[Query] Onyx Boox C69 Custom Edition: Dumping firmware, cross-flashing, and more

Bokasoda · 10-26-2026, 09:44 AM

My sister-in-law got a couple of decommissioned Boox devices from her workplace and asked me to take a look at them. They feature a custom boot logo as well as a modified firmware with various bundled apps.

I managed to remotely dump the following info from one unit:

Code:

adb shell getprop ro.product.model
C69_M_STAR

adb shell getprop ro.product.device
C69_M_STAR

adb shell getprop ro.build.fingerprint
Onyx/C69_M_STAR/C69_M_STAR:11/2023-07-20_17-44_3.2.2-bridge_1d80e860a/5465:user/dev-keys

adb shell getprop ro.build.display.id
2023-07-20_17-44_3.2.2-bridge_1d80e860a

adb shell getprop ro.build.version.incremental
5465

It looks like the C69 platform is being rebranded by various vendors across the globe, as seen here. My SIL also confirmed that the physical appearance of the units does match with the one shown in the Reddit thread.

According to her, no OTA is available on the units, and a manual check reports that the current (customized) firmware is the latest one.

I tried to cross-flash the Boox Bering 5 firmware through the updater, but it failed as intended due to mismatched prop values.

I'm planning to go to her place in the weekends and borrow one unit to tinker with it. Meanwhile, what can be done remotely if we want to:

Backup the existing firmware for preservation
Cross-flash a newer, retail Boox firmware
Root it to have more control

?

Tagging @Renate, since this seems to be her domain of interest.

Bokasoda · 10-26-2026, 12:10 PM

Dumped the keys for decrypting the OTA:

Code:

"STRING_SETTINGS" = "+zt3jLZkVx8eBFtQHizYUj8NYMUuRLXIhplplBZo04W6"

"STRING_UPGRADE" = "gUpyirtiIB0xfvV5Y8PTHs6vEgBX4j34DD5XyeuTkm7d"

Renate · 10-27-2026, 01:23 AM

Thanks! The keys have been added.
I haven't seen an update for this though.
They might not be in the normal channels?

What is this thing when it's not a C69?

We don't have the keys yet for the BERING5 although there is one update:

Code:

Model:  BERING5 (English)
Finger: Onyx/BERING5/BERING5:11/2026-09-09_03-53_3.5.4-mc_1a4c0a083a/51761:user/release-keys
Link:   http://firmware-us.boox.com/452934b1fd947fb1857659ccda6ebf29/update.upx
Size:   2,110,803,364
MD5:    452934b1fd947fb1857659ccda6ebf29

Model:  BERING5 (Russian)
Finger: Onyx/BERING5/BERING5:11/2026-09-09_03-53_3.5.4-mc_1a4c0a083a/51761:user/release-keys
Link:   https://onyx-boox.ru/files/bering5/update.upx
Size:   2,110,803,364
MD5:    452934b1fd947fb1857659ccda6ebf29

Bokasoda · 10-27-2026, 05:14 AM

Quote:

Originally Posted by Renate

Thanks! The keys have been added.

You're welcome!

After posting, I realized that the extracted keys are in old format, but thanks for converting them and adding the entry in the database.

Quote:

Originally Posted by Renate

I haven't seen an update for this though.
They might not be in the normal channels?

Yeah, I can't construct a valid update request even after trying numerous combinations. Guess the updates are/were seeded from a custom OTA server too?

Quote:

Originally Posted by Renate

What is this thing when it's not a C69?

According to my SIL, these units were used for distributing study materials. You can actually find a such an app for downloading the contents from the company's server, with different sections for teachers and students.

Quote:

Originally Posted by Renate

We don't have the keys yet for the BERING5 although there is one update:

Code:

Model:  BERING5 (English)
Finger: Onyx/BERING5/BERING5:11/2026-09-09_03-53_3.5.4-mc_1a4c0a083a/51761:user/release-keys
Link:   http://firmware-us.boox.com/452934b1fd947fb1857659ccda6ebf29/update.upx
Size:   2,110,803,364
MD5:    452934b1fd947fb1857659ccda6ebf29

Model:  BERING5 (Russian)
Finger: Onyx/BERING5/BERING5:11/2026-09-09_03-53_3.5.4-mc_1a4c0a083a/51761:user/release-keys
Link:   https://onyx-boox.ru/files/bering5/update.upx
Size:   2,110,803,364
MD5:    452934b1fd947fb1857659ccda6ebf29

Here's the main confusion: The Darwin 11 (we have the decryption keys for this one), Faust 7, and Bering 5 are all looking similar to the unit.

