Palma 2 Pro - rooting?

[Renate]

Are we having fun yet?

flatten /v abl /d
32 bit ELF
0000  ZERO
0010  FSS2
0020  Length  00022000
0028  Sig     _FVH
002c  Attr    0003feff
0030  HdrLen  0048
0032  Check   d3be -> 0000
0034  ExtHdr  0000
0037  Vers    2
0038  Blocks  000110 x 0200 -> 00022000
0048  IMG
0058  Check   16 -> 00
005c  Size1   01ebc0
0060  Size2   01eba8
0064  LZMA
----------
0008  ZERO
0018  FSS2
0028  Length  0006a0c0
0030  Sig     _FVH
0034  Attr    0003feff
0038  HdrLen  0048
003a  Check   3ae7 -> 0000
003c  ExtHdr  0060
003f  Vers    2
0040  Blocks  001a83 x 0040 -> 0006a0c0
0050  ONES
0068  QCOM
0080  APP1
009c  LL
00b8  MZ
0f10  PE
10b8  Code

[darkwill]

I found someone managed to root Palma 2 Pro by flashing fairphone images to get the fastboot unlock commands working.

https://github.com/jdkruzr/BooxPalma2RootGuide/issues/9

[Kisuke-CZE]

Oh, thank you guys very much. Last comment put me on right track. My Palma 2 Pro is now unlocked and rooted.

Working procedure is this.

BEWARE - THIS PROCEDURE WILL WIPE YOUR DATA!

Preparing tools

Get edl utility

Get Palma loader file for EDL utility:

wget -O palma2pro.bin 'https://github.com/bkerler/Loaders/raw/refs/heads/main/lenovo_motorola/0000000000000000_bdaf51b59ba21d8a_fhprg.bin'

Get latest available eOS build for Fairphone 4 Android 15 from eOS site. I used this specifically.

From that Fairphone 4 image, extract abl.img somewhere. I will reference it as abl-fp4.img in the process.

Reboot phone into bootloader with

adb reboot bootloader

then issue

fastboot getvar current-slot

Note down that letter. For me it was and rest of the guide I will be using slot `a`. Do adjust those commands for your active slot.

Backing up data

Put the device into EDL mode with

adb reboot edl

Now do the backup of the device. Best way how to do that is backing up all partitions.
This takes about 1 hour and backup is about 128GB in size.
It is optional, but highly recommended. Can be done with command (folder stock_partitions_backup must exists):

edl --loader=palma2pro.bin --memory=ufs rl stock_partitions_backup/

Now let's backup the important stuff only. This cannot be skipped:

mkdir stock_backup
edl --loader=palma2pro.bin --memory=ufs r devinfo stock_backup/devinfo.img
edl --loader=palma2pro.bin --memory=ufs r boot_a stock_backup/boot_a.img
edl --loader=palma2pro.bin --memory=ufs r boot_b stock_backup/boot_b.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_a stock_backup/vbmeta_a.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_b stock_backup/vbmeta_b.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_system_a stock_backup/vbmeta_system_a.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_system_b stock_backup/vbmeta_system_b.img
edl --loader=palma2pro.bin --memory=ufs r recovery_a stock_backup/recovery_a.img
edl --loader=palma2pro.bin --memory=ufs r recovery_b stock_backup/recovery_b.img
edl --loader=palma2pro.bin --memory=ufs r abl_a stock_backup/abl_a.img
edl --loader=palma2pro.bin --memory=ufs r abl_b stock_backup/abl_b.img

Unlocking bootloader

Unfortunately Boox firmware does not allow unlocking device. But since hardware is similar to Fairphone 4 we will take Fairphone image to help.

Get into edl mode again with

adb reboot edl

Then issue those commands to write FP4 ABL into Palma (not sure why, but for me it was needed to write into both slots):

edl --loader=palma2pro.bin --memory=ufs w abl_a abl-fp4.img
edl --loader=palma2pro.bin --memory=ufs w abl_b abl-fp4.img

Now use your activeslot you noted before (my palma was not booting without this) and reboot device:

edl --loader=palma2pro.bin setactiveslot a
edl --loader=palma2pro.bin reset

Go into android settings.

Select System submenu.

Then select Developer options.

In those go to Developer options enable OEM unlocking.

Reboot the device.

Now we will proceed to unlocking bootloader. Your data will be WIPED from the device. There is no going back! Ready?

Reboot into bootloader with

adb reboot bootloader

You should get BOOX logo on screen and command

fastboot devices

should see the device.

Issue

fastboot flashing unlock

to begin unlocking.

