Boox Leaf 2 general discussion - Page 3

denisuu · 12-09-2022, 04:30 AM

Quote:

Originally Posted by kandwo

Thank you, that solved it! Yes, I changed the orientation so that I can use it with my right hand. I really don't understand why they've made it default to have the buttons on the left.

It doesn't matter much to me, as the device is symmetrical you wouldn't even know when you're holding it "upside-down" if it wasn't for the Boox logo on the front. I'm right handed but I mostly hold the e-reader in my left hand. Doesn't make much difference reading-experience wise in which hand I hold the device.

As for the border, the perfect e-reader doesn't exist haha.

I'd like it to be all black with a 10" screen and 1 or 2GB more RAM. So basically a Onyx Note in black, with page-turn buttons, without the note-taking capabilities.

popej · 12-09-2022, 07:25 AM

I have found my "edl cable"

I can give it a try, but I have read, that headphone connection on USB-C could interfere. Does Leaf2 support headphones?

popej · 12-09-2022, 07:50 AM

There is some effect: Leaf2 looks dead after inserting this edl cable. No change on screen and no reaction to power button. And I can't see any new devices on PC. Only long press on power button restart device.

I'm rather reluctant to experiment with this rusty cable. I have fond, that there is USB-C version of cable, see here (I'm not sure if I can public links yet):

Code:

https://www.mobilerdx.com/2022/12/how-to-make-qualcomm-modified-type-c-edl-cable-latest-security.html

denisuu · 12-09-2022, 09:15 AM

Quote:

Originally Posted by popej

There is some effect: Leaf2 looks dead after inserting this edl cable. No change on screen and no reaction to power button. And I can't see any new devices on PC. Only long press on power button restart device.

Using the EDL terminals inside the device you have to keep pressing the power-button while shorting the terminals until you hear/see it connect in Windows. Sometimes it goes into 900e mode instead of 9008 mode.

Thanks for testing. I'll make my own cable for further testing.

denisuu · 12-09-2022, 10:54 AM

By reading the official spec sheet on Qualcomms website I figured out that QCS/QCM2290 are the same. (both are QCS_AGATTI)
Qualcomm spec-sheet: qcs-qcm2290-soc-product-brief_87-28731-1.pdf

When I searched a bit I found found some information on blog.csdn.net
There are 13 articles on QCM2290 on that website and a few on AGATTI.

This one looked interesting. From what I can make of it, you need to short Ground &U SB D+ (so the basic EDL cable) then press volume up + volume down while booting.

It would be nice to know if there's a key combination for Fastboot too!

Qualcomm QCM2290 platform key combination into 9008

Rough translation
Requirements: Customers need to press the VOL_UP and VOL_DOWN key combinations to enter forced download mode when powering on, especially RESIN_N is used for VOL_DOWN.

Qualcomm source code default is to have a forced download function, when pressing vol- and vol+ when the key value is SCAN_ESC, the abl stage obtains this key value and enters the EDL process, the customer because of VOL- to reset, the code is configured KEYPWR reset and KEYPWR_AND_RESIN reset, when pressing POWER and VOL- at the same time will always restart, because:

Code:

POWER ON by KPDPWR, POWER OFF by S3 reset KPDPWR_ANDOR_RESIN

Solution: Set the following function in pm_device_post_init() to set the s3 reset configuration: time is 16s

Code:

diff --git a/BOOT.XF.4.1/boot_images/QcomPkg/Library/PmicLib/target/Agatti_pmCocos/system/src/pm_sbl_boot_oem.c b/BOOT.XF.4.1/boot_images/QcomPkg/Library/PmicLib/target/Agatti_pmCocos/system/src/pm_sbl_boot_oem.c
 index 31fe073a4..509a8d61b 100755
 --- a/BOOT.XF.4.1/boot_images/QcomPkg/Library/PmicLib/target/Agatti_pmCocos/system/src/pm_sbl_boot_oem.c
 +++ b/BOOT.XF.4.1/boot_images/QcomPkg/Library/PmicLib/target/Agatti_pmCocos/system/src/pm_sbl_boot_oem.c
 @@ -1052,6 +1052,7 @@ pm_device_post_init ( void )
    err_flag |= pm_comm_write_byte(1, 0x5046, 0x80, 0);
    config_gpio_cam2_standby(INPUT);
    err_flag |= pm_comm_write_byte(0, 0x0880, 0xd4, 0);
 +  pm_pon_stage3_reset_source_cfg(0, PM_PON_RESET_SOURCE_RESIN, 32);
    
    return err_flag;
  }

Barty · 12-09-2022, 12:11 PM

Quote:

Originally Posted by kandwo

- The screen is one of the sharpest I've seen and an utter joy to read on. Considerably sharper than the Libra 2, which surprised me. Maybe the water proofing on the Libra 2 adds another slightly obfuscating layer?.

