Go 7 attempted root and now stuck on boox logo

[Grimbly1024]

My Go 7 Gen 2 should be arriving tomorrow - very keen to root it to remove all the spyware. Just wanted to ask if there's a full tutorial on how to do this on my mac ?

Just installing the software has been challenging!

[Renate]

Most people seem to go the Magisk route, er, root.
It's well documented and similar for all.
Just make sure that you use the boot image that is actually on your device.

[dcarvil]

Originally Posted by Grimbly1024

My Go 7 Gen 2 should be arriving tomorrow - very keen to root it to remove all the spyware. Just wanted to ask if there's a full tutorial on how to do this on my mac ?

Just installing the software has been challenging!

Make sure to read the posts on the previous page about rooting firmware 4.1.1 with magisk. That firmware version broke Magisk.

Also, rooting guides mentioning "fastboot flash" are outdated. Boox crippled fastboot several updates ago. Unless you are on older firmware, you will have to use edl to flash the patched boot image.

[Grimbly1024]

Hi All,

Sorry to appear stupid, but I got a bit lost with my first attempt and could do with a bit of help.

Firstly - what OS are you using ?

I tried using terminal on my mac and ended up with loads of issues with getting EDL to work.

I also tried various flavours of Linux and they all presented their own unique issues - some didn't like installing EDL.

I'm assuming that I also need to get the android (adb) stuff installed as well.

Once I've got the OS sorted am I correct that I need to get the BOOX into EDL mode by connecting the usb cable in EDL mode and then issue the adb reboot edl command ?

Thank you all so much in advance for your help.

[dcarvil]

Originally Posted by Grimbly1024

Hi All,

Sorry to appear stupid, but I got a bit lost with my first attempt and could do with a bit of help.

Firstly - what OS are you using ?

I tried using terminal on my mac and ended up with loads of issues with getting EDL to work.

I also tried various flavours of Linux and they all presented their own unique issues - some didn't like installing EDL.

I'm assuming that I also need to get the android (adb) stuff installed as well.

Once I've got the OS sorted am I correct that I need to get the BOOX into EDL mode by connecting the usb cable in EDL mode and then issue the adb reboot edl command ?

Thank you all so much in advance for your help.

I use Fedora and edl from https://github.com/bkerler/edl. That site also hosts a LiveDVD that has everything already packaged. If not using the LiveDVD, you'll need Android Platform Tools from https://developer.android.com/tools/...platform-tools.

Don't know what "connecting the usb cable in EDL mode" means, but yes, "adb reboot edl" is one way to get into edl mode.

I can't help with Mac.

[Grimbly1024]

Some progress - got Fedora up and running and have adb and edl running.

Got the Boox to respond to an edb reboot edl and was able to check which partition was active.

Then, the following.

sudo edl --loader=gocolor7_loader.bin r boot_a boot_a.img
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Using loader gocolor7_loader.bin ...
main - Waiting for the device
main - Device detected
main - Mode detected: firehose
DeviceClass - USBError(5, 'Input/Output Error')
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
Traceback (most recent call last):

any ideas ?

Thanks in advance.

I have a feeling it may be related to getting the device in EDL mode - is there a knack to this or just trial and error ?

[Renate]

If this is a Go Color (Gen 2) then you're using the wrong Firehose.
https://github.com/bkerler/Loaders/b...1d8a_fhprg.bin

[Grimbly1024]

Hi,

Thanks for the reply.

So, I was using that Bin file.

I've tried lots of ways to get the device to boot into EDL mode and nothing happens.

I'm using a decent four wire USB cable.

Is there a confirmed way to get the Boox into EDL mode ?

Thank you.

[dcarvil]

Originally Posted by Grimbly1024

Some progress - got Fedora up and running and have adb and edl running.

Got the Boox to respond to an edb reboot edl and was able to check which partition was active.

Then, the following.

sudo edl --loader=gocolor7_loader.bin r boot_a boot_a.img
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Using loader gocolor7_loader.bin ...
main - Waiting for the device
main - Device detected
main - Mode detected: firehose
DeviceClass - USBError(5, 'Input/Output Error')
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
Traceback (most recent call last):

any ideas ?

Thanks in advance.

I have a feeling it may be related to getting the device in EDL mode - is there a knack to this or just trial and error ?

Once edl fails, you have to reboot the Boox to clear the failure, then put it back in edl mode again.

It should not make a difference, but breaking "sudo edl --loader=gocolor7_loader.bin r boot_a boot_a.img" into separate commands is how I did it.

sudo su -
change to whatever directory you were using before
edl --loader=gocolor7_loader.bin
edl r boot_a boot_a.img
edl reset

If that doesn't work, there may be a clue in the logs (sudo dmesg).

