Palma 2 Pro - rooting?

[Kisuke-CZE]

Hi,

I purchased Palma 2 Pro two weeks ago. And I was trying to root it with edl. But was not successful so far. Even when I run in in liveDVD environment, it always fails with this error:

sahara - [LIB]: Error: Cannot receive specified number of program headers

So probably not correct loader.
I tried all loaders edl matched as "possible loader".
Also tried this one (I did found that OnePlus Nord CE 5G has same Qualcomm chipset as Palma 2 Pro)

Any ideas what to try next? Or has anyone rooted Palma 2 Pro?

[dcarvil]

Originally Posted by Kisuke-CZE

Hi,

I purchased Palma 2 Pro two weeks ago. And I was trying to root it with edl. But was not successful so far. Even when I run in in liveDVD environment, it always fails with this error:

sahara - [LIB]: Error: Cannot receive specified number of program headers

So probably not correct loader.
I tried all loaders edl matched as "possible loader".
Also tried this one (I did found that OnePlus Nord CE 5G has same Qualcomm chipset as Palma 2 Pro)

Any ideas what to try next? Or has anyone rooted Palma 2 Pro?

See this page for the Palma 2 loader. I don't know if it also works for the Palma 2 Pro.

https://www.temblast.com/ref/onyxldr.htm

[Kisuke-CZE]

Nope. Palma 2 loader does not work :-(

[Renate]

The Palma2 and the Palma2Pro seem to be different processors.

The message "... program headers ..." is pure nonsense, but indicates a problem.

Please quote the HWID and the PK hash.

Try using my Windows EDL client in my sig.

[Kisuke-CZE]

HWID:              0x0013f0e100000000 (MSM_ID:0x0013f0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "bitra_SDM"
PK_HASH:           0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87

Unfortunately not able to test Windows EDL now, since in past 10 years I had no Win computer. And no Windows bootable machine is in sight for me in next ~3 days.
Will do more testing on Linux in meantime. But I believe that I will find some Win machine on weekend.

Yes, Palma 2 and Palma 2 Pro has totally different chipset/CPU.
I found so far that those phones have same Qualcomm CPU:

Samsung Galaxy A52 5G
OnePlus Nord CE 5G
Fairphone 4
Motorola Moto G 5G

[Kisuke-CZE]

Found working loader here: https://github.com/Alephgsm/SAMSUNG-...ephgsm.com.elf

[Renate]

Hmm, that's strange because it appears to be the same Qualcomm chip as the Palma2.
But Qualcomm goes crazy with JEDEC numbers, Snapdragon numbers, codenames, part numbers.
The only real check is to see what's written on the IC itself.

Stupid question: This is the third Palma and still no GPS?

[Kisuke-CZE]

Originally Posted by Renate

Stupid question: This is the third Palma and still no GPS?

It does have GPS. Just tested it now.


I was thinking that it will be easy after I found "working" loader from Samsung A52. But I am at another dead end right now.

I patched active boot image with Magisk. But when flashing it back to Palma, it ends up with this

edl --loader=palma2pro_from_a52.elf --memory=ufs w boot_b partitions/boot_b_patched.img

program,read,nop,patch,configure,setbootablestoragedrive,erase,power,firmwarewrite,getstorageinfo,benchmark,emmc,ufs,fixgpt,getsha256digest
modules
modules - [LIB]: 'Logger' object has no attribute 'loglevel'
firehose - 
Writing to physical partition 4, sector 258954, sectors 24576
Progress: |██████████| 100.0% Write (Sector 0x6000 of 0x6000, ) 0.25 MB/s                                          
firehose
firehose - [LIB]: Error:{}
Error writing partitions/boot_b_patched.img to sector 258954.

And boot image is unchanged.

Any ideas? Could loader be still the problem?

[Renate]

Mmm, see if you can find a Windows machine.
I really can't handle error messages that make no sense.

[Kisuke-CZE]

@Renate: I did some more testing. And I was able to read/write partition images with Palma 2 loader listed at your site. So you were right, it does work too.

