Tab Ultra C Pro - totally borked... but there may be hope

derget1212 · 04-16-2026, 10:29 AM

Hi All,

tldr - backstory

After Magisk and Boox 4.1.1 didn't play nice on my Tab Ultra C Pro, i ended up delving into edl to start fresh. I stupidly ended up doing:

Quote:

edl e super

which was the final nail in the coffin as I didn't know super was a dynamic partition holding system, system_ext etc. with a specific layout that cannot be rebuilt without a specific firehose .xml.

The reason I believe there is hope is, even though the super is borked and I can't get to regular recovery or fastboot, using the instructions here:

https://www.mobileread.com/forums/sh....php?p=4567106

I was able to get regular recovery to boot. I tried to flash multiple update.zip for 4.1 fw and 4.1.1 OTA fw, hoping to "reset" the super partition but all were unsuccessful.

After all this, I still have hope - I think what I need to do is flash a functioning super.img either from Boox or pulled from a functioning device with at least 4.1 fw. I opened a ticket with Boox asking for a flashable firehose or super.img, but their response is (currenty) "we don't share flashable zips". I am arguing back and forth to get a full firehose or at least a super.img.

My big asks from the forum

Does anyone have a stock super.img from a working TUCP device?
Is anyone be willing to pull a super.img from a functioning TUCP?
Is there a way to rebuild super.img any other way besides firehose.xml (which Boox won't share) or flashing a working super.img?

I really do love this device and I'm a hairs breath away from having it working again.
Any help is appreciated!

Renate · 04-16-2026, 12:47 PM

Yeah, the super manifest is a pain (but possible) to create from nothing.
It's easier to start with something halfway reasonable.
super does not contain anything personally identifiable so maybe somebody could donate it.

derget1212 · 04-16-2026, 02:02 PM

Quote:

Originally Posted by Renate

Yeah, the super manifest is a pain (but possible) to create from nothing.

I've used lpmake to build a super.img a few times, but its a total shot in the dark. I flashed the created super.img a couple of times. It flashes normally up to about 33%, then slows to a crawl and ultimately fails.

Quote:

It's easier to start with something halfway reasonable.
super does not contain anything personally identifiable so maybe somebody could donate it.

This is what I'm praying for

if someone donates the super.img, I will create a full flashable zip for recovery if anyone else runs into this issue AND keep it updated with ota updates.

Renate · 04-16-2026, 02:10 PM

Well, you really need only 1 MB of super, not the whole thing.

derget1212 · 04-16-2026, 08:43 PM

Quote:

Originally Posted by Renate

Well, you really need only 1 MB of super, not the whole thing.

I'm still waiting to hear back from Boox, but I reached out in a few other ways to see if I can pay someone to pull their super.img. I'm desperate

Is there a way to make an educated guess on the layout of super.img based on the system.img, system_ext.img etc? I used lpmake based on the file sizes in update.zip but I don't think that's exactly right, which is why the flash of my generated super.img wasn't successful.

Renate · 04-16-2026, 11:43 PM

Theoretically lpmake should do the job but you need more info.

I did a 50 line makefile for someone recently but that was only to modify their super.
And I just discovered a bug in it!

derget1212 · 04-16-2026, 11:49 PM

Quote:

Originally Posted by Renate

Theoretically lpmake should do the job but you need more info.

I did a 50 line makefile for someone recently but that was only to modify their super.
And I just discovered a bug in it!

what extra info do i need? I'm assuming partition alignment, which i don't have w/o firehose.xml unfortunately.

What bug did you find?? it wouldn't be the kind that will allow me to flash an update.zip would it?

Renate · 04-17-2026, 02:25 AM

Flashing an update.zip is no problem.
But it expects the manifest of super to be in good shape.

I meant that in the 50 lines I forgot to do the last SHA256 on slot 1.

derget1212 · 04-18-2026, 12:54 PM

Quote:

Originally Posted by Renate

Flashing an update.zip is no problem.
But it expects the manifest of super to be in good shape.

I meant that in the 50 lines I forgot to do the last SHA256 on slot 1.

I found an older version of the boox tab ultra c full fw and tab 10 c pro (because they're the same device afaik for different regions) and flashed recovery.img from the tab 10 c pro, flashed misc-recovery and was able to boot into tab 10 c pro recovery that ID'd an older FW. I tried doing the same with a recovery.img from an older tab ultra c pro fw and misc-recovery, but when the tablet reboots, it stays in fastboot and i can't get into recovery. Any ideas? is the FW I have just too old?

I'm hoping by some luck from heaven I can flash an older recovery.img, then flash the most recent update.zip to

get this thing working again.

I've also written scripts for arch and windows to backup all partitions (except userdata) and zip in case someone on the forum or elsewhere has a working tab ultra c pro and would be will graciously share their super.img - this should make the process super easy. I am also going to offer a bounty for a working super.img in the flea market if that's the appropriate place?