[Serdar1st]

Originally Posted by doomgoatman

Kept trying, was able to recover without the go7-rec.img. Go 7 (B/W) is recovered.
Flashing original boot images back via EDL did not fix it.

What worked:

EDL cable to get back into 9008 mode (no software path from fastboot to EDL exists on this device)
Flashed FP4 ABL, frp_oemunlock, stock boot/recovery from decrypted 4.1.1 firmware, and Renate's misc-recovery via EDL
Erased devinfo partition (frp_oemunlock alone was not enough to unlock, devinfo wipe was required)
fastboot reboot recovery from the now-functional FP4 ABL
Recovery screen rendered on e-ink. Page turn buttons work as volume up/down. Selected "Factory data reset"
Device booted. Restored stock ABL/FRP/devinfo from backups via EDL.

For anyone else in this situation: buy an EDL cable. It's the only way back in once you're stuck in fastboot with the locked stock bootloader. I used bkerler's Python edl tool from WSL2 since Windows fastboot had persistent driver issues with this device.

What is fairphone abl

[Renate]

Originally Posted by Grimbly1024

Hi,
Is there a confirmed way to get the Boox into EDL mode ?

EDL cables work if:

• The OEM put a test for USB D+ in the abl
• You didn't destroy the abl (or xbl, cmnlib, rpm, tz...)
• That you reset (with long power button) the device while the D+ is shorted, then un-short it

[Eamonnator]

i was following the guide on buduroiu.com and after patching with magisk and pushing the patched image to boot slot a it is now stuck on the boox logo and i have now idea how to recover/fix it

[Serdar1st]

Originally Posted by Eamonnator

i was following the guide on buduroiu.com and after patching with magisk and pushing the patched image to boot slot a it is now stuck on the boox logo and i have now idea how to recover/fix it

Can you in anyway share me devinfo.img file I accidentally deleted it without backup now I am in a deeper grave.

[Serdar1st]

Originally Posted by Grimbly1024

Hi,

Thanks for the reply.

So, I was using that Bin file.

I've tried lots of ways to get the device to boot into EDL mode and nothing happens.

I'm using a decent four wire USB cable.

Is there a confirmed way to get the Boox into EDL mode ?

Thank you.

Definitely get an edl cable. Cheap and more reliable than homemade.

bytheway can you in anyway share me devinfo.img I messed up my bootloader by erasing it.

[Serdar1st]

Originally Posted by doomgoatman

Got the Go 7 (B/W) rooted. Documenting the full process here for anyone else who wants to attempt it.

WHAT YOU NEED:
- EDL cable (Qualcomm 9008 deep flash cable with button). Not optional.
- FairPhone 4 ABL (abl.img from latest e/OS/ A15 build for FP4: https://doc.e.foundation/devices/FP4/install)
- fonix232's frp_oemunlock.img (from https://github.com/jdkruzr/BooxPalma2RootGuide/issues/9, Jan 13 comment)
- Renate's misc-recovery.prc (from this thread, post #3, rename to .img)
- Decrypted Go7 4.1.1 firmware (decrypt the .upx with https://github.com/Hagb/decryptBooxUpdateUpx, extract images with payload-dumper-go)
- EDL loader: 0000000000000000_bdaf51b59ba21d8a_fhprg.bin from https://www.temblast.com/ref/onyxldr.htm
- bkerler edl tool (https://github.com/bkerler/edl) running in WSL2. Windows fastboot was not able to consistently communicate with this device.
- Magisk APK and Termux APK
- Java, baksmali, and smali for the services.jar patch

PHASE 0: Download Firmware, Decrypt, and Extract Stock Images

Download

1. In your browser, navigate to:
   

   http://en-data.onyx-international.cn/api/firmware/update?where={"buildNumber":0,"buildType":"user","deviceMAC":"","lang":"en_US","model":"Go7","submodel":"","fingerprint":""}

2. The key you are looking for is

   "downloadUrlList": ...

3. Download the .upx file

Decrypt and extract

# Clone decryption tool
git clone https://github.com/Hagb/decryptBooxUpdateUpx.git
cd decryptBooxUpdateUpx
git submodule update --init --recursive

# Decrypt (Go7 keys are in BooxKeys.csv)
python3 DeBooxUpx.py Go7 /path/to/update.upx /path/to/update.zip

# Extract payload
unzip update.zip payload.bin

# Extract individual partition images
# Download payload-dumper-go from https://github.com/ssut/payload-dumper-go/releases
./payload-dumper-go -o stock_images payload.bin

PHASE 1: UNLOCK THE BOOTLOADER

The Go 7's stock bootloader is completely locked. All fastboot write commands return "unknown command." We need to replace it with the FairPhone 4 ABL which has full fastboot functionality.

