Palma 2 Pro - rooting? - Page 2

Kisuke-CZE · 12-20-2025, 02:02 PM

Hi, thanks for helping. Tried your image and device refuses to boot it.
I wrote it to recovery_b. Then the device booted normally into Android. But since I tried to boot into recovery (regardles if it was button combination or adb reboot recovery), it started to refusing to boot. Not only into recovery, but also to Adnroid (which worked after new recovery was written). I had to write back original recovery. Then (it was starting directly to fastboot until this) I had to do that trick with setting activeslot to A and then back to B again to make device boot again.

It seem there is some check. After I write some modified image (boot or recovery), device tries to boot it first time. Then probably refuses it, because it vibrates and does reboot. After this first reboot device never tries to start from that slot again and goes directly into fastboot mode without trying.
Even after flashing to original state, it just goes directly into fastboot mode. Until I do that procedure with swapping activeslot.

Renate · 12-20-2025, 02:47 PM

Well, I certainly could have screwed up.
But the mods are the same as for the Palma2.

Did you disable vbmeta?
Just rename this to .img and flash it to vbmeta.

Kisuke-CZE · 12-21-2025, 07:51 AM

Tested numerous combinations but Palma just refuses to boot to anything but fastboot if there is any modification done it seem.

Flashing clear vbmeta does not help. In fact, when I have everything original and device boots (into android or stock recovery). When I flash just empty vbmeta with this command:

Code:

edl --loader=palma2pro.bin --memory=ufs w vbmeta_b vbmeta_empty.bin

Device refuses to boot.

I am starting to believe that rooting without unlocked bootloader might not be possible.

Renate · 12-21-2025, 08:39 AM

There are usually two places where the mounting/verification are specified, in the DTB and in the fstab.
For recovery, that's system/etc/recovery.fstab
Of course the boot image is not in the fstab.

You can try from fastboot: "fastboot boot rec.img"
That's sometimes problematical but it might tell you something.

Why can't you unlock the bootloader?
Or are you concerned about root detection?

Kisuke-CZE · 12-21-2025, 09:18 AM

Palma 2 Pro just does not accept those commands in fastboot mode.
Fastboot boot rec.img ends up with error. Something like "unrecognized command" I think. It just does not accept boot or flash commands

Also fastboot oem unlock and fastboot flashing unlock just fails.

Also disabling that verification from ADB does not work

Code:

adb disable-verity 
/system/bin/sh: disable-verity: inaccessible or not found

I just do not know how to unlock bootloader on this device.
I've contacted Boox and their response was:

Quote:

We are unable to provide information about unlocking the device's bootloader. In this case, you can submit feedback via "Settings" > "Feedback" > "+" on your device. Our tech team will get back to you on the feedback system as soon as possible.

So I tried that feedback option. I think they will just say no or something

But no response so far.

Renate · 12-21-2025, 10:31 AM

I mean, you've got full EDL.
There must be some way to beat this into submission.
Worst comes to worst we can patch the abl.
But that's a bunch of work and I wouldn't even try unless I had one of these in my hands.

You are able to restore it to stock when you're bored, right?

I see that the Palma (1) is selling for 160 € now
That's almost worth buying to play with the BSR series.
I hadn't realized that the Palma2Pro is the first cell capable device.

dcarvil · 12-21-2025, 11:21 AM

Quote:

Originally Posted by Kisuke-CZE

Palma 2 Pro just does not accept those commands in fastboot mode.
Fastboot boot rec.img ends up with error. Something like "unrecognized command" I think. It just does not accept boot or flash commands

Also fastboot oem unlock and fastboot flashing unlock just fails.

Also disabling that verification from ADB does not work

Code:

adb disable-verity 
/system/bin/sh: disable-verity: inaccessible or not found

I just do not know how to unlock bootloader on this device.
I've contacted Boox and their response was:

So I tried that feedback option. I think they will just say no or something

But no response so far.

An unlocked bootloader is a prerequisite for booting a modified kernel.

Boox has removed the boot and flash commands from fastboot in recent updates. You likely have a crippled fastboot.

Renate · 12-21-2025, 11:53 AM

Quote:

Originally Posted by dcarvil

An unlocked bootloader is a prerequisite for booting a modified kernel.

Boox has removed the boot and flash commands from fastboot in recent updates. You likely have a crippled fastboot.