Renate · 04-18-2026, 01:35 PM

If you save the whole thing as one big file, you can dissect it later with dd if someone needs a part.
That's more reliable than keeping 100 files.

For somebody who wants to volunteer to help:
This is UFS, so there are 6 LUNs.
Look at your GPT, find out where the super is, dd out or EDL the first 1MB.

Eternalcat · 04-20-2026, 03:40 AM

If you want, this is my gpt readback, but it's from tab 10c Pro, you need test it.https://drive.google.com/file/d/1E6-...usp=drive_link

Renate · 04-20-2026, 06:03 AM

Well, that's the GPT. What we need is more like either:

Code:

edl /u0 /r /psuper /c256 man.img

Or

Code:

dd if=/dev/block/by-name/super of=/sdcard/man.img bs=4096 count=256

Eternalcat · 04-20-2026, 06:39 AM

this one？https://drive.google.com/file/d/1H00...usp=drive_link

Eternalcat · 04-20-2026, 07:40 AM

If you need, I build a super.img to flash my tab 10c Pro to Tab UltraC Pro, now it boot success. but Maybe it must disable avb,I`m not sure, my tab 10C pro need to disable the avb to boot.

Renate · 04-20-2026, 07:49 AM

LGTM, but is that for the exact same device?

Spoiler:

Code:

====== Slot 0 ======
03000 Header v10.2 (virtual_ab)
03100 P0 odm_a (readonly updated) E0 G1
03134 P1 product_a (readonly updated) E1 G1
03168 P2 system_a (readonly updated) E2-8 G1
0319c P3 system_ext_a (readonly updated) E9-10 G1
031d0 P4 vendor_a (readonly updated) E11-12 G1
03204 P5 odm_a-cow () E13 G2
03238 P6 product_a-cow () E14 G2
0326c P7 system_a-cow () E15 G2
032a0 P8 system_ext_a-cow () E16 G2
032d4 P9 vendor_a-cow () E17 G2
03308 E0 2048 - 4048 (2000) D0
03320 E1 4096 - 1092176 (1088080) D0
03338 E2 1093632 - 5129944 (4036312) D0
03350 E3 4048 - 4096 (48) D0
03368 E4 1092176 - 1093632 (1456) D0
03380 E5 5129944 - 5130240 (296) D0
03398 E6 5763432 - 5765120 (1688) D0
033b0 E7 6953904 - 7414840 (460936) D0
033c8 E8 7450992 - 7451008 (16) D0
033e0 E9 5130240 - 5763432 (633192) D0
033f8 E10 7414840 - 7415208 (368) D0
03410 E11 5765120 - 6953904 (1188784) D0
03428 E12 7415208 - 7450992 (35784) D0
03440 E13 7454648 - 7454896 (248) D0
03458 E14 7454896 - 7475752 (20856) D0
03470 E15 7475752 - 10845496 (3369744) D0
03488 E16 10845496 - 10857744 (12248) D0
034a0 E17 10857744 - 11890512 (1032768) D0
034b8 G0 default () 0 B
034e8 G1 qti_dynamic_partitions_a () 6.00 G
03518 G2 cow () 0 B
03548 D0 super 6.00 G (4.00 k, +0 B)

====== Slot 1 ======
13000 Header v10.2 (virtual_ab)
13100 P0 odm_b (readonly updated) E0 G1
13134 P1 product_b (readonly updated) E1 G1
13168 P2 system_b (readonly updated) E2-7 G1
1319c P3 system_ext_b (readonly updated) E8-9 G1
131d0 P4 vendor_b (readonly updated) E10-11 G1
13204 P5 odm_b-cow () E12 G2
13238 P6 product_b-cow () E13 G2
1326c P7 system_b-cow () E14 G2
132a0 E0 2048 - 4048 (2000) D0
132b8 E1 4096 - 1092176 (1088080) D0
132d0 E2 1093632 - 5129944 (4036312) D0
132e8 E3 4048 - 4096 (48) D0
13300 E4 1092176 - 1093632 (1456) D0
13318 E5 5129944 - 5130240 (296) D0
13330 E6 5763432 - 5765120 (1688) D0
13348 E7 6953904 - 7414840 (460936) D0
13360 E8 5130240 - 5763432 (633192) D0
13378 E9 7414840 - 7415208 (368) D0
13390 E10 5765120 - 6953904 (1188784) D0
133a8 E11 7415208 - 7454648 (39440) D0
133c0 E12 7454648 - 7456664 (2016) D0
133d8 E13 7456664 - 8549008 (1092344) D0
133f0 E14 8549008 - 12582912 (4033904) D0
13408 G0 default () 0 B
13438 G1 qti_dynamic_partitions_b () 6.00 G
13468 G2 cow () 0 B
13498 D0 super 6.00 G (4.00 k, +0 B)

