Go 7 attempted root and now stuck on boox logo

[jd27]

Unfortunately I didnt make a full backup before I started this - my backup was only of boot_a and boot_b.

Would a full backup from someone else work? And if so, is there someoene who is willing to share this with me?

[Renate]

Well, you can get the update, decrypt it and extract the stock recovery.

[doomgoatman]

Hey all, following up on this thread. Current state after following the recovery path from this thread and the BooxPalma2RootGuide issue #9:

FP4 ABL flashed to abl_a/abl_b via EDL: fastboot commands work
frp_oemunlock flashed + devinfo wiped: bootloader shows Device unlocked: true
Stock recovery flashed to recovery_a/recovery_b
misc-recovery.img flashed to misc
Device boots into recovery: shows as 18d1:d001 "Go7" (ADB sideload mode) in USB

The problem: adb sideload update.zip fails with "device unauthorized." The e-ink screen is completely blank so I can't approve the USB debugging dialog. Set ADB_VENDOR_KEYS to my local key: still unauthorized.

I think I need the custom go7-rec.img that jd27 referenced in post #25?

[doomgoatman]

Kept trying, was able to recover without the go7-rec.img. Go 7 (B/W) is recovered.
Flashing original boot images back via EDL did not fix it.

What worked:

EDL cable to get back into 9008 mode (no software path from fastboot to EDL exists on this device)
Flashed FP4 ABL, frp_oemunlock, stock boot/recovery from decrypted 4.1.1 firmware, and Renate's misc-recovery via EDL
Erased devinfo partition (frp_oemunlock alone was not enough to unlock, devinfo wipe was required)
fastboot reboot recovery from the now-functional FP4 ABL
Recovery screen rendered on e-ink. Page turn buttons work as volume up/down. Selected "Factory data reset"
Device booted. Restored stock ABL/FRP/devinfo from backups via EDL.

For anyone else in this situation: buy an EDL cable. It's the only way back in once you're stuck in fastboot with the locked stock bootloader. I used bkerler's Python edl tool from WSL2 since Windows fastboot had persistent driver issues with this device.

[doomgoatman]

Scratch that, restoring the stock ABL/FRP/devinfo from backups via EDL trapped me at the Boox logo screen again.

[doomgoatman]

Follow-up to my recovery post. Device is back and stable with FP4 ABL, unlocked bootloader, stock everything else. Now trying to actually root.

The problem: Magisk-patched boot images do not boot on the Go 7, regardless of method.

• fastboot boot magisk_patched.img hangs at Boox logo indefinitely. Device eventually falls back to fastboot or EDL. Stock boot.img boots fine via fastboot boot.

• Flashing patched images to boot_a/boot_b via EDL (what originally bricked me) also results in a hang at the Boox logo.

• Patched with Magisk v30.7 against the stock boot.img extracted from the decrypted 4.1.1 firmware.

• Bootloader is unlocked (Device unlocked: true, Device critical unlocked: true) via FP4 ABL + frp_oemunlock + devinfo wipe.

So the unlock and fastboot functionality all work. The device just refuses to run a Magisk-patched boot image.

[dcarvil]

Originally Posted by doomgoatman

Follow-up to my recovery post. Device is back and stable with FP4 ABL, unlocked bootloader, stock everything else. Now trying to actually root.

The problem: Magisk-patched boot images do not boot on the Go 7, regardless of method.

• fastboot boot magisk_patched.img hangs at Boox logo indefinitely. Device eventually falls back to fastboot or EDL. Stock boot.img boots fine via fastboot boot.

• Flashing patched images to boot_a/boot_b via EDL (what originally bricked me) also results in a hang at the Boox logo.

• Patched with Magisk v30.7 against the stock boot.img extracted from the decrypted 4.1.1 firmware.

• Bootloader is unlocked (Device unlocked: true, Device critical unlocked: true) via FP4 ABL + frp_oemunlock + devinfo wipe.

So the unlock and fastboot functionality all work. The device just refuses to run a Magisk-patched boot image.

Boox firmware 4.1.1 broke Magisk. See this for a possible fix:

https://github.com/jdkruzr/BooxPalma...ent-3864465804

[doomgoatman]

Got the Go 7 (B/W) rooted. Documenting the full process here for anyone else who wants to attempt it.

