Failing to root a Max2 with 3.3.1 firmware

[luismc]

I've just bought a second hand Max2 that I'm trying to root with no success.

It came with version 1.8.3 from 2018, that couldn't connect to my wireless AP using WPA. After temporarily disabling authentication on my AP, I did an OTA update and I got version 3.3.1.

I obtained the same version's update bundle from the URL that I got from: http://en-data.onyx-international.cn/api/firmware/update?where={"buildNumber":0,"buildType":"user"," deviceMAC":"","lang":"en_US","model":"Max2","submo del":"","fingerprint":""}

I decrypted it with https://github.com/Hagb/decryptBooxUpdateUpx and I extracted the update.zip. I pushed boot.img to the ereader, installed Magisk, generated the patched image and pulled it back to the computer.

Enabled developer mode, enabled ADB, etc...

The device seemed to be locked. After looking at several ways of unlocking it, I managed to unlock it by doing:

$ fastboot oem unlock ; fastboot oem unlock_accept

After automatically rebooting and doing a factory reset:

$ fastboot getvar unlocked 
unlocked: yes
Finished. Total time: 0.000s

And now the problems start. 'flashing unlock' gives and error, although I don't think I need it.

$ fastboot flashing unlock
                                                   FAILED (remote: '')
fastboot: error: Command failed

$ fastboot boot magisk_patched-25200_2WNQW.img

doesn't work. The led stays blue, nothing changes in the screen and the device disappears from the USB bus. Same thing happens with the original image:

$ fastboot boot boot.img

which is weird.

I did:

$ fastboot flash boot boot.img

and the device rebooted fine, so I took the risk and tried flashing the patched image:

$ fastboot flash boot magisk_patched-25200_2WNQW.img

This breaks it and the device boots directly into recovery. Thankfully from there I can easily sideload the full image using ADB.

I've tried a few times with different magisk patched images using all combinations of the two options, verity and vbmeta (which I don't think I need anyway) with same results.

In summary:

- 'fastboot boot' doesn't work, the device hangs
- flashing the original boot.img doesn't break anything
- flasiing magisk patched images forces the device to always boot into recovery

Has anyone managed to root a Max2 with a recent firmware?

Additional questions:

- Is there any way to boot into fastboot mode using some key combination or from the recovery? At the moment, the process of having to sideload the full image to recover full adb access to be able to reboot into fastboot again is quite time consuming. It'd be great if I could just flash the original boot.img each time that boot breaks after flashing a patched one. I have not been able to boot into recovery (with a working system) either with the process I've seen around, pressing the power button for 7 seconds and then pulse it 5 times; it just boots normally.

- 3.3.1 feels sluggish, it's the main reason I wanted to root it, so I could try to tweak a few things. The main limitation seems to be the 2GB of RAM; most of the time the CPUs are just on iowait state, probably just moving pages back and forth from zram. I'm wondering if some previous version is less demanding in resources and works better. What versions are people here using?

- Are there any RockChip tools compatible with this device that allow to do a full dump and flash the device? I thought I could try the recovery image method of Magisk, but I worried that if I brick the recovery too I won't be able to restore the device again.

[luismc]

In case anyone here finds the information useful, and for the records, I finally managed to root the Max2 following some hints I was given on Reddit: using some RockChip flashing tools to dump the system partition (upgrade_tool and rkflashtool), mounting it on my Linux system, installing SuperSU manually on it and flashing it back.