Root for Note Air 2? - Page 6

Renate · 03-05-2022, 02:58 PM

Yeah, what you're showing me in UsbView is the normal mode of MTP/ADB.
We're only interested in th QUSB_BULK, but I can see that's working.
Just start fresh and fix the /llauncher.bin

readandread · 03-05-2022, 02:59 PM

I tried this with two "ll" at the beginning even though the filename is launcher.bin:

Quote:

C:\Users\David\edl>edl.exe /llauncher.bin
Found EDL 9008
ce 42 bf 1f
00 00 00 00 e1 d0 14 00
d4 0e ee 56 f3 19 46 65 57 41 09 a3 92 67 72 4a e7 94 41 34 cd 53 cb 76 7e 29 3d 3c 40 49 79 55
Sending launcher.bin.Received unexpected 04 command

Renate · 03-05-2022, 03:17 PM

Ok, the way that it knows how much to load is from loading the ELF header. Are you sure that you have a good ELF file there (launcher.bin)? Use a hex editor and look for <7f>ELF as the first 4 characters.

Code:

elfview sdm636.bin /p
 #  Type     Flags     Size  Offset  Address
--  -------  -----  -------  ------  --------
 0  null                792  000000  00000000
 1  null               6856  001000  85e28000
 2  load     RX      356508  003000  14015000
 3  load     RWZ          0  05A0A0  14077000
 4  load     RW       40704  05A0A0  1407a000
 5  load     RWX      39176  063FA0  14084800
 6  load     RWZ          0  06D8B0  85e10000
 7  load     RX        7804  06D8B0  146ae000
 8  load     RWZ          0  06F730  146b1000
 9  load     RWX     100568  06F730  14098000
10  load     RWZ          0  088010  146b2000
11  load     RWZ          0  088010  14680000
12  load     RX       77248  088010  14699000

(Sorry that's my own tool there. I don't know what else can show it.)

readandread · 03-05-2022, 03:22 PM

Quote:

Originally Posted by Renate

Ok, the way that it knows how much to load is from loading the ELF header. Are you sure that you have a good ELF file there (launcher.bin)? Use a hex editor and look for <7f>ELF as the first 4 characters.

Here's the file. I didn't find any mention of <7f>ELF in there.
launcher.bin

Renate · 03-05-2022, 03:27 PM

That's garbage. It's all HTML. Somebody copied a web page instead of the destination of a link or something.

Try this:

https://github.com/bkerler/Loaders/r...4665_FHPRG.bin

I checked it, it's 660,620 big and it is an ELF.

readandread · 03-05-2022, 03:34 PM

Quote:

Originally Posted by Renate

That's garbage. It's all HTML. Somebody copied a web page instead of the destination of a link or something.

That's the loader Cascade94 posted for the Note Air 2 here

Unless the filename is the issue. I copied the launcher file over again from github and tired again:

Quote:

C:\Users\David\edl>edl.exe launcher.bin
Found EDL 9008
Could not write device

C:\Users\David\edl>edl.exe /launcher.bin
Found EDL 9008
ce 42 bf 1f
00 00 00 00 e1 d0 14 00
d4 0e ee 56 f3 19 46 65 57 41 09 a3 92 67 72 4a e7 94 41 34 cd 53 cb 76 7e 29 3d 3c 40 49 79 55
Could not open auncher.bin

C:\Users\David\edl>edl.exe /llauncher.bin
Found EDL 9008
Received unexpected 12 command

C:\Users\David\edl>edl.exe /v text 0 10
Found EDL 9008
Wrote config...
<bad XML data>
<bad XML data>
Could not read device

C:\Users\David\edl>edl.exe /u text 0 10
Found EDL 9008
Wrote config...<bad XML data>

Renate · 03-05-2022, 03:39 PM

No, the issue is the file you posted is not a valid file.
Do you have a file that's 660,620 big now?

readandread · 03-05-2022, 03:42 PM

Quote:

Originally Posted by Renate

No, the issue is the file you posted is not a valid file.
Do you have a file that's 660,620 big now?