WHAT YOU NEED:
- EDL cable (Qualcomm 9008 deep flash cable with button). Not optional.
- FairPhone 4 ABL (abl.img from latest e/OS/ A15 build for FP4: https://doc.e.foundation/devices/FP4/install)
- fonix232's frp_oemunlock.img (from https://github.com/jdkruzr/BooxPalma2RootGuide/issues/9, Jan 13 comment)
- Renate's misc-recovery.prc (from this thread, post #3, rename to .img)
- Decrypted Go7 4.1.1 firmware (decrypt the .upx with https://github.com/Hagb/decryptBooxUpdateUpx, extract images with payload-dumper-go)
- EDL loader: 0000000000000000_bdaf51b59ba21d8a_fhprg.bin from https://www.temblast.com/ref/onyxldr.htm
- bkerler edl tool (https://github.com/bkerler/edl) running in WSL2. Windows fastboot was not able to consistently communicate with this device.
- Magisk APK and Termux APK
- Java, baksmali, and smali for the services.jar patch

PHASE 0: Download Firmware, Decrypt, and Extract Stock Images

Download

1. In your browser, navigate to:
   

   http://en-data.onyx-international.cn/api/firmware/update?where={"buildNumber":0,"buildType":"user","deviceMAC":"","lang":"en_US","model":"Go7","submodel":"","fingerprint":""}

2. The key you are looking for is

   "downloadUrlList": ...

3. Download the .upx file

Decrypt and extract

# Clone decryption tool
git clone https://github.com/Hagb/decryptBooxUpdateUpx.git
cd decryptBooxUpdateUpx
git submodule update --init --recursive

# Decrypt (Go7 keys are in BooxKeys.csv)
python3 DeBooxUpx.py Go7 /path/to/update.upx /path/to/update.zip

# Extract payload
unzip update.zip payload.bin

# Extract individual partition images
# Download payload-dumper-go from https://github.com/ssut/payload-dumper-go/releases
./payload-dumper-go -o stock_images payload.bin

PHASE 1: UNLOCK THE BOOTLOADER

The Go 7's stock bootloader is completely locked. All fastboot write commands return "unknown command." We need to replace it with the FairPhone 4 ABL which has full fastboot functionality.

Enter EDL Mode

1. Power off Go 7 completely (hold power 15+ seconds)
2. Plug in EDL cable, press/hold the button
3. Confirm "05c6:9008" appears in "usbipd list"

Attach USB to WSL

# Windows PowerShell (Admin)
usbipd bind --busid <BUSID>
usbipd attach --wsl --busid <BUSID>

Back up stock partitions

cd /path/to/edl
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r abl_a abl_a_backup.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r abl_b abl_b_backup.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r frp frp_backup.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r devinfo devinfo_backup.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r boot_a boot_a_backup.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r boot_b boot_b_backup.img

Note: bkerler edl reports Error:{} after every write at 100%. This is a false negative. Verify with read-back + sha256sum if concerned.

Flash unlocked bootloader stack

# Stock boot to both slots
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w boot_a stock_images/boot.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w boot_b stock_images/boot.img

# FairPhone 4 ABL to both slots
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w abl_a fp4/abl.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w abl_b fp4/abl.img

# Unlocked FRP
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w frp frp_oemunlock.img

# Stock recovery to both slots
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w recovery_a stock_images/recovery.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w recovery_b stock_images/recovery.img

# Misc-recovery to trigger recovery boot
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w misc misc-recovery.img

# Erase devinfo (required for unlock to take effect)
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc e devinfo

Boot into recovery and factory reset
Power cycle the device, it should enter fastboot. Attach to WSL via usbipd.
Check unlock status and reboot into recovery

fastboot oem device-info
# Should show: Device unlocked: true

fastboot reboot recovery

Recovery menu appears on e-ink screen. Page turn buttons navigate, power button selects. Select "Factory data reset". Device boots into Android.

WARNING: Do NOT restore the stock Boox ABL after this procedure. It will re-brick the device. The FP4 ABL must stay.

PHASE 2: PATCH BOOT WITH MAGISK

Install Magisk and Termux APKs on the device.

Patch the boot image
Copy "stock_images/boot.img" to the Go 7's Download folder via USB File Explorer.