On screen there will still bee BOOX logo, nothing visible.
Press Vol Up once, and then Power button.
Now device will automatically reboot few times and wipes all your data.

Now you are with clear device in defaults. Enable ADB in settings again. And issue

adb reboot bootloader

Issue

fastboot flashing unlock_critical

AGAIN: On screen there will still bee BOOX logo, nothing visible.
Press Vol Up once, and then Power button.
Device will automatically reboot few times and wipes all your data once again.

Now you have unlocked device.
Issuing fastboot oem device-info should say something like:

(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: true
(bootloader) Charger screen enabled: true

Rooting with Magisk

From now the rooting procedure can be done as on Palma 2.

Install Magisk to your Palma

Push your backed up boot image for your activeslot onto Palma

adb push stock_backup/boot_a.img /sdcard/

Patch the boot image using Magisk in your phone. Note the filename and use it in next command.

Then download it back to your computer

adb pull /sdcard/Download/magisk_patched-30600_x1Hl9.img boot_a_patched.img

Reboot Palma into EDL mode

adb reboot edl

Write modified image into Palma and reboot it:

edl --loader=palma2pro.bin --memory=ufs w boot_a boot_a_patched.img
edl --loader=palma2pro.bin reset

Congrats! Your Palma is rooted now!

If you want, you can now flash back the stock ABL images back into Palma.
I do recommend it, because without it, device was kinda unstable and for example launching Onyx settings from top-tray did not worked (after flashing original ABL it did worked)

edl --loader=palma2pro.bin --memory=ufs w abl_a stock_backup/abl_a.img
edl --loader=palma2pro.bin --memory=ufs w abl_b stock_backup/abl_b.img

Procedure is described in Github repository.

[Kisuke-CZE]

Hi,

I am trying to continue in mission of modifying Palma 2 Pro.

My thinking was, that maybe I could make it reliable phone for incoming calls. So I am trying to replace various components from Palma 2 Pro software with software from FP4.

I am using magic_overlayfs to be able to write into /system partition.

But I did run into another problem. When I replace system app, it refuses to function.

For example replacing TeleService app:

adb push ../apk_from_fairphone/TeleService.* /tmp/
adb shell
su -mm -c magic_remount_rw
su
cp /tmp/TeleService.apk /system/priv-app/TeleService/TeleService.apk
cp /tmp/TeleService.odex /system/priv-app/TeleService/oat/arm64/TeleService.odex
cp /tmp/TeleService.vdex /system/priv-app/TeleService/oat/arm64/TeleService.vdex
su -mm -c magic_remount_ro
exit
exit
adb reboot

Unfortunately on next boot it does not work. Ends up with this error:

12-29 15:17:29.359  7481  7481 E System  : ******************************************
12-29 15:17:29.359  7481  7481 E System  : ************ Failure starting system services
12-29 15:17:29.359  7481  7481 E System  : java.lang.IllegalStateException: Signature mismatch on system package com.android.phone for shared user SharedUserSetting{ee5270f android.uid.phone/1001}
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.pm.ReconcilePackageUtils.reconcilePackages(ReconcilePackageUtils.java:284)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.pm.InstallPackageHelper.addForInitLI(InstallPackageHelper.java:3960)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.pm.InstallPackageHelper.installPackagesFromDir(InstallPackageHelper.java:3704)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.pm.InitAppsHelper.scanDirTracedLI(InitAppsHelper.java:377)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.pm.InitAppsHelper.scanSystemDirs(InitAppsHelper.java:345)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.pm.InitAppsHelper.initSystemApps(InitAppsHelper.java:178)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.pm.PackageManagerService.<init>(PackageManagerService.java:2292)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:1763)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.SystemServer.startBootstrapServices(SystemServer.java:1259)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.SystemServer.run(SystemServer.java:945)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.server.SystemServer.main(SystemServer.java:666)
12-29 15:17:29.359  7481  7481 E System  : 	at java.lang.reflect.Method.invoke(Native Method)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:580)
12-29 15:17:29.359  7481  7481 E System  : 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:870)
12-29 15:17:29.359  7481  7481 E Zygote  : System zygote died with fatal exception
12-29 15:17:29.359  7481  7481 E Zygote  : java.lang.IllegalStateException: Signature mismatch on system package com.android.phone for shared user SharedUserSetting{ee5270f android.uid.phone/1001}
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.pm.ReconcilePackageUtils.reconcilePackages(ReconcilePackageUtils.java:284)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.pm.InstallPackageHelper.addForInitLI(InstallPackageHelper.java:3960)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.pm.InstallPackageHelper.installPackagesFromDir(InstallPackageHelper.java:3704)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.pm.InitAppsHelper.scanDirTracedLI(InitAppsHelper.java:377)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.pm.InitAppsHelper.scanSystemDirs(InitAppsHelper.java:345)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.pm.InitAppsHelper.initSystemApps(InitAppsHelper.java:178)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.pm.PackageManagerService.<init>(PackageManagerService.java:2292)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:1763)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.SystemServer.startBootstrapServices(SystemServer.java:1259)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.SystemServer.run(SystemServer.java:945)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.server.SystemServer.main(SystemServer.java:666)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at java.lang.reflect.Method.invoke(Native Method)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:580)
12-29 15:17:29.359  7481  7481 E Zygote  : 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:870)
12-29 15:17:29.359  7481  7481 D AndroidRuntime: Shutting down VM
12-29 15:17:29.359  7481  7481 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main