Yeah, I copied that one over again and tried again. Result is the error message from my previous comment.

Renate · 03-05-2022, 03:51 PM

You keep trying to load "auncher.bin".
You have to do a full reset when you mess up.

If the loader doesn't load don't bother trying things that need the loader.

There is a bug report already here (for the bin) https://github.com/bkerler/edl/issues/200

readandread · 03-05-2022, 04:26 PM

Quote:

Originally Posted by Renate

You keep trying to load "auncher.bin".
You have to do a full reset when you mess up.

If the loader doesn't load don't bother trying things that need the loader.

There is a bug report already here (for the bin) https://github.com/bkerler/edl/issues/200

I've tried again and now I get a different error, but it seems to have worked at least half way.

Quote:

C:\Users\David\edl>edl.exe /l0014d0e100000000_d40eee56f3194665_FHPRG.bin
Found EDL 9008
ce 42 bf 1f
00 00 00 00 e1 d0 14 00
d4 0e ee 56 f3 19 46 65 57 41 09 a3 92 67 72 4a e7 94 41 34 cd 53 cb 76 7e 29 3d 3c 40 49 79 55
Sending 0014d0e100000000_d40eee56f3194665_FHPRG.bin....... .................................................. .................................................. .................................................. ......... Ok
No Firehose detected, wrong loader?

Renate · 03-05-2022, 04:31 PM

Well, that's what I would expect. A generally valid loader, but not the one that will make this work.

Somebody mentions a patched loader in the last msg of the github link. I looked for it but got bored by websites with a dozen "Download" buttons.

Try to find the one they mention. Start fresh every time you fail. The Qcom protocol (Sahara) itself is the problem, it's so stupid and fragile.

readandread · 03-05-2022, 04:43 PM

Quote:

Originally Posted by Renate

Well, that's what I would expect. A generally valid loader, but not the one that will make this work.

Somebody mentions a patched loader in the last msg of the github link. I looked for it but got bored by websites with a dozen "Download" buttons.

Try to find the one they mention. Start fresh every time you fail. The Qcom protocol (Sahara) itself is the problem, it's so stupid and fragile.

Ok that helped. I now have no errors:

Quote:

C:\Users\David\edl>edl.exe /lprog_firehose_life_ddr_patched.elf
Found EDL 9008
ce 42 bf 1f
00 00 00 00 e1 d0 14 00
d4 0e ee 56 f3 19 46 65 57 41 09 a3 92 67 72 4a e7 94 41 34 cd 53 cb 76 7e 29 3d 3c 40 49 79 55
Sending prog_firehose_life_ddr_patched.elf................ .................................................. .................................................. .................................................. .. Ok
Firehose detected

but now what? It didn't give a file or anything.

Just for fun I also tried:

Quote:

C:\Users\David\edl>edl.exe /u text 0 10
Found EDL 9008
Wrote config... Ok
Wrote request... Ok
Receiving text.. Ok

On my Mac I tried

Code:

python3 edl printgpt --loader=prog_firehose_life_ddr_patched.elf --memory=ufs

and got this (lot's of output):
https://www.dropbox.com/s/dsqbqf9orn...utput.rtf?dl=0

Renate · 03-05-2022, 05:43 PM

You did get a file. Didn't you notice that you have one called "text".

So, it all works, now you just have to get the boot image.

Start fresh.

Code:

edl.exe /lprog_firehose_life_ddr_patched.elf /u boot.img 65414

(Copy this carefully.)

This should produce a file called boot.img somewhere around 15-20 megs.
Does it?

readandread · 03-05-2022, 06:01 PM

Quote:

Originally Posted by Renate

Start fresh.

Code:

edl.exe /lprog_firehose_life_ddr_patched.elf /u boot.img 65414

(Copy this carefully.)

Ok, this just pulls the boot.img off the device and does NOT write anything on the device. That's what I understood from the tool. Better to be safe than sorry

Renate · 03-05-2022, 06:02 PM

It does not alter anything on the device.
Did you do it?