Perhaps dumping the firmware - especially the bootloader and vendor partitions - via the QCS_AGATTI Firehose loader would be the next logical step?

Renate · 10-27-2026, 10:44 AM

Use an EDL client and get the HWID.
(That's the model of the Qualcomm processor, not your secret id.)

Bokasoda · 10-27-2026, 01:37 PM

Quote:

Originally Posted by Renate

Use an EDL client and get the HWID.

(That's the model of the Qualcomm processor, not your secret id.)

Tried with the QCS_AGATTI loader, since the processor (Qualcomm SCUBAPIIOT / Scuba IoT = QCS2290?) is somewhat similar:

Code:

edl.exe /lQcm2290_ddr_fhprg.elf

Found EDL 9008, handshaking... nope, resetting... version 2
HWID: 001860e100000000 (x3), JTAG: 001860e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending Qcm2290_ddr_fhprg.elf 100% ok, starting... ok, waiting for Firehose... ok

The partition map is as follows:

Code:

edl.exe /g

Found EDL 9008, configuring... nope, configuring... nope, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok

 #  Name                   Start       Count  Type
──  ────────────────  ──────────  ──────────  ────────────────────
 1  xbl_a                 131072        7168  SBL1
 2  xbl_b                 138240        7168  Inactive
 3  xbl_config_a          262144         256  Boot config
 4  xbl_config_b          262400         256  Inactive
 5  tz_a                  393216        8192  TrustZone
 6  tz_b                  524288        8192  Inactive
 7  rpm_a                 655360        1024  Resource/power mgmt
 8  rpm_b                 786432        1024  Inactive
 9  hyp_a                 917504        1024  Hypervisor
10  hyp_b                1048576        1024  Inactive
11  boot_a               1049600      196608  Boot
12  boot_b               1246208      196608  Inactive
13  super                1442816     8388608  Super
14  vbmeta_system_a      9961472         128  VB meta system
15  vbmeta_system_b      9961600         128    fe3ab853
16  recovery_a           9961728      196608  Recovery
17  recovery_b          10158336      196608  Recovery B
18  keymaster_a         10354944        1024  Key master
19  keymaster_b         10355968        1024  Inactive
20  mdtpsecapp_a        10356992        8192  MDTP secure
21  mdtpsecapp_b        10365184        8192  Inactive
22  mdtp_a              10373376       65536  MDTP
23  mdtp_b              10438912       65536  Inactive
24  modem_a             10504448      368640  FAT32
25  modem_b             10873088      368640  Inactive
26  dsp_a               11241728      131072  DSP
27  dsp_b               11372800      131072  Inactive
28  abl_a               11503872        2048  Android bootloader
29  abl_b               11505920        2048  Inactive
30  ddr                 11507968        2048  DDR
31  bluetooth_a         11510016        2048  Bluetooth
32  bluetooth_b         11512064        2048  Inactive
33  ssd                 11534336          16  Secure SW download
34  dtbo_a              11534352       49152  DTBO
35  dtbo_b              11583504       49152  Inactive
36  imagefv_a           11632656        4096  Image FV
37  imagefv_b           11636752        4096  Inactive
38  uefisecapp_a        11640848        4096    be8a7e08
39  uefisecapp_b        11644944        4096  Inactive
40  persist             11649040       65536  Persist
41  metadata            11714576       32768  Metadata
42  misc                11747344        2048  Misc
43  keystore            11749392        1024  Key store
44  devcfg_a            11750416         256  Device config
45  devcfg_b            11750672         256  Inactive
46  featenabler_a       11750928         256    741813d2
47  featenabler_b       11751184         256  Inactive
48  qupfw_a             11751440         128  QUP firmware
49  qupfw_b             11751568         128  Inactive
50  frp                 11751696        1024  FRP
51  rawdump             11752720      262144  RAM dump
52  devinfo             12058624           8  Device info
53  dip                 12058632        2048  DIP
54  apdp                12189696         512  APDP
55  spunvm              12190208       16384  Spun VM
56  splash              12206592       66848  Splash
57  limits              12320768           8  Limits
58  toolsfv             12320776        2048  Tools FV
59  logfs               12451840       16384  Log FS
60  cateloader          12468224        4096  STI
61  logdump             12472320      131072  Log dump
62  vbmeta_a            12713984         128  VB meta
63  vbmeta_b            12714112         128  Inactive
64  storsec             12714240         256  Store secure
65  multiimgoem_a       12714496          64    e126a436
66  multiimgoem_b       12714560          64  Inactive
67  multiimgqti         12714624          64    846c6f05
68  secdata             12714688          50    76cfc7ef
69  catefv              12714744        1024  Cate FV
70  catecontentfv       12715768        2048  Cate content FV
71  uefivarstore        12717816        1024    165bd6bc
72  modemst1            12845056        4096  Modem FS1
73  modemst2            12849152        4096  Modem FS2
74  fsg                 12976128        4096  Modem FSG
75  fsc                 13107200         256  FSC
76  onyxconfig          13107456       49152  System
77  userdata            13156608    17514207  User data