I have a Libra 2 so I'm very interested to hear this. They're both 300 dpi so I'm unsure what sharper means. I guess you mean contrast? How do they look with the lights off? Is the background on one lighter than the other? Is the text on one darker the other? Thanks

denisuu · 12-09-2022, 06:31 PM

I only understood half of what I posted above but I can confirm it works.

Holding the power button + volume down + the Qualcomm cable button on boot (or before rebooting) brings the device in Emergency Download Mode (EDL). So, in case of a brick you don't need to open the device.

Now that we know the ways to access EDL, we just need to find a loader so we can read/write to it.

I'll test UART tomorrow.

denisuu · 12-09-2022, 06:45 PM

Quote:

Originally Posted by Barty

I have a Libra 2 so I'm very interested to hear this. They're both 300 dpi so I'm unsure what sharper means. I guess you mean contrast? How do they look with the lights off? Is the background on one lighter than the other? Is the text on one darker the other? Thanks

MyDeepGuide has a video where he compares the two: Boox Leaf 2: In-Depth Review

I wouldn't upgrade to the Leaf 2 if I already had the Libra 2,unless PDF support or better performance is important. If I didn't have an e-reader I would pay the extra €30 for the Leaf 2.

Unless you hold them next to each other you probably couldn't tell much difference in screen quality. I borrowed a friends Libra 2 for while before my (white) Leaf 2 arrived, if the device is just used for reading books, both are great devices!

My opionion:

Libra2:
+ Better buttons, waterproof, more user friendly.
- Bigger, weighs more, terrible performance for anything else than e-books.

Leaf2:
+ Beautiful design, weighs less, handles PDF's well, a lot of flexibility.
- Not as intuitive, not waterproof, no kernel sources.

Renate · 12-09-2022, 07:11 PM

Quote:

Originally Posted by denisuu

By reading the official spec sheet on Qualcomm...

That's a great find.
It confirms some things that I've never had proof of.
The first is that (obviously) the test points are checked right in the ROM bootloader and will always work.
The "grounding USB D+" is in XBL and is dependent on whether the code is in there.
Also it necessitates standing on your head and having the timing correct.
I've never gotten it to work on any device, but it's probably just me.
I have done the "nuclear option" before and erased secondary bootloaders on things so that it had no choice but to go to ROM pbl.
In abl there can be any number of things that will make it go into fastboot.
There is usually detection for some things, unfortunately often buttons that don't exist. Sometimes screen touches, like corners. Or swipes.

In any case, where are the Firehose loaders for this thing?
Onyx (so far) has been very accomodating and not using Secure Boot.
One last shot in the dark is this loader: https://github.com/bkerler/Loaders/r...5106_fhprg.bin
It's for an SM/SMP_AGATTI.

Barty · 12-10-2022, 02:12 AM

Quote:

Originally Posted by denisuu

MyDeepGuide has a video where he compares the two: Boox Leaf 2: In-Depth Review
Libra2:
+ Better buttons, waterproof, more user friendly.
- Bigger, weighs more, terrible performance for anything else than e-books.

Leaf2:
+ Beautiful design, weighs less, handles PDF's well, a lot of flexibility.
- Not as intuitive, not waterproof, no kernel sources.

Yeah i wish this had been available when i bought the Libra. The tts and built in speaker are big plus. Lack of waterproofing i consider a plus because i never use mine around water and water proofing only makes it less repairable.

Android is a mixed bag because there's more flexibility but 2gb ram is really limiting. Do you need to root it to run Koreader?

Btw is there a Plato port for boox?

If there were an easy cost free way for me to try it, I'd upgrade and sell my Libra 2

P013onEr · 12-10-2022, 05:52 AM

Quote:

Originally Posted by pandaquq

Root Tutorial?
I wrote in Chinese in another forum but the translation tested well in English via microsoft egde.
https://www.yunyaokz.com/forum.php?m...extra=page%3D1

How did u sovle the 900E problem? Leaf2_P

I use your turial but stuck on 900E bootloop

Thx

denisuu · 12-10-2022, 06:53 AM

Quote:

Originally Posted by P013onEr

How did u sovle the 900E problem? Leaf2_P

I use your turial but stuck on 900E bootloop

Thx

Can you get the device into Recovery or Fastboot? Press the power-button 7 seconds on boot, then tap it 5 times to get into recovery. (You might have to try a few times, it's quite tricky)

If you manage to boot Fastboot, you can try switching the active boot partition. That fixed a bootloop for me. (Thanks @popej)

Code:

fastboot  --set-active=b

If you really can't get into Recovery or Fastboot you can get the device in 9008 mode by one of two methods. You won't be able to restore the device (YET) because we haven't found a loader to Firehose the device.

