Rooting Tab Ultra

[Venator3]

Ok that worked, output is:

/system/priv-app/OnyxOtaService/OnyxOtaService.apk: 1 file pulled, 0 skipped. 31.1 MB/s (405397 bytes in 0.012s)

And I now how the apk on my computer.

[Renate]

Originally Posted by Venator3

And I now have the apk on my computer.

Great. Now may I have it?
Rename it .zip and attach it to your post here.

[Venator3]

Oops, forgot to attach.

[Renate]

Thanks. Erm, some things have changed that make this not as easy as I thought.
I'll have to look at this tomorrow.

In any case if you want to proceed getting EDL to work...
But don't go crazy flashing things until you backup what you want to flash.

Edit: In post #4 https://www.mobileread.com/forums/sh...03&postcount=4
They say they got the decoding strings.
But they were never merged with the GitHub.
Anybody know what's going on?
Did they work?

[Renate]

Could you do me another favor?
Could you try this:

C:\>adb pull /system/priv-app/OnyxOtaService/lib/arm64/libota_jni.so

And post it, please?

[Venator3]

Sure, file is attached.

[Venator3]

I think for EDL the command to grab the boot.img is:

python edl.py --loader 0014d0e100000000_d40eee56f3194665_FHPRG.bin --memory=ufs <command>

Still not sure how to get a full backup. Is there any risk involved with running a bad command in EDL?

[Renate]

Originally Posted by Venator3

Sure, file is attached.

Thanks! I confirmed the strings reported already and posted them on GitHub.

Edit: The correct strings (in the new format) are in BooxKeys.csv

[Venator3]

Thank you! I now have the boot.img from the update. I would still like to figure out the command for a full backup in EDL to get the original boot img, I'm just not sure if it's possible to mess things up in EDL so I don't want to use the wrong command. But I will at least boot the patched boot.img and probably flash it if it works.

[Renate]

Originally Posted by Venator3

I would still like to figure out the command for a full backup in EDL to get the original boot img...

Well, then just do it. As long as you are only doing reads nothing bad will happen.
You need to load the Firehose loader, do your reads, then do a reset.
I'm tired of the Python one so I'll only give specifics for mine.

[snuggy]

Hey, I tried flashing my brand new Boox Tab Ultra (Black and White) with the guide here, and when I flashed the magisk'd boot.img and booted the backlight has stopped working.

When I tried flashing the edl'd image I took, the backlight doesn't work either.

What am I doing wrong here? I'm guessing that when I pulled the boot image, I used something that was incorrect -- any ideas which?

Thank you!

[Renate]

Mmm, maybe an update has caused your versions to be mixed.
Do you have ADB enabled?

C:\>adb shell lsmod

Does that show one line or twenty?
If it's one, then versions are probably not the problem.
If it's twenty...

The most recent TabUltra version is:

Model:  TabUltra (English)
Finger: Onyx/TabUltra/TabUltra:11/2023-11-22_08-58_3.5_946657f755/43508:user/dev-keys
Link:   http://firmware-us-volc.boox.com/00135b572b9d321902f87c9d71a7f17f/update.upx
Size:   1,561,582,806
MD5:    00135b572b9d321902f87c9d71a7f17f

You might try to download that to your desktop, then ADB push to /sdcard.
Then:

C:\>adb shell am start -a onyx.settings.action.firmware

And do an update.

Then, because you've lost root, you can extract the current boot image from update.upx (after decrypting) or EDL read the current boot image.