Need Help Converting Boox P6Pro(Chinese version) firmware to Boox Palma 2 Pro(Global)

giamre · 07-04-2026, 01:43 PM

Hey guys! During my trip to China, I bought a Boox P6 Pro, which seemed to be exactly the same device as the Palma 2 Pro (but with a different name, as is often the case).
In fact, in terms of hardware, it seems to be the same thing, but on the software side, even though I managed to install the Play Store on it, it has several issues and often displays messages in Chinese.
Now I’d like to know if anyone has managed to—or can help me— convert to an international version.
I’m pretty comfortable working with ADB, the terminal, Android, etc.
Can anyone help me?
I’m attaching the libota_jni.so

Thank you

Renate · 07-04-2026, 11:18 PM

Thanks for the file.
I did find an update.upx for this model.

Code:

Model:  P6Pro (Chinese)
Finger: Onyx/P6Pro/P6Pro:11/2026-05-09_16-00_4.2-rel_05092_49329622e/8608:user/release-keys
Link:   http://firmware.boox.com/6958961c8549ece5b56d0845e6f2cc9c/update.upx
Size:   1,966,166,797
MD5:    6958961c8549ece5b56d0845e6f2cc9c

But something is screwy, I can't seem to decrypt this one.
Maybe they have the wrong link?

If you're not up to this version you can try updating.
If the link is wrong it won't do any harm.

giamre · 07-05-2026, 09:20 AM

I can't decrypt this file either.
When I try to install it as a regular “manual” update on the device, the decryption is successful, but it appears the message: “The update package is not compatible with this model”.

Renate · 07-06-2026, 12:52 AM

I did a quick check to see if I could decrypt it as another model.
I tried 100+ and no dice.

vuanh1408 · 07-07-2026, 02:43 AM

There is two model of P6pro: P6pro bw and p6pro color. The equivalent of Palma2pro is p6Pro Color, both have color screen. I can find two firmware for P6pro and P6ProC
P6ProC:

Code:

http://firmware.boox.com/717ae3b19263f00f336b7161370c0fd3/update.upx
MD5: 717ae3b19263f00f336b7161370c0fd3

P6Pro:

Code:

http://firmware.boox.com/6958961c8549ece5b56d0845e6f2cc9c/update.upx
MD5: 6958961c8549ece5b56d0845e6f2cc9c

Any chances OP's device is P6Pro Color and the firmware you are trying to decrypt is P6Pro BW's firmware, so u cant decrypt it?

vuanh1408 · 07-07-2026, 03:27 AM

Quote:

Originally Posted by giamre

Hey guys! During my trip to China, I bought a Boox P6 Pro, which seemed to be exactly the same device as the Palma 2 Pro (but with a different name, as is often the case).

Can you confirm yours is a BW or a Color version of P6pro?

Renate · 07-07-2026, 04:30 AM

Quote:

Originally Posted by vuanh1408

Can you confirm yours is a BW or a Color version of P6pro?

Yes, I can confirm that the libota that was posted is for the P6ProC.
If someone has the one for the B/W P6Pro it would be appreciated.
The key file has been updated.

Code:

Model:  P6ProC (Chinese)
Finger: Onyx/P6ProC/P6ProC:11/2026-05-09_16-53_4.2-rel_05092_49329622e/8611:user/release-keys
Link:   http://firmware.boox.com/717ae3b19263f00f336b7161370c0fd3/update.upx
Size:   2,034,413,118
MD5:    717ae3b19263f00f336b7161370c0fd3

giamre · 07-14-2026, 10:03 AM

Quote:

Originally Posted by vuanh1408

Can you confirm yours is a BW or a Color version of P6pro?

Sorry it took me a few days to reply, but I've been really busy.
I bought the color version.
I'll try again later with the new file and let you know.
Thank you so much!

giamre · 07-14-2026, 04:25 PM

Quote:

Originally Posted by Renate

Yes, I can confirm that the libota that was posted is for the P6ProC.
If someone has the one for the B/W P6Pro it would be appreciated.
The key file has been updated.

Code:

Model:  P6ProC (Chinese)
Finger: Onyx/P6ProC/P6ProC:11/2026-05-09_16-53_4.2-rel_05092_49329622e/8611:user/release-keys
Link:   http://firmware.boox.com/717ae3b19263f00f336b7161370c0fd3/update.upx
Size:   2,034,413,118
MD5:    717ae3b19263f00f336b7161370c0fd3

I managed to decrypt the update.upx for my Chinese P6 Pro and successfully extracted all the images via payload-dumper. I'm now trying to backup my original boot/recovery partitions via EDL before attempting any flash.
I set up bkerler/edl, but my device HWID is 0013f0e1 (CPU: bitra_SDM) and I can't find a matching firehose loader for it anywhere.
I'm stuck at this point, hoping I've done well so far. The problem is also that I'm on a Mac.
Any help to move forward?

