Root Boox Note Air 3C

[dcarvil]

Originally Posted by farfromrefuge

finally a dumb question. Do I need an edl cable to root an air 3c (seeing we use edl commands make me wonder)? If so any cable.will do ? Or do we need some specific cable?

Thanks again for this community and the great job they do

EDIT: btw actually if we use the boot.img extracted from the upx to root using magisk, why do we need edl command? Must be a dumb question i am sure but seems like i could (if the bootloader is unlocked?) update air 3c to latest, download the corresponding upx, extract the boot.img, open it with magisk app, let magisk do the rest.

I can't answer all your questions, but the edl cable is needed only if you have no other way to get into edl mode. Usually you can do that by doing a reboot edl command. If you can do that, you do not need an edl cable.

Boox has crippled fastboot on recent updates so you can no longer use "fastboot flash" or "fastboot boot" commands. The only way to flash the magisk modified boot.img is with edl.

[Renate]

Sorry, I missed your post somehow.

Originally Posted by farfromrefuge

Anyone can confirm we have loader that works?

I don't know, don't remember. We can figure that out if you tell me the HWID/hash. More later.

Originally Posted by farfromrefuge

After that comes the question of the A/B partition.

Most things nowadays use A/B. Only one is active at a time. Flash the active one and you'll see a difference. Flash the inactive one and you won't notice. You can flash them both too. Many super partitions only have one "real" slot.

Originally Posted by farfromrefuge

Would be nice to also have commands to backup/restore stock to ensure we can go back.

This is covered elsewhere.

Originally Posted by farfromrefuge

Like decrypt the image, extract android system jar, then build it again, then encrypt into upx again.

Possible, but pointless. For most users looking for a simple way Magisk is the solution. For hard-core nuts (raises hand) there are better ways to modify a system.

Originally Posted by farfromrefuge

Do I need an edl cable?

ADB in normal system allows you to "reboot edl". You'll need a custom recovery to access ADB in recovery. The bootloader (fastboot) may support commands. An EDL cable on newer Onyx works. It's the basic one, that just shorts the green and black on the USB 2 pathway. In worse case there are test points inside that enable EDL mode. In worst cast disabling the flash memory compels EDL mode.

Originally Posted by farfromrefuge

Why do we need edl command?

Rooting devices without an update. Flashing devices when all flashing commands have been removed from abl (fastboot).

[farfromrefuge]

Thanks a lot from both of you for you answers. Things are getting clearer. So Renate from what you tell me (fastboot command removed), i understand that Magisk direct flash method is not working anymore on latest Boox devices (with latest update). Is that right?

And yes you are right about modifyng with magisk. Will look at doing that. Guess we were doing that for the Hisense a9 for people without root.

And so finally i think i will get an EDL cable to ensure i can make it work.

[Renate]

Flash memory   EDL Mode    Bootloader (fastboot)       Rooted Android  Stock Android  Custom recovery  Stock recovery
-------------  --------    --------------------------  --------------  -------------  ---------------  --------------
Read access?   Yes         No, unless engineering      Yes             No             Yes              No
Write access?  Yes         Maybe, if commands present  Yes             No             Yes              No

The current problem for some people is that some commands were removed from newer versions of fastboot and that you need EDL or to be already rooted somehow to install any sort of modified boot image.

[quaxlyqueen]

EDL is...daunting to say the least, and I'm getting the same results as others. Renate, do you have a link to your EDL client? Additionally, how does one determine a loader that works based on HWID/hash?

[Renate]

Originally Posted by quaxlyqueen

EDL is...daunting to say the least...

Nah, it isn't. I probably use EDL at least once a day on something and when I'm building a custom system or recovery probably a dozen times a day.

It's all under https://www.temblast.com/android.htm

The first step is just getting the HWID and hash, as detailed in the instructions.

And when you say "same results" a bit more details would be helpful.

Of course, it would be appreciated if you took a hammer and a big screwdriver and opened your unit so we could see what's inside it.

Did you already get/install 3.5.4 that came out in September?

[quaxlyqueen]

Renate, you said that given a HWID/hash you could potentially identify a loader. HWID seems to be a no go, the only result I found is https://github.com/bkerler/Loaders/b...5374_fhprg.bin and that did not work. The only other match is the G52 which you previously said to not use.

PK_HASH also is a bit of a dead end, it is 96 characters (which doesn't match the 16 used in Firehose, which also does not appear to use truncation).
Hash: d40eee56f3194665574109a39267724ae7944134cd53cb767e 293d3c40497955bc8a4519ff992b031fadc6355015ac87

I was wondering, if we knew the loader for say the Samsung Galaxy A23 4G which also uses the Snapdragon 680, could the loader for that work for the Boox Note Air 3C?