Enter EDL Mode

1. Power off Go 7 completely (hold power 15+ seconds)
2. Plug in EDL cable, press/hold the button
3. Confirm "05c6:9008" appears in "usbipd list"

Attach USB to WSL

# Windows PowerShell (Admin)
usbipd bind --busid <BUSID>
usbipd attach --wsl --busid <BUSID>

Back up stock partitions

cd /path/to/edl
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r abl_a abl_a_backup.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r abl_b abl_b_backup.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r frp frp_backup.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r devinfo devinfo_backup.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r boot_a boot_a_backup.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc r boot_b boot_b_backup.img

Flash unlocked bootloader stack

# Stock boot to both slots
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w boot_a stock_images/boot.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w boot_b stock_images/boot.img

# FairPhone 4 ABL to both slots
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w abl_a fp4/abl.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w abl_b fp4/abl.img

# Unlocked FRP
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w frp frp_oemunlock.img

# Stock recovery to both slots
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w recovery_a stock_images/recovery.img
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w recovery_b stock_images/recovery.img

# Misc-recovery to trigger recovery boot
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w misc misc-recovery.img

# Erase devinfo (required for unlock to take effect)
sudo python3 edl.py --loader=go7_loader.bin --memory=emmc e devinfo

Boot into recovery and factory reset
Power cycle the device, it should enter fastboot. Attach to WSL via usbipd.
Check unlock status and reboot into recovery

fastboot oem device-info
# Should show: Device unlocked: true

fastboot reboot recovery

Recovery menu appears on e-ink screen. Page turn buttons navigate, power button selects. Select "Factory data reset". Device boots into Android.



PHASE 2: PATCH BOOT WITH MAGISK

Install Magisk and Termux APKs on the device.

Patch the boot image
Copy "stock_images/boot.img" to the Go 7's Download folder via USB File Explorer.

On the Go 7:

1. Open Magisk
2. Tap Install
3. Select "Select and Patch a File"
4. Navigate to Download, select "boot.img"
5. Wait for patching to complete
6. Copy the resulting "magisk_patched-XXXXX.img" back to your PC via USB File Explorer.

Flash Patched Boot

1. Power off, plug in EDL cable, press button. Attach to WSL.
2. Flash Magisk-patched boot to slot A ONLY

   sudo python3 edl.py --loader=go7_loader.bin --memory=emmc w boot_a magisk_patched-XXXXX.img
   sudo python3 edl.py --loader=go7_loader.bin reset

The device will boot into Android. Magisk's init runs but the Boox AMS bug will cause the Magisk app to freeze on splash and "su" to be inaccessible. This is expected and will be fixed in Phase 3.

Open Magisk, when Magisk opens for the first time, it shows a dialog: "Upgrade to full Magisk to finish the setup." Tap Install/OK. Let it download and complete. The app will freeze on splash after this. This is expected.

PHASE 3: FIX THE AMS BUG

This is the Boox WebView tracking bug in ActivityManagerService that crashes when it encounters Magisk's root daemon. Credit to dynamicfire for identifying this: https://github.com/dynamicfire/boox-ams-fix

The pre-built module from that repo will NOT work on the Go 7 because services.jar differs per device. You need to build your own.

Mount the stock system.img (read-only, from WSL):

cp stock_images/system.img /tmp/system.img
sudo mkdir -p /tmp/system_mount
sudo mount -t ext4 -o ro,loop /tmp/system.img /tmp/system_mount
cp /tmp/system_mount/system/framework/services.jar ./services.jar
sudo umount /tmp/system_mount

Disassemble:

# Download baksmali and smali
curl -sL -o baksmali.jar https://github.com/baksmali/smali/releases/download/v2.5.2/baksmali-2.5.2.jar
curl -sL -o smali.jar https://github.com/baksmali/smali/releases/download/v2.5.2/smali-2.5.2.jar

# Disassemble
unzip services.jar classes.dex
java -jar baksmali.jar d classes.dex -o smali_out

# Find the patch target
grep -n "addPackageDependency" smali_out/com/android/server/am/ActivityManagerService.smali

Open ActivityManagerService.smali. Find the addPackageDependency method. Locate the if-eqz line that branches to the label shared with UpdateWebViewUsedPkgsAction code (on my device it was if-eqz v1, :cond_4c).

