How to Root the Onyx Boox Note Air 2 Plus (Windows)

[mmc_meneses]

Originally Posted by Renate

Besides the September update?

Model:  NoteAir2 (English)
Finger: Onyx/NoteAir2/NoteAir2:11/2024-09-10_19-03_3.5.4_fbdec6b69a/47378:user/release-keys
Link:   http://firmware-us.boox.com/1d618f957d28ebd0896cece40e8b1077/update.upx
Size:   1,796,337,779
MD5:    1d618f957d28ebd0896cece40e8b1077

And I forgot to mention my #1 reason, to get rid of the stupid non-standard system font.

Edit: Oh, you're on 3.5.4 already.

Well i do not find system font as annoying, and for the books you can always customize.
The one thing i hate is when you customize font and spaces for an specific book and you change the book and have to remake it...

Big hug

[Renate]

They used to have a system where they had a "gutted" (ony glyphs) font to use for spacing kerning and then a separate font for actually drawing glyphs. Unfortunately the two were not related. This caused a really weird thing where apostrophes got a full space before and after. The current situation uses goofy Onyx custom fonts to replace the normal system bold fonts..

[Herschenglime]

After trying for many hours in October, giving up, and trying again today, I was finally able to get root working on v3.5.4!

Many thanks to Renate for their pointers here and in the forums as a whole. I primarily struggled with actually getting the edl utility to work with my device as no matter what I tried (or what version of EDL I used) I couldn't get it to work except at one time.

I eventually stumbled upon a post in the XDA forums from Renate mentioning that some EDL loaders have a timeout that prevents the tool from working in some instances, and sure enough, as long as I started the EDL commands quickly after putting the tablet in edl mode, it would actually connect to the device. For example,

adb reboot edl && edl rf flash-backup.img --memory=ufs --loader=q662.elf

is what allowed me to backup all of my system partitions with bkerler's EDL utility on Linux.

Following that, I was able to easily flash my patched boot partition with edl like so:

edl w boot_a magisk_patched-27000_RNHDQ.img --memory=ufs

After reboot, everything worked as expected! I just had to open the magisk app and let it reboot the system one more time.

The rest of the rooting process is mostly the same as the standard Linux procedure for a Boox device, but if anyone reading this down the line needs extra guidance please let me know.

[vedri]

Dear gentlemen,

previously rooted NoteA2P following below instructions:


https://blog.tho.ms/hacks/2021/03/27...-note-air.html


After recent update to 3.5.4 fw have been unpleasantly surprised that fastboot rooting approach seems now closed:

Writing 'boot_b' FAILED (remote: 'Unrecognized command flash')

After lurking a little and reading about EDL from this topic have tried also that approach but am also experiencing problems, precisely problems with communicating with device via loaders. Please read below:

C:\Users\user1\Documents>edl.exe /l662.elf
Found EDL 9008, handshaking... nope, resetting...
Could not write device

C:\Users\user1\Documents>edl.exe /l0014d0e100000000_d40eee56f3194665_FHPRG.bin
Found EDL 9008, handshaking... nope, resetting...
Could not write device

C:\Users\user1\Documents>edl.exe /z
Found EDL 9008, requesting reboot...
Could not write device

If you have possibly experienced same issues, please write, would be most grateful.

[Renate]

Originally Posted by vedri

C:\Users\user1\Documents>edl.exe /l662.elf
Found EDL 9008, handshaking... nope, resetting...
Could not write device

The entire Sahara protocol is backwards. The device is supposed to speak first. If it has spoken already and you connect after that or if you did something wrong, you lost the opportunity. Some device can recover, some can't.

TLDR: Do a clean reset to EDL, don't disconnect the cable. Use "edl /l662.elf" before anything else.

[vedri]

Originally Posted by Renate

The entire Sahara protocol is backwards. The device is supposed to speak first. If it has spoken already and you connect after that or if you did something wrong, you lost the opportunity. Some device can recover, some can't.

TLDR: Do a clean reset to EDL, don't disconnect the cable. Use "edl /l662.elf" before anything else.

Hi Renate,

now I have more questions over my head than before nevertheless will try to answer them and hopefully get back here with some good news. Seems a bit more complicated than fastboot imho.. thanks for advice.

[vedri]

Originally Posted by Herschenglime

After trying for many hours in October, giving up, and trying again today, I was finally able to get root working on v3.5.4!

Many thanks to Renate for their pointers here and in the forums as a whole. I primarily struggled with actually getting the edl utility to work with my device as no matter what I tried (or what version of EDL I used) I couldn't get it to work except at one time.