Out of curiosity, how can you use the HWID/hash to identify which loader to use?

Lastly, could you provide a link to your Windows-only EDL client?

Thanks

[Renate]

Originally Posted by quaxlyqueen

Lastly, could you provide a link to your Windows-only EDL client?

It's on the link above. That page include Windows utilities for Android and Android utilities for Android.

You didn't say what the HWID was. Snapdragon numbers can be unique or ambiguous.

Since d40eee... indicates Qualcomm signing we don't need to match the hash. But we do need to match the SoC, the PMIC, the flash type, etc. We can try to match using memory footprint. Be prepared to try a bunch of Firehose loaders.

Did you install 3.5.4 already?

I really could use an xbl for comparison. If somebody could pull a copy from an update it would make my life easier.

[kawaiishay]

Originally Posted by Renate

It's on the link above. That page include Windows utilities for Android and Android utilities for Android.

You didn't say what the HWID was. Snapdragon numbers can be unique or ambiguous.

Since d40eee... indicates Qualcomm signing we don't need to match the hash. But we do need to match the SoC, the PMIC, the flash type, etc. We can try to match using memory footprint. Be prepared to try a bunch of Firehose loaders.

Did you install 3.5.4 already?

I really could use an xbl for comparison. If somebody could pull a copy from an update it would make my life easier.

From: https://github.com/bkerler/edl/issues/534

I believe I found the loader that works linked.

However looks like "VIP" mode is enabled.

Does anyone have any resources/information on working with VIP locked devices?

C:\Users\shayn\Downloads\root_boox_onyx_devices\ed l>..\env_setup_dependencies\edl /l..\prog_firehose_ddr.elf
Found EDL 9008, handshaking... nope, resetting... version 2.1
HWID: 001b80e100000000, JTAG: 001b80e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending prog_firehose_ddr.elf 100% ok, starting... ok, waiting for Firehose... ok

C:\Users\shayn\Downloads\root_boox_onyx_devices\ed l>edl reset
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2024.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected
main - Mode detected: firehose
firehose
firehose - [LIB]: ERROR: Secure Boot *not* enabled BUT VIP *is* enabled. Therefore will *not* check digital signature on Digest Table. This allows easier testing on non-secure targets.

[Renate]

Originally Posted by kawaiishay

However looks like "VIP" mode is enabled.

Looks can be deceiving.

Just go back to my EDL page, select the Firehose loader for the NA3C.
I'm only responsible for my own software.

edl /lgoco7.bin
edl /u /g
edl /u /f /psplash /c1

[kawaiishay]

Originally Posted by Renate

Looks can be deceiving.

Just go back to my EDL page, select the Firehose loader for the NA3C.
I'm only responsible for my own software.

edl /lgoco7.bin
edl /u /g
edl /u /f /psplash /c1

Sorry I must've missed it on your page (https://www.temblast.com/edl.htm)

I don't see any links for the NA3C

Onyx Poke3, Leaf and Note Air 2 all use this loader
Onyx Nova Air 2 uses this loader
Onyx Max Lumi 2, Tab Ultra, Tab Ultra C uses this loader
Onyx Page, Go6 (Poke6) uses this loader
Onyx Go Color 7 uses this loader
Onyx Palma 2 uses this loader

Can you link the actual loader you're referring too (I only used the other tool because I couldn't find reference to NA3C on your tool walkthrough --- I would prefer to use yours as the walkthrough is very well written!)

[kawaiishay]

Oh!!! it's the link from

Onyx Go Color 7 uses this loader

thank you so much!!

(if it's easy enough it might help Google-ers to mention that works for the NA3C as well. Google told me originally had the same CPU as the Tab Ultra C which is clearly incorrect based on your loaders. The answer was right under my nose the whole time >.<)

[Renate]

Your browser's cache also let you down. It says:

Onyx Go Color 7, Go 10.3, Note Air 3C uses this loader

[kawaiishay]

With the correct loader everything else was smooth as butter! I'm officially rooted on the latest update! thank you again @Renate

[farfromrefuge]

Originally Posted by kawaiishay

With the correct loader everything else was smooth as butter! I'm officially rooted on the latest update! thank you again @Renate

Just for my info you did it with an edl cable?
Maybe you could share the list of commands you ran. Would help a lot of people to know how to get it right