Note Air 5c

[123dlr]

Originally Posted by Renate

Model:  NoteAir5C (English)
Finger: Onyx/NoteAir5C/NoteAir5C:11/2025-12-05_14-39_4.1.2-rel_1205_da3fc7661/1324:user/release-keys
Link:   http://firmware-us.boox.com/66a6d180959cf2807c0972bdd1a30c8c/update.upx
Size:   2,150,066,687
MD5:    66a6d180959cf2807c0972bdd1a30c8c

Hi there,

How can I find out update path's for the note air 5 c?

Thanks in advance,

123dlr

[Renate]

Model:  NoteAir5C (English)
Finger: Onyx/NoteAir5C/NoteAir5C:11/2026-04-02_19-54_4.2-rel_0402_75ba17df0/2413:user/release-keys
Link:   http://firmware-us.boox.com/431142eee75880e8d29c4c51fc144a3f/update.upx
Size:   2,138,694,155
MD5:    431142eee75880e8d29c4c51fc144a3f

[123dlr]

Thanks @Renate very useful.

still I wonder, how do you find out, from where to get it.

123dlr

[Renate]

It's all detailed elsewhere here the URLs to query that.

[Croat]

Hi all,
I have a Note Air 5C (English) that was bricked by a previous owner — both boot slots were patched during a root attempt, resulting in a bootloop/stuck on logo. Device responds to EDL (9008) via power button hold method with the SM_BITRA loader (0000000000000000_bdaf51b59ba21d8a_fhprg.bin).
What I've done so far via EDL:
Using bkerler's edl.py, I downloaded and decrypted Renate's firmware link (4.1.2 English) and extracted all partitions via payload_dumper. I then compared md5sums of dumped partitions against extracted stock and found the following were modified:

abl_a/b — different, flashed stock
aop_a/b — different, flashed stock
dtbo_a/b — different, flashed stock
xbl_a/b — different, flashed stock
vbmeta_a/b — flashed stock
vbmeta_system_a/b — flashed stock
boot_a/b — already matched stock
recovery_a/b — already matched stock
misc — contained boot-fastboot, erased and then set to boot-recovery
super — currently flashing clean super built with lpmake from extracted partitions

Device still hangs on logo after all of the above. Currently flashing fresh super built from stock system/vendor/product/system_ext/odm images.
Questions:

Could tz or hyp being modified cause a logo hang even with everything else stock?
Is there anything else in the boot chain I'm missing?

Does anyone have a full partition dump for Note Air 5C 4.1.2 English they'd be willing to share?

Thanks — especially to Renate for the firmware link and AuroraWright for documenting the root process.

[alllexx]

Hi Croat,
I had a similar issue, when I flashed bad boot images on Go 10.3 Gen2. I restored them from the backups, but the device wasn't booting. Solved it by cycling the active slot, like:

edl --loader=loader.bin --memory=ufs setactiveslot b
edl --loader=loader.bin --memory=ufs setactiveslot a

or

edl --loader=loader.bin --memory=ufs setactiveslot a
edl --loader=loader.bin --memory=ufs setactiveslot b

and restart

edl --loader=loader.bin reset

[Croat]

Originally Posted by alllexx

Hi Croat,
I had a similar issue, when I flashed bad boot images on Go 10.3 Gen2. I restored them from the backups, but the device wasn't booting. Solved it by cycling the active slot, like:

edl --loader=loader.bin --memory=ufs setactiveslot b
edl --loader=loader.bin --memory=ufs setactiveslot a

or

edl --loader=loader.bin --memory=ufs setactiveslot a
edl --loader=loader.bin --memory=ufs setactiveslot b

and restart

edl --loader=loader.bin reset

Tried active slots, tried misc reset.. one previously posted a full dump helped. So I was wondering if that could rescue me.

[alllexx]

A thing you could try, since you're stuck with a non-booting device anyways. Try to flash https://github.com/user-attachments/..._oemunlock.zip to the frp partition and https://github.com/user-attachments/...353/ablmod.zip to the abl_a/b partition(s). Unzip the images first, ofc. All files are from https://github.com/jdkruzr/BooxPalma2RootGuide/issues/9
After flashing, erase the devinfo partition, and upon reboot you will be prompted on the device to do a factory reset. You'll need to use volume and power buttons to choose and confirm the reset. I actually did it on my Go 10.3 Gen2, but since it has no volume buttons, I had to connect a USB keyboard, which fortunately worked: I could use arrows to navigate the menu. Note Air 5C seems to have volume buttons, so this shouldn't concern you.
This should give you an unlocked bootloader, and hopefully you'll be able to boot.

[Croat]

I can try it since at this point I am really out of ideas what else to try. Thanks

Just to make sure..

I am stuck at boox logo, no matter what I tried so far it never gets beyond boox logo.

[alllexx]

I had similar symptoms, but I only flashed boot partitions to patched ones and restoring them from backups and active slot cycling did the job. Hopefully an unlocked bootloader will be more permissive and boot

[Croat]

Thanks for the suggestions. Here's what I tried and found:
What worked:

Downloaded and flashed frp_oemunlock.img to frp partition
Flashed ablmod.img from the Palma 2 guide to abl_a/b
Erased devinfo
After reboot fastboot flashing unlock now returns OKAY — bootloader is properly unlocked

What didn't work:

Any attempt to boot an image via fastboot fails with Failed to load/authenticate boot image: Load Error
This applies to stock boot.img, stock recovery.img, and even fastboot --disable-verification makes no difference
fastboot flashing unlock_critical completes successfully but doesn't help with image authentication

