the firmware v4. Unless I am on the wrong regional version. How can I know if it is the Chinese or Intl version ?

Pushing the encrypted update to /sdcard/ and triggering the update does not work. I don't know why but I guess it is the same reason as why it does not work either with OTA.

I will try with stock recovery + adb sideload.
I have not seen custom recoveries for Onyx yet. Do you recommend it for NoteAir3 ? If yes, which one ?

[BiduleMachin]

EDIT because I can no longer edit the previous message:

Pushing the update to /sdcard/ and triggering it manually worked. I don't know why OTA did not work.

If I want to clean update, deleting all the boox's data to be sure to be on a fresh install, I should install with the recovery then ? What would be the procedure for cleaning the data and reflashing ?

[Renate]

Well, that cleared up (or muddied) the waters.
That's the difference between:

http://data.onyx-international.cn/
http://data.boox.com/

[BiduleMachin]

Ok, I see now. Thanks for the info.

I have successfully installed the v4 version, which is the chinese firmware. I did it by pushing the encrypted update to /sdcard/ and triggering it manually, as you advised. It worked.

If I wanted to clean install this version, to be sure to be on a fresh install, would I do that through recovery ? What would be the procedure ?

Also, here is my partition table:

PS D:\Downloads\OnyxBoox> .\edl.exe /u /g
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 1 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 2 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 3 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 4 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 5 header... ok, receiving... ok, requesting entries... ok, receiving... ok

LUN   #  Name                   Start       Count  Type
───  ──  ────────────────  ──────────  ──────────  ────────────────────
 0    1  ssd                        6           2  Secure SW download
 0    2  persist                    8        8192  Persist
 0    3  misc                    8200         256  Misc
 0    4  keystore                8456         128  Key store
 0    5  frp                     8584         128  FRP
 0    6  super                   8712     1048576  Super
 0    7  recovery_a           1057288       24576  Recovery
 0    8  recovery_b           1081864       24576  Recovery B
 0    9  vbmeta_system_a      1106440          16  VB meta system
 0   10  vbmeta_system_b      1106456          16  VB meta system B
 0   11  metadata             1106472        4096  Metadata
 0   12  onyxconfig           1110568        6144  System
 0   13  userdata             1116712    13402579  User data

 1    1  xbl_a                      6         896  Bootloader
 1    2  xbl_config_a             902          32  Boot config
 1    3  last_parti               934        1109  Empty

 2    1  xbl_b                      6         896  Bootloader
 2    2  xbl_config_b             902          32  Boot config
 2    3  last_parti               934        1109  Empty

 3    1  ALIGN_TO_128K_1            6          26    fde1604b
 3    2  cdt                       32          32  CDT
 3    3  ddr                       64         256  DDR
 3    4  last_parti               320       32443  Empty

 4    1  rpm_a                      6         128  Inactive
 4    2  tz_a                     134        1024  Inactive
 4    3  hyp_a                   1158         128  Inactive
 4    4  modem_a                 1286       46080  Inactive
 4    5  bluetooth_a            47366         256  Inactive
 4    6  mdtpsecapp_a           47622        1024  Inactive
 4    7  mdtp_a                 48646        8192  Inactive
 4    8  abl_a                  56838         256  Inactive
 4    9  dsp_a                  57094        8192  Inactive
 4   10  keymaster_a            65286         128  Inactive
 4   11  boot_a                 65414       24576  Inactive
 4   12  cmnlib_a               89990         128  Inactive
 4   13  cmnlib64_a             90118         128  Inactive
 4   14  devcfg_a               90246          32  Inactive
 4   15  qupfw_a                90278          16  Inactive
 4   16  vbmeta_a               90294          16  Inactive
 4   17  dtbo_a                 90310        6144  Inactive
 4   18  imagefv_a              96454         512  Inactive
 4   19  uefisecapp_a           96966         512    be8a7e08
 4   20  featenabler_a          97478          32    741813d2
 4   21  multiimgoem_a          97510           8  Inactive
 4   22  rpm_b                  97518         128  Resource/power mgmt
 4   23  tz_b                   97646        1024  TrustZone
 4   24  hyp_b                  98670         128  Hypervisor
 4   25  modem_b                98798       46080  FAT32
 4   26  bluetooth_b           144878         256  Bluetooth
 4   27  mdtpsecapp_b          145134        1024  MDTP secure
 4   28  mdtp_b                146158        8192  MDTP
 4   29  abl_b                 154350         256  Android bootloader
 4   30  dsp_b                 154606        8192  DSP
 4   31  keymaster_b           162798         128  Key master
 4   32  boot_b                162926       24576  Boot
 4   33  cmnlib_b              187502         128  Common lib
 4   34  cmnlib64_b            187630         128  Common lib64
 4   35  devcfg_b              187758          32  Device config
 4   36  qupfw_b               187790          16  QUP firmware
 4   37  vbmeta_b              187806          16  VB meta
 4   38  dtbo_b                187822        6144  DTBO
 4   39  featenabler_b         193966          32  Inactive
 4   40  imagefv_b             193998         512  Image FV
 4   41  uefisecapp_b          194510         512  Inactive
 4   42  multiimgoem_b         195022           8    e126a436
 4   43  devinfo               195030           1  Device info
 4   44  dip                   195031         256  DIP
 4   45  apdp                  195287          64  APDP
 4   46  spunvm                195351        2048  Spun VM
 4   47  splash                197399        8356  Splash
 4   48  limits                205755           1  Limits
 4   49  toolsfv               205756         256  Tools FV
 4   50  logfs                 206012        2048  Log FS
 4   51  cateloader            208060         512  STI
 4   52  rawdump               208572       32768  RAM dump
 4   53  logdump               241340       16384  Log dump
 4   54  storsec               257724          32  Store secure
 4   55  multiimgqti           257756           8    846c6f05
 4   56  uefivarstore          257764         128    165bd6bc
 4   57  secdata               257892           7    76cfc7ef
 4   58  catefv                257899         128  Cate FV
 4   59  catecontentfv         258027         256  Cate content FV
 4   60  last_parti            258283      790288  Empty

 5    1  ALIGN_TO_128K_2            6          26    6891a3b7
 5    2  modemst1                  32         512  Modem ST1
 5    3  modemst2                 544         512  Modem ST2
 5    4  fsg                     1056         512  Modem storage
 5    5  fsc                     1568          32  FSC
 5    6  last_parti              1600       31163  Empty

In the guide for NoteAir4, the boot partitions are named pboot_a and pboot_b.

From the partition table, I guess mine are simply boot_a and boot_b ? I would be sure to not flash the wrong ones after I patched them.

I tried to pull them, I am having the following error

PS D:\Downloads\OnyxBoox> .\edl.exe /u /r /boot_a boota.img
Operations on UFS raw devices (vs. partitions) requires LUN specified

[Renate]

Originally Posted by BiduleMachin

I tried to pull them, I am having the following error

You can ask for a whole LUN to be read specified by /u =OR=
Some number of blocks specified by /u /s /c =OR=
A partition specified by /p =OR=
Some part of a partition specified by /p /s /c

You don't have a /p there.

If you know the LUN you can save time by specifying /u0 /p