I have a grayed-out "OEM unlocking" on my Go6.
But I get:

Code:

fastboot getvar unlocked
unlocked: yes

Yes, the utility of fastboot in the abl has been chopped down.

@Kisuke-CZE
Please check in fastboot your unlock status.
Please link, post or pm your abl_b (since _b is newer).

Kisuke-CZE · 12-21-2025, 02:03 PM

I do have active "OEM Unlocking" in hidden Adnroid settings (via non-Onyx launcher)

But it does nothing.
When enabled, in fastboot getvar all there is still:

Code:

(bootloader) unlocked:no

I was thinking that unlocking bootloader will disable those checks and probably patched boot will work after that. I take it as disabling Secure Boot on computer, but maybe I am wrong.

Quote:

Originally Posted by Renate

I hadn't realized that the Palma2Pro is the first cell capable device.

That is the reason I bought the device to play with it. The beast is capable of outgoing calls and receiving SMS (only GSM) out of the box. So I was thinking maybe there is a possibility to make it receive calls too.

dcarvil · 12-21-2025, 03:41 PM

Quote:

Originally Posted by Kisuke-CZE

I do have active "OEM Unlocking" in hidden Adnroid settings (via non-Onyx launcher)

But it does nothing.
When enabled, in fastboot getvar all there is still:

Code:

(bootloader) unlocked:no

I was thinking that unlocking bootloader will disable those checks and probably patched boot will work after that. I take it as disabling Secure Boot on computer, but maybe I am wrong.

That is the reason I bought the device to play with it. The beast is capable of outgoing calls and receiving SMS (only GSM) out of the box. So I was thinking maybe there is a possibility to make it receive calls too.

On my phone, it takes more than toggling "OEM unlocking" to unlock the bootloader. After "OEM unlocking" is on, I must execute "fastboot flashing unlock", or "fastboot oem unlock" (depending on device) to do the actual unlocking. I suspect a similar command is needed to unlock Onyx devices. Unfortunately I don't remember what I did to unlock my NoteAir3 years ago.

sasone · 12-24-2025, 03:30 AM

Quote:

Originally Posted by Renate

...
I made some patches for the original NST, NSTG.
This included font sizes in com.bn.nook.reader.commonui.ReaderCommonUIConstant s
The largest stock font sizes were absurdly large. (See chart.)
...
> I like more font sizes, like 17 here.

https://www.mobileread.com/forums/sh...d.php?t=367791
.

Hi @Renate,
In the other thread, you mentioned you have made patch for better font size gradient for NST. Could you please share the link to that patch.

BTW, I have rooted NST with Phase2 mod firmware of the Phoenix project.
https://xdaforums.com/t/nst-g-the-ph...oject.4673934/

(Sorry, this is off-topic for this thread. I didn't find any other way to connect.)

zenarch · Yesterday, 09:43 AM

Quote:

Originally Posted by Kisuke-CZE

I also ended with "bricked" Palma for some time (after flashing magisked boot_b.img) booting only into fastboot mode (Boox logo on screen stuck). And unbricked the palma flashing back original boot image.

THANK YOU for this un-bricking guide. I tried to root my Palma 2 Pro using the Palma 2 guide, because I didn't read carefully, and of course it wouldn't boot afterwards. Your guide got it back working as it did before.

Renate · Yesterday, 10:22 AM

Quote:

Originally Posted by dcarvil

On my phone, it takes more than toggling "OEM unlocking" to unlock the bootloader. After "OEM unlocking" is on, I must execute "fastboot flashing unlock", or "fastboot oem unlock" (depending on device) to do the actual unlocking. I suspect a similar command is needed to unlock Onyx devices. Unfortunately I don't remember what I did to unlock my NoteAir3 years ago.

The PalmaPro2 doesn't have hardly any commands in fastboot.
There's none for flashing, unlocking or direct boot of an image.
That's the problem that I'm currently working on.

Kisuke-CZE · Yesterday, 02:51 PM

@zenarch: Well some time after that I find it can be lot worse

If you are experimenting, buying some pre-made EDL cable is probably good idea (You can make one with some soldering from any USB cable, but it just about $10 and it will make things easier when things go wrong).

Anyway, did someone here already got that 2025-12-22_15-51_4.1.1-rel_1222_1b15acb55 update? Nothing so far here.
Getting link to the update could be also good.

