12-26-2025, 01:51 AM
|
#31 |
|
Onyx-maniac
  Posts: 4,433
Karma: 22077647
Join Date: Feb 2012
Location: Germany
Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6
|
Are we having fun yet?
Code:
flatten /v abl /d 32 bit ELF 0000 ZERO 0010 FSS2 0020 Length 00022000 0028 Sig _FVH 002c Attr 0003feff 0030 HdrLen 0048 0032 Check d3be -> 0000 0034 ExtHdr 0000 0037 Vers 2 0038 Blocks 000110 x 0200 -> 00022000 0048 IMG 0058 Check 16 -> 00 005c Size1 01ebc0 0060 Size2 01eba8 0064 LZMA ---------- 0008 ZERO 0018 FSS2 0028 Length 0006a0c0 0030 Sig _FVH 0034 Attr 0003feff 0038 HdrLen 0048 003a Check 3ae7 -> 0000 003c ExtHdr 0060 003f Vers 2 0040 Blocks 001a83 x 0040 -> 0006a0c0 0050 ONES 0068 QCOM 0080 APP1 009c LL 00b8 MZ 0f10 PE 10b8 Code Last edited by Renate; 12-26-2025 at 02:24 AM. |
|
|
|
12-27-2025, 12:31 PM
|
#32 |
|
Member
Posts: 19
Karma: 10
Join Date: Dec 2025
Device: Boox Note Air 5c
|
I found someone managed to root Palma 2 Pro by flashing fairphone images to get the fastboot unlock commands working.
https://github.com/jdkruzr/BooxPalma2RootGuide/issues/9 |
|
|
|
|
12-28-2025, 01:45 PM
|
#33 |
|
Enthusiast
Posts: 36
Karma: 53196
Join Date: Apr 2018
Device: Kobo Forma, Onyx Boox Palma 2 Pro
|
Oh, thank you guys very much. Last comment put me on right track. My Palma 2 Pro is now unlocked and rooted.
Working procedure is this. BEWARE - THIS PROCEDURE WILL WIPE YOUR DATA! Preparing tools Get edl utility Get Palma loader file for EDL utility: Code:
wget -O palma2pro.bin 'https://github.com/bkerler/Loaders/raw/refs/heads/main/lenovo_motorola/0000000000000000_bdaf51b59ba21d8a_fhprg.bin' From that Fairphone 4 image, extract abl.img somewhere. I will reference it as abl-fp4.img in the process. Reboot phone into bootloader with Code:
adb reboot bootloader Code:
fastboot getvar current-slot Backing up data Put the device into EDL mode with Code:
adb reboot edl This takes about 1 hour and backup is about 128GB in size. It is optional, but highly recommended. Can be done with command (folder stock_partitions_backup must exists): Code:
edl --loader=palma2pro.bin --memory=ufs rl stock_partitions_backup/ Code:
mkdir stock_backup edl --loader=palma2pro.bin --memory=ufs r devinfo stock_backup/devinfo.img edl --loader=palma2pro.bin --memory=ufs r boot_a stock_backup/boot_a.img edl --loader=palma2pro.bin --memory=ufs r boot_b stock_backup/boot_b.img edl --loader=palma2pro.bin --memory=ufs r vbmeta_a stock_backup/vbmeta_a.img edl --loader=palma2pro.bin --memory=ufs r vbmeta_b stock_backup/vbmeta_b.img edl --loader=palma2pro.bin --memory=ufs r vbmeta_system_a stock_backup/vbmeta_system_a.img edl --loader=palma2pro.bin --memory=ufs r vbmeta_system_b stock_backup/vbmeta_system_b.img edl --loader=palma2pro.bin --memory=ufs r recovery_a stock_backup/recovery_a.img edl --loader=palma2pro.bin --memory=ufs r recovery_b stock_backup/recovery_b.img edl --loader=palma2pro.bin --memory=ufs r abl_a stock_backup/abl_a.img edl --loader=palma2pro.bin --memory=ufs r abl_b stock_backup/abl_b.img Unfortunately Boox firmware does not allow unlocking device. But since hardware is similar to Fairphone 4 we will take Fairphone image to help. Get into edl mode again with Code:
adb reboot edl Code:
edl --loader=palma2pro.bin --memory=ufs w abl_a abl-fp4.img edl --loader=palma2pro.bin --memory=ufs w abl_b abl-fp4.img Code:
edl --loader=palma2pro.bin setactiveslot a edl --loader=palma2pro.bin reset Select System submenu. Then select Developer options. In those go to Developer options enable OEM unlocking. Reboot the device. Now we will proceed to unlocking bootloader. Your data will be WIPED from the device. There is no going back! Ready? Reboot into bootloader with Code:
adb reboot bootloader Code:
fastboot devices Issue Code:
fastboot flashing unlock On screen there will still bee BOOX logo, nothing visible. Press Vol Up once, and then Power button. Now device will automatically reboot few times and wipes all your data. Now you are with clear device in defaults. Enable ADB in settings again. And issue Code:
adb reboot bootloader Code:
fastboot flashing unlock_critical Press Vol Up once, and then Power button. Device will automatically reboot few times and wipes all your data once again. Now you have unlocked device. Issuing fastboot oem device-info should say something like: Code:
