Go Color 7 Gen II in EDL 9008, xbl_config zeroed in both slots – need a donor dump

[Mormyxa]

Hi all,

My Boox Go Color 7 Gen II is stuck in EDL 9008 (no LED, no screen). I need a dump of two tiny partitions from a working Gen II unit, and would really appreciate help.

What happened
I was trying to recover the device and by mistake flashed images extracted from the Gen I firmware (pre-device=GoColor7): xbl, abl, boot, dtbo, recovery, vbmeta, vbmeta_system (both slots). I have since realized the mistake and restored all of these from the correct Gen II OTA, and verified by reading them back that they match the OTA images in both slots.

Current state
- EDL works fine: loader 0000000000000000_bdaf51b59ba21d8a_fhprg.bin (bkerler/Loaders), --memory=emmc, bkerler edl on Windows. printgpt shows an intact GPT, and I can read and write partitions.
- Active slot is b.
- A full read of the small partitions shows that xbl_config_a and xbl_config_b (128 KiB each) are completely zeroed. Everything else in the boot chain has data (xbl, tz, hyp, aop, devcfg, keymaster, multiimgoem, featenabler, qupfw, uefisecapp, imagefv, abl, persist).
- The device returns to 9008 after reset, which is what I would expect with an empty xbl_config.
- The OTA payload does not contain xbl_config. It only has: abl, boot, dtbo, modem, odm, product, recovery, system, system_ext, vbmeta, vbmeta_system, vendor, xbl. So I cannot restore it from firmware.

Device info
- Firmware used (Gen II OTA): pre-device=GoColor7_2, post-build ONYX/TabBoox/TabBoox:13/TKQ1.230615.001/GV2.027.SQ83A, incremental 546, security patch 2026-04-01
- HWID: 0x0013f0e100000000 (MSM_ID 0x0013f0e1), CPU "bitra_SDM"
- PK_HASH: 0xd40eee56f3194665574109a39267724ae7944134cd53cb76 7e293d3c40497955bc8a4519ff992b031fadc6355015ac87
- eMMC: prod_name C21E00, total_blocks 122142720

What I am asking
Could someone with a working Go Color 7 Gen II please read just these two small partitions and share the files?

adb reboot edl
edl.py --loader=go7_loader.bin --memory=emmc r xbl_config_a xbl_config_a.img
edl.py --loader=go7_loader.bin --memory=emmc r xbl_config_b xbl_config_b.img

(each file should be exactly 131072 bytes)

Please also tell me your firmware build. Ideally GV2.027.SQ83A or newer; if yours is older, please let me know so I can judge whether it is safe to use.

Please do NOT share persist, devinfo, frp or any other partitions, they contain device-specific data.

If anyone knows another source for a valid Gen II xbl_config (for example from a QFIL package or a service image), that would also be very helpful. I have a full backup of all readable partitions, so I can verify and compare.

Thank you very much in advance!

[Renate]

I don't have any experience with those and have never looked into them.

On my Go6 the two xbl_config_x are identical.
They are typical SecureBoot signed 32 bit ELF images.
Besides the header and signing there are three program sections.
They seem to have gobble-dee-gook configuration data.

I know this is advice after the fact, but since you have EDL you could have made a complete, raw backup in one file.

[Mormyxa]

Thanks a lot for taking the time to answer, that's very helpful to know (identical a/b, signed ELF). Agreed on the full raw backup, lesson learned. I'll keep looking for a Gen II owner who can read xbl_config_a, and I'll only write something once I've verified it's a proper ELF of the right size. Thanks again!

[ardy]

Hello,

Sorry for late response, I was only checking the forums occassionally to see if someone has managed to perform a firmware upgrade on a device with the fairphone transplantation (as far as I know, no one did)

Because of the uncertainty after the transplantation procedure I'm still running firmware 4.1.1 with fingerprint GV2.023.SQ83A and I've uploaded the extracted partitions here: https://github.com/ardyln/boox-xbl

[Mormyxa]

@ardy – thank you very much for sending the xbl_config files. Writing them to xbl_config_a/b brought my Go Color 7 Gen II back from the dead: the power LED lights up again, the screen flickers when I hold the power button, and the device no longer drops into EDL 9008 by itself. I can still reach EDL via the test point, and printgpt/read/write work fine.