For some reason it started to work when I removed SDcard from Palma 2 Pro. Or maybe I just did something wrong. Just remove any memory cards from device next time - just to be safe.

I also ended with "bricked" Palma for some time (after flashing magisked boot_b.img) booting only into fastboot mode (Boox logo on screen stuck). And unbricked the palma flashing back original boot image.

But it was weird. I probably messed something up - it is very possible. For now I am done testing until I can try that Windows EDL version. So I am posting my notes here for any fellow adventurer who might be willing to sacrifice device when trying.
It is not my invention, I just repeated process described many times. Here for example.

Rooting - Unsuccessful

wget -O palma2pro.bin 'https://github.com/bkerler/Loaders/raw/refs/heads/main/lenovo_motorola/0000000000000000_bdaf51b59ba21d8a_fhprg.bin'
adb reboot edl
edl --loader=palma2pro.bin --memory=ufs r devinfo partitions/devinfo.img
edl --loader=palma2pro.bin --memory=ufs r boot_a partitions/boot_a.img
edl --loader=palma2pro.bin --memory=ufs r boot_b partitions/boot_b.img
edl --loader=palma2pro.bin reset

adb reboot bootloader
# Now it will be stuck with BOOX logo on screen

fastboot getvar all
# note the "current-slot" value
# For me it was current-slot:b
# So I will work with boot_b partition

fastboot reboot
# Boot back to Android

adb push partitions/boot_b.img /sdcard/
# upload extracted partition to phone

# Now just patch image using Magisk in phone
# I used Magisk v30.6 https://github.com/topjohnwu/Magisk/releases/tag/v30.6

adb pull /sdcard/Download/magisk_patched-30600_WosxU.img partitions/boot_b_patched.img
# Download patched image from phone

adb reboot edl
edl --loader=palma2pro.bin --memory=ufs w boot_b partitions/boot_b_patched.img
edl --loader=palma2pro.bin reset

At this point I ended up with "bricked" device with stuck Boox logo on screen. Not booting any further.
But I was lucky, device was constantly booting into fastboot. I was able to do:

## Fastboot check
fastboot devices
fastboot getvar all

How to get from fastboot to EDL

When I ended up with device stuck in fastboot mode, I tried numerous things. This procedure worked for me to get it back into EDL.

Keep device connected to computer and issue some EDL command. I used this:

edl --loader=palma2pro.bin printgpt

Press and hold power button until Palma starts rebooting - screen flashes.

Then immediately release power button and press and hold VolUp + VolDown. Device gets recognized by computer and is put into EDL mode.

Flashing back stock images

To recover device back to working state I did this:

edl --loader=palma2pro.bin w boot_b partitions/boot_b.img
edl --loader=palma2pro.bin setactiveslot a
edl --loader=palma2pro.bin reset
# Repeat process to get from fastboot to EDL
edl --loader=palma2pro.bin setactiveslot b
edl --loader=palma2pro.bin reset

I do not know why, but without setting that active slot back and forth Palma refused to boot. (But doing same procedure with magisked boot_b.img does not work - tested that)

Questions

This process left some unanswered questions for me. I probably did something wrong. Or it might be that this linux EDL does not work properly. Not sure.

Main question. Why is there two boot partitions A and B? I was thinking that it is safety measure for updates and content in both slots should be same. When update fails, device can return to other slot which is intacted and able to boot.
But aparently this is not true. When my Palma failed to boot after flashing magisked boot_b.img first thing I tried was just to set activeslot to A. But device did not boot after that.

Any ideas if Palma bootloader can be unlocked somehow?

Does anyone have info how to boot into Palma 2 (Pro) recovery menu?

Any link to download Palma 2 Pro firmware? Tried procedure described in decryptBooxUpdateUpx. But without luck.

[Renate]

If you want a backup, just backup the entire storage.
Ok, that is slow and wasteful on today's ginormous devices.
Restore is a one step.

You can get to recovery by configuring the /misc partition.
Usually there is not a lot of exciting things to do in stock recovery.
You normally don't even get ADB.