Rooting Tab Ultra

[Renate]

I just checked. I can't see any updates on the normal channel.

[clavigerpc]

Originally Posted by smrtr-rdr

Nice, I was worried I'd have to wait for the next firmware release to grab it from the OS.

Would you mind elaborating on the tools and processes used to accomplish this / pointing me toward a primer on that?

I think you can follow the process, making the necessary changes for device, from the set of instructions in the opening post here:
https://www.mobileread.com/forums/sh...d.php?t=349397

Basically, the process is as follows:
1. Get the boot/kernel partition (using edl)
2. Patch it with the magisk app
3. Flash it with fastboot

I have done a lot of Android rooting, but do not have a Tab Ultra, yet, it is supposed to arrive today. If I have any problems or clarifications in the next couple of days after rooting for myself, I'll let you know.

[clavigerpc]

Originally Posted by Renate

I just checked. I can't see any updates on the normal channel.

Mine arrived today and it has a version number of 2022-11-22_18-28_3.3.1_.....

I was able to use edl to pull boot and patch with another android device, but no matter what Magisk app crashes on load. I am attaching a log, any ideas?

[Renate]

I'm not quite sure whether Magisk uses information outside of the boot image it's processing.
I would just use your target device for the Magisk processing.

[clavigerpc]

Originally Posted by Renate

I'm not quite sure whether Magisk uses information outside of the boot image it's processing.
I would just use your target device for the Magisk processing.

I am pretty sure it does not, as I have done this before. But it is working now, the problem was somehow caused, as far as I can tell, by the installation of magisk over adb. I reinstalled it directly on the browser (just download and tap on it in the file browser) and now it is working.

Incidentally, I had to use this edl loader, rather than the qualcomm one someone else used above:
https://github.com/bkerler/Loaders/b...5106_fhprg.bin

Otherwise, the whole of the tutorial I linked above worked precisely, included a couple of sticky points like the fastboot drivers. Thanks to this wonderful community!!

[shahin]

Originally Posted by clavigerpc

I am pretty sure it does not, as I have done this before. But it is working now, the problem was somehow caused, as far as I can tell, by the installation of magisk over adb. I reinstalled it directly on the browser (just download and tap on it in the file browser) and now it is working.

Incidentally, I had to use this edl loader, rather than the qualcomm one someone else used above:
https://github.com/bkerler/Loaders/b...5106_fhprg.bin

Otherwise, the whole of the tutorial I linked above worked precisely, included a couple of sticky points like the fastboot drivers. Thanks to this wonderful community!!

Hi, can you please gather the instruction in a blog page or something for usage of non tech savvy users, who want to root their device?
I want to root my device, and need a streit forward method.

[tatteredscroll]

@shahin, look over these threads

https://www.mobileread.com/forums/sh...d.php?t=336523
https://www.mobileread.com/forums/sh...d.php?t=344505
https://www.mobileread.com/forums/sh...d.php?t=349397

The last thread has some instructions attached to the first and fourth posts. Read and re-read them. Hopefully, it will start to sink in.

As Renate has posted in threads throughout here--

There's a lot of commonality between recent models of Onyx.
Rooting of them is pretty much all the same. There are explicit tutorials up already.

1. Enable ADB on your device
2. Get a copy of the boot image, either:

a. Download an update and decrypt it

b. Use EDL mode to extract the boot image from your device

3. Install Magisk.apk
4. Have Magisk process your boot image
5. Replace your boot image, either:

a. fastboot flash boot magisk.img

b. In a rooted recovery, dd if=magisk.img of=/dev/block/by-name/boot

c. Use EDL mode to write the magisk image

[rainer.zufall]

Hi there,
puhh, what a journey this thread is

I just came to read about "how to root the tab ultra", and ended up in a syncing nightmare, aber vom Feinsten!

I really needed to reread several posts, and look up into google, to get a grasp of what you guys are talking about ...

Just bought an boox ultra c, and now Im gathering all the information, to make myself a step by step tutorial. I did this for my samsung, and it worked well, BUT there was a detailed thread on XDA.

No, quite the opposite. As mentioned in this thread it can be rooted without a problem. You can easily root it by downloading the boot image in EDL mode and then root it using magisk. I used the loader

Oh man, I wish I could say that. I do not even know, wth EDL is

But if you say the ultra c can be rooted like the ultra, then I would give it a try.

The best I found so far is this from the Note Air 2 https://www.mobileread.com/forums/sh...d.php?t=349397

can I just take this as an example, and juse those tools? Im just a bit afraid, that there is another Chip or sh like that, and therefore other drivers/tools may be needed.

