Go 7 attempted root and now stuck on boox logo

[Alfaa]

I actually managed to make some progress on this issue this morning by trying some of the recovery ideas in this GitHub issue: https://github.com/jdkruzr/BooxPalma2RootGuide/issues/9

Using the FairPhone patched ABL, modified FRP and your misc-recovery image I was able to finally get my Go7 to boot into stock recovery.

However, I cannot get the device to accept a stock update.zip because of timestamp mismatches and if I do try to boot, the device immediately goes into dump mode, so something is still not working right.

[Alfaa]

Just wanted to update this and say after 10+ hours of pain, I finally got my Go7 to boot again after the soft brick.

Once I had a working recovery, I attempted to sideload the latest update.zip but it would not install because the timestamp on the update was earlier than the one on the recovery. This is annoying because it means you can't 'reinstall' updates over the same version.

HOWEVER, I also found a link to the 4.0 firmware and flashed the 4.0 recovery using EDL. Because the timestamp on that recovery was behind my 4.1.1 zip, I was able to flash it using ADB and I

F I N A L L Y

have a working device again.

[Renate]

Well, too bad that I still don't know if my custom recovery for the Go7 works or not.

[idovitz]

Originally Posted by Renate

Well, too bad that I still don't know if my custom recovery for the Go7 works or not.

Hi Renate, I ran in the same problem. I tried to flash your misc-recovery.prc but after edl reset* it restarts in fastboot.

./edl.py --loader=0000000000000000_bdaf51b59ba21d8a_fhprg.bin reset --resetmode=reset

[idovitz]

Originally Posted by Alfaa

Just wanted to update this and say after 10+ hours of pain, I finally got my Go7 to boot again after the soft brick.

Once I had a working recovery, I attempted to sideload the latest update.zip but it would not install because the timestamp on the update was earlier than the one on the recovery. This is annoying because it means you can't 'reinstall' updates over the same version.

HOWEVER, I also found a link to the 4.0 firmware and flashed the 4.0 recovery using EDL. Because the timestamp on that recovery was behind my 4.1.1 zip, I was able to flash it using ADB and I

F I N A L L Y

have a working device again.

Can you describe the steps you folowed to this result? I flashed the FP4 abl and frp_oemunlock.img and Renate's misc-recovery, but no luck.

[Renate]

Many people have asked my help.
Most have not ever reported back.
I don't know what's going on.

[idovitz]

Sorry to hear that.. I want to report back. What do you expect in this report?

[Renate]

Originally Posted by idovitz

Sorry to hear that.. I want to report back. What do you expect in this report?

I don't know what you flashed.
Did you write a custom recovery?
Where did you get it from?

I don't want to hear/get mixed up with FreePhone anything.
If there are changes needed they can be made to the Onyx stuff.
I spent a bunch of time making unlocking mods for Onyx limited abl's.
That was in January.

[idovitz]

I first overwrote **boot_b** with a Magisk‑patched image. That didn’t have any effect, so I also patched **boot_a**. Now the device only boots into fastboot (locked).

► `./edl.py --loader=0000000000000000_bdaf51b59ba21d8a_fhprg.bin r boot_a boot.img`
► `./edl.py --loader=0000000000000000_bdaf51b59ba21d8a_fhprg.bin w boot_b magisk_patched-30700_8NVgz.img`
► `./edl.py --loader=0000000000000000_bdaf51b59ba21d8a_fhprg.bin w boot_a magisk_patched-30700_8NVgz.img` (stupid)

Rebooting to recovery doesn’t work. I tried flashing **misc‑recovery.prc** to **misc** in order to get into recovery, but that also failed.

► `./edl.py --loader=0000000000000000_bdaf51b59ba21d8a_fhprg.bin w misc misc-recovery.img`

Ideally I’d like to build an OrangeFox‑style recovery for this device. I extracted the device tree from the stock recovery using **twrpdtgen**. My knowledge of custom ROMs and recoveries is a bit rusty, unfortunately, but I bought this device to tinker with. For reading I still have my PocketBook*630.

https://github.com/idovitz/android_device_Onyx_Go7

[jd27]

Originally Posted by Renate

Well, too bad that I still don't know if my custom recovery for the Go7 works or not.