On the Go 7:

1. Open Magisk
2. Tap Install
3. Select "Select and Patch a File"
4. Navigate to Download, select "boot.img"
5. Wait for patching to complete
6. Copy the resulting "magisk_patched-XXXXX.img" back to your PC via USB File Explorer.

Flash Patched Boot

1. Power off, plug in EDL cable, press button. Attach to WSL.
2. Flash Magisk-patched boot to slot A ONLY

   sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w boot_a magisk_patched-XXXXX.img
   sudo python3 edl.py --loader=go7_loader.bin reset

The device will boot into Android. Magisk's init runs but the Boox AMS bug will cause the Magisk app to freeze on splash and "su" to be inaccessible. This is expected and will be fixed in Phase 3.

Open Magisk, when Magisk opens for the first time, it shows a dialog: "Upgrade to full Magisk to finish the setup." Tap Install/OK. Let it download and complete. The app will freeze on splash after this. This is expected.

PHASE 3: FIX THE AMS BUG

This is the Boox WebView tracking bug in ActivityManagerService that crashes when it encounters Magisk's root daemon. Credit to dynamicfire for identifying this: https://github.com/dynamicfire/boox-ams-fix

The pre-built module from that repo will NOT work on the Go 7 because services.jar differs per device. You need to build your own.

Mount the stock system.img (read-only, from WSL):

cp stock_images/system.img /tmp/system.img
sudo mkdir -p /tmp/system_mount
sudo mount -t ext4 -o ro,loop /tmp/system.img /tmp/system_mount
cp /tmp/system_mount/system/framework/services.jar ./services.jar
sudo umount /tmp/system_mount

Disassemble:

# Download baksmali and smali
curl -sL -o baksmali.jar https://github.com/baksmali/smali/releases/download/v2.5.2/baksmali-2.5.2.jar
curl -sL -o smali.jar https://github.com/baksmali/smali/releases/download/v2.5.2/smali-2.5.2.jar

# Disassemble
unzip services.jar classes.dex
java -jar baksmali.jar d classes.dex -o smali_out

# Find the patch target
grep -n "addPackageDependency" smali_out/com/android/server/am/ActivityManagerService.smali

Open ActivityManagerService.smali. Find the addPackageDependency method. Locate the if-eqz line that branches to the label shared with UpdateWebViewUsedPkgsAction code (on my device it was if-eqz v1, :cond_4c).

Two edits:
1. Change that if-eqz branch target to :cond_return
2. Add :cond_return label on the line before return-void at the end of the method

Verify the patch:

# Should show: if-eqz v1, :cond_return
grep "if-eqz v1, :cond_return" smali_out/com/android/server/am/ActivityManagerService.smali

# Should show :cond_return before return-void at end of method
grep -A1 "cond_return" smali_out/com/android/server/am/ActivityManagerService.smali

Reassemble:

java -jar smali.jar a smali_out -o classes_patched.dex
cp services.jar services_patched.jar
cp classes_patched.dex classes.dex
zip services_patched.jar classes.dex

Build the Magisk module

mkdir -p boox-ams-fix-module/system/framework/oat/arm64

cp services_patched.jar boox-ams-fix-module/system/framework/services.jar

cat > boox-ams-fix-module/module.prop << 'EOF'
id=boox-ams-fix
name=Boox AMS Fix
version=v1.0
versionCode=1
author=dynamicfire (adapted for Go7)
description=Fix Magisk crash caused by Boox WebView tracking in ActivityManagerService
EOF

cat > boox-ams-fix-module/customize.sh << 'EOF'
SKIPUNZIP=0
EOF

cat > boox-ams-fix-module/post-fs-data.sh << 'EOF'
MODDIR=${0%/*}
EOF

cd boox-ams-fix-module
zip -r ../boox-ams-fix-go7.zip .
cd ..

Copy "boox-ams-fix-go7.zip" to the Go 7's Download folder via USB File Explorer.

PHASE 4: GET ROOT ACCESS AND INSTALL THE FIX

This is the trickiest part. The AMS bug prevents normal su access, but there is a workaround.