(bootloader) Verity mode: true (bootloader) Device unlocked: true (bootloader) Device critical unlocked: true (bootloader) Charger screen enabled: true From now the rooting procedure can be done as on Palma 2. Install Magisk to your Palma Push your backed up boot image for your activeslot onto Palma Code:
adb push stock_backup/boot_a.img /sdcard/ Then download it back to your computer Code:
adb pull /sdcard/Download/magisk_patched-30600_x1Hl9.img boot_a_patched.img Code:
adb reboot edl Code:
edl --loader=palma2pro.bin --memory=ufs w boot_a boot_a_patched.img edl --loader=palma2pro.bin reset If you want, you can now flash back the stock ABL images back into Palma. I do recommend it, because without it, device was kinda unstable and for example launching Onyx settings from top-tray did not worked (after flashing original ABL it did worked) Code:
edl --loader=palma2pro.bin --memory=ufs w abl_a stock_backup/abl_a.img edl --loader=palma2pro.bin --memory=ufs w abl_b stock_backup/abl_b.img |
|
|
|
|
12-29-2025, 09:33 AM
|
#34 |
|
Enthusiast
Posts: 36
Karma: 53196
Join Date: Apr 2018
Device: Kobo Forma, Onyx Boox Palma 2 Pro
|
Hi,
I am trying to continue in mission of modifying Palma 2 Pro. My thinking was, that maybe I could make it reliable phone for incoming calls. So I am trying to replace various components from Palma 2 Pro software with software from FP4. I am using magic_overlayfs to be able to write into /system partition. But I did run into another problem. When I replace system app, it refuses to function. For example replacing TeleService app: Code:
adb push ../apk_from_fairphone/TeleService.* /tmp/ adb shell su -mm -c magic_remount_rw su cp /tmp/TeleService.apk /system/priv-app/TeleService/TeleService.apk cp /tmp/TeleService.odex /system/priv-app/TeleService/oat/arm64/TeleService.odex cp /tmp/TeleService.vdex /system/priv-app/TeleService/oat/arm64/TeleService.vdex su -mm -c magic_remount_ro exit exit adb reboot Code:
12-29 15:17:29.359 7481 7481 E System : ******************************************
12-29 15:17:29.359 7481 7481 E System : ************ Failure starting system services
12-29 15:17:29.359 7481 7481 E System : java.lang.IllegalStateException: Signature mismatch on system package com.android.phone for shared user SharedUserSetting{ee5270f android.uid.phone/1001}
12-29 15:17:29.359 7481 7481 E System : at com.android.server.pm.ReconcilePackageUtils.reconcilePackages(ReconcilePackageUtils.java:284)
12-29 15:17:29.359 7481 7481 E System : at com.android.server.pm.InstallPackageHelper.addForInitLI(InstallPackageHelper.java:3960)
12-29 15:17:29.359 7481 7481 E System : at com.android.server.pm.InstallPackageHelper.installPackagesFromDir(InstallPackageHelper.java:3704)
12-29 15:17:29.359 7481 7481 E System : at com.android.server.pm.InitAppsHelper.scanDirTracedLI(InitAppsHelper.java:377)
12-29 15:17:29.359 7481 7481 E System : at com.android.server.pm.InitAppsHelper.scanSystemDirs(InitAppsHelper.java:345)
12-29 15:17:29.359 7481 7481 E System : at com.android.server.pm.InitAppsHelper.initSystemApps(InitAppsHelper.java:178)
12-29 15:17:29.359 7481 7481 E System : at com.android.server.pm.PackageManagerService.<init>(PackageManagerService.java:2292)
12-29 15:17:29.359 7481 7481 E System : at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:1763)
12-29 15:17:29.359 7481 7481 E System : at com.android.server.SystemServer.startBootstrapServices(SystemServer.java:1259)
12-29 15:17:29.359 7481 7481 E System : at com.android.server.SystemServer.run(SystemServer.java:945)
12-29 15:17:29.359 7481 7481 E System : at com.android.server.SystemServer.main(SystemServer.java:666)
12-29 15:17:29.359 7481 7481 E System : at java.lang.reflect.Method.invoke(Native Method)
12-29 15:17:29.359 7481 7481 E System : at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:580)
12-29 15:17:29.359 7481 7481 E System : at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:870)
12-29 15:17:29.359 7481 7481 E Zygote : System zygote died with fatal exception
12-29 15:17:29.359 7481 7481 E Zygote : java.lang.IllegalStateException: Signature mismatch on system package com.android.phone for shared user SharedUserSetting{ee5270f android.uid.phone/1001}