Renate · 07-14-2026, 11:18 PM

It tells you what the Firehose loader for SM_BITRA and Palm2Pro is https://www.temblast.com/ref/onyxldr.htm

giamre · Yesterday, 04:15 AM

Quote:

Originally Posted by Renate

It tells you what the Firehose loader for SM_BITRA and Palm2Pro is https://www.temblast.com/ref/onyxldr.htm

You're amazing!
BUT.....
Now I'm stuck in a hard freeze with the Boox logo. During my attempt to cross-flash the Global firmware via EDL on my P6 Pro, I flashed the global ABL/XBL/AOP/DTBO/VBMETA. Unfortunately, the hardware didn't like the global drivers and now the device is frozen. It's amazing how many obstacles and safeguards there are that I have to find a way around every time and maybe I did something wrong...
I still have full EDL access and my original Chinese super partition is intact (hopefully). I think that I need to revert the low-level partitions to the Chinese stock ones to unbrick it. Does anyone have a direct link to the stock Chinese P6 Pro Colour firmware? Or any suggestion?

Also, once it's unbricked, what is the best way to proceed?

giamre · Yesterday, 04:38 AM

Just to add a fascinating detail: before I messed up the low-level partitions today, I had actually achieved a fully functional and amazing 'hybrid' device yesterday.
This happened right after I flashed ONLY the Global boot.img and recovery.img (from the Palma 2 Pro) via EDL, leaving the original Chinese super and low-level partitions untouched.
Upon booting, the device magically switched to Italian (my native language) and had the Google Play Store working perfectly! The craziest part is that Italian wasn't even available in the language settings of the Chinese firmware, and I never explicitly selected it anywhere. It seems the Global boot partition alone was enough to unmask the native Android locales and bypass the regional UI locks of the Chinese super partition.
Even the pre-installed WeChat and Chinese apps were almost all in Italian. Even going back to that state would be great, although perhaps with the first update everything would have gone back to how it was before.

Renate · Yesterday, 09:58 AM

Why did you flash that other stuff?
I don't even know what aop is.

Had you disabled verity before with --disable-verity --disable-verification ?
You are probably failing on vbmeta since you overwrote it.

giamre · Yesterday, 11:17 AM

Quote:

Originally Posted by Renate

Why did you flash that other stuff?
I don't even know what aop is.

Had you disabled verity before with --disable-verity --disable-verification ?
You are probably failing on vbmeta since you overwrote it.

You're totally right, it was a reckless move born out of sheer frustration. I kept hitting the 'update not allowed' error in Recovery, and fastboot is completely locked down (any command, including disabling verity, returns 'unknown command'). So I stupidly tried to force-flash the entire Global boot chain via EDL to bypass the region lock.
You are spot on about vbmeta failing. Sadly, I was in such a rush that I didn't back up those specific low-level partitions (abl, xbl, vbmeta, etc.) before overwriting them.
Do you by any chance have a dump of the stock Chinese P6 Pro partitions or a link to the Chinese update.upx? I just need those original files to make it boot again via EDL. Lesson learned!

giamre · Yesterday, 12:59 PM

Since we don't have the original Chinese raw partitions to rollback, I'm currently attempting a different route:
I have the full Global firmware extracted (system, vendor, product, etc.) and my original Chinese super.img backup.

My idea is to read the exact partition geometry/metadata of the Chinese super.img using lpdump, and then use lpmake to repack the Global image files into a new, fully-Global super_global.img matching that exact layout. Since the bootloader and vbmeta are already Global, flashing a matching Global OS partition via EDL should theoretically satisfy the AVB check and let the device boot.

If anyone has already mapped the super partition layout for SM_BITRA or has advice on the lpmake parameters, please let me know!

Am I making things too complicated, or is there a simpler way? If it’s turned into a paperweight, I might as well have some real fun with it at this point.

07-04-2026, 11:18 PM	#2
Renate Onyx-maniac Posts: 4,468 Karma: 22077803 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Thanks for the file. I did find an update.upx for this model. Code: Model: P6Pro (Chinese) Finger: Onyx/P6Pro/P6Pro:11/2026-05-09_16-00_4.2-rel_05092_49329622e/8608:user/release-keys Link: http://firmware.boox.com/6958961c8549ece5b56d0845e6f2cc9c/update.upx Size: 1,966,166,797 MD5: 6958961c8549ece5b56d0845e6f2cc9c But something is screwy, I can't seem to decrypt this one. Maybe they have the wrong link? If you're not up to this version you can try updating. If the link is wrong it won't do any harm.