Apologies - have been out of town and haven't had a look.

In summary, I think your custom recovery works. I flashed the go7-rec to recovery_a and recovery_b.

I also subsequently have flashed xabl to xabl_a and xabl_b (from my decrypted update), and abl to abl_a and abl_b.

When the device boots, it is still just stuck on the BOOX logo. However, if I plug in the device and hold down the on button till the BOOX logo flashes, I can access fastboot.

$ fastboot devices
eebba4d	 fastboot

Could you all please help with two questions:

• Does this mean that the custom recovery works? I'm not actually sure what stage the custom recovery gets you to, and Google has not been all that helpful.
• Now that I am in fastboot, would anyone have any step-by-step instructions on how I can get a working device again? I have a decrypted update.zip.

Thank you all so much!

JD

[Renate]

EDL write misc-recovery to misc

[jd27]

Originally Posted by Renate

EDL write misc-recovery to misc

Thanks, I have just done this. What should I do now? I saw previously that you suggested after this to run adb sideload:

Originally Posted by Renate

Try this. You already have the decrypted update.zip.

edl /l~~~~~~ <-- your loader
edl /w /pmisc misc-recovery.img
edl /z
adb sideload update.zip

The file ends in .prc, just rename it .img (not that it matters).

However, once I have written misc-recovery.img via EDL (and then edl /z), the device reboots but I still cannot access via adb.

I can now however access via fastboot (fastboot devices shows eebba4d fastboot).

Would you have any suggestions from here?

Thanks,

JD

[Renate]

What did you flash to recovery?

[doomgoatman]

Hey all, joining the club of people who bricked their Go 7 trying to root it and thought I'd add to the discussion. Read through this thread and the BooxPalma2RootGuide issue #9 — I believe that my situation is almost identical to jd27's and Alfaa's.

Device: Go 7 (monochrome/B&W)
HWID: 0013f0e1 / product: lito / variant: SM_ EMMC
Serial: ec9bf62
Firmware: 4.1.1

What I did:

1. Entered EDL via adb reboot edl
2. Used temblast's edl.exe with the SM_BITRA loader (0000000000000000_bdaf51b59ba21d8a_fhprg.bin), confirmed working, got partition table, HWID matched
3. Dumped boot_a and boot_b (have originals backed up)
4. Sideloaded Magisk, patched both boot images
5. Flashed patched images to boot_a and boot_b via EDL
6. Device now stuck on Boox logo, will not boot to Android

Current state:

- Device reliably enters fastboot (18d1:d00d, shows as "Android" in Device Manager)
- I can communicate with fastboot from WSL (Ubuntu) via usbipd, fastboot devices returns ec9bf62 fastboot
- Windows fastboot.exe does NOT see the device despite correct VID/PID and WinUSB driver installed via Zadig. Tried WinUSB, libusbK, Google USB driver, no dice.
- Cannot get into EDL from fastboot. Tried fastboot oem edl, fastboot reboot edl, fastpwn oem edl, all fail with "unknown command"
- Bootloader is locked (unlocked:no), secure:no
- All write commands fail: fastboot flash, fastboot boot, fastboot set_active, fastboot flashing unlock, all "unknown command"
- fastboot reboot recovery reports OKAY but device loops back to fastboot, tried page-turn button combos to force EDL, no luck

fastboot getvar all highlights:
unlocked:no
secure:no
current-slot:a
slot-retry-count:a:6
slot-unbootable:a:yes
slot-successful:a:yes
slot-retry-count:b:0
slot-unbootable:b:no
slot-successful:b:no
product:lito
variant:SM_ EMMC
kernel:uefi

I ordered an EDL cable that should arrive later today or tomorrow then I will attempt recovery.

[Renate]

It comes down to two possibilities and I don't know which one it is:

1) There is some problem with Magisk on the Go7 image.

2) The device not being unlocked prevents running non-stock images.

I had written a patch for the NoteAir5C abl to allow unlocking.
That fell by the wayside as the people drifted away.

I could write a patch for the Go7 but it is a bunch of effort.