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.pm.ReconcilePackageUtils.reconcilePackages(ReconcilePackageUtils.java:284)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.pm.InstallPackageHelper.addForInitLI(InstallPackageHelper.java:3960)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.pm.InstallPackageHelper.installPackagesFromDir(InstallPackageHelper.java:3704)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.pm.InitAppsHelper.scanDirTracedLI(InitAppsHelper.java:377)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.pm.InitAppsHelper.scanSystemDirs(InitAppsHelper.java:345)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.pm.InitAppsHelper.initSystemApps(InitAppsHelper.java:178)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.pm.PackageManagerService.<init>(PackageManagerService.java:2292)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:1763)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.SystemServer.startBootstrapServices(SystemServer.java:1259)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.SystemServer.run(SystemServer.java:945)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.server.SystemServer.main(SystemServer.java:666)
12-29 15:17:29.359 7481 7481 E Zygote : at java.lang.reflect.Method.invoke(Native Method)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:580)
12-29 15:17:29.359 7481 7481 E Zygote : at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:870)
12-29 15:17:29.359 7481 7481 D AndroidRuntime: Shutting down VM
12-29 15:17:29.359 7481 7481 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
|
|
|
|
|
12-29-2025, 10:39 AM
|
#35 | |
|
Member
Posts: 15
Karma: 10
Join Date: Dec 2025
Device: Boox Air 4C
|
Quote:
Thank you |
|
|
|
|
|
12-31-2025, 12:06 PM
|
#36 |
|
Enthusiast
Posts: 36
Karma: 53196
Join Date: Apr 2018
Device: Kobo Forma, Onyx Boox Palma 2 Pro
|
Regarding using system apps from different device.
I got little bit further. Found all apps that shares sharedUserId="android.uid.phone" Replaced them. But id does not work (but I kinda expected that after reading something about it). Palma now accepts the package itself. But it won't grant them privileged permissions protected by signature (unless packages are signed with some correct keys used to build system - so Onyx keys). Error at boot is following: Code:
12-31 17:29:55.809 1484 1484 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
12-31 17:29:55.809 1484 1484 E AndroidRuntime: java.lang.IllegalStateException: Signature|privileged permissions not in privileged permission allowlist: {com.android.stk (/system/app/Stk): android.permission.RECEIVE_STK_COMMANDS, com.android.stk (/system/app/Stk): android.permission.REAL_GET_TASKS, com.qualcomm.atfwd (/system_ext/app/atfwd): android.permission.MASTER_CLEAR, com.qti.qualcomm.deviceinfo (/system_ext/app/DeviceInfo): android.permission.CONTROL_INCALL_EXPERIENCE, com.android.stk (/system/app/Stk): android.permission.USER_ACTIVITY, com.android.stk (/system/app/Stk): android.permission.SUBSTITUTE_NOTIFICATION_APP_NAME, com.qualcomm.qti.uceShimService (/system_ext/app/uceShimService): android.permission.READ_PRIVILEGED_PHONE_STATE, com.android.stk (/system/app/Stk): android.permission.START_ACTIVITIES_FROM_BACKGROUND}
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.server.permission.access.permission.AppIdPermissionPolicy.onSystemReady(AppIdPermissionPolicy.kt:1625)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.server.permission.access.AccessPolicy.onSystemReady(AccessPolicy.kt:275)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.server.permission.access.AccessCheckingService.onSystemReady$frameworks__base__services__permission__android_common__services_permission_pre_jarjar(AccessCheckingService.kt:239)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.server.permission.access.permission.PermissionService.onSystemReady(PermissionService.kt:2295)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.server.pm.permission.PermissionManagerService$PermissionManagerServiceInternalImpl.onSystemReady(PermissionManagerService.java:772)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.server.pm.PackageManagerService.systemReady(PackageManagerService.java:4285)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.server.SystemServer.startOtherServices(SystemServer.java:2981)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.server.SystemServer.run(SystemServer.java:947)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.server.SystemServer.main(SystemServer.java:666)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:580)