Unfortunately it still doesn't boot, and I can't get into recovery:
- No USB device appears on the PC at all after boot attempts (no adb, no fastboot).
- I wrote the stock Gen II recovery to recovery_a/b and tried a hand-made misc (BCB with "boot-recovery"/"recovery") – no reaction.

What happened (my mistakes, for context): I mistakenly flashed images from the Gen I firmware, then erased xbl_config, and overwrote the beginning of the super partition with a raw system.img. Afterwards I restored xbl, abl, boot, dtbo, vbmeta, vbmeta_system and recovery (both slots) from the Gen II OTA (GV2.027.SQ83A). I checked the beginning of super: the LP metadata is gone. misc, metadata and userdata are also erased. I don't know which firmware version was on the device before.

Your build is GV2.023.SQ83A, mine now has GV2.027.SQ83A files plus your xbl_config, so I'd like to rule out a mismatch.

If you are willing to help a bit more, could you please read these from the ACTIVE slot of your device (edl getactiveslot):
1. Small ones (a few MB total): xbl, abl, tz, hyp, aop, devcfg – I will only compare hashes with mine.
2. The first 1 MiB of super (edl rs <super start sector> 2048 head.bin) – I need the LP metadata layout (group names/flags).
3. If you are OK with a ~6 GB upload: the full super, plus boot, dtbo, vbmeta, vbmeta_system of the same slot, so that I can write a consistent GV2.023 set.

Please don't send persist, devinfo, frp or userdata. SHA256 sums would be great.

Also, does anyone have a link to Renate's misc-recovery.img attachment for the Go 7/Go Color 7 (the one used to reboot into stock recovery)? My own misc may simply be wrong.

[ardy]

Originally Posted by Mormyxa

@ardy – thank you very much for sending the xbl_config files. Writing them to xbl_config_a/b brought my Go Color 7 Gen II back from the dead: the power LED lights up again, the screen flickers when I hold the power button, and the device no longer drops into EDL 9008 by itself. I can still reach EDL via the test point, and printgpt/read/write work fine.

Unfortunately it still doesn't boot, and I can't get into recovery:
- No USB device appears on the PC at all after boot attempts (no adb, no fastboot).
- I wrote the stock Gen II recovery to recovery_a/b and tried a hand-made misc (BCB with "boot-recovery"/"recovery") – no reaction.

What happened (my mistakes, for context): I mistakenly flashed images from the Gen I firmware, then erased xbl_config, and overwrote the beginning of the super partition with a raw system.img. Afterwards I restored xbl, abl, boot, dtbo, vbmeta, vbmeta_system and recovery (both slots) from the Gen II OTA (GV2.027.SQ83A). I checked the beginning of super: the LP metadata is gone. misc, metadata and userdata are also erased. I don't know which firmware version was on the device before.

Your build is GV2.023.SQ83A, mine now has GV2.027.SQ83A files plus your xbl_config, so I'd like to rule out a mismatch.

If you are willing to help a bit more, could you please read these from the ACTIVE slot of your device (edl getactiveslot):
1. Small ones (a few MB total): xbl, abl, tz, hyp, aop, devcfg – I will only compare hashes with mine.
2. The first 1 MiB of super (edl rs <super start sector> 2048 head.bin) – I need the LP metadata layout (group names/flags).
3. If you are OK with a ~6 GB upload: the full super, plus boot, dtbo, vbmeta, vbmeta_system of the same slot, so that I can write a consistent GV2.023 set.

Please don't send persist, devinfo, frp or userdata. SHA256 sums would be great.

Also, does anyone have a link to Renate's misc-recovery.img attachment for the Go 7/Go Color 7 (the one used to reboot into stock recovery)? My own misc may simply be wrong.

Hello,

I've updated the repository to upload the partitions, keep in mind that the device is rooted with magisk and abl is from fairphone 4.

I'm not sure if I got the super start sector offset correctly so i'd appreciate if you could double check, and I'm looking into whether github will let me upload the whole remaining partitions.

I've also uploaded the sha256 sums and included my copy of misc-recovery living in my downloads folder since april. I don't know of any ways I could help further troubleshoot your setup (I'm not that experienced) but I'll happily send partitions and device info along the way.

[Renate]

cat misc-recovery.img
boot-recovery