07-07-2026, 02:43 AM	#5
vuanh1408 Connoisseur Posts: 70 Karma: 2024 Join Date: Jan 2014 Device: Tab 10C Pro, Boox Note X5 mini, Boox Note X5	There is two model of P6pro: P6pro bw and p6pro color. The equivalent of Palma2pro is p6Pro Color, both have color screen. I can find two firmware for P6pro and P6ProC P6ProC: Code: http://firmware.boox.com/717ae3b19263f00f336b7161370c0fd3/update.upx MD5: 717ae3b19263f00f336b7161370c0fd3 P6Pro: Code: http://firmware.boox.com/6958961c8549ece5b56d0845e6f2cc9c/update.upx MD5: 6958961c8549ece5b56d0845e6f2cc9c Any chances OP's device is P6Pro Color and the firmware you are trying to decrypt is P6Pro BW's firmware, so u cant decrypt it?

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Flash the global rom of Boox Page for Boox Leaf3 Chinese version	I_Love_Saigon	Onyx Boox	95	06-27-2026 03:47 AM
Boox Go 10.3 (Gen II) Lumi vs Palma 2 Pro - screen comparison	adorabledc	Onyx Boox	2	06-02-2026 12:44 AM
Need Help Converting Boox P6Pro(Chinese version) firmware to Boox Palma 2 Pro(Global)	Xyonine	Onyx Boox	1	03-30-2026 06:06 AM
Flashing a Chinese version of the Onyx BOOX Tab X C to Western version	Tom Swift	Onyx Boox	5	01-19-2026 02:10 AM
Help Needed: Flashing Global Firmware on Poke 4S (Chinese Version)	flowxd	Onyx Boox	12	07-10-2025 12:22 AM

07-05-2026, 09:20 AM	#3
giamre Junior Member Posts: 8 Karma: 10 Join Date: Jun 2026 Device: Boox P6Pro	I can't decrypt this file either. When I try to install it as a regular “manual” update on the device, the decryption is successful, but it appears the message: “The update package is not compatible with this model”.

07-06-2026, 12:52 AM	#4
Renate Onyx-maniac Posts: 4,468 Karma: 22077803 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	I did a quick check to see if I could decrypt it as another model. I tried 100+ and no dice.

07-14-2026, 11:18 PM	#10
Renate Onyx-maniac Posts: 4,468 Karma: 22077803 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	It tells you what the Firehose loader for SM_BITRA and Palm2Pro is https://www.temblast.com/ref/onyxldr.htm

Yesterday, 04:38 AM	#12
giamre Junior Member Posts: 8 Karma: 10 Join Date: Jun 2026 Device: Boox P6Pro	Just to add a fascinating detail: before I messed up the low-level partitions today, I had actually achieved a fully functional and amazing 'hybrid' device yesterday. This happened right after I flashed ONLY the Global boot.img and recovery.img (from the Palma 2 Pro) via EDL, leaving the original Chinese super and low-level partitions untouched. Upon booting, the device magically switched to Italian (my native language) and had the Google Play Store working perfectly! The craziest part is that Italian wasn't even available in the language settings of the Chinese firmware, and I never explicitly selected it anywhere. It seems the Global boot partition alone was enough to unmask the native Android locales and bypass the regional UI locks of the Chinese super partition. Even the pre-installed WeChat and Chinese apps were almost all in Italian. Even going back to that state would be great, although perhaps with the first update everything would have gone back to how it was before.

Yesterday, 09:58 AM	#13
Renate Onyx-maniac Posts: 4,468 Karma: 22077803 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Why did you flash that other stuff? I don't even know what aop is. Had you disabled verity before with --disable-verity --disable-verification ? You are probably failing on vbmeta since you overwrote it.

Yesterday, 12:59 PM	#15
giamre Junior Member Posts: 8 Karma: 10 Join Date: Jun 2026 Device: Boox P6Pro	Since we don't have the original Chinese raw partitions to rollback, I'm currently attempting a different route: I have the full Global firmware extracted (system, vendor, product, etc.) and my original Chinese super.img backup. My idea is to read the exact partition geometry/metadata of the Chinese super.img using lpdump, and then use lpmake to repack the Global image files into a new, fully-Global super_global.img matching that exact layout. Since the bootloader and vbmeta are already Global, flashing a matching Global OS partition via EDL should theoretically satisfy the AVB check and let the device boot. If anyone has already mapped the super partition layout for SM_BITRA or has advice on the lpmake parameters, please let me know! Am I making things too complicated, or is there a simpler way? If it’s turned into a paperweight, I might as well have some real fun with it at this point.