====== Slot 2 ======
23000 Header v10.2 (virtual_ab)
23100 P0 odm_a (readonly) E0 G1
23134 P1 odm_b (readonly) G2
23168 P2 product_a (readonly) E1 G1
2319c P3 product_b (readonly) G2
231d0 P4 system_a (readonly) E2 G1
23204 P5 system_b (readonly) G2
23238 P6 system_ext_a (readonly) E3 G1
2326c P7 system_ext_b (readonly) G2
232a0 P8 vendor_a (readonly) E4 G1
232d4 P9 vendor_b (readonly) G2
23308 E0 2048 - 4048 (2000) D0
23320 E1 4096 - 1092176 (1088080) D0
23338 E2 1093632 - 5129944 (4036312) D0
23350 E3 5130240 - 5763432 (633192) D0
23368 E4 5765120 - 6953904 (1188784) D0
23380 G0 default () 0 B
233b0 G1 qti_dynamic_partitions_a () 6.00 G
233e0 G2 qti_dynamic_partitions_b () 6.00 G
23410 D0 super 6.00 G (1.00 M, +0 B)

====== Slot 3 ======
33000 Header v10.2 (virtual_ab)

====== Slot 4 ======
43000 Header v10.2 (virtual_ab)

====== Slot 5 ======
53000 Header v10.2 (virtual_ab)

====== Usage ======
    2048 - 12582912

04-20-2026, 06:03 AM	#12
Renate Onyx-maniac Posts: 4,426 Karma: 22077647 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Well, that's the GPT. What we need is more like either: Code: edl /u0 /r /psuper /c256 man.img Or Code: dd if=/dev/block/by-name/super of=/sdcard/man.img bs=4096 count=256

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
BOOX Firmware 4.0 Beta for Tab Ultra C Pro	stetre_76	Onyx Boox	2	01-17-2025 02:58 AM
successor for Tab Ultra C Pro to be expected soon?	lepau	Onyx Boox	2	12-18-2024 05:28 AM
Boox Note Air 3C vs. TAB ULTRA C PRO	lepau	Onyx Boox	5	04-28-2024 07:29 AM
About Tab 10c（ultra tab c）	MichaelSmith	Onyx Boox	2	03-17-2024 01:33 PM
Almost borked my Galaxy Tab	TallMomof2	Android Devices	6	02-20-2011 11:39 PM

04-16-2026, 12:47 PM	#2
Renate Onyx-maniac Posts: 4,426 Karma: 22077647 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Yeah, the super manifest is a pain (but possible) to create from nothing. It's easier to start with something halfway reasonable. super does not contain anything personally identifiable so maybe somebody could donate it.

04-16-2026, 02:10 PM	#4
Renate Onyx-maniac Posts: 4,426 Karma: 22077647 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Well, you really need only 1 MB of super, not the whole thing.

04-16-2026, 11:43 PM	#6
Renate Onyx-maniac Posts: 4,426 Karma: 22077647 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Theoretically lpmake should do the job but you need more info. I did a 50 line makefile for someone recently but that was only to modify their super. And I just discovered a bug in it!

04-17-2026, 02:25 AM	#8
Renate Onyx-maniac Posts: 4,426 Karma: 22077647 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Flashing an update.zip is no problem. But it expects the manifest of super to be in good shape. I meant that in the 50 lines I forgot to do the last SHA256 on slot 1.

04-18-2026, 01:35 PM	#10
Renate Onyx-maniac Posts: 4,426 Karma: 22077647 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	If you save the whole thing as one big file, you can dissect it later with dd if someone needs a part. That's more reliable than keeping 100 files. For somebody who wants to volunteer to help: This is UFS, so there are 6 LUNs. Look at your GPT, find out where the super is, dd out or EDL the first 1MB.

04-20-2026, 03:40 AM	#11
Eternalcat Member Posts: 19 Karma: 10 Join Date: Mar 2025 Device: BOOX TAB10CPro(TabUltraCPro CN)	If you want, this is my gpt readback, but it's from tab 10c Pro, you need test it.https://drive.google.com/file/d/1E6-...usp=drive_link

04-20-2026, 06:39 AM	#13
Eternalcat Member Posts: 19 Karma: 10 Join Date: Mar 2025 Device: BOOX TAB10CPro(TabUltraCPro CN)	this one？https://drive.google.com/file/d/1H00...usp=drive_link

04-20-2026, 07:40 AM	#14
Eternalcat Member Posts: 19 Karma: 10 Join Date: Mar 2025 Device: BOOX TAB10CPro(TabUltraCPro CN)	If you need, I build a super.img to flash my tab 10c Pro to Tab UltraC Pro, now it boot success. but Maybe it must disable avb,I`m not sure, my tab 10C pro need to disable the avb to boot.