Root for Note Air 2?

[downeaster59]

Originally Posted by Renate

Sounds like driver isn't responding.

Add --debugmode
You should be seeing XML bopping back and forth.

It definitely looks that way.

[citytrader]

What are the advantages of rooting the Note Air 2?

[Renate]

I can't tell anything from that log, but it doesn't look good. Such a bunch of verbose trash.

grep \[LIB\] dl.txt
UsbClass - [LIB]:   CONFIGURATION 1: 2 mA ====================================
UsbClass - [LIB]: connect:0x80
UsbClass - [LIB]:
UsbClass - [LIB]: RX:010000003000000002000000010000000004000000000000000000000000000000000000000000000000000000000000
UsbClass - [LIB]:
UsbClass - [LIB]: TX:020000003000000002000000010000000000000003000000000000000000000000000000000000000000000000000000
UsbClass - [LIB]: get_rsp:0x80
UsbClass - [LIB]:
UsbClass - [LIB]: RX:0b00000008000000
UsbClass - [LIB]:
UsbClass - [LIB]: TX:0d0000000c00000001000000
UsbClass - [LIB]: get_rsp:0x80
UsbClass - [LIB]:
UsbClass - [LIB]: RX:0e000000100000000100000004000000
UsbClass - [LIB]:
UsbClass - [LIB]: TX:0f0000000c00000001000000
UsbClass - [LIB]: cmd_exec:0x4
UsbClass - [LIB]:
UsbClass - [LIB]: RX:403425c3
UsbClass - [LIB]:
UsbClass - [LIB]: TX:0d0000000c00000002000000
UsbClass - [LIB]: get_rsp:0x80
UsbClass - [LIB]:
UsbClass - [LIB]: RX:0e000000100000000200000018000000
UsbClass - [LIB]:
UsbClass - [LIB]: TX:0f0000000c00000002000000
UsbClass - [LIB]: cmd_exec:0x18
UsbClass - [LIB]:
UsbClass - [LIB]: RX:00000000e1d0140000000000e1d0140000000000e1d01400
UsbClass - [LIB]:
UsbClass - [LIB]: TX:0d0000000c00000003000000
UsbClass - [LIB]: get_rsp:0x80
UsbClass - [LIB]:
UsbClass - [LIB]: RX:0e000000100000000300000090000000
UsbClass - [LIB]:
UsbClass - [LIB]: TX:0f0000000c00000003000000
UsbClass - [LIB]: cmd_exec:0x90
UsbClass - [LIB]:
UsbClass - [LIB]: RX:d40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87d40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87d40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87
UsbClass - [LIB]:
UsbClass - [LIB]: TX:0c0000000c00000003000000
UsbClass - [LIB]: connect:0x80
UsbClass - [LIB]:
UsbClass - [LIB]: RX:010000003000000002000000010000000004000003000000000000000000000000000000000000000000000000000000
UsbClass - [LIB]:
UsbClass - [LIB]: TX:020000003000000002000000010000000000000000000000000000000000000000000000000000000000000000000000
UsbClass - [LIB]: get_rsp:0x80
UsbClass - [LIB]:
UsbClass - [LIB]: RX:12000000200000000d0000000000000000000000000000004000000000000000
UsbClass - [LIB]:
UsbClass - [LIB]: TX:7f454c460201010000000000000000000200b70001000000d8a08214000000004000000000000000000000000000000000000000400038001200000000000000
UsbClass - [LIB]: get_rsp:0x80
UsbClass - [LIB]:
UsbClass - [LIB]: RX:12000000200000000d000000000000004000000000000000f003000000000000
UsbClass - [LIB]:
UsbClass - [LIB]: TX:00000000000000070000000000000000000000000000000000000000000000003004000000000000000000000000000000000000000000000000000000002002001000000000000000a0e2850000000000a0e28500000000081d000000000000002000000000000000100000000000000100000005000000003000000000000000c081140000000000c081140000000064ff04000000000064ff04000000000000100000000000000100000006000000702f05000000000000d086140000000000d08614000000000000000000000000003000000000000000100000000000000100000006000000702f05000000000000008714000000000000871400000000a88d000000000000a88d0000000000000010000000000000010000000600000020bd05000000000000008814000000000000881400000000000000000000000000e00100000000000010000000000000010000000600000020bd0500000000000000e185000000000000e18500000000000000000000000040970100000000000010000000000000010000000500000020bd05000000000000e06a140000000000e06a14000000005c200000000000005c200000000000000010000000000000010000000600000080dd05000000000000106b140000000000106b1400000000740300000000000074030000000000000010000000000000010000000700000000e105000000000000e089140000000000e0891400000000a020020000000000a02002000000000000100000000000000100000006000000a00108000000000000306b140000000000306b14000000000000000000000000c01b00000000000000100000000000000100000006000000a001080000000000000068140000000000006814000000000000000000000000002f01000000000000100000000000000100000007000001a00108000000000000f88d140000000000f88d1400000000ac00000000000000ac00000000000000010000000000000001000000070000014c02080000000000acf88d1400000000acf88d1400000000e0c3000000000000e0c3000000000000010000000000000001000000070000012cc60800000000008cbc8e14000000008cbc8e1400000000043400000000000004340000000000000100000000000000010000000700000130fa08000000000090f08e140000000090f08e14000000000434000000000000043400000000000001000000000000000100000007000001342e09000000000094248f140000000094248f14000000000434000000000000043400000000000001000000000000000100000005000005386209000000000000806914000000000080691400000000006001000000000000600100000000000010000000000000
UsbClass - [LIB]: get_rsp:0x80
UsbClass - [LIB]:
UsbClass - [LIB]: RX:04000000100000000d00000012000000
UsbClass - [LIB]: Operation not supported or unimplemented on this platform