I will try to search for some answers. But maybe there will be again someone smarter who did this in past.

[amperage4255]

Originally Posted by Kisuke-CZE

Oh, thank you guys very much. Last comment put me on right track. My Palma 2 Pro is now unlocked and rooted.

Working procedure is this.

BEWARE - THIS PROCEDURE WILL WIPE YOUR DATA!

Preparing tools

Get edl utility

Get Palma loader file for EDL utility:

wget -O palma2pro.bin 'https://github.com/bkerler/Loaders/raw/refs/heads/main/lenovo_motorola/0000000000000000_bdaf51b59ba21d8a_fhprg.bin'

Get latest available eOS build for Fairphone 4 Android 15 from eOS site. I used this specifically.

From that Fairphone 4 image, extract abl.img somewhere. I will reference it as abl-fp4.img in the process.

Reboot phone into bootloader with

adb reboot bootloader

then issue

fastboot getvar current-slot

Note down that letter. For me it was and rest of the guide I will be using slot `a`. Do adjust those commands for your active slot.

Backing up data

Put the device into EDL mode with

adb reboot edl

Now do the backup of the device. Best way how to do that is backing up all partitions.
This takes about 1 hour and backup is about 128GB in size.
It is optional, but highly recommended. Can be done with command (folder stock_partitions_backup must exists):

edl --loader=palma2pro.bin --memory=ufs rl stock_partitions_backup/

Now let's backup the important stuff only. This cannot be skipped:

mkdir stock_backup
edl --loader=palma2pro.bin --memory=ufs r devinfo stock_backup/devinfo.img
edl --loader=palma2pro.bin --memory=ufs r boot_a stock_backup/boot_a.img
edl --loader=palma2pro.bin --memory=ufs r boot_b stock_backup/boot_b.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_a stock_backup/vbmeta_a.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_b stock_backup/vbmeta_b.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_system_a stock_backup/vbmeta_system_a.img
edl --loader=palma2pro.bin --memory=ufs r vbmeta_system_b stock_backup/vbmeta_system_b.img
edl --loader=palma2pro.bin --memory=ufs r recovery_a stock_backup/recovery_a.img
edl --loader=palma2pro.bin --memory=ufs r recovery_b stock_backup/recovery_b.img
edl --loader=palma2pro.bin --memory=ufs r abl_a stock_backup/abl_a.img
edl --loader=palma2pro.bin --memory=ufs r abl_b stock_backup/abl_b.img

Unlocking bootloader

Unfortunately Boox firmware does not allow unlocking device. But since hardware is similar to Fairphone 4 we will take Fairphone image to help.

Get into edl mode again with

adb reboot edl

Then issue those commands to write FP4 ABL into Palma (not sure why, but for me it was needed to write into both slots):

edl --loader=palma2pro.bin --memory=ufs w abl_a abl-fp4.img
edl --loader=palma2pro.bin --memory=ufs w abl_b abl-fp4.img

Now use your activeslot you noted before (my palma was not booting without this) and reboot device:

edl --loader=palma2pro.bin setactiveslot a
edl --loader=palma2pro.bin reset

Go into android settings.

Select System submenu.

Then select Developer options.

In those go to Developer options enable OEM unlocking.

Reboot the device.

Now we will proceed to unlocking bootloader. Your data will be WIPED from the device. There is no going back! Ready?

Reboot into bootloader with

adb reboot bootloader

You should get BOOX logo on screen and command

fastboot devices

should see the device.

Issue

fastboot flashing unlock

to begin unlocking.

On screen there will still bee BOOX logo, nothing visible.
Press Vol Up once, and then Power button.
Now device will automatically reboot few times and wipes all your data.