I better not brick my new device, so I want to be sure everything would be OK.
When flashing my phone back then (maybe 5 years ago) I read everything I could find, and made several backups to cover my ass if I messed up. This worked great, and I flashed several devices (all samsungs). But here, I dont know how to even start, because all I needed back then, was Odin and TWRP

Well, in general I know the order, but the steps I need to research (which is fun)
But like I said, need the confirmation, that the way is correct, and the tools also the proper ones. would be very glad, if you can fly an eye over and warn me before Ill make a huge mistake?

There's a lot of commonality between recent models of Onyx.
Rooting of them is pretty much all the same. There are explicit tutorials up already.


1. Enable ADB on your device (done, that was easy)
2. Get a copy of the boot image, either:
..a. Download an update and decrypt it (no update available yet)
..b. Use EDL mode to extract the boot image from your device (have a tut 4 reading)
3. Install Magisk.apk (26.1 works?)
4. Have Magisk process your boot image (idk, will find a tutorial)
5. Replace your boot image, either:
..a. fastboot flash boot magisk.img (iirc need sdk and console 4 this,will find a tutorial)
..b. In a rooted recovery, dd if=magisk.img of=/dev/block/by-name/boot
c. Use EDL mode to write the magisk image (idk, will find a tutorial)

And before this, I need to find out, how to make a backup.


BUT like I said, before I finally start digging in, I want to find out, if it is even possible to root the Ultra C? And you guys seem the right ppl to ask...

Thanks in advance for any hint in the right direction.

[Renate]

Originally Posted by rainer.zufall

Just bought an boox ultra c...

Nice!

I presume that the C uses the same Firehose loader as the non-C.
But you'll be able to tell us that.

You need to get yourself an EDL client program, either bkerler's or mine.
Follow the instructions on whichever one you are using.

Then you need to get the Firehose loader

For safety you should save the entire flash memory to your desktop.
That's 128 GB. I hope that you have room. And time.

On my edl, that would be:

C:\>adb reboot edl
C:\>edl /l0014d0e100000000_d40eee56f3194665_FHPRG.bin
C:\>edl /u /r /s0 /c0 mybackup.img

[Venator3]

Is there any resource for rooting either that tab ultra or any of the other onyx devices on Linux? I'm familiar with the process starting with patching the boot image with magisk and the flashing, but have never used EDL or decrypted a boox update.

[Renate]

Originally Posted by Venator3

Is there any resource for rooting either that tab ultra or any of the other onyx devices on Linux? I'm familiar with the process starting with patching the boot image with magisk and the flashing, but have never used EDL or decrypted a boox update.

If you have a boot image from an update (or someone else) you can root with Magisk.
If there is no boot image available you'll have to use EDL.
The bkerler Python EDL client above works on any platform with Python.
Of course I only use my own native Windows client.

[Venator3]

Using the python EDL client is where I get a little lost. I can install it no problem, though I see two install methods on the github, I assume either or works. I would then reboot to EDL, but not sure what command I should use after that, I've seen a lot of tutorials use a .elf file, in this thread I've seen reference to a .bin file, am I supposed to rename that? I do not see the command needed to get the boot.img file on the github page under UFS or emmc, nor do I see a command to do a complete backup.

I guess my other option is to get the update from:

http://data.onyx-international.cn/api/firmware/update?where={"buildNumber":0,"buildType":"user"," deviceMAC":"","lang":"en_US","model":"Poke3","subm odel":"","fingerprint":""}

But https://github.com/Hagb/decryptBooxUpdateUpx does not list the Tab Ultra, seem like obtaining a string isn't too difficult, but in either case it would be nice to get a full 128gb backup using EDL in case things go wrong.

Any help appreciated!

[Renate]

Originally Posted by Venator3

Using the python EDL client is where I get a little lost.

Firehose loaders may be named .bin or .elf
It doesn't matter, just leave them so.

No, there are no strings for the Tab Ultra.
That means you get to get them.
Do you have ADB yet?

C:\>adb pull /system/priv-app/OnyxOtaService/OnyxOtaService.apk

Then post it here.

Edit: Oops

[Venator3]

adb: error: failed to stat remote object '/system/priv-app/OnyxOtaService.apk': No such file or directory

(On Linux, assuming the command is the same), do I need to install that apk first?

[Renate]

Originally Posted by Venator3

No such file or directory

Oops, my bad.

adb pull /system/priv-app/OnyxOtaService/OnyxOtaService.apk