12-31 17:29:55.809 1484 1484 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:870)
There is probably no easy way around this. Nothing I know of. Only option I found reading some docs is to build whole Android for Palma using some generated keys. And then sign the packages with those keys. That would mean create custom ROM. That is outside of my skills. |
|
|
|
|
04-28-2026, 12:30 AM
|
#37 |
|
Junior Member
Posts: 4
Karma: 10
Join Date: Apr 2026
Device: Palma2pro
|
Hi all, especially Renate and Kisuke,
I've been following Kisuke's Palma 2 Pro rooting guide and have gotten myself into a situation where EDL is falling into streaming mode and I cannot recover. Hoping someone can help. My setup: - Palma 2 Pro - Linux Mint laptop (USB-A port) - bkerler edl tool (latest, python3 -m edl) - palma2pro.bin loader from: https://github.com/bkerler/Loaders/r...1d8a_fhprg.bin CPU: bitra_SDM Active slot: B What I did, in order: 1. Successfully backed up all key partitions via EDL (boot_a, boot_b, vbmeta_a, vbmeta_b, vbmeta_system_a, vbmeta_system_b, recovery_a, recovery_b, abl_a, abl_b, devinfo) - all completed at 100%. 2. Downloaded FP4 ABL from eOS Fairphone 4 Android 15 build and extracted abl.img. 3. Flashed FP4 ABL to both slots via EDL: edl --loader=palma2pro.bin --memory=ufs w abl_a abl-fp4.img edl --loader=palma2pro.bin --memory=ufs w abl_b abl-fp4.img 4. Set active slot to b and rebooted: edl --loader=palma2pro.bin setactiveslot b edl --loader=palma2pro.bin reset (also did the a then b slot swap that Kisuke mentions) 5. Booted into Android, enabled OEM Unlocking in Developer Options. 6. Rebooted to bootloader, ran fastboot flashing unlock, pressed Vol Up + Power on device. Device wiped and rebooted. 7. Re-enabled ADB, rebooted to bootloader again, ran fastboot flashing unlock_critical, pressed Vol Up + Power. Device wiped again. 8. Confirmed with fastboot oem device-info: Device unlocked: true Device critical unlocked: true 9. Installed Magisk, pushed stock boot_b.img to device, patched it with Magisk, pulled magisk_patched back to computer. 10. Rebooted to EDL, flashed patched boot_b: edl --loader=palma2pro.bin --memory=ufs w boot_b boot_b_patched.img edl --loader=palma2pro.bin setactiveslot b edl --loader=palma2pro.bin reset 11. Device would not boot past BOOX logo after 10+ minutes. 12. Recovered by restoring stock boot_b and slot swapping. 13. At this point I mistakenly restored stock ABL (abl_a and abl_b) before confirming root worked, thinking it would help stability. 14. After restoring stock ABL, EDL now falls into streaming mode and hangs after sahara. The loader never successfully uploads and firehose mode is never reached. Current EDL behavior with --debugmode: - Device detected in sahara mode - TX: nop XML sent - RX: 04000000100000000000000001000000 (streaming mode hello) - Falls into streaming_client.py handle_streaming - Times out repeatedly - Never reaches firehose I also tried the Samsung Galaxy A52 5G loader (A526U_Loader_alephgsm.com.elf) which triggered a full memory dump instead. Current device state: - Won't boot past BOOX logo - EDL reachable via Vol Up + Vol Down + USB - Sahara connects but loader upload fails - Streaming mode hello packet received instead of firehose - No Windows access (Mac + Linux only) My backup files are intact including stock abl_a.img and abl_b.img. My main question: Is there any way to restore the stock ABL from Linux when EDL is stuck in streaming mode? Or is Renate's Windows EDL client the only path forward? Any help would be greatly appreciated. Happy to provide any additional debug output needed. |
|
|
|
|
04-28-2026, 09:21 AM
|
#38 |
|
Onyx-maniac
Posts: 4,433
Karma: 22077647
Join Date: Feb 2012
Location: Germany
Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6
|
Post your debug log, your paraphrasing doesn't interest me.
Actually, I pretty much lost interest when you said Fairphone. |
|
|
|
|
04-28-2026, 10:29 AM
|
#39 |
|
Junior Member
Posts: 4
Karma: 10
Join Date: Apr 2026
Device: Palma2pro
|
Thank you for taking a look, I’m really at a loss here.