Now you are with clear device in defaults. Enable ADB in settings again. And issue

adb reboot bootloader

Issue

fastboot flashing unlock_critical

AGAIN: On screen there will still bee BOOX logo, nothing visible.
Press Vol Up once, and then Power button.
Device will automatically reboot few times and wipes all your data once again.

Now you have unlocked device.
Issuing fastboot oem device-info should say something like:

(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: true
(bootloader) Charger screen enabled: true

Rooting with Magisk

From now the rooting procedure can be done as on Palma 2.

Install Magisk to your Palma

Push your backed up boot image for your activeslot onto Palma

adb push stock_backup/boot_a.img /sdcard/

Patch the boot image using Magisk in your phone. Note the filename and use it in next command.

Then download it back to your computer

adb pull /sdcard/Download/magisk_patched-30600_x1Hl9.img boot_a_patched.img

Reboot Palma into EDL mode

adb reboot edl

Write modified image into Palma and reboot it:

edl --loader=palma2pro.bin --memory=ufs w boot_a boot_a_patched.img
edl --loader=palma2pro.bin reset

Congrats! Your Palma is rooted now!

If you want, you can now flash back the stock ABL images back into Palma.
I do recommend it, because without it, device was kinda unstable and for example launching Onyx settings from top-tray did not worked (after flashing original ABL it did worked)

edl --loader=palma2pro.bin --memory=ufs w abl_a stock_backup/abl_a.img
edl --loader=palma2pro.bin --memory=ufs w abl_b stock_backup/abl_b.img

Procedure is described in Github repository.

Would this also be a viable solution for the Air 4C, I am currently stuck using what appears to be a old github for root instruction. Any assistance is much appreciated. I just want to debloat my boox so it doesn't sound off on the internet.

Thank you

[Kisuke-CZE]

Regarding using system apps from different device.

I got little bit further. Found all apps that shares sharedUserId="android.uid.phone"
Replaced them.

But id does not work (but I kinda expected that after reading something about it).
Palma now accepts the package itself. But it won't grant them privileged permissions protected by signature (unless packages are signed with some correct keys used to build system - so Onyx keys).

Error at boot is following:

12-31 17:29:55.809  1484  1484 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
12-31 17:29:55.809  1484  1484 E AndroidRuntime: java.lang.IllegalStateException: Signature|privileged permissions not in privileged permission allowlist: {com.android.stk (/system/app/Stk): android.permission.RECEIVE_STK_COMMANDS, com.android.stk (/system/app/Stk): android.permission.REAL_GET_TASKS, com.qualcomm.atfwd (/system_ext/app/atfwd): android.permission.MASTER_CLEAR, com.qti.qualcomm.deviceinfo (/system_ext/app/DeviceInfo): android.permission.CONTROL_INCALL_EXPERIENCE, com.android.stk (/system/app/Stk): android.permission.USER_ACTIVITY, com.android.stk (/system/app/Stk): android.permission.SUBSTITUTE_NOTIFICATION_APP_NAME, com.qualcomm.qti.uceShimService (/system_ext/app/uceShimService): android.permission.READ_PRIVILEGED_PHONE_STATE, com.android.stk (/system/app/Stk): android.permission.START_ACTIVITIES_FROM_BACKGROUND}
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.server.permission.access.permission.AppIdPermissionPolicy.onSystemReady(AppIdPermissionPolicy.kt:1625)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.server.permission.access.AccessPolicy.onSystemReady(AccessPolicy.kt:275)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.server.permission.access.AccessCheckingService.onSystemReady$frameworks__base__services__permission__android_common__services_permission_pre_jarjar(AccessCheckingService.kt:239)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.server.permission.access.permission.PermissionService.onSystemReady(PermissionService.kt:2295)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.server.pm.permission.PermissionManagerService$PermissionManagerServiceInternalImpl.onSystemReady(PermissionManagerService.java:772)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.server.pm.PackageManagerService.systemReady(PackageManagerService.java:4285)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.server.SystemServer.startOtherServices(SystemServer.java:2981)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.server.SystemServer.run(SystemServer.java:947)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.server.SystemServer.main(SystemServer.java:666)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at java.lang.reflect.Method.invoke(Native Method)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:580)
12-31 17:29:55.809  1484  1484 E AndroidRuntime: 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:870)

There is probably no easy way around this. Nothing I know of.

Only option I found reading some docs is to build whole Android for Palma using some generated keys. And then sign the packages with those keys.
That would mean create custom ROM.
That is outside of my skills.