I'll have to look at this closer a bit later.

[downeaster59]

It might be best, after all, if I wait for a full firmware update to be available!

[yokos]

@downeaster59. The strings of Note Air 2 are missing on website of decryptBooxUpdateUpx. This would be a nice excercise to get these strings. Without frustration for sure.

[downeaster59]

Well, I discovered one "oops" that is the likely culprit in me not being able to move ahead with EDL mode. I thought that the Note Air 2 has a Snapdragon 662 CPU. Wrong! I learned that the "Bengal" code name covers more than one chip. I installed the CPU-Z app. The Note Air 2 has a Snapdragon 665 CPU. That would explain why the 662 EDL loader won't work for me! I've passed that info along to bkerler.

[Cascade94]

Hey guys, I came across this thread after just purchasing a Note Air 2 and wanting to root it (don't like the "phoning home to China" aspect) to install AFWall.

With the great start you all made, I managed to get the Note Air 2 rooted using Magisk, which is stable after reboots. I think the part we were missing is that the Note Air 2 doesn't use eMMC storage, it's UFS which you have to specify when using the edl tool.

* Guide assumes you already have developer mode enabled and ADB mode on your Note Air 2 *

Obtaining boot.img

1. Install the EDL tool mentioned earlier in the thread (https://github.com/bkerler/edl)
2. Ensure you have a backend (libusb) installed, you can Google how to install libusb for your platform
3. Download the SDM662 loader (https://github.com/bkerler/Loaders/b...4665_FHPRG.bin)
4. Reboot in to EDL mode (adb reboot edl)
5. Now we'll dump the boot partition. The new Onyx uses a and b partition slots, so for this I'm assuming 'a' is your active slot.
   

   edl r boot_a boot.img --memory=ufs --loader 0014d0e100000000_d40eee56f3194665_FHPRG.bin

6. If all has worked successfully, you should see a boot.img file

Patching boot.img

1. Download the latest Magisk APK on to your Note Air 2 and install it
2. Copy your downloaded boot.img to your device
3. In the Magisk app, select "Install", then select "Patch a file" and finally select your boot.img
4. It'll save a "magisk_patched" boot image in to your Downloads folder, copy this file back over to your PC

Testing & making permanent

1. Reboot in to fastboot mode - this'll take us to fastbootd (adb reboot fastboot)
2. Now go in to bootloader mode (fastboot reboot bootloader)
3. Now boot from your patched boot image (fastboot boot magisk_patched.img)
4. The device should power on normally. Open the Magisk app, check that Magisk has installed correctly...
5. If everything looks fine, select "Install", then select "Direct install" and wait for it to complete.
6. When you reboot, you should be still rooted - success!

I've included full instructions for you to make your own patched magisk image. I've attached the pre-patched one that I used to root my Note Air 2, if you want to use that. In that case you can skip straight to the "Testing & making permanent" part.

Magisk Patched Image: https://drive.google.com/file/d/1oje...ew?usp=sharing
Stock Boot Image: https://drive.google.com/file/d/1fRR...ew?usp=sharing

[downeaster59]

@Cascade94: Congrats on your first post, and thanks for the help!

[readandread]

Hi @Cascade94 & @downeaster59

I tried your command

edl r boot_a boot.img --memory=ufs --loader 0014d0e100000000_d40eee56f3194665_FHPRG.bin

but get the following error:

Traceback (most recent call last):
File "/usr/local/bin/edl", line 4, in <module>
__import__('pkg_resources').run_script('edlclient= =3.60', 'edl')
File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources/__init__.py", line 3241, in <module>
@_call_aside
File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources/__init__.py", line 3225, in _call_aside
f(*args, **kwargs)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources/__init__.py", line 3254, in _initialize_master_working_set
working_set = WorkingSet._build_master()
File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources/__init__.py", line 583, in _build_master
ws.require(__requires__)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources/__init__.py", line 900, in require
needed = self.resolve(parse_requirements(requirements))
File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources/__init__.py", line 786, in resolve
raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'pylzma' distribution was not found and is required by edlclient

I already tried:

pip install pylzma

but get this:

DEPRECATION: Configuring installation scheme with distutils config files is deprecated and will no longer work in the near future. If you are using a Homebrew or Linuxbrew Python, please see discussion at https://github.com/Homebrew/homebrew-core/issues/76621
Requirement already satisfied: pylzma in /usr/local/lib/python3.9/site-packages (0.5.0)

Any ideas how to fix this? I'm in the same boot, Note Air 2 wanting to root v3.2. Any help would be appreciated!