Debug output (edl --debugmode): Code:
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025. main - Using loader palma2pro.bin ... main - Waiting for the device main - Device detected :) DeviceClass DeviceClass - [LIB]: read:0x0 DeviceClass DeviceClass - [LIB]: [' File "<frozen runpy>", line 198, in _run_module_as_main\n', ' File "<frozen runpy>", line 88, in _run_code\n', ' File "/home/nothing/edl/edl.py", line 419, in <module>\n run()\n', ' File "/home/nothing/edl/edl.py", line 412, in run\n base.run()\n', ' File "/home/nothing/edl/edl.py", line 305, in run\n conninfo = self.doconnect(loop)\n', ' File "/home/nothing/edl/edl.py", line 232, in doconnect\n resp = self.sahara.connect()\n', ' File "/home/nothing/edl/edlclient/Library/sahara.py", line 118, in connect\n v = self.cdc.read(length=0xC * 0x4, timeout=1)\n'] DeviceClass DeviceClass - [LIB]: RX: DeviceClass DeviceClass - [LIB]: [' File "<frozen runpy>", line 198, in _run_module_as_main\n', ' File "<frozen runpy>", line 88, in _run_code\n', ' File "/home/nothing/edl/edl.py", line 419, in <module>\n run()\n', ' File "/home/nothing/edl/edl.py", line 412, in run\n base.run()\n', ' File "/home/nothing/edl/edl.py", line 305, in run\n conninfo = self.doconnect(loop)\n', ' File "/home/nothing/edl/edl.py", line 232, in doconnect\n resp = self.sahara.connect()\n'] DeviceClass DeviceClass - [LIB]: TX:<?xml version="1.0" ?><data><nop /></data> DeviceClass DeviceClass - [LIB]: read:0x10 DeviceClass DeviceClass - [LIB]: [' File "<frozen runpy>", line 198, in _run_module_as_main\n', ' File "<frozen runpy>", line 88, in _run_code\n', ' File "/home/nothing/edl/edl.py", line 419, in <module>\n run()\n', ' File "/home/nothing/edl/edl.py", line 412, in run\n base.run()\n', ' File "/home/nothing/edl/edl.py", line 305, in run\n conninfo = self.doconnect(loop)\n', ' File "/home/nothing/edl/edl.py", line 232, in doconnect\n resp = self.sahara.connect()\n', ' File "/home/nothing/edl/edlclient/Library/sahara.py", line 138, in connect\n res = self.cdc.read(timeout=1)\n'] DeviceClass DeviceClass - [LIB]: RX:04000000100000000000000001000000 main - Mode detected: sahara DeviceClass |
|
|
|
|
04-29-2026, 12:40 AM
|
#40 | |
|
Onyx-maniac
Posts: 4,433
Karma: 22077647
Join Date: Feb 2012
Location: Germany
Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6
|
Quote:
|
|
|
|
|
|
04-29-2026, 09:14 AM
|
#41 |
|
Junior Member
Posts: 4
Karma: 10
Join Date: Apr 2026
Device: Palma2pro
|
Apologies, I thought since it started repeating it wouldn't be useful. This is about 10 seconds of the log before I hit Ctl+c because it would swamp my screen. Happy to collect more if it is useful.
Code:
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025. main - Using loader palma2pro.bin ... main - Waiting for the device main - Device detected :) DeviceClass DeviceClass - [LIB]: read:0x0 DeviceClass DeviceClass - [LIB]: [' File "<frozen runpy>", line 198, in _run_module_as_main\n', ' File "<frozen runpy>", line 88, in _run_code\n', ' File "/home/nothing/edl/edl.py", line 419, in <module>\n run()\n', ' File "/home/nothing/edl/edl.py", line 412, in run\n base.run()\n', ' File "/home/nothing/edl/edl.py", line 305, in run\n conninfo = self.doconnect(loop)\n', ' File "/home/nothing/edl/edl.py", line 232, in doconnect\n resp = self.sahara.connect()\n', ' File "/home/nothing/edl/edlclient/Library/sahara.py", line 118, in connect\n v = self.cdc.read(length=0xC * 0x4, timeout=1)\n'] DeviceClass DeviceClass - [LIB]: RX: DeviceClass DeviceClass - [LIB]: [' File "<frozen runpy>", line 198, in _run_module_as_main\n', ' File "<frozen runpy>", line 88, in _run_code\n', ' File "/home/nothing/edl/edl.py", line 419, in <module>\n run()\n', ' File "/home/nothing/edl/edl.py", line 412, in run\n base.run()\n', ' File "/home/nothing/edl/edl.py", line 305, in run\n conninfo = self.doconnect(loop)\n', ' File "/home/nothing/edl/edl.py", line 232, in doconnect\n resp = self.sahara.connect()\n'] DeviceClass DeviceClass - [LIB]: TX:<?xml version="1.0" ?