Rooting Tab Ultra

[Venator3]

Ok that worked, output is:

/system/priv-app/OnyxOtaService/OnyxOtaService.apk: 1 file pulled, 0 skipped. 31.1 MB/s (405397 bytes in 0.012s)

And I now how the apk on my computer.

[Renate]

Originally Posted by Venator3

And I now have the apk on my computer.

Great. Now may I have it?
Rename it .zip and attach it to your post here.

[Venator3]

Oops, forgot to attach.

[Renate]

Thanks. Erm, some things have changed that make this not as easy as I thought.
I'll have to look at this tomorrow.

In any case if you want to proceed getting EDL to work...
But don't go crazy flashing things until you backup what you want to flash.

Edit: In post #4 https://www.mobileread.com/forums/sh...03&postcount=4
They say they got the decoding strings.
But they were never merged with the GitHub.
Anybody know what's going on?
Did they work?

[Renate]

Could you do me another favor?
Could you try this:

C:\>adb pull /system/priv-app/OnyxOtaService/lib/arm64/libota_jni.so

And post it, please?

[Venator3]

Sure, file is attached.

[Venator3]

I think for EDL the command to grab the boot.img is:

python edl.py --loader 0014d0e100000000_d40eee56f3194665_FHPRG.bin --memory=ufs <command>

Still not sure how to get a full backup. Is there any risk involved with running a bad command in EDL?

[Renate]

Originally Posted by Venator3

Sure, file is attached.

Thanks! I confirmed the strings reported already and posted them on GitHub.

Edit: The correct strings (in the new format) are in BooxKeys.csv

[Venator3]

Thank you! I now have the boot.img from the update. I would still like to figure out the command for a full backup in EDL to get the original boot img, I'm just not sure if it's possible to mess things up in EDL so I don't want to use the wrong command. But I will at least boot the patched boot.img and probably flash it if it works.

[Renate]

Originally Posted by Venator3

I would still like to figure out the command for a full backup in EDL to get the original boot img...

Well, then just do it. As long as you are only doing reads nothing bad will happen.
You need to load the Firehose loader, do your reads, then do a reset.
I'm tired of the Python one so I'll only give specifics for mine.

[snuggy]

Hey, I tried flashing my brand new Boox Tab Ultra (Black and White) with the guide here, and when I flashed the magisk'd boot.img and booted the backlight has stopped working.

When I tried flashing the edl'd image I took, the backlight doesn't work either.

What am I doing wrong here? I'm guessing that when I pulled the boot image, I used something that was incorrect -- any ideas which?

Thank you!

[Renate]

Mmm, maybe an update has caused your versions to be mixed.
Do you have ADB enabled?

C:\>adb shell lsmod

Does that show one line or twenty?
If it's one, then versions are probably not the problem.
If it's twenty...

The most recent TabUltra version is:

Model:  TabUltra (English)
Finger: Onyx/TabUltra/TabUltra:11/2023-11-22_08-58_3.5_946657f755/43508:user/dev-keys
Link:   http://firmware-us-volc.boox.com/00135b572b9d321902f87c9d71a7f17f/update.upx
Size:   1,561,582,806
MD5:    00135b572b9d321902f87c9d71a7f17f

You might try to download that to your desktop, then ADB push to /sdcard.
Then:

C:\>adb shell am start -a onyx.settings.action.firmware

And do an update.

Then, because you've lost root, you can extract the current boot image from update.upx (after decrypting) or EDL read the current boot image.

[mariocord]

Hi,

I have an Onyx Boox Tab Ultra (non-C, purchased Nov 2022, Snapdragon 662) that got bricked back in January during an OTA firmware update — power/update failed mid-way and it's been stuck at the ONYX boot logo ever since, no matter how I try to reboot it.

It does NOT show up in normal fastboot or adb devices. The only way I can get it to respond at all is using a test-point short cable with a button, which puts it into EDL (Sahara) mode.

I tried various recovery/flashing attempts back in January (with some help from ChatGPT) without success, but at the time I was on Windows. Since then I've migrated my PC to Ubuntu (around April), so I no longer have my old Windows setup or any of the tools/files I used back then.

I set up bkerler's edl.py on Ubuntu and ran `edl printgpt`. Here's what it reports:

```
HWID: 0x001740e100000000 (MSM_ID:0x001740e1, OEM_ID:0x0000, MODEL_ID:0x0000)
CPU detected: "kamorta_IoT_APQ"
PK_HASH: 0xd40eee56f3194665574109a39267724ae7944134cd53cb76 7e293d3c40497955bc8a4519ff992b031fadc6355015ac87
Serial: 0xdb19616f
```

None of the auto-detected generic loaders (quectel mdm9x05, SDM855LA, sdm662 factory, sc8180x factory) work — uploading any of them fails with "Error: Invalid data size received in image header".

Since the CPU string comes back as "kamorta_IoT_APQ", I'm guessing this needs the specific Onyx/kamorta firehose loader (signed for this exact PK_HASH) rather than a generic Qualcomm one, which Onyx doesn't publish publicly.

Does anyone have the correct firehose loader (and ideally the full rawprogram/patch images) for the Tab Ultra (non-C, kamorta platform)? Happy to run any further diagnostics needed. Thanks so much in advance!