Two edits:
1. Change that if-eqz branch target to :cond_return
2. Add :cond_return label on the line before return-void at the end of the method

Verify the patch:

# Should show: if-eqz v1, :cond_return
grep "if-eqz v1, :cond_return" smali_out/com/android/server/am/ActivityManagerService.smali

# Should show :cond_return before return-void at end of method
grep -A1 "cond_return" smali_out/com/android/server/am/ActivityManagerService.smali

Reassemble:

java -jar smali.jar a smali_out -o classes_patched.dex
cp services.jar services_patched.jar
cp classes_patched.dex classes.dex
zip services_patched.jar classes.dex

Build the Magisk module

mkdir -p boox-ams-fix-module/system/framework/oat/arm64

cp services_patched.jar boox-ams-fix-module/system/framework/services.jar

cat > boox-ams-fix-module/module.prop << 'EOF'
id=boox-ams-fix
name=Boox AMS Fix
version=v1.0
versionCode=1
author=dynamicfire (adapted for Go7)
description=Fix Magisk crash caused by Boox WebView tracking in ActivityManagerService
EOF

cat > boox-ams-fix-module/customize.sh << 'EOF'
SKIPUNZIP=0
EOF

cat > boox-ams-fix-module/post-fs-data.sh << 'EOF'
MODDIR=${0%/*}
EOF

cd boox-ams-fix-module
zip -r ../boox-ams-fix-go7.zip .
cd ..

Copy "boox-ams-fix-go7.zip" to the Go 7's Download folder via USB File Explorer.

PHASE 4: GET ROOT ACCESS AND INSTALL THE FIX

This is the trickiest part. The AMS bug prevents normal su access, but there is a workaround.

1. Open the Magisk app on the Go 7 (it will freeze on splash screen, leave it)
2. Fully power off the device (not sleep, hold power until it shuts down completely)
3. Power back on
4. Open Magisk again. It should get past the splash screen this time.
5. If Magisk asks about additional setup, tap OK and let it reboot.
6. After reboot, open Magisk (it freezes on splash again)
7. Leave Magisk on splash, switch to Termux
8. Type su and press enter
9. A superuser grant popup should appear. Tap Allow.
10. You should see a # root prompt

If Magisk's binaries are missing from /data/adb/magisk/ (you can check with ls /data/adb/magisk/ from the root shell), extract them manually from the APK:

# In root Termux shell
pm path com.topjohnwu.magisk
# Note the path, then:
cp /data/app/<path>/base.apk /data/local/tmp/magisk.zip
cd /data/local/tmp
unzip magisk.zip lib/arm64-v8a/* -d magisk_extract
mkdir -p /data/adb/magisk
cp magisk_extract/lib/arm64-v8a/libmagisk.so /data/adb/magisk/magisk64
cp magisk_extract/lib/arm64-v8a/libmagiskinit.so /data/adb/magisk/magiskinit
cp magisk_extract/lib/arm64-v8a/libmagiskboot.so /data/adb/magisk/magiskboot
cp magisk_extract/lib/arm64-v8a/libmagiskpolicy.so /data/adb/magisk/magiskpolicy
cp magisk_extract/lib/arm64-v8a/libbusybox.so /data/adb/magisk/busybox
chmod 755 /data/adb/magisk/*

With root in Termux, install the fix module:

mkdir -p /data/adb/modules/boox-ams-fix/
unzip /sdcard/Download/boox-ams-fix-go7.zip -d /data/adb/modules/boox-ams-fix/
reboot

After reboot, Magisk should open normally. Installed, root working, su accessible.

KNOWN ISSUES:
- Stock ABL cannot be restored after this procedure (re-bricks the device)
- OTA updates will likely break things. Disable com.onyx.android.onyxotaservice.
- fastboot boot with Magisk-patched images crashes the device. Must flash to disk via EDL.
- Windows fastboot.exe cannot see this device. Use WSL2 with usbipd.
- bkerler edl reports Error:{} on every write at 100%. Writes are successful (verify with read-back + sha256sum).
- fastbootd (userspace fastboot) does not support flash commands on this device.
- The full power off/on cycle (not sleep) is what breaks through the Magisk splash freeze. Regular sleep/wake does not work.

Thanks to Renate for misc-recovery.img, fonix232 for the FP4 ABL method, dynamicfire for identifying the AMS bug, and everyone in this thread for the collective knowledge that made this possible.

THANKS DUDE IT WORKED almost PERFECTLY. Except one little detail on my go color 7 gen 2 is I deleted

In addition to your guide to first part erasing and writing abl,boot,frp etc. in your way and deleting device info in fastboot thanks to misc_recovery write.

fastboot delete-logical-partition system_a
fastboot delete-logical-partition vendor_a
fastboot delete-logical-partition product_a
fastboot delete-logical-partition system_ext_a
fastboot delete-logical-partition odm_a

Recreated them with this

fastboot create-logical-partition system_a 0
fastboot create-logical-partition vendor_a 0
fastboot create-logical-partition product_a 0
fastboot create-logical-partition system_ext_a 0
fastboot create-logical-partition odm_a 0

used this

fastboot snapshot-update cancel

And finally gone back to adb and flashed the latest update

this allowed me to flash seamlessly update. I wont try to root again though so I didnt applied magisk.