Boox Leaf 2 general discussion

[popej]

Oh, I forgot about this button, I never touch it. I support the idea: free memory is memory wasted

I don't know how to protect app against killing. On bright side, what you kill is only a front end. Firewall is still active, I think work is done by kernel. Just start AFWall again.

[baruch]

hi all,

I followed the rooting procedure and I went into trouble because the version of the app I installed wasn’t the last one (I installed the one from fdroid 1601 and the last is 1602) after doing fastboot boot magisk-patched-blahblah.img when I opened the magisk app to do the direct install, Magisk went into an update loop never actually lauching and never achieving update.
Since then I have no more fastboot working in booloader mode (actually I don’t even have any usb traffic when the device boots in bootloader mode)
So I managed to complete the rooting procedure using the flastboot from recovery but I kind of wonder what is wrong with my booloader mode and how to fix it. Here is what I tried so far, with no success:
- reset to factory
- copy last update.upx to device and redo update with the onyx update procedure
- use fastboot in recovery to rewrite all the partition provided after extraction of the payload.pin

Any other ideas of things I could try?

[Renate]

Are you sure that no USB presents itself when you "adb reboot bootloader"?
You might have lost the Windows driver for fastboot?

[baruch]

Hi, thanks for the answer. Yes, I am sure because i’m on linux so I shouldn’t need to install driver and furthermore if I unplug the device and replug it nothing happens in the kernel logs

[Renate]

You've done "adb reboot bootloader"?
And nothing shows up in "lsusb -v" for the Leaf2?

Remind me: we never found an EDL Firehose for the Leaf2?

[rexbanner]

Originally Posted by denisuu

I meant the gesture when swiping up (Settings.png) There must be a way to lock AFwall+? Why is there a lock icon next to the apps otherwise?

It would be nice to just be able to push the trash icon and kill all apps without it killing AFwall+.

On my TabUltra, just tapping the lock locks it (if it’s unlocked) and then it is as you said, the app is not killed when freeing memory. I’ve just tested it with AFWall+ and from my (very limited) testing it works exactly as you want…

[baruch]

Originally Posted by Renate

You've done "adb reboot bootloader"?
And nothing shows up in "lsusb -v" for the Leaf2?

Yes that’s exactly it. The device show only the onyx logo. No usb even after waiting for 10 min

But by retesting it I realized something new:
the only way to get out of it is holding power for like 10 sec until the little blue led goes off. Then 2 sec later, it turns by itself on again. But the device remains with onyx logo (not even a full refresh in between). There fastboot doesn’t work either - so I didn’t check usb again assuming it was the same mode. In fact a new usb device appears:

Bus 001 Device 019: ID 05c6:900e Qualcomm, Inc. QUSB_BULK_SN:A1326E1D
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.10
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x05c6 Qualcomm, Inc.
  idProduct          0x900e 
  bcdDevice            0.00
  iManufacturer           1 Qualcomm CDMA Technologies MSM
  iProduct                2 QUSB_BULK_SN:A1326E1D
  iSerial                 3 1ee54a23
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0020
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower                2mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol     16 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Binary Object Store Descriptor:
  bLength                 5
  bDescriptorType        15
  wTotalLength       0x002a
  bNumDeviceCaps          3
  SuperSpeedPlus USB Device Capability:
    bLength                20
    bDescriptorType        16
    bDevCapabilityType     10
    bmAttributes         0x00000001
      Sublink Speed Attribute count 1
      Sublink Speed ID count 0
    wFunctionalitySupport   0x1100
    bmSublinkSpeedAttr[0]   0x000a4030
      Speed Attribute ID: 0 10Gb/s Symmetric RX SuperSpeedPlus
    bmSublinkSpeedAttr[1]   0x000a40b0
      Speed Attribute ID: 0 10Gb/s Symmetric TX SuperSpeedPlus
  SuperSpeed USB Device Capability:
    bLength                10
    bDescriptorType        16
    bDevCapabilityType      3
    bmAttributes         0x00
    wSpeedsSupported   0x000e
      Device can operate at Full Speed (12Mbps)
      Device can operate at High Speed (480Mbps)
      Device can operate at SuperSpeed (5Gbps)
    bFunctionalitySupport   1
      Lowest fully-functional device speed is Full Speed (12Mbps)
    bU1DevExitLat          10 micro seconds
    bU2DevExitLat        2047 micro seconds
  USB 2.0 Extension Device Capability:
    bLength                 7
    bDescriptorType        16
    bDevCapabilityType      2
    bmAttributes   0x00000002
      HIRD Link Power Management (LPM) Supported
Device Status:     0x0000
  (Bus Powered)

then after holding again power for like 10 sec the device boots normally to system