1. Open the Magisk app on the Go 7 (it will freeze on splash screen, leave it)
2. Fully power off the device (not sleep, hold power until it shuts down completely)
3. Power back on
4. Open Magisk again. It should get past the splash screen this time.
5. If Magisk asks about additional setup, tap OK and let it reboot.
6. After reboot, open Magisk (it freezes on splash again)
7. Leave Magisk on splash, switch to Termux
8. Type su and press enter
9. A superuser grant popup should appear. Tap Allow.
10. You should see a # root prompt

If Magisk's binaries are missing from /data/adb/magisk/ (you can check with ls /data/adb/magisk/ from the root shell), extract them manually from the APK:

# In root Termux shell
pm path com.topjohnwu.magisk
# Note the path, then:
cp /data/app/<path>/base.apk /data/local/tmp/magisk.zip
cd /data/local/tmp
unzip magisk.zip lib/arm64-v8a/* -d magisk_extract
mkdir -p /data/adb/magisk
cp magisk_extract/lib/arm64-v8a/libmagisk.so /data/adb/magisk/magisk64
cp magisk_extract/lib/arm64-v8a/libmagiskinit.so /data/adb/magisk/magiskinit
cp magisk_extract/lib/arm64-v8a/libmagiskboot.so /data/adb/magisk/magiskboot
cp magisk_extract/lib/arm64-v8a/libmagiskpolicy.so /data/adb/magisk/magiskpolicy
cp magisk_extract/lib/arm64-v8a/libbusybox.so /data/adb/magisk/busybox
chmod 755 /data/adb/magisk/*

With root in Termux, install the fix module:

mkdir -p /data/adb/modules/boox-ams-fix/
unzip /sdcard/Download/boox-ams-fix-go7.zip -d /data/adb/modules/boox-ams-fix/
reboot

After reboot, Magisk should open normally. Installed, root working, su accessible.

KNOWN ISSUES:
- Stock ABL cannot be restored after this procedure (re-bricks the device)
- OTA updates will likely break things. Disable com.onyx.android.onyxotaservice.
- fastboot boot with Magisk-patched images crashes the device. Must flash to disk via EDL.
- Windows fastboot.exe cannot see this device. Use WSL2 with usbipd.
- bkerler edl reports Error:{} on every write at 100%. Writes are successful (verify with read-back + sha256sum).
- fastbootd (userspace fastboot) does not support flash commands on this device.
- The full power off/on cycle (not sleep) is what breaks through the Magisk splash freeze. Regular sleep/wake does not work.

Thanks to Renate for misc-recovery.img, fonix232 for the FP4 ABL method, dynamicfire for identifying the AMS bug, and everyone in this thread for the collective knowledge that made this possible.

[ardy]

Hello,

I have a go color 7 gen 2 and I also tried to install magisk by trying to follow this tutorial and now my device is also stuck in fastboot, matching the first post in the thread. I am in the process of preparing myself an EDL cable and attempting the recovery process outlined in doomgoatman's detailed post but I first wanted to confirm how many of these steps are applicable to color 7 gen 2, and if it's also compatible with the fairphone image method described above etc.

My current situation (I will update as there are new developments)

* go color 7 gen 2 and ubuntu for flashing environment

* I have tried to apply root using the method described here
buduroiu.com/blog/taming-boox-gocolor7/

* I took a backup of boot_a and flashed magisk patched boot_a using EDL (I did not alter boot_b as a backup and also, the tutorial is poorly written and does not ask you to patch boot_b until suddenly it expects you already having extracted boot_b)

* For some reason, I can only send one EDL command per boot cycle, so after each command I wait for the device to reboot to android (it does automatically) and use the adb reboot edl command to go back to EDL to apply the next command: however, after the edl w command the device is stuck on the boox logo screen, (connected to fastboot mode), but fastboot reboot edl (or fastboot oem commands etc.) is broken

* Because of this I was never able to send the edl reset command, I probably require an EDL cable at this point

* My working hypothesis is that if I can get back into EDL and activate the unmodified boot_b partition I should have a bootable device and fix the faulty boot_a from that point on(and maybe try rooting again)

Given my situation matches the original post closely except only that I have a color gen 2 variant, my next steps will involve investigating the CPU differences before trying the tutorial and maybe finding someone else who ran into a fastboot loop and recovered with the same device I have

If anyone has any tips or recommendations I'm looking forward to hear from the community, thank you

[doomgoatman]

I believe that the hardware between the Go Color 7 gen 2 and the Go 7 Monochrome are the same except for the screen.

