Root Boox Note Air 3C

[Renate]

Originally Posted by farfromrefuge

Just for my info you did it with an edl cable?

With a working system it's as easy as "adb reboot edl". It's only sometimes with a bricked device that you need an EDL cable or even EDL test points.

[farfromrefuge]

Does anyone knows a way to boot the Note Air 3c in safe mode? I am stuck on boot and i think it is caused by magisk. Would need to start in safe mode to disable it

[Renate]

Onyx don't have the normal boot screens that a phone has so it would be hard to see if Safe Mode even exists. It probably does but requires volume buttons.

You could replace the Magisk boot image with the stock boot image, but that will leave you without root and you won't be able to disable the Magisk module that is causing the problems.

You might be able to patch your Magisk boot image so that it will disable the conflicting module.

This all can be a sticky situation, one reason that I don't use Magisk.

[dcarvil]

Originally Posted by farfromrefuge

Does anyone knows a way to boot the Note Air 3c in safe mode? I am stuck on boot and i think it is caused by magisk. Would need to start in safe mode to disable it

If you still have adb, try this:

https://github.com/badabing2005/Magisk

[cronkdonkey]

Anyone have any additional tips for unbricking?

I successfully rooted my note air 3c on 3.5.4, but then I did some experimenting and messed things up...stuck on the onyx logo, not booting.

I tried to restore my system backup (minus userdata.bin, which I never backed up...) using `edl qfil rawprogram0.xml patch0.xml dumps_dir/lun01` for lun01 through lun05.

I have access to fastboot (crippled in the latest version) and edl using an edl cable. No adb. I also manually reflashed key partitions (boot, vbmeta), but still not booting.

(I even created a blank userdata.bin of the same size and flashed that, which probably screwed things up even more...I realize now I should have probably just read the entire flash to a single .bin...)

All I can figure is there is something is wrong with my backup...does anyone have the full stock firmware that I can flash? Would that save my $500+ brick? Again, I have edl mode, but nothing I do restores the ability to boot...

Also, in case people are having trouble following the thread (I did at first), the edl loader that worked for my note air 3c is 001b80e102e80000_8b2d1c830d9d8576_fhprg_moto_g52.b in

[Renate]

Many partitions are never included in even a full update.

If it were just a case of messed up Magisk a full update will fix that. You could even extract just the boot partition out of a full update.

[cronkdonkey]

Thank you, I appreciate the response. Still bricked!

I downloaded the 3.5.4 upx from boox, decrypted it, then flashed the boot partition with edl--no luck--then all of the other partitions in the update (except for system, vendor, and product, for which I'd need to rebuild a super partition to flash, from my limited understanding?). Still no luck. `fastboot reboot recovery` seems to do something, but it just again hangs on the onyx logo. Blue or purple led, onyx logo--that's all I can produce right now.

Come to think of it, I wonder if restoring my backup is what truly bricked things. I was having issues before that, caused by my own messing around, but I still had adb until I flashed the backup partitions...lesson learned, hopefully: always make a full, verified backup before tinkering...

Any unbricking tips?

[Renate]

Usually recovery is more bomb-proof than the normal system because it has less dependencies and no vbmeta.

When your device stalls on normal boot, are you sure that there is no ADB. ADB is technically independent of the Android subsystem, but is mostly started by it. Another reason that I make ADB entirely independent.

Bad userdata can break the normal system, but not recovery.

[DrunkProtos]

Took me a whole day to figure all the correct steps, but I'm dumb so that's par for the course.

Let's start by saying that if you have data on the device backup it in case of messing up, shouldn't need to mention it, but everyone makes mistakes and it's easy to forget things.

This guide is for 4.2 update, if you have pre-4.0, please copy it using edl and upload it somewhere.

For the sake of simplicity assume steps are written as if everything you download or extract is in the same folder, unless stated otherwise.

Start by installing adb and apktools.

Get edl working with your NA3C, if you've never used edl here's how:

1. Go to https://www.temblast.com/edl.htm, AND READ THROUGH THE ENTIRE PAGE, so you understand exactly what you are doing, it is much simpler than you think. Section that is very important is: Windows Drivers. At the bottom of the site is a link to download edl.exe, click it and download the file to our folder.
2. Get the loader for NA3C, if you haven't read the page, go to https://www.temblast.com/ref/onyxldr.htm and download the one where there's Note Air 3 C written in 'Models'.
3. Now that we have goco7.bin in our folder, we make sure adb can see your device by running

   adb devices

   then we run

   adb reboot edl

4. Now let's check if edl.exe sees our device by running simply

   edl.exe

   now if you have read the section Windows Drivers, you know that you should get just "Found EDL 9008" in response, if you got an error or something on top of that go to https://www.temblast.com/edl.htm and read the Windows Drivers section, you probably need to uninstall your current driver and install the correct one.
5. Run

   edl.exe /lgoco7.bin

   to load the loader.
6. Now we have edl recognizing our device so we can run other commands.
7. To reboot our device run

   edl.exe /z

8. When using edl.exe always start by loading the loader.

We need the boot.img, two ways to get it:

1. You will need python and python-protobuf.
2. Go to this link, there's a "downloadUrlList" property there, underneath that is the link to download update.upx, copy it to another tab and download it.
3. Go to this Github repo and download source, extract it in the folder.
4. In cmd, powershell or terminal run

   python DeBooxUpx.py NoteAir3C

   this should create an 'update.zip' file.
5. Extract the update.zip file, now you should see a 'payload.bin' file.
6. Go to another Github repo and download source, extract it in the folder.
7. Before you run

   python extract_android_ota_payload.py payload.bin

   make sure you have installed python-protobuf specifically any 3.20 version, otherwise the script won't work.
8. Run

   python extract_android_ota_payload.py payload.bin

   this should take a short while, now we finally should have boot.img.

Or

1. Setup edl and run

   edl.exe /u /r /pboot_a boota.img /t and edl.exe /u /r /pboot_b bootb.img /t

I'll let you decide which is easier.

Now we need to patch the boot partition, here's how:

1. Install Magisk on your NA3C. I got the pre-release v31.0, however I'm very much sure that v30.7 will work the same.
2. Transfer boot.img from PC to NA3C. If you copied them from your device, make sure to transfer both boota.img and bootb.img and don't mix them up.
3. Go into Magisk, click install, select your boot.img. If you have a and b, write down which is which.
4. Transfer the patched .img file from NA3C to PC. *you don't have to, but I've renamed the file to magisk.img, just so it's easier to reference.
5. We're backed up and ready to write our patched .img, run

   edl.exe /u /w /pboot_a magisk.img

   once that is done run

   edl.exe /u /w /pboot_b magisk.img

   Technically not necessary to write them both, but in for a penny in for a pound. If you have two patched images remember to change their names respectively
6. Run

   edl.exe /z

   and congrats! you should have a rooted NA3C.

We aren't done just yet, hopefully your NA3C boots normally, but Magisk freezes on boot right? It's broken like this for post-4.0 firmware.
This is the part that took me the longest to figure out, looking through Github issues on Magisk and figuring out what is the correct fix for the NA3C.

This part has been figured out by people smarter than me, I'll be just giving you (hopefully) easy to follow steps to fix Magisk.
Basically what we'll be doing is modifying a module that fixes Magisk on a different Boox model. I will attach the one I made, but I would recommend going through the steps to create your own as to not make your device bootloop. If your device bootloops because of this you can remove modules from Magisk in adb shell and if push comes to shove you can factory reset it.

You'll need a code editor that can search through files in a folder.

1. Let's start by opening Magisk and on running on our PC

   adb shell

   and then

   su

   on your NA3C there should be a pop up to grant superuser permissions, if you miss it, you can do all of this using Termux, after downloading Termux, opening it and running

   su

   you should get the same pop up. If you miss both, I haven't looked for other apps than Termux, but something that is similar would work, and if all else fails: factory reset gives you another chance to grant permissions.
2. In the adb shell run

   cp /system/framework/services.jar

   /storage/emulated/0/services.jar

   this will copy the file we need to the root of NA3C storage, giving us easy access to grab it just by mounting the NA3C.
3. Copy over 'services.jar' to our folder and run

   apktools d services.jar -f -o services/

   this will decompile the jar file and allow us access to internal classes? I'm actually unsure what we are doing, but it's gonna work trust
4. Open the newly created 'services' folder with a code editor of your choosing, I used VSC.
5. Using the search function of your code editor, search for

   addPackageDependency

   one result should come up, which for me was:

   .method public addPackageDependency(Ljava/lang/String;)V

   in

   /smali/com/android/server/am/ActivityManagerService.smali

6. Mark where was the line we just found, because in the same file, underneath it, we are looking for:

   com/android/server/am/ProcessRecord;->info

   if you use the search function it might jump to a different part of the file, so be mindful of that. If you found the correct line, there should be

   :cond_2

   couple lines above and

   return-void

   couple of lines below.
7. We want to move, not copy, move

   :cond_2

   to right above

   return-void

   so it looks like this:
   

   :cond_2
   return-void

8. Save and close, run

   apktool b --copy original -f services -o services.jar

9. Check that the services.jar has been modified.
10. Download boox-ams-fix-v1.1.zip from this link.
11. In this zip file we replace the services.jar inside with the one we just modified.
12. We have successfully modified the module for Magisk, now all that's left is to install it.
13. Transfer the zip file to the NA3C, take note of where you are putting it, I put it in the Download folder. *You don't have to but I renamed it to "fix.zip" for brevity.
14. Run

    adb shell

    then

    su

    then

    Magisk --install-module /storage/emulated/0/Download/fix.zip

    and lastly

    reboot

    Don't forget to change

    /storage/emulated/0/Download

    to the path of your choosing.
15. Magisk should now open without issues.

I found out how to make the module from here.

Yes I know some steps could be shorter, but I want to make sure you don't get lost along the way.
Hopefully I haven't forgotten anything, hopefully no device that follows this guide gets bricked, if it does I'm not responsible. Good luck have fun!