[baruch]

if I do adb reboot edl after having booted system and with usb debug on, I get that:

Bus 001 Device 025: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.10
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x05c6 Qualcomm, Inc.
  idProduct          0x9008 Gobi Wireless Modem (QDL mode)
  bcdDevice            0.00
  iManufacturer           1 Qualcomm CDMA Technologies MSM
  iProduct                2 QUSB_BULK_CID:0420_SN:A1326E1D
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0020
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower                2mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol     16 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Binary Object Store Descriptor:
  bLength                 5
  bDescriptorType        15
  wTotalLength       0x0016
  bNumDeviceCaps          2
  SuperSpeed USB Device Capability:
    bLength                10
    bDescriptorType        16
    bDevCapabilityType      3
    bmAttributes         0x00
    wSpeedsSupported   0x000e
      Device can operate at Full Speed (12Mbps)
      Device can operate at High Speed (480Mbps)
      Device can operate at SuperSpeed (5Gbps)
    bFunctionalitySupport   1
      Lowest fully-functional device speed is Full Speed (12Mbps)
    bU1DevExitLat          10 micro seconds
    bU2DevExitLat        2047 micro seconds
  USB 2.0 Extension Device Capability:
    bLength                 7
    bDescriptorType        16
    bDevCapabilityType      2
    bmAttributes   0x00000002
      HIRD Link Power Management (LPM) Supported
Device Status:     0x0000
  (Bus Powered)

[Renate]

This is the "Diag" interface, it's practically useless.
You often get this when it partially boots but fails.

  idVendor           0x05c6 Qualcomm, Inc.
  idProduct          0x900e

This is the "Download" interface, a/k/a EDL.
This is what you want to do anything useful.
You will get this when booting totally fails, like with a blank flash.

  idVendor           0x05c6 Qualcomm, Inc.
  idProduct          0x9008 Gobi Wireless Modem (QDL mode)

[denisuu]

Can you boot it in to fastboot and change the active boot partition? We still haven't found an EDL loader for the Leaf 2.

[baruch]

Originally Posted by denisuu

Can you boot it in to fastboot and change the active boot partition? We still haven't found an EDL loader for the Leaf 2.

What’s an edl loader?

I did a fastboot --set-active=b from the fastboot menu in recovery and got into a diag boot loop
I could only get out of it by doing the recovery sequence tap which did not boot into recovery but into system right away... I suppose it switched back the active slot.

[Renate]

Originally Posted by baruch

What’s an edl loader?

It's a piece of software that lets you progress from "bricked" EDL mode to something that will allow you to flash your device even if partioning is gone. Technically, it's an external xbl replacement with special sauce to support the Firehose protocol. It's the only way (err, except JTAG) to get a completely erased/wrecked device working. There are many versions of Firehose loaders and they must be compatible with both the processor and auxilliary components (memory, power).

Since (knock on wood) most? Onyx models do not have SecureBoot enabled the possibilities for finding a valid Firehose loader is much larger than for most devices. If you want a Firehose loader for a Motorola phone, the loader can only be one issued (leaked) from Motorola. It's possible that a loader will be found tomorrow for a Chinese phone or tablet that is compatible with the Leaf2.

[baruch]

Thanks for the explanation!

Onyx models do not have SecureBoot enabled

If I boot to recovery and select "enter fastboot", the following appears as info:

Product name - Leaf2
Bootloader version - unknown
Baseband version -
Serial number - «some number I won't disclose»
Secure Boot - yes
HW version - 0

Does this means Secure Boot is enable on Leaf2?

And so there is no way to reflash bootloader from fastboot or adb?

[Renate]

Originally Posted by baruch

Secure Boot - yes

Grrr, it looks like it is locked down.
I just went through this with the Poke5.
A preliminary test seemed to indicate that it wasn't locked.

Originally Posted by baruch

And so there is no way to reflash bootloader from fastboot or adb?

With a working fastboot you can flash partitions.
With a rooted adb you can read or flash partitions or even write/fix partioning.

[baruch]

With a working fastboot you can flash partitions.
With a rooted adb you can read or flash partitions or even write/fix partioning.

I actually have both
so were can I find a copy of the original bootloader and how to reflash it?