Anyone able to root the Boox Page?

parkaymang · 11-21-2023, 06:24 PM

I see a lot of the guides for other models need the update.upx, but I do not know how to get this for the Page. I also saw one guide for the NA2, that doesn't seem to need it, but I am not sure if this will work with the Page. Does someone mind pointing me in the right direction?

Thanks so much.

Renate · 11-21-2023, 06:48 PM

I haven't seen any software update for the "Page" yet.
Is that exactly what it's called? (The "Poke5" is actually "Poke5P" in the US.)
If you have ADB or a terminal app:

Code:

adb shell
getprop|grep finger

Also, we don't know the processor number, the Firehose loader or the update decryption strings for this yet.
You can help.

Code:

cat /proc/cpuinfo

No, we don't need the whole mess. Does it say "BENGAL"? What's the last line?
Can you pull a file and post it, please?

Code:

adb pull /system/lib64/libota_jni.so

That way we can get the strings ready for when there is an update.

parkaymang · 11-25-2023, 08:42 AM

Quote:

Originally Posted by Renate

I haven't seen any software update for the "Page" yet.
Is that exactly what it's called? (The "Poke5" is actually "Poke5P" in the US.)
If you have ADB or a terminal app:

Code:

adb shell
getprop|grep finger

Also, we don't know the processor number, the Firehose loader or the update decryption strings for this yet.
You can help.

Code:

cat /proc/cpuinfo

No, we don't need the whole mess. Does it say "BENGAL"? What's the last line?
Can you pull a file and post it, please?

Code:

adb pull /system/lib64/libota_jni.so

That way we can get the strings ready for when there is an update.

Thanks so much for responding! Happy to help!

This is from the getprop|grep finger, don't really see a name anywhere though. In Settings > Model & Hardware > Model it just says Page.

Code:

[ro.bootimage.build.fingerprint]: [ONYX/BOOX/BOOX:11/RKQ1.210614.002/200:userdebug/release-keys]
[ro.build.fingerprint]: [ONYX/BOOX/BOOX:11/RKQ1.210614.002/200:userdebug/release-keys]
[ro.build.version.preview_sdk_fingerprint]: [REL]
[ro.odm.build.fingerprint]: [ONYX/BOOX/BOOX:11/RKQ1.210614.002/200:userdebug/release-keys]
[ro.product.build.fingerprint]: [ONYX/BOOX/BOOX:11/RKQ1.210614.002/200:userdebug/release-keys]
[ro.system.build.fingerprint]: [ONYX/BOOX/BOOX:11/RKQ1.210614.002/200:userdebug/release-keys]
[ro.system_ext.build.fingerprint]: [ONYX/BOOX/BOOX:11/RKQ1.210614.002/200:userdebug/release-keys]
[ro.vendor.build.fingerprint]: [ONYX/BOOX/BOOX:11/RKQ1.210614.002/200:userdebug/release-keys]

This is the last line in cpuinfo

Code:

Hardware	: Qualcomm Technologies, Inc BENGAL

It also corresponds to the device id on the computer which says Bengal IDP and a serial number.

MR wouldn't let me attach the libota_jni.so directly so it's in a zip file here.

What else can I do?

parkaymang · 11-25-2023, 09:32 AM

I also tried adb reboot bootloader, it rebooted to the onyx logo and then I ran the below:

Code:

$ fastboot getvar secure
secure: no
Finished. Total time: 0.002s

And running edl gives this:

Code:

$ python3 edl
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x2
------------------------
HWID:              0x0014d0e100000000 (MSM_ID:0x0014d0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "SDM662"
PK_HASH:           0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87
Serial:            REMOVED

sahara - Possibly unfused device detected, so any loader should be fine...
sahara - Trying loader: /home/ubuntu/edl/edlclient/../Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin
sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader /home/ubuntu/edl/edlclient/../Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.

Which seems like good news?

This device is so light and powerful. Would be a dream to free it from Onyx software.

On an unrelated note, not sure if this worry is founded, but i don't even feel comfortable plugging this device in its current state into my main machine. Not sure if it contains spyware etc. I'm doing all the above in a live environment.

Let me know what else I can do! Thanks!

Renate · 11-25-2023, 10:12 AM

Quote:

Originally Posted by parkaymang

What else can I do?

Nothing.

The 3.5 update is out:

Code:

Model:  Page
Finger: Onyx/Page/Page:11/2023-11-22_09-59_3.5_946657f755/43508:user/dev-keys
Link:   http://firmware-us-volc.boox.com/73efa5396d8ff9f53fd34a7e282b8053/update.upx
Size:   1522065675
MD5:    73efa5396d8ff9f53fd34a7e282b8053

DeBooxUpd.py has had a major change so load from https://github.com/Hagb/decryptBooxUpdateUpx
Put two files, DeBooxUpd.py and BooxKeys.csv into some directory.

There will be an update, but since you're the first Page, just insert this line in BooxKeys.csv
Page,Page,25CC82D3A7B62D4F03321946F135037D,8D2BC33 F82F6A14E04085574947687D0
(Unless I get to patching it first and it's already done.)
It's patched already.

You can root this the same as that thread "Rooting the Poke5".
That is, update first, then Magisk.

parkaymang · 11-25-2023, 12:19 PM

Quote:

Originally Posted by Renate

Nothing.

The 3.5 update is out:

Code:

Model:  Page
Finger: Onyx/Page/Page:11/2023-11-22_09-59_3.5_946657f755/43508:user/dev-keys
Link:   http://firmware-us-volc.boox.com/73efa5396d8ff9f53fd34a7e282b8053/update.upx
Size:   1522065675
MD5:    73efa5396d8ff9f53fd34a7e282b8053

DeBooxUpd.py has had a major change so load from https://github.com/Hagb/decryptBooxUpdateUpx
Put two files, DeBooxUpd.py and BooxKeys.csv into some directory.
There will be an update, but since you're the first Page, just insert this line in BooxKeys.csv

Code:

Page,Page,25CC82D3A7B62D4F03321946F135037D,8D2BC33F82F6A14E04085574947687D0

(Unless I get to patching it first and it's already done.)

You can root this the same as that thread "Rooting the Poke5".
That is, update first, then Magisk.

Wow ok that's great!

A few questions: I have heard some bad things about the recent update, and I am on 3.3.2 right now. Is there a way I can do this and keep my current version?

And similarly, how can i generate these myself?

Code:

Model:  Page
Finger: Onyx/Page/Page:11/2023-11-22_09-59_3.5_946657f755/43508:user/dev-keys
Link:   http://firmware-us-volc.boox.com/73efa5396d8ff9f53fd34a7e282b8053/update.upx
Size:   1522065675
MD5:    73efa5396d8ff9f53fd34a7e282b8053

This might tell me how to get the 3.3.2 file.

And lastly, a person in the root Note Air 2 Plus thread posted a linux script for rooting.
https://www.mobileread.com/forums/sh...=349397&page=3
Could I also use this to root instead?

Thanks so much!

Renate · 11-25-2023, 12:39 PM

The problem with updates is that at any time you can only get a link for the latest.
That's why it's helpful when you see an update to post the link somewhere.
The link is forever, but the info is only available for arbitrary periods of time.

The basic problem is extracting the boot image so that you can Magisk it.
If you have a Firehose loader, you can pull it directly.
If you don't you have to wait until an update appears so that you can extract the boot image.

Have you got EDL working? It's probably the qualcomm/factory/sdm662 one.

If you have EDL working and are concerned that you might have to rollback, you can dump the whole flash.
OTOH, it's probably better to just fix what's wrong with the new update.

parkaymang · 11-25-2023, 02:57 PM

Quote:

Originally Posted by Renate

The problem with updates is that at any time you can only get a link for the latest.
That's why it's helpful when you see an update to post the link somewhere.
The link is forever, but the info is only available for arbitrary periods of time.

The basic problem is extracting the boot image so that you can Magisk it.
If you have a Firehose loader, you can pull it directly.
If you don't you have to wait until an update appears so that you can extract the boot image.

Have you got EDL working? It's probably the qualcomm/factory/sdm662 one.

If you have EDL working and are concerned that you might have to rollback, you can dump the whole flash.
OTOH, it's probably better to just fix what's wrong with the new update.

I think my post #4 in this thread got delayed because it needed "moderator approval".
But in it i installed the linux EDL and got the output about the loader. It does seem like its sdm662.

Could i just use these instructions to pull the boot image, patch with magisk and flash on my current version?

Code:

 EDL mode
cd ..
adb reboot edl # reboot to edl
# ./edl/edl --loader=Qualcomm_662_loader.elf &&\
./edl/edl --loader=./edl/Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin &&\
    ./edl/edl r boot_a boot_a &&\
    ./edl/edl reset # use EDL loader, pull boot_a and reset 

t=45; echo "> waiting ${t}s for reboot" && sleep $t
adb push boot_a /sdcard/Download/
read -erp '> please install via Magisk and press <Return> when finished..'
patchedfile=$(adb shell 'ls -1 /sdcard/Download/' | tail -1 | grep patched)
adb pull /sdcard/Download/$patchedfile
adb reboot bootloader
t=15; echo "waiting ${t}s for bootloader" && sleep $t

read -erp '> flash (1); boot only (2): ' prompt
case $prompt in
    1) fastboot flash boot $patchedfile ;;
    2) fastboot boot $patchedfile ;;
    *) echo "no valid option; exiting, but remaining in fastboot mode. You may try 'fastboot flash boot ${patchedfile}' for flashing or 'fastboot boot ${patchedfile}' for testing yourself." && exit 1
esac
echo "> booting $patchedfile"
cd $_OLDDIR
echo "> all done; I hope it worked : )"

parkaymang · 11-25-2023, 05:20 PM

Quote:

Originally Posted by parkaymang

I think my post #4 in this thread got delayed because it needed "moderator approval".
But in it i installed the linux EDL and got the output about the loader. It does seem like its sdm662.

Could i just use these instructions to pull the boot image, patch with magisk and flash on my current version?

Code:

 EDL mode
cd ..
adb reboot edl # reboot to edl
# ./edl/edl --loader=Qualcomm_662_loader.elf &&\
./edl/edl --loader=./edl/Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin &&\
    ./edl/edl r boot_a boot_a &&\
    ./edl/edl reset # use EDL loader, pull boot_a and reset 

t=45; echo "> waiting ${t}s for reboot" && sleep $t
adb push boot_a /sdcard/Download/
read -erp '> please install via Magisk and press <Return> when finished..'
patchedfile=$(adb shell 'ls -1 /sdcard/Download/' | tail -1 | grep patched)
adb pull /sdcard/Download/$patchedfile
adb reboot bootloader
t=15; echo "waiting ${t}s for bootloader" && sleep $t

read -erp '> flash (1); boot only (2): ' prompt
case $prompt in
    1) fastboot flash boot $patchedfile ;;
    2) fastboot boot $patchedfile ;;
    *) echo "no valid option; exiting, but remaining in fastboot mode. You may try 'fastboot flash boot ${patchedfile}' for flashing or 'fastboot boot ${patchedfile}' for testing yourself." && exit 1
esac
echo "> booting $patchedfile"
cd $_OLDDIR
echo "> all done; I hope it worked : )"

Since I had to wait half a day for mobileread to approve my post and question above, I just decided to try the above. Would still value your feedback though @renate.

First at your suggestion, I used edl rf xxx.bin to dump full flash.

Then I followed the instructions above
Used edl r as above to pull boot_a
Then patched it w/ Magisk on my device
then pulled patched img back to computer and then ran fastboot boot with it first to test, and then fastboot flash boot after it looked like it worked.

Seems I am rooted now on 3.3.2 through multiple reboots

Anything that I need to keep in mind since i didn't do it with debooxupx? I never flashed vbmeta for instance.

Should I go back and do it the other way for?
and for 3.5, should I do it with debooxupx and then update on device and then flash, or can I just update to 3.5 on my device the way it is, and use the linux instructions above again?

Thanks!

(this post will probably need another half day to get approved...)

Renate · 11-25-2023, 06:32 PM

Sorry if we got out of sync. I don't know what happened but I just now read #4.

Be careful flashing stuff when you have an A/B device. Be sure to check which slot you are on. That's one of many reasons that I don't like "handy-dandy scripts".

If you're going to update to 3.5, just adb push update.upx to /sdcard
That will save downloading 1.5 GB again.

parkaymang · 11-25-2023, 07:39 PM

Quote:

Originally Posted by Renate

Sorry if we got out of sync. I don't know what happened but I just now read #4.

Be careful flashing stuff when you have an A/B device. Be sure to check which slot you are on. That's one of many reasons that I don't like "handy-dandy scripts".

If you're going to update to 3.5, just adb push update.upx to /sdcard
That will save downloading 1.5 GB again.

No problem, you're right I should have been more careful! How is it that I can tell which partitions i should patch and flash on a/b devices? e.g. boot_b vs boot_a (I am assuming all android 10+ are a/b)

Cool, so for the update i would do deboox and just adb push to sdcard.

Let me know if there is anything I can post more in this thread to make it helpful for others with the amazing Page 7!

Renate · 11-25-2023, 07:50 PM

Quote:

Originally Posted by parkaymang

Cool, so for the update i would do deboox and just adb push to sdcard.

Wrong! You push the still encrypted update.upx

parkaymang · 11-25-2023, 08:05 PM

Quote:

Originally Posted by Renate

Wrong! You push the still encrypted update.upx

ok thanks!

Jolly · 01-01-2024, 06:15 PM

Uploaded the patched boot.img and vbmeta per the Rooting the Poke5 page instructions

theCrow · 01-29-2024, 04:25 PM

How does updating work after rooting? Can you just install updates via automatic updates and flash updated patched boot.img or do you need to do something else?

11-21-2023, 06:24 PM	#1
parkaymang Member Posts: 23 Karma: 10 Join Date: Nov 2023 Device: Boox Page	Anyone able to root the Boox Page? I see a lot of the guides for other models need the update.upx, but I do not know how to get this for the Page. I also saw one guide for the NA2, that doesn't seem to need it, but I am not sure if this will work with the Page. Does someone mind pointing me in the right direction? Thanks so much.

11-21-2023, 06:48 PM	#2
Renate Wizard Posts: 2,972 Karma: 12345815 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5	I haven't seen any software update for the "Page" yet. Is that exactly what it's called? (The "Poke5" is actually "Poke5P" in the US.) If you have ADB or a terminal app: Code: adb shell getprop\|grep finger Also, we don't know the processor number, the Firehose loader or the update decryption strings for this yet. You can help. Code: cat /proc/cpuinfo No, we don't need the whole mess. Does it say "BENGAL"? What's the last line? Can you pull a file and post it, please? Code: adb pull /system/lib64/libota_jni.so That way we can get the strings ready for when there is an update.

01-01-2024, 06:15 PM	#14
Jolly Junior Member Posts: 6 Karma: 10 Join Date: Apr 2008 Location: Chicago Device: iRex Iliad v1	Uploaded the patched boot.img and vbmeta per the Rooting the Poke5 page instructions Last edited by Jolly; 01-03-2024 at 01:34 PM.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Root Boox Note Air 3C	SuiVu1fa	Onyx Boox	26	09-29-2024 08:11 PM
How to root a Boox Leaf (7")	Geremia	Onyx Boox	42	11-10-2023 08:58 AM
Boox Note 3 root available on 3.3 firmware?	tatteredscroll	Onyx Boox	8	03-30-2023 06:30 AM
Root onyx boox max2	deb2016	Onyx Boox	41	12-01-2018 01:37 PM
Is it possible to root the ONYX BOOX Kepler Pro?	Tlnvsn	Onyx Boox	6	12-20-2017 02:43 PM

11-25-2023, 12:39 PM	#7
Renate Wizard Posts: 2,972 Karma: 12345815 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5	The problem with updates is that at any time you can only get a link for the latest. That's why it's helpful when you see an update to post the link somewhere. The link is forever, but the info is only available for arbitrary periods of time. The basic problem is extracting the boot image so that you can Magisk it. If you have a Firehose loader, you can pull it directly. If you don't you have to wait until an update appears so that you can extract the boot image. Have you got EDL working? It's probably the qualcomm/factory/sdm662 one. If you have EDL working and are concerned that you might have to rollback, you can dump the whole flash. OTOH, it's probably better to just fix what's wrong with the new update.

11-25-2023, 06:32 PM	#10
Renate Wizard Posts: 2,972 Karma: 12345815 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5	Sorry if we got out of sync. I don't know what happened but I just now read #4. Be careful flashing stuff when you have an A/B device. Be sure to check which slot you are on. That's one of many reasons that I don't like "handy-dandy scripts". If you're going to update to 3.5, just adb push update.upx to /sdcard That will save downloading 1.5 GB again.

01-29-2024, 04:25 PM	#15
theCrow Junior Member Posts: 7 Karma: 10 Join Date: Jan 2024 Device: Onyx Boox Page	How does updating work after rooting? Can you just install updates via automatic updates and flash updated patched boot.img or do you need to do something else?

Advert

Advert