Tip: Renate has made some amazing tools for troubleshooting and EDL. I recommend having her USBlog tool open to see when the device is being detected.

Option 1: You can make a Qualcomm-EDL cable. You just need an old USB-C cable, cut it in half and solder a Momentary Push Button in between the green and black wire. There are a lot of tutorials on Youtube on how to make such a cable. Alternatively you could buy the cable of course.

Once you have the cable push Power + Volume Down + EDL-Cable button on boot. (Or reboot it with the 3 buttons pushed) This will most likely also take a few tries but eventually you'll get it into 9008 mode. (see first picture in the attachment)
Option 2: You can open the device and short the EDL pads while booting the device. See the second picture in the attachment for the locations.

denisuu · 12-10-2022, 07:06 AM

Quote:

Originally Posted by Renate

That's a great find.
It confirms some things that I've never had proof of.
The first is that (obviously) the test points are checked right in the ROM bootloader and will always work. The "grounding USB D+" is in XBL and is dependent on whether the code is in there.

Also it necessitates standing on your head and having the timing correct.

Yes the timing is a pain, but the same goes for shorting the EDL pads and getting in to Recovery. It's just trial and error until it finally works. I still haven't found a consistent way of getting in, I just keep holding all 3 buttons and release them randomly until I hear/see it being detected by Windows.

Quote:

Originally Posted by Renate

In any case, where are the Firehose loaders for this thing?
Onyx (so far) has been very accomodating and not using Secure Boot.
One last shot in the dark is this loader: https://github.com/bkerler/Loaders/r...5106_fhprg.bin
It's for an SM/SMP_AGATTI.

No luck, same result as all the others.

Code:

Waiting for Firehose... No response, poking...
Could not write device

So the only difference between QCM and QCS 2290 is LTE support. Is there a loader for QCM4290/QCS4290? They're also mentioned in the spec-sheet. How do you find these loaders? Do you have to download them all and open them with qcomview.exe to see which chipsets they support?

Maybe a loader for Qualcomm 630 (which CPU-z misidentifies it as) might work? I'm trying to figure out how the Python EDL program works while I'm waiting for the UART-USB to arrive.

Renate · 12-10-2022, 07:48 AM

Quote:

Originally Posted by denisuu

Maybe a loader for Qualcomm 630...

Did we try that: https://github.com/bkerler/Loaders/b..._asus_peek.bin

The closest in the '90 that I see is the QCA6390 which is in the QC factory SDM662 that you tried.

Yeah, I load the all the loaders into a directory then "qcomview * /s" and it lists all the models. I then search for the string to find which loader(s) that model is in.

Spoiler:

I can see on my hardware console that if you push and hold the power button after it does a reset it pauses the boot. If you hold it long enough it reboots to 900e. I've never found anything that you can do with that except get the serial number.
I can also see if you push the power button rapidly you can get:

Code:

KeyPress:258, BootReason:0

(vs. the normal KeyPress:0)
But it doesn't do anything.

Edit: If you hold Esc into the hardware console when it boots it will go to 9008
If you hold Backspace (^H) it will go to recovery

*** Stop the presses! I can get it into fastboot mode! ***
Reliably, no. But I've done it five times.
You'll need your UART for this.

Power reset until it starts booting, hold the backspace key down.
When it says "BootIntoMode detect begin" hold it for another 3 seconds, then release.
It should go into recovery.

Power reset until it starts booting, hold the backspace key down.
When it says "BootIntoMode detect begin" hold it for another 3 seconds, then release.
It should go into fastboot.

If it doesn't catch or reboots, just do the backspace again same as before.

Warning: Fastboot initially has a fast timeout. Do any command within 5 seconds. After that, take your time.

Code:

C:\>fastboot getvar all

(UART is 115200, 8 bit, no parody

)

denisuu · 12-10-2022, 09:56 AM

Quote:

Originally Posted by Renate

Did we try that: https://github.com/bkerler/Loaders/b..._asus_peek.bin...

I tested the loader but I get:

Code:

Sending 000ac0e100000000_7be49b72f9e43372_fhprg_asus_peek.bin   0%
End transfer returned error 12

I also tested the UART Serial-USB on a Raspberry Pi first to confirm it's working, then switched the 3,3v to 1,8v and tried it on the Leaf2. But I don't get any output.