Renate · Yesterday, 03:11 PM

Nope. I haven't seen it.

I've battled all day with UEFI.
I guess that I was lucky all the other times that I patched abl's.
I finally got a patched abl to run on my Go6.

12-21-2025, 07:51 AM	#18
Kisuke-CZE Member Posts: 21 Karma: 50000 Join Date: Apr 2018 Device: Kobo Forma, Onyx Boox Palma 2 Pro	Tested numerous combinations but Palma just refuses to boot to anything but fastboot if there is any modification done it seem. Flashing clear vbmeta does not help. In fact, when I have everything original and device boots (into android or stock recovery). When I flash just empty vbmeta with this command: Code: edl --loader=palma2pro.bin --memory=ufs w vbmeta_b vbmeta_empty.bin Device refuses to boot. I am starting to believe that rooting without unlocked bootloader might not be possible.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Palma 2 Pro Notes App ?	itsme2020	Onyx Boox	7	12-20-2025 02:20 PM
Palma 3 in 2025?	norweger	Onyx Boox	10	04-13-2025 12:10 PM
Palma 2 Released	twowheels	Onyx Boox	62	01-10-2025 05:18 AM
Rooting: Onyx Boox Note Pro - Build 2019-06-12	hansipansi65	Onyx Boox	12	01-25-2020 03:52 AM
Rooting the Poke Pro	bel3atar	Onyx Boox	13	04-14-2019 10:49 PM

12-20-2025, 02:02 PM	#16
Kisuke-CZE Member Posts: 21 Karma: 50000 Join Date: Apr 2018 Device: Kobo Forma, Onyx Boox Palma 2 Pro	Hi, thanks for helping. Tried your image and device refuses to boot it. I wrote it to recovery_b. Then the device booted normally into Android. But since I tried to boot into recovery (regardles if it was button combination or adb reboot recovery), it started to refusing to boot. Not only into recovery, but also to Adnroid (which worked after new recovery was written). I had to write back original recovery. Then (it was starting directly to fastboot until this) I had to do that trick with setting activeslot to A and then back to B again to make device boot again. It seem there is some check. After I write some modified image (boot or recovery), device tries to boot it first time. Then probably refuses it, because it vibrates and does reboot. After this first reboot device never tries to start from that slot again and goes directly into fastboot mode without trying. Even after flashing to original state, it just goes directly into fastboot mode. Until I do that procedure with swapping activeslot.

12-21-2025, 08:39 AM	#19
Renate Onyx-maniac Posts: 4,204 Karma: 19345881 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	There are usually two places where the mounting/verification are specified, in the DTB and in the fstab. For recovery, that's system/etc/recovery.fstab Of course the boot image is not in the fstab. You can try from fastboot: "fastboot boot rec.img" That's sometimes problematical but it might tell you something. Why can't you unlock the bootloader? Or are you concerned about root detection?

12-21-2025, 10:31 AM	#21
Renate Onyx-maniac Posts: 4,204 Karma: 19345881 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	I mean, you've got full EDL. There must be some way to beat this into submission. Worst comes to worst we can patch the abl. But that's a bunch of work and I wouldn't even try unless I had one of these in my hands. You are able to restore it to stock when you're bored, right? I see that the Palma (1) is selling for 160 € now That's almost worth buying to play with the BSR series. I hadn't realized that the Palma2Pro is the first cell capable device.

Yesterday, 02:51 PM	#29
Kisuke-CZE Member Posts: 21 Karma: 50000 Join Date: Apr 2018 Device: Kobo Forma, Onyx Boox Palma 2 Pro	@zenarch: Well some time after that I find it can be lot worse If you are experimenting, buying some pre-made EDL cable is probably good idea (You can make one with some soldering from any USB cable, but it just about $10 and it will make things easier when things go wrong). Anyway, did someone here already got that 2025-12-22_15-51_4.1.1-rel_1222_1b15acb55 update? Nothing so far here. Getting link to the update could be also good.

Yesterday, 03:11 PM	#30
Renate Onyx-maniac Posts: 4,204 Karma: 19345881 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Nope. I haven't seen it. I've battled all day with UEFI. I guess that I was lucky all the other times that I patched abl's. I finally got a patched abl to run on my Go6.