><data><nop /></data> DeviceClass DeviceClass - [LIB]: read:0x10 DeviceClass DeviceClass - [LIB]: [' File "<frozen runpy>", line 198, in _run_module_as_main\n', ' File "<frozen runpy>", line 88, in _run_code\n', ' File "/home/nothing/edl/edl.py", line 419, in <module>\n run()\n', ' File "/home/nothing/edl/edl.py", line 412, in run\n base.run()\n', ' File "/home/nothing/edl/edl.py", line 305, in run\n conninfo = self.doconnect(loop)\n', ' File "/home/nothing/edl/edl.py", line 232, in doconnect\n resp = self.sahara.connect()\n', ' File "/home/nothing/edl/edlclient/Library/sahara.py", line 138, in connect\n res = self.cdc.read(timeout=1)\n'] DeviceClass DeviceClass - [LIB]: RX:04000000100000000000000001000000 main - Mode detected: sahara DeviceClass DeviceClass - [LIB]: [' File "<frozen runpy>", line 198, in _run_module_as_main\n', ' File "<frozen runpy>", line 88, in _run_code\n', ' File "/home/nothing/edl/edl.py", line 419, in <module>\n run()\n', ' File "/home/nothing/edl/edl.py", line 412, in run\n base.run()\n', ' File "/home/nothing/edl/edl.py", line 388, in run\n sc.handle_streaming(cmd, options)\n', ' File "/home/nothing/edl/edlclient/Library/streaming_client.py", line 83, in handle_streaming\n if self.streaming.connect(mode):\n', ' File "/home/nothing/edl/edlclient/Library/streaming.py", line 783, in connect\n resp = self.send(cmdbuf, True)\n', ' File "/home/nothing/edl/edlclient/Library/streaming.py", line 1000, in send\n return self.hdlc.send_cmd_np(cmd, nocrc)\n', ' File "/home/nothing/edl/edlclient/Library/hdlc.py", line 232, in send_cmd_np\n return self.send_cmd_base(outdata, 0, nocrc)\n', ' File "/home/nothing/edl/edlclient/Library/hdlc.py", line 221, in send_cmd_base\n if self.send_unframed_buf(packet, prefixflag):\n'] DeviceClass DeviceClass - [LIB]: TX:11001200a0e30000c1e50140a0e31eff2fe14bd97e DeviceClass DeviceClass - [LIB]: read:0x10 DeviceClass DeviceClass - [LIB]: [' File "<frozen runpy>", line 198, in _run_module_as_main\n', ' File "<frozen runpy>", line 88, in _run_code\n', ' File "/home/nothing/edl/edl.py", line 419, in <module>\n run()\n', ' File "/home/nothing/edl/edl.py", line 412, in run\n base.run()\n', ' File "/home/nothing/edl/edl.py", line 388, in run\n sc.handle_streaming(cmd, options)\n', ' File "/home/nothing/edl/edlclient/Library/streaming_client.py", line 83, in handle_streaming\n if self.streaming.connect(mode):\n', ' File "/home/nothing/edl/edlclient/Library/streaming.py", line 783, in connect\n resp = self.send(cmdbuf, True)\n', ' File "/home/nothing/edl/edlclient/Library/streaming.py", line 1000, in send\n return self.hdlc.send_cmd_np(cmd, nocrc)\n', ' File "/home/nothing/edl/edlclient/Library/hdlc.py", line 232, in send_cmd_np\n return self.send_cmd_base(outdata, 0, nocrc)\n', ' File "/home/nothing/edl/edlclient/Library/hdlc.py", line 223, in send_cmd_base\n return self.receive_reply_nocrc()\n', ' File "/home/nothing/edl/edlclient/Library/hdlc.py", line 177, in receive_reply_nocrc\n tmp = self.cdc.read(timeout=timeout)\n'] DeviceClass DeviceClass - [LIB]: RX:04000000100000000000000001000000 |
|
|
|
|
04-30-2026, 05:12 PM
|
#42 |
|
Junior Member
Posts: 1
Karma: 10
Join Date: Apr 2026
Device: boox palma 2 pro
|
lost boot images
Hello,
I have been very stupid (actually very tired) and did not back-up my boot_a and b images. Now my device is stuck on the boox logo after trying to root it. Can someone send me original boot images or a link to a stock firmware? I would really appreciate the help here. |
|
|
|
|
05-01-2026, 10:45 AM
|
#43 | |
|
Enthusiast
Posts: 36
Karma: 53196
Join Date: Apr 2018
Device: Kobo Forma, Onyx Boox Palma 2 Pro
|
Quote:
sorry for joining late to the party. Actualy I do not know exactly what to do in state you get into. I believe my "dead" states were bit different. From my point of view I think problem could be in your software - did something like software update happened in meantime (As Arch user I have to reinstall all python modules when python update happens...)? Are you sure you are using correct loader? Maybe redownload it for sure! I can provide you original ABL and BOOT images from my device. But I am not sure it will help anything. When I was unable to get into EDL mode from user side, EDL cable helped me (I just ripped some random cable, but it is easy to order some user friendly for $10). But that is probably not your problem. ==================== Once I did get into state where I was also unable to use EDL loader. In that state when device went into 9008 ("proper EDL") using EDL cable. When I tried to use edl utility with palma loader. Device switched into 900e mode ("dump mode"). Here is EDL utility output from that time: Code:
edl --loader=palma2pro.bin --memory=ufs w abl_b rooting3/abl_b.img Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025. main - Using loader palma2pro.bin ... main - Waiting for the device main - Device detected :) sahara - Protocol version: 2, Version supported: 1 main - Mode detected: sahara sahara - Version 0x2 ------------------------ HWID: 0x0013f0e100000000 (MSM_ID:0x0013f0e1,OEM_ID:0x0000,MODEL_ID:0x0000) CPU detected: "bitra_SDM" PK_HASH: ..... Serial: ..... sahara - Protocol version: 2, Version supported: 1 sahara - Uploading loader palma2pro.bin ... sahara - 64-Bit mode detected. sahara - Firehose mode detected, uploading... sahara - Loader successfully uploaded. main - Trying to connect to firehose loader ... DeviceClass - USBError(19, 'No such device (it may have been disconnected)') DeviceClass - USBError(19, 'No such device (it may have been disconnected)') DeviceClass - USBError(19, 'No such device (it may have been disconnected)') DeviceClass - USBError(19, 'No such device (it may have been disconnected)') Look for something like this: Code:
# proper EDL [14696.573211] usb 3-2: USB disconnect, device number 59 [14709.543241] usb 3-2: new high-speed USB device number 60 using xhci_hcd [14709.672960] usb 3-2: New USB device found, idVendor=05c6, idProduct=9008, # dump mode EDL [14696.573211] usb 3-2: USB disconnect, device number 59 [14709.543241] usb 3-2: new high-speed USB device number 60 using xhci_hcd [14709.672960] usb 3-2: New USB device found, idVendor=05c6, idProduct=900e, bcdDevice= 0.00 Last edited by Kisuke-CZE; 05-01-2026 at 10:49 AM. |
|
|
|
|
|
05-02-2026, 10:24 AM
|
#44 |
|
Junior Member
Posts: 4
Karma: 10
Join Date: Apr 2026
Device: Palma2pro
|
Hi Kisuke,
Awesome, thank you for the input. I've been using sum check to verify the boot loader, the boot and abl images. I don't think it is a software update as I didn't do anything between the start and the hang. I'll see what I can do with an EDL cable. At this point it is worth a shot. Thanks again! |
|
|
|
|
05-14-2026, 02:19 AM
|
#45 |
|
Enthusiast
Posts: 36
Karma: 53196
Join Date: Apr 2018
Device: Kobo Forma, Onyx Boox Palma 2 Pro
|
Just quick info about Palma 2 Pro update 2026-05-11_4.2-rel_05112_c56d9759e.
Instaling it did not work for first time. But I restored backed up vbmeta partition and then it worked. I found that this is the problem by reading logs using logcat: Code:
05-13 23:10:28.870 1645 1645 I update_engine: [INFO:partition_writer_factory_android.cc(42)] Virtual AB Compression disabled, using Partition Writer for `vbmeta` 05-13 23:10:28.871 1645 1645 I update_engine: [INFO:partition_writer.cc(165)] Opening /dev/block/bootdevice/by-name/vbmeta_b partition without O_DSYNC 05-13 23:10:28.872 1645 1645 I update_engine: [INFO:partition_writer.cc(99)] Caching writes. 05-13 23:10:28.872 1645 1645 I update_engine: [INFO:partition_writer.cc(177)] Applying 1 operations to partition "vbmeta" 05-13 23:10:28.967 1645 1645 E update_engine: [ERROR:fec_file_descriptor.cc(32)] No ECC data in the passed file 05-13 23:10:28.969 1645 1645 E update_engine: [ERROR:verified_source_fd.cc(56)] Unable to open ECC source partition /dev/block/bootdevice/by-name/vbmeta_a: Invalid argument (22) 05-13 23:10:28.970 1645 1645 E update_engine: [ERROR:partition_writer.cc(316)] The hash of the source data on disk for this operation doesn't match the expected value. This could mean that the delta update payload was targeted for another version, or that the source partition was modified after it was installed, for example, by mounting a filesystem. 05-13 23:10:28.970 1645 1645 E update_engine: [ERROR:partition_writer.cc(321)] Expected: sha256|hex = 96929C89CCD61002E499025E0F854D08272A88447D0F2E0108F7FAE002762757 05-13 23:10:28.971 1645 1645 E update_engine: [ERROR:partition_writer.cc(324)] Calculated: sha256|hex = 85ADE2B9AF906B324BE0987630CB113740D6EEF2848A3168BC1478C9D9EA1522 05-13 23:10:28.971 1645 1645 E update_engine: [ERROR:partition_writer.cc(335)] Operation source (offset:size) in blocks: 0:2 05-13 23:10:28.972 1645 1645 E update_engine: [ERROR:partition_writer.cc(258)] source_fd != nullptr failed. 