I eventually stumbled upon a post in the XDA forums from Renate mentioning that some EDL loaders have a timeout that prevents the tool from working in some instances, and sure enough, as long as I started the EDL commands quickly after putting the tablet in edl mode, it would actually connect to the device. For example,

adb reboot edl && edl rf flash-backup.img --memory=ufs --loader=q662.elf

is what allowed me to backup all of my system partitions with bkerler's EDL utility on Linux.

Following that, I was able to easily flash my patched boot partition with edl like so:

edl w boot_a magisk_patched-27000_RNHDQ.img --memory=ufs

After reboot, everything worked as expected! I just had to open the magisk app and let it reboot the system one more time.

The rest of the rooting process is mostly the same as the standard Linux procedure for a Boox device, but if anyone reading this down the line needs extra guidance please let me know.

Can confirm procedure is working for Note Air 2 Plus, initially had trouble installing edl utility on my distro(tried Windows 10 VM in QEMU but device just couldn't connect properly, you can read in post, few posts back), followed advice from experienced python users:

https://github.com/bkerler/edl/issues/574

Installed edl on distro, and followed Herschenglime approach but changing write partition to boot_b

edl w boot_b magiskboot.img --memory=ufs --loader=q662.elf

Magisk showing as installed, "System UI app is not responding" on startup, have experienced the same issue from previous fw update after rooting nevertheless all that is needed by me is working correctly.

Thanks all contributing for your time and patience!

[ramensoup150]

Its me again.

I had to reset the device for private reasons. Looking at the recent update, I cant do the flash method.

So Im attempting the edl method. But theres a problem and I cant figure out what the issue is.

edl /l0014d0e100000000_d40eee56f3194665_FHPRG.bin
Found EDL 9008, handshaking... version 2.1
HWID: 001740e100000000 (x3), JTAG: 001740e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending 0014d0e100000000_d40eee56f3194665_FHPRG.bin 100% ok, starting... ok, waiting for Firehose...
<log value="ERROR: Call to ufs_open(0, UFS_WLUN_DEVICE) failed:0" />
Ok

edl.exe /u /r /pboot_a boota.img /t
Found EDL 9008, configuring... ok
Requesting info on LUN 0... no ack/nak

I downloaded the proper loader. the nova air 2 has the snapdragon 662 chip and i downloaded the loader for that, so idk why this problem is happening.

[Renate]

Originally Posted by ramensoup150

<log value="ERROR: Call to ufs_open(0, UFS_WLUN_DEVICE) failed:0" />

This thread is on the Note Air 2 Plus, you've got an Nova Air 2, which has eMMC.
So lose the /u and start over.

[ramensoup150]

Originally Posted by Renate

This thread is on the Note Air 2 Plus, you've got an Nova Air 2, which has eMMC.
So lose the /u and start over.

Thank you, that worked.

[Renate]

Originally Posted by ramensoup150

Thank you, that worked.

Do you still get that error at starting "ufs open" when using the "normal" SDM662 Firehose loader?

[johnwu0512]

Originally Posted by Renate

Do you still get that error at starting "ufs open" when using the "normal" SDM662 Firehose loader?

Hi Renate. Do you have a Note Air2/Air2Plus custom recovery? I have a X2 and want to flash a Note Air2Plus rom on it to see if it works. Thank you

[Renate]

@johnwu0512 Got my PM?

[johnwu0512]

Originally Posted by Renate

@johnwu0512 Got my PM?

Hi Renate. Sorry for my late reply. I got your pm and your rec
- I flashed it through edl to my Boox Note X2, no problem
- Reboot to recovery, the screen froze at Boox logo
- I got adb, so i think it's just the screen
The same as before.

adb shell
#id
.....
#start autoupdate

- The screen still show nothings, just Boox Logo, no text like waiting for drive
- I put the flash drive into it and wait for like 5 mins. The screen flashing and reboot.
- After that it stuck at Boox logo again, but my PC show that a Boox Note Air2 just connects to my PC. I got adb, i can copy file to the device but the screen just froze
Can I do anything to make it work? I still got adb, edl so if nothing can be done, I can just flash your rec and flash Note X2 firmware

P/s: I also downloaded a NoteAir2P (Note Air2 Plus) firmware and try to flash it to my X2. But the same as the Note Air 2. The screen just froze
Here the autolog from the drive. Can u have a look

[Renate]

The autolog is happy.
The conclusion is that the Note X2 is not related to the NoteAir2.
The NoteAir2 and the NoteAir2P share the same kernel.

Is the Note X2 BSR?
That would explain why the screen doesn't work in either recovery or NoteAir2 image.