Note Air 5c

[Kisuke-CZE]

For me it is.
- Issue fastboot reboot
- Screens flashes (goes completely white)
- I immediatelly press and hold vol up + vol down
- After few seconds, there is BOOX logo on screen (still holding)
- I release the the keys few seconds after boox logo appears
- I got new device recognized on computer with ID=9008

[darkwill]

Tried those steps, but just goes back to D00D. Tried other variants of holding the keys right after, waiting for blanking out etc.
The entire reboot cycle is very fast, under 8 seconds. The PC detects fastboot within a second or so of the Box logo reappearing on the screen.

[darkwill]

OK after a few tries with EDL cable (and starting from a completely dead battery) I was finally able to get into EDL. It's finicky for sure but I got the hang of it.

I carefully wrote the original images, but as you had described it refused to boot up. I had to switch the slot, reset, then switch back, reset and lo and behold I saw the recovery menu. For the first time in over a week. Finally it's not a paperweight anymore.

I guess now someone smarter than me could get an abl which will allow unlocking and flashing patched images with disabled checks. Not sure if the Freephone abl can work here but I'm past the dead paperweight stage so will put that thought aside for a few... weeks until I'm feeling brave.

Tomorrow maybe I'll install a different launcher and then try to get into android settings and developer mode. I don't see a way to get there with stock launcher.

[darkwill]

Oh one more thing. While I was initially trying to get into EDL mode, I kept running into "NotImplementedError: Operation not supported or unimplemented on this platform" even though it was showing up in 9008.

This could have been due to battery being dead and it happened a few times before it finally succeeded in letting me put the device in firehose (by then battery got to 4%). Just a tip for those who might try this, keep battery somewhat charged.

Lastly it's impossible to shut the device down entirely when it's "bricked". To get to EDL I had to reboot using fastboot, immediately swap to EDL cable and do the cable thing. Took a few tries.

Hope these help someone! I'll keep watching the forum and posting my adventures.

[Kisuke-CZE]

If the device uses same loader file as Palma 2 Pro, it could work.

With that EDL cable you should always have return ticket.

But maybe you do not even need root access. It is usually about having control over device and doing some crazy stuff (like replacing system packages, using some actions in MacroDroid, ...)

[darkwill]

My biggest use case is to use AFWall to block all Onyx traffic. At my home I can do that with my managed switch and pihole, but that won't work elsewhere.

With all the packages you disabled, can you make it behave as a plain google device, instead of Onyx's?

[Ouro003]

Hi Gang, I feel rather idiotic. I went through a similar process for the Palma 2, as this thread discussed—booting with magisk, however the backup i made on my PC i cannot find for the life of me. I have surely learned my lesson. I've tried to navigate via fastboot, add, and recovery, as I do have a backup of the boot physically on ny device in the userdate portion of my device (from the magisk patch), but I cannot access it. My device is currently in a bootloader, and I've tried all the means I've could to resolve it. If anyone has a backup of the boot, or any suggestions on accessing at the adb level. Thank you!

[dcarvil]

Originally Posted by Ouro003

Hi Gang, I feel rather idiotic. I went through a similar process for the Palma 2, as this thread discussed—booting with magisk, however the backup i made on my PC i cannot find for the life of me. I have surely learned my lesson. I've tried to navigate via fastboot, add, and recovery, as I do have a backup of the boot physically on ny device in the userdate portion of my device (from the magisk patch), but I cannot access it. My device is currently in a bootloader, and I've tried all the means I've could to resolve it. If anyone has a backup of the boot, or any suggestions on accessing at the adb level. Thank you!

If you can get to adb, run these commands:

adb shell find sdcard/ -type f -name "*.img"
adb pull xxx (xxx = the result from the first command)

[Ouro003]

Originally Posted by dcarvil

If you can get to adb, run these commands:

adb shell find sdcard/ -type f -name "*.img"
adb pull xxx (xxx = the result from the first command)

I'm trying to find a way to get into the adb settings through recovery �� It won't boot recovery, which tracks with OPS previous issues. I will say though, I have an update.upx file and I've been analyzing the libota_jni.so files, along with a few other. I have found the obfuscated keys to the device. Currently as it stands I'm trying to deobfuscate it, which may work. The obfuscation the boox devs have been using is relatively complex in recent devices from what I've seen and read. I've tried modifying the misc.bin file as well to redirect me to recovery, to no avail either. I've modified the bricked magisk img to direct me there too, no avail. I think it has to do with the verity and the truncated fastboot the note 5 has. This has been a stress to deal with, but honestly this has been very educational for me so I don't entirely regret this lollll. To make it clear, I have a backup of all these filles, I literally just messed up my only copy of the boot img file ��

[darkwill]

Check DM!

[AuroraWright]

For what it's worth, Fairphone 4 abl does boot on the Note5C and you can reboot into fastboot and trigger the unlocking process (you can actually see the fastboot menu and then the unlock prompt) but it seems the volume buttons aren't mapped the same way as on the Fairphone so the prompt is completely unresponsive and you can't actually unlock (so close!). Tried blindly pressing any combination of them, but no dice.
If anyone has any ideas I'm open to testing as I have an EDL cable too (already checked it's working fine)

[Renate]

Yes, the Fairphone abl might be some kind of solution, but maybe not optimal and probably not a way to move forward if this becomes a problem on other models.

You can flash whatever you like from EDL.
The (unresolved) question is whether there is still a problem with Verified Boot.

Who has tried to flash a boot image with EDL and what was the result?

[AuroraWright]

Originally Posted by Renate

Yes, the Fairphone abl might be some kind of solution, but maybe not optimal and probably not a way to move forward if this becomes a problem on other models.

You can flash whatever you like from EDL.
The (unresolved) question is whether there is still a problem with Verified Boot.

Who has tried to flash a boot image with EDL and what was the result?

I think this thread's OP tried doing that and bricked. Probably a way would be finding out where the bootloader unlock flag is (according to the github discussion it should be somewhere on the FRP partition) and then reflash that through EDL.