This is how I wired it:

TX > RX
RX > TX
Ground > Ground

Maybe the RX trace needs to be bridged somewhere first?
Should it give output while booting or only in EDL-mode?

12-09-2022, 07:25 AM	#32
popej Connoisseur Posts: 50 Karma: 300 Join Date: Dec 2022 Device: onyx boox leaf 2 black	I have found my "edl cable" I can give it a try, but I have read, that headphone connection on USB-C could interfere. Does Leaf2 support headphones? Attached Thumbnails

12-09-2022, 07:50 AM	#33
popej Connoisseur Posts: 50 Karma: 300 Join Date: Dec 2022 Device: onyx boox leaf 2 black	There is some effect: Leaf2 looks dead after inserting this edl cable. No change on screen and no reaction to power button. And I can't see any new devices on PC. Only long press on power button restart device. I'm rather reluctant to experiment with this rusty cable. I have fond, that there is USB-C version of cable, see here (I'm not sure if I can public links yet): Code: https://www.mobilerdx.com/2022/12/how-to-make-qualcomm-modified-type-c-edl-cable-latest-security.html

12-09-2022, 10:54 AM	#35
denisuu Zealot Posts: 119 Karma: 90 Join Date: Dec 2018 Device: Onyx Leaf 2 (White)	By reading the official spec sheet on Qualcomms website I figured out that QCS/QCM2290 are the same. (both are QCS_AGATTI) Qualcomm spec-sheet: qcs-qcm2290-soc-product-brief_87-28731-1.pdf When I searched a bit I found found some information on blog.csdn.net There are 13 articles on QCM2290 on that website and a few on AGATTI. This one looked interesting. From what I can make of it, you need to short Ground &U SB D+ (so the basic EDL cable) then press volume up + volume down while booting. It would be nice to know if there's a key combination for Fastboot too! Qualcomm QCM2290 platform key combination into 9008 Rough translation Requirements: Customers need to press the VOL_UP and VOL_DOWN key combinations to enter forced download mode when powering on, especially RESIN_N is used for VOL_DOWN. Qualcomm source code default is to have a forced download function, when pressing vol- and vol+ when the key value is SCAN_ESC, the abl stage obtains this key value and enters the EDL process, the customer because of VOL- to reset, the code is configured KEYPWR reset and KEYPWR_AND_RESIN reset, when pressing POWER and VOL- at the same time will always restart, because: Code: POWER ON by KPDPWR, POWER OFF by S3 reset KPDPWR_ANDOR_RESIN Solution: Set the following function in pm_device_post_init() to set the s3 reset configuration: time is 16s Code: diff --git a/BOOT.XF.4.1/boot_images/QcomPkg/Library/PmicLib/target/Agatti_pmCocos/system/src/pm_sbl_boot_oem.c b/BOOT.XF.4.1/boot_images/QcomPkg/Library/PmicLib/target/Agatti_pmCocos/system/src/pm_sbl_boot_oem.c index 31fe073a4..509a8d61b 100755 --- a/BOOT.XF.4.1/boot_images/QcomPkg/Library/PmicLib/target/Agatti_pmCocos/system/src/pm_sbl_boot_oem.c +++ b/BOOT.XF.4.1/boot_images/QcomPkg/Library/PmicLib/target/Agatti_pmCocos/system/src/pm_sbl_boot_oem.c @@ -1052,6 +1052,7 @@ pm_device_post_init ( void ) err_flag \|= pm_comm_write_byte(1, 0x5046, 0x80, 0); config_gpio_cam2_standby(INPUT); err_flag \|= pm_comm_write_byte(0, 0x0880, 0xd4, 0); + pm_pon_stage3_reset_source_cfg(0, PM_PON_RESET_SOURCE_RESIN, 32); return err_flag; } Last edited by denisuu; 12-09-2022 at 11:08 AM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
How to root a Boox Leaf (7")	Geremia	Onyx Boox	42	11-10-2023 08:58 AM
Setting Resolution on Boox Poke/Leaf	Mr.Shortstop	Onyx Boox	4	06-28-2022 09:03 PM
General Discussion of Genres	Nyssa	General Discussions	37	03-17-2013 01:23 AM

12-09-2022, 06:31 PM	#37
denisuu Zealot Posts: 119 Karma: 90 Join Date: Dec 2018 Device: Onyx Leaf 2 (White)	I only understood half of what I posted above but I can confirm it works. Holding the power button + volume down + the Qualcomm cable button on boot (or before rebooting) brings the device in Emergency Download Mode (EDL). So, in case of a brick you don't need to open the device. Now that we know the ways to access EDL, we just need to find a loader so we can read/write to it. I'll test UART tomorrow.

Advert

Advert