Anyone willing to "repair" an Onyx Note 2?

[tatteredscroll]

Originally Posted by Renate

No, I meant the custom recovery that I PM'ed you.

[tatteredscroll]

C:\Users\anon\Downloads\note2-edl>edl.exe /lnote2.bin
Found EDL 9008, handshaking... version 2
HWID: 000460e100000000 (x3), JTAG: 000460e1, OEM: 0000, Model: 0000
Hash: cc3153a80293939b-90d02d3bf8b23e02-92e452fef662c749-98421adad42a380f (x3)
Sending note2.bin 100% ok, starting... ok, waiting for Firehose... no response, poking... ok

C:\Users\anon\Downloads\note2-edl>edl /w /precovery note2-rec2.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting write note2-rec2.img... ok, writing 100% ok

C:\Users\anon\Downloads\note2-edl>edl /w /pmisc misc-recovery.prc
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting write misc-recovery.prc... ok, writing 100% ok

C:\Users\anon\Downloads\note2-edl>edl /z
Found EDL 9008, requesting reboot... ok

\\ I named the updated recovery note2-rec2.img
\\ at first glance console output looks very much the same
\\ making my way through the output
\\ https://pastebin.com/W2Yj5tx7

[Renate]

I don't see that it's doing anything.
Did you check for ADB?
Does Windows make sounds when you plug/unplug the USB?

This is very painful, we're up to 6 pages and we're not making progress.

[tatteredscroll]

I feel bad for taking up your time. I thought we had good progress getting EDL.

Nothing in ADB (see below). I have USB Event Logger running while placing device in EDL/9008 mode. I see EDL mode start and go green. Then when I tell it to reboot with edl /z it disconnects from EDL and does regular boot process. No new devices registered or logged. No bing-bong notifications. Not seeing Android device in Device Manager or zadig. Onyx logo on screen.

C:\Users\anon\Downloads\note2-edl>adb start-server
* daemon not running; starting now at tcp:5037
* daemon started successfully

C:\Users\anon\Downloads\note2-edl>adb devices -l
List of devices attached

C:\Users\anon\Downloads\note2-edl>adb shell
adb.exe: no devices/emulators found

[tatteredscroll]

Thanks again to Renate for all the help. Here is a write-up with help from AI on how it fixed it. I know people have strong feelings this way or that on AI. I'm thankful that it helped bring this device back to life.

The Note 2 is now up on stock `2024-01-03_07-30_3.5_1b692dcde`. Everything works, bootloader is still unlocked. I used the Universal Android Debloater Next-Gen to disable about 20 "apps", installed Nova Launcher.

## Why the earlier EDL flashes stopped short

We did get 9008, and the recovery write did succeed. `edl /w /precovery`, then `misc-recovery.prc`, then `edl /z` all reported ok, including with the custom recovery. After the reboot there was still no adb and no recovery menu. That part was real. It was not a bad flash and it was not a missing Windows driver.

UART at 115200 showed a normal Qualcomm boot into recovery: PBL, SBL1, ABL, unlocked, then the kernel with `is_recovery_mode: 1`. The misc boot command was `boot-recovery`. `misc-recovery.prc` sets that same command, so every reset was sent into recovery on purpose.

Recovery on this Note 2 starts the eink driver and then goes silent. USB loads and never enumerates. There is no menu to choose "wipe data" from, and adb never appears. Writing another recovery image still boots into that hang.

Clearing `boot-recovery` got one normal boot, and Android put the flag back by itself. Userdata had no ext4 superblock. This firmware treats that as a wiped encryptable data partition and writes `boot-recovery` plus `--wipe_data`. Recovery hung again before it formatted anything. So the usual "force recovery and let it wipe" path cannot finish on this unit. The filesystem has to be created from EDL, and misc has to be left empty.

The first empty ext4 used a 4 MB journal. Kernel 3.18 caps journal credits at `journal_blocks / 8`, which is 128. `installd` wanted 167 and died with error 28. That looks like a full disk. It is the journal refusing the transaction. A 64 MB journal on userdata (16 MB on cache) got past it. The new filesystem also has to be old-ext4: 4K blocks, no `metadata_csum` and no `64bit`.

The boot partition under all of that was still my old Magisk image from 13 Oct 2022. I think of that as the rooted 3.2 system. Wiping data removed `/data/adb`, but `magiskinit` was still there until 3.5 replaced boot. I did not use the on-device updater while that boot was installed. The updater checks the boot hash, and a mismatch writes `boot-recovery` again, which is the hang we already could not use.

## What actually got it to 3.5

EDL pads, same pair as in the photo markup: round gold pad (~1.8 V) and the empty square directly under it (~0 V), left edge of the lower shield, above the screw. Short only those two, and keep the short on through a long power hold. The red blink is 9008, not a low battery. The loader is bkerler's `000460e100290021_cc3153a80293939b_fhprg_peek.bin` . The OEM id in the name does not match this chip. The PK hash does.

From there: clear misc, build userdata and cache from EDL with a large enough journal, then install official 3.5 by writing boot, recovery, splash, vendor, and system. I did not write aboot, sbl1, or rpm. Stock 3.5 boot has no ramdisk, so Magisk is gone. `ro.boot.verifiedbootstate` is still orange.

The battery picture on the panel with USB plugged in is the sleep frame. A few seconds on the power button booted it. The build number matches the 3.5 package. USB debugging is under Apps, the three-line menu, App management. Tapping the build number does nothing.

I put the tablet on a guest SSID that can reach the internet and cannot reach the rest of the LAN. The first handwritten search wanted a network because the MyScript certificate check refuses to start offline. That check is small. The notes themselves stayed on the device. The Play Store was already in the 3.5 image. Once Wi-Fi was up it updated, and I signed in there. I have not created an Onyx account.

[Renate]

So you're saying that when it was broken neither the stock recovery or my custom recovery worked?
Have you gone back and checked both?

[tatteredscroll]

Originally Posted by Renate

So you're saying that when it was broken neither the stock recovery or my custom recovery worked?
Have you gone back and checked both?

Yes. Both were flashed while this was still the 3.3.1 system with the Magisk boot. System and vendor were not flashed, so vendor was still the old one. Stock was note2-rec.img, extracted from the 3.5 update.upx. Yours was the static-linked custom recovery you PM'd, flashed on 6 Oct 2025 as note2-rec2.img. Both writes reported 100%. misc-recovery.prc put it into recovery, and neither one reached a menu or adb.

The UART log showed is_recovery_mode: 1. The Onyx logo came up and it sat there. USB never enumerated, so there was no adb device and Windows made no USB sound. Swapping the recovery file did not change that. Magisk was on the boot partition, not in recovery.

During the fix, recovery was overwritten with the official 3.5 recovery.img from that same update.upx, and vendor was replaced with the matching 3.5 vendor. Recovery has not been booted since, so I have not retested your idea that stock recovery needed the matching vendor.