Update: I did manage to use the prepatched boot.img. However, the problem above still stands and it seems a few more users have faced the same or similar issues.

[downeaster59]

I have never gotten edl to work properly on my Note Air 2. I ended up using the boot.img that Cascade94 posted. Some people have had success with edl. I hope one of them responds to you!

[readandread]

Thanks for letting me know! @downeaster59

Do you happen to know how to fix this error (on a Mac)?

pkg_resources.DistributionNotFound: The 'pylzma' distribution was not found and is required by edlclient

If so, I can create future patch boot.img (e.g. the upcoming v3.2.1) and upload them.

[Renate]

Python makes me say bad words.

What version of edl do you have?
As far as I can see, this does not use pylzma, lzma, compress or decompress.
Can you grep for those words in your .py files?

Do you see "pylzma>=0.5.0" in any requirements.txt file?
Have you tried simply removing that line?

[readandread]

Originally Posted by Renate

Python makes me say bad words.

What version of edl do you have?
As far as I can see, this does not use pylzma, lzma, compress or decompress.
Can you grep for those words in your .py files?

Have you tried simply removing that line?

I can deal with bad words

I have v0.5.0 of pylzma and based on the error message

__import__('pkg_resources').run_script('edlclient= =3.60', 'edl')

version 3.6 of EDL.

In the setup.py it has the following:

install_requires=[
'colorama',
'docopt',
'usb',
'pyusb',
'pyserial',
'lxml',
'pylzma',
'pycryptodome',
'wheel'
],

Do you see "pylzma>=0.5.0" in any requirements.txt file?

Yes, I do.

Have you tried simply removing that line?

I removed that line in the setup.py and requirements.txt, still same problem.

As part of the error code refers to python 2.7

/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources/_

and in the setup it has a line

python_requires=">=3.7",

I'm wondering if that's the issue. However, I don't see an error related to the python version and it seems to have worked for you on 2.7.

I did also try uninstalling pylzma and trying to run the edl command again. Same issue. This makes no sense to me

Just FYI, I'm not a dev so I need terminal commands to follow along

[Renate]

Just try to get it to print help. python edl.py -h
Why, the hell do they not have a ".py" extension on the file? Are they too cool for that???

They changed a bunch in going to 3.6 from 3.52, presumably adding bells & whistles, but definitely dependencies.

I have no idea why they want/require pylzma. Just another stupid dependencies being dragged in. It's not used directly in the code.

Working with Python is like cooking for a friend who's just moved in. "Ok, where's the salt?" "Oh, I don't have that, I'll run out and get some..." "And some oil?" "Oh, yeah, I should get some of that..."

The last time I used this I swore I would write a standalone Windows version with no dependencies.

[readandread]

I seem to have made some huge progress...

I entered command:

david@iMac edl % python3 edl printgpt

and got:

Capstone library is missing (optional).
Keystone library is missing (optional).
Qualcomm Sahara / Firehose Client V3.60 (c) B.Kerler 2018-2022.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected
sahara - Protocol version: 2.1
main - Mode detected: sahara
sahara -
------------------------
HWID: 0x0014d0e100000000 (MSM_ID:0x0014d0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected: "SDM662"
PK_HASH: XXXXXXXXXX
Serial: XXXXXXX

sahara - Possibly unfused device detected, so any loader should be fine...
sahara - Trying loader: /Users/USER/Dropbox/Apps/BOOX/Jailbreak/edl/edlclient/../Loaders/0014d0e100000000_d40eee56f3194665_FHPRG.bin
sahara - Protocol version: 2.1
sahara - Uploading loader /Users/USER/Dropbox/Apps/BOOX/Jailbreak/edl/edlclient/../Loaders/0014d0e100000000_d40eee56f3194665_FHPRG.bin ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara
sahara - [LIB]: Error: Unknown host error received in HELLO_RESP
Connection detected, quitting.

Then I entered command:

david@iMac edl % python3 edl --loader=/Users/USER/Dropbox/Apps/BOOX/Jailbreak/edl/0014d0e100000000_d40eee56f3194665_FHPRG.bin

and got the following:

Capstone library is missing (optional).
Keystone library is missing (optional).
Qualcomm Sahara / Firehose Client V3.60 (c) B.Kerler 2018-2022.
main - Using loader /Users/USER/Dropbox/Apps/BOOX/Jailbreak/edl/0014d0e100000000_d40eee56f3194665_FHPRG.bin ...
main - Waiting for the device
main - Device detected
main - Mode detected: sahara

and here it has been stuck for quite a while without doing anything..