03-05-2022, 03:17 PM	#78
Renate Onyx-maniac Posts: 3,969 Karma: 17500001 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Ok, the way that it knows how much to load is from loading the ELF header. Are you sure that you have a good ELF file there (launcher.bin)? Use a hex editor and look for <7f>ELF as the first 4 characters. Code: elfview sdm636.bin /p # Type Flags Size Offset Address -- ------- ----- ------- ------ -------- 0 null 792 000000 00000000 1 null 6856 001000 85e28000 2 load RX 356508 003000 14015000 3 load RWZ 0 05A0A0 14077000 4 load RW 40704 05A0A0 1407a000 5 load RWX 39176 063FA0 14084800 6 load RWZ 0 06D8B0 85e10000 7 load RX 7804 06D8B0 146ae000 8 load RWZ 0 06F730 146b1000 9 load RWX 100568 06F730 14098000 10 load RWZ 0 088010 146b2000 11 load RWZ 0 088010 14680000 12 load RX 77248 088010 14699000 (Sorry that's my own tool there. I don't know what else can show it.) Last edited by Renate; 03-05-2022 at 03:22 PM.

03-05-2022, 03:27 PM	#80
Renate Onyx-maniac Posts: 3,969 Karma: 17500001 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	That's garbage. It's all HTML. Somebody copied a web page instead of the destination of a link or something. Try this: https://github.com/bkerler/Loaders/r...4665_FHPRG.bin I checked it, it's 660,620 big and it is an ELF. Last edited by Renate; 03-05-2022 at 03:34 PM.

03-05-2022, 03:51 PM	#84
Renate Onyx-maniac Posts: 3,969 Karma: 17500001 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	You keep trying to load "auncher.bin". You have to do a full reset when you mess up. If the loader doesn't load don't bother trying things that need the loader. There is a bug report already here (for the bin) https://github.com/bkerler/edl/issues/200 Last edited by Renate; 03-05-2022 at 04:17 PM.

03-05-2022, 05:43 PM	#88
Renate Onyx-maniac Posts: 3,969 Karma: 17500001 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	You did get a file. Didn't you notice that you have one called "text". So, it all works, now you just have to get the boot image. Start fresh. Code: edl.exe /lprog_firehose_life_ddr_patched.elf /u boot.img 65414 (Copy this carefully.) This should produce a file called boot.img somewhere around 15-20 megs. Does it?

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Note Air 2 vs. Note 5	downeaster59	Onyx Boox	8	11-25-2021 06:28 AM
Onyx Boox Note Air+	ayme08	Onyx Boox	25	07-19-2021 05:41 AM
[HELP] Bricked Note Air after 3.1 fw update	hedeon	Onyx Boox	7	05-03-2021 01:18 PM
Boox Note Air <-> Dropbox	ganymede	Onyx Boox	1	12-12-2020 09:47 PM
Note Air vs Note 3	Futuregrace	Onyx Boox	1	10-04-2020 01:27 AM

03-05-2022, 02:58 PM	#76
Renate Onyx-maniac Posts: 3,969 Karma: 17500001 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Yeah, what you're showing me in UsbView is the normal mode of MTP/ADB. We're only interested in th QUSB_BULK, but I can see that's working. Just start fresh and fix the /llauncher.bin

03-05-2022, 03:39 PM	#82
Renate Onyx-maniac Posts: 3,969 Karma: 17500001 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	No, the issue is the file you posted is not a valid file. Do you have a file that's 660,620 big now?

03-05-2022, 04:31 PM	#86
Renate Onyx-maniac Posts: 3,969 Karma: 17500001 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Well, that's what I would expect. A generally valid loader, but not the one that will make this work. Somebody mentions a patched loader in the last msg of the github link. I looked for it but got bored by websites with a dozen "Download" buttons. Try to find the one they mention. Start fresh every time you fail. The Qcom protocol (Sahara) itself is the problem, it's so stupid and fragile.

03-05-2022, 06:02 PM	#90
Renate Onyx-maniac Posts: 3,969 Karma: 17500001 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	It does not alter anything on the device. Did you do it?

Advert

Advert