05-13 23:10:28.972 1645 1645 E update_engine: [ERROR:delta_performer.cc(1023)] partition_writer_->PerformDiffOperation( operation, error, buffer_.data(), buffer_.size()) failed. 05-13 23:10:28.973 1645 1645 E update_engine: [ERROR:delta_performer.cc(194)] Failed to perform BROTLI_BSDIFF operation 5073, which is the operation 0 in partition "vbmeta" 05-13 23:10:28.973 1645 1645 E update_engine: [ERROR:delta_performer.cc(506)] unable to process operation: BROTLI_BSDIFF Error: ErrorCode::kDownloadStateInitializationError 05-13 23:10:28.974 1645 1645 E update_engine: [ERROR:download_action.cc(227)] Error ErrorCode::kDownloadStateInitializationError (20) in DeltaPerformer's Write method when processing the received payload -- Terminating processing 05-13 23:10:29.064 1645 1645 I update_engine: [INFO:delta_performer.cc(213)] Discarding 1050 unused downloaded bytes 05-13 23:10:29.114 1645 1645 I update_engine: [INFO:multi_range_http_fetcher.cc(175)] Received transfer terminated. 05-13 23:10:29.114 1645 1645 I update_engine: [INFO:multi_range_http_fetcher.cc(127)] TransferEnded w/ code 200 05-13 23:10:29.114 1645 1645 I update_engine: [INFO:multi_range_http_fetcher.cc(129)] Terminating. 05-13 23:10:29.115 1645 1645 I update_engine: [INFO:action_processor.cc(116)] ActionProcessor: finished DownloadAction with code ErrorCode::kDownloadStateInitializationError 05-13 23:10:29.115 1645 1645 I update_engine: [INFO:action_processor.cc(121)] ActionProcessor: Aborting processing due to failure. 05-13 23:10:29.116 1645 1645 I update_engine: [INFO:update_attempter_android.cc(694)] Processing Done. 05-13 23:10:29.172 1645 1645 I update_engine: [INFO:delta_performer.cc(1470)] Resetting recorded hash for prepared partitions. 05-13 23:10:29.174 1645 1645 I update_engine: [INFO:update_attempter_android.cc(722)] Resetting update progress. 05-13 23:10:29.201 1645 1645 I update_engine: [INFO:snapshot.cpp(2610)] Successfully unmapped snapshot product_b 05-13 23:10:29.237 1645 1645 I update_engine: [INFO:snapshot.cpp(2610)] Successfully unmapped snapshot system_b 05-13 23:10:29.273 1645 1645 I update_engine: [INFO:snapshot.cpp(2610)] Successfully unmapped snapshot system_ext_b 05-13 23:10:29.305 1645 1645 I update_engine: [INFO:snapshot.cpp(2610)] Successfully unmapped snapshot vendor_b 05-13 23:10:29.349 1645 1645 I update_engine: [INFO:snapshot.cpp(2610)] Successfully unmapped snapshot odm_b 05-13 23:10:29.350 1645 1645 I update_engine: [INFO:dynamic_partition_control_android.cc(311)] Destroying [odm_b, product_b, system_b, system_ext_b, vendor_b] from device mapper 05-13 23:10:29.376 1645 1645 I update_engine: [INFO:metrics_reporter_android.cc(159)] Current update attempt downloads 416 bytes data 05-13 23:10:29.431 1373 4311 W ForegroundServiceTypeLoggerModule: FGS stop call for: 10029 has no types! Except Pixel IMS patch for enabling VoLTE - now it is not persistent and it is needed to be enabled after every reboot, but then it works as usual. More investigation neded. There is big change in "e-ink wise" option "Stay active in the background". Now it is not just on/off. But there is time how long app can be active in background after leaving the app. But it can be set to "Unlimited". In all apps I need to run in background (fortunately it is only few apps for me) I had to set it to unlimited. Update "changed" my previous settings (I had those apps enabled for background running) and set it to 5 minutes for all apps. |
|
|
|
 |
«
Previous Thread
|
Next Thread
»
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Palma 2 Pro Notes App ? | itsme2020 | Onyx Boox | 7 | 12-20-2025 01:20 PM |
| Palma 3 in 2025? | norweger | Onyx Boox | 10 | 04-13-2025 11:10 AM |
| Palma 2 Released | twowheels | Onyx Boox | 62 | 01-10-2025 04:18 AM |
| Rooting: Onyx Boox Note Pro - Build 2019-06-12 | hansipansi65 | Onyx Boox | 12 | 01-25-2020 02:52 AM |
| Rooting the Poke Pro | bel3atar | Onyx Boox | 13 | 04-14-2019 09:49 PM |
All times are GMT -4. The time now is 05:13 AM.