On a different note, after comparing the processor core count (4) and the display resolution (758*1024), the Faust 5 seems to be the closest retail relative of this one.

Renate · 10-27-2026, 04:21 PM

Yes, that is a QCS2290, same as the Poke5.

stillcurious · 10-30-2026, 01:20 AM

can i get one of that device too, and can you provide details of where this project currently stands, how can i too do that ?

10-26-2026, 09:44 AM	#1
Bokasoda Junior Member Posts: 4 Karma: 10 Join Date: Oct 2026 Device: Amazon Kindle Paperwhite 11th Gen	[Query] Onyx Boox C69 Custom Edition: Dumping firmware, cross-flashing, and more My sister-in-law got a couple of decommissioned Boox devices from her workplace and asked me to take a look at them. They feature a custom boot logo as well as a modified firmware with various bundled apps. I managed to remotely dump the following info from one unit: Code: adb shell getprop ro.product.model C69_M_STAR adb shell getprop ro.product.device C69_M_STAR adb shell getprop ro.build.fingerprint Onyx/C69_M_STAR/C69_M_STAR:11/2023-07-20_17-44_3.2.2-bridge_1d80e860a/5465:user/dev-keys adb shell getprop ro.build.display.id 2023-07-20_17-44_3.2.2-bridge_1d80e860a adb shell getprop ro.build.version.incremental 5465 It looks like the C69 platform is being rebranded by various vendors across the globe, as seen here. My SIL also confirmed that the physical appearance of the units does match with the one shown in the Reddit thread. According to her, no OTA is available on the units, and a manual check reports that the current (customized) firmware is the latest one. I tried to cross-flash the Boox Bering 5 firmware through the updater, but it failed as intended due to mismatched prop values. I'm planning to go to her place in the weekends and borrow one unit to tinker with it. Meanwhile, what can be done remotely if we want to: Backup the existing firmware for preservation Cross-flash a newer, retail Boox firmware Root it to have more control ? Tagging @Renate, since this seems to be her domain of interest.

10-26-2026, 12:10 PM	#2
Bokasoda Junior Member Posts: 4 Karma: 10 Join Date: Oct 2026 Device: Amazon Kindle Paperwhite 11th Gen	Dumped the keys for decrypting the OTA: Code: "STRING_SETTINGS" = "+zt3jLZkVx8eBFtQHizYUj8NYMUuRLXIhplplBZo04W6" "STRING_UPGRADE" = "gUpyirtiIB0xfvV5Y8PTHs6vEgBX4j34DD5XyeuTkm7d"

10-30-2026, 01:20 AM	#8
stillcurious Junior Member Posts: 1 Karma: 10 Join Date: Oct 2026 Device: Kindle 8th gen	HI, sorry for asking, can i get one of that device too, and can you provide details of where this project currently stands, how can i too do that ?

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Flashing a Chinese version of the Onyx BOOX Tab X C to Western version	Tom Swift	Onyx Boox	5	01-19-2026 03:10 AM
Need help flashing Boox Note Air firmware	Boox4ev	Onyx Boox	21	09-10-2025 05:03 AM
Sell Onyx Boox M92 Black (Booxtor Edition) - Europe - Italy	namazu	Flea Market	1	07-27-2015 07:55 AM
Onyx is dumping M90 users like a rock	jian1	Onyx Boox	61	04-05-2012 09:13 AM
eWeek PDF Magazine - How does it look on DXG? (cross-post from Onyx Boox forum)	originl	Amazon Kindle	5	07-21-2010 01:59 AM

10-27-2026, 10:44 AM	#5
Renate Onyx-maniac Posts: 4,563 Karma: 22077803 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Use an EDL client and get the HWID. (That's the model of the Qualcomm processor, not your secret id.)

10-27-2026, 04:21 PM	#7
Renate Onyx-maniac Posts: 4,563 Karma: 22077803 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Yes, that is a QCS2290, same as the Poke5.

Advert

Advert