Conclusion:
The ablmod from the Palma 2 guide appears to enforce signature verification using Palma 2 specific signing keys. Since the Note Air 5C uses different keys, all images are rejected. I restored stock abl_a/b from the 4.1.2 firmware but kept frp_oemunlock and erased devinfo in place.
Current state:

Bootloader unlocked (fastboot confirms)
frp_oemunlock flashed
devinfo erased
Stock abl restored
Still stuck on Boox logo

What I've done overall via EDL (full summary):

Complete partition dump saved before any changes
Compared all dumped partitions to stock 4.1.2 — found abl, aop, dtbo, xbl, modem, vbmeta were all modified
Flashed stock versions of all modified partitions
Built and flashed clean super.img from extracted 4.1.2 partitions using lpmake
Cleared misc partition (was set to boot-fastboot)

Question:
Does anyone have a Note Air 5C specific ablmod, or a full EDL partition dump from a working 4.1.2 English device they'd be willing to share? The fastboot unlock is now working so we're closer than before.

[Croat]

Originally Posted by Croat

Thanks for the suggestions. Here's what I tried and found:
What worked:

Downloaded and flashed frp_oemunlock.img to frp partition
Flashed ablmod.img from the Palma 2 guide to abl_a/b
Erased devinfo
After reboot fastboot flashing unlock now returns OKAY — bootloader is properly unlocked

What didn't work:

Any attempt to boot an image via fastboot fails with Failed to load/authenticate boot image: Load Error
This applies to stock boot.img, stock recovery.img, and even fastboot --disable-verification makes no difference
fastboot flashing unlock_critical completes successfully but doesn't help with image authentication

Conclusion:
The ablmod from the Palma 2 guide appears to enforce signature verification using Palma 2 specific signing keys. Since the Note Air 5C uses different keys, all images are rejected. I restored stock abl_a/b from the 4.1.2 firmware but kept frp_oemunlock and erased devinfo in place.
Current state:

Bootloader unlocked (fastboot confirms)
frp_oemunlock flashed
devinfo erased
Stock abl restored
Still stuck on Boox logo

What I've done overall via EDL (full summary):

Complete partition dump saved before any changes
Compared all dumped partitions to stock 4.1.2 — found abl, aop, dtbo, xbl, modem, vbmeta were all modified
Flashed stock versions of all modified partitions
Built and flashed clean super.img from extracted 4.1.2 partitions using lpmake
Cleared misc partition (was set to boot-fastboot)

Question:
Does anyone have a Note Air 5C specific ablmod, or a full EDL partition dump from a working 4.1.2 English device they'd be willing to share? The fastboot unlock is now working so we're closer than before.

"Renate and AuroraWright — any ideas appreciated given your experience with this device."

[alllexx]

Originally Posted by Croat

Conclusion:
The ablmod from the Palma 2 guide appears to enforce signature verification using Palma 2 specific signing keys. Since the Note Air 5C uses different keys, all images are rejected. I restored stock abl_a/b from the 4.1.2 firmware but kept frp_oemunlock and erased devinfo in place.

That's not quite right. This ablmod comes from FairPhone 4 and Note Air 5c has secure boot disabled. It doesn't check the keys the way you suggest, but on my Go 10.3 Gen2 booting an image via fastboot doesn't work as well. However, after unlocking the bootloader `fastboot flash` command works -- that's how I flashed magisk patched boot images and have a rooted device now.

Given your state of things, you can try booting into recovery (fastboot reboot recovery) and flash a decrypted firmware zip via it. I haven't tried it myself but seen the option to sideload system update via ADB in ablmod's recovery. Maybe it would fix whatever broken partitions you have.

[Croat]

Device is now fully working. Here’s what finally fixed it:

The key breakthrough was the ablmod from the FairPhone 4 guide. While fastboot boot didn’t work, fastboot flash did. Combined with disabling vbmeta verification (fastboot flash –disable-verity –disable-verification vbmeta), the device finally got into Android init.

From there fastboot reboot recovery dropped into the ablmod recovery with ADB sideload available. Sideloaded firmware 4.2 successfully via adb sideload.

Final state:

- Boox Note Air 5C running 4.2
- Rooted with Magisk 30.7 (Ramdisk: Yes, Zygisk enabled)
- Verity confirmed enforcing (ro.boot.veritymode: enforcing)
- Bootloader unlocked (ro.boot.verifiedbootstate: orange) — expected with Magisk
- AFWall+ deny-by-default configured
- Fully debloated

Full recovery steps for anyone with same brick (both boot slots patched):

1. Get into EDL (9008) with SM_BITRA loader (0000000000000000_bdaf51b59ba21d8a_fhprg.bin)
2. Flash stock abl, aop, dtbo, xbl, vbmeta, boot from official 4.1.2 firmware via EDL
3. Flash frp_oemunlock.img to frp partition via EDL
4. Flash ablmod.img (FairPhone 4 mod) to abl_a and abl_b via EDL
5. Erase devinfo via EDL
7. Reboot — device enters fastboot
8. Run: fastboot flashing unlock — should return OKAY
9. Flash vbmeta with: fastboot flash –disable-verity –disable-verification vbmeta vbmeta.img
10. fastboot reboot recovery
11. adb sideload firmware.zip (decrypted 4.2 firmware)
12. Device reboots into 4.2
13. Root with Magisk — patch boot_a, flash via EDL, done
14. Re-enable verity: flash stock vbmeta via EDL (python3 edl.py w vbmeta_a vbmeta.img)
15. Confirm: getprop ro.boot.veritymode should return enforcing

Thanks to Alllexx for the critical hint about ablmod recovery and ADB sideload. Files used: frp_oemunlock.zip and ablmod.zip provided in this topic.