Go 7 Monochrome specs can be seen here if you scroll down a bit: https://www.techradar.com/tablets/er...ox-go-7-review

Go 7 Color gen 2 specs can be seen here if you scroll down a bit:
https://www.techradar.com/tablets/er...-gen-ii-review

No idea about the stock firmware though. Purely speculatively I think they're the same given that I see some options for color settings in my Go 7 Monochrome that don't actually seem to do anything.

[ardy]

Originally Posted by doomgoatman

I believe that the hardware between the Go Color 7 gen 2 and the Go 7 Monochrome are the same except for the screen.

Go 7 Monochrome specs can be seen here if you scroll down a bit: https://www.techradar.com/tablets/er...ox-go-7-review

Go 7 Color gen 2 specs can be seen here if you scroll down a bit:
https://www.techradar.com/tablets/er...-gen-ii-review

No idea about the stock firmware though. Purely speculatively I think they're the same given that I see some options for color settings in my Go 7 Monochrome that don't actually seem to do anything.

https://blog.tho.ms/hacks/2021/03/27/hacking-onyx-boox-note-air.html
https://gist.github.com/fardjad/97ba...953b3d359bb918

The two posts that inspired the tutorial I used suggest that the bootloader should have already been unlocked by default.The buduroiu post makes no mention of a locked or unlocked bootloader status.

Given I'm stuck in fastboot with no EDL cable and the flashing commands not working I did some digging and found this, which almost certainly reveals the culprit:

root@computer:~# fastboot oem device-info
(bootloader) Verity mode: false
(bootloader) Device unlocked: false
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
OKAY [  0.001s]
Finished. Total time: 0.001s

It seems likely that at some point after the publishing of these posts Onyx published an update that locked the bootloaders by default. A device trying to boot a patched magisk image with a locked bootloader will almost certainly trip the AVB mechanism and brick itself. (I consider myself lucky having fastboot access) Now I'm a diligent person and I try to verify what I'm doing before executing random commands from the internet, and if there was even a passing remark of an unlocked bootloader I'd have stopped and checked what I was doing. It's only after looking at the original posts that I saw this and I find it irresponsible for the post writer to omit this detail. (even though ultimately it's my responsibility to not cause thermonuclear war while tinkering with my devices)

Either way I will try the fairphone bootloader method to get my device in a working position before attempting root again, thank you for your insight.

[doomgoatman]

oh I recognize that

(bootloader) Device unlocked: false

Mine was in the same state. I am pretty sure you need the EDL cable at this point.

[ardy]

Originally Posted by doomgoatman

oh I recognize that

(bootloader) Device unlocked: false

Mine was in the same state. I am pretty sure you need the EDL cable at this point.

I wired together an EDL cable (with a button too!) and I can enter EDL now, initial observations:

* Setting boot_b active does not work and results in a fastboot loop

* Flashing stock boot_a does not work and results in a fastboot loop

* I accidentally entered recovery for a split second while pressing down the power button and gotten out of it at the same moment, I couldn't replicate the conditions but I know that there was a completely white screen and when I pressed the power button, it displayed the AOSP recovery menu and interpreted my press as the reboot command, sending me back to fastboot

* EDL identifies Go 7 Color 2 as bitra_sdm and I'm highly confident that Go 7 B/W is also bitra_sdm mainly because of this table, so the procedures on the tutorial should be compatible, but a full confirmation could be useful

* DecryptBooxUpdateUpx/BooxKeys.csv suggests that Go7 and GoColor7_2 have key entries which means they probably have seperate OTA files and I should use GoColor7_2

[ardy]

I have downloaded the upx file for GoColor7_2 (instead of Go7) and followed the tutorial up until the recovery step, but now I cannot enter recovery and fastboot reboot recovery just sends me back to fastboot.

I have attained bootloader unlock using the Fairphone ABL:

root@computer:~# fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: true
(bootloader) Charger screen enabled: false
OKAY [  0.001s]
Finished. Total time: 0.001s

But since I can't seem to reach recovery I don't know how to proceed with the factory data reset. I'm not sure if using fastboot commands for doing a reset would break things further so I'll refrain from doing that for now. Any ideas about how to proceed from here?

[ardy]

My bad, switching the active partition to a allowed me to enter recovery and proceed with the factory reset (it was stuck at b for some reason) and I was able to complete the guide; root has been attained and the magisk app is opening properly. Thank you!