Rooting Nova Air C

[SleepWithMachine]

I'm getting ready to read everything here again, new firmware 3.2.3 is coming soon

[devilsangel360]

Is there a runbook on things/hacks that can be done after rooting this device?

[Renate]

Mmm, I went back to look what mods I made (on my Poke3).
#1 for me is to get rid of short/long presses on remote buttons so that it reacts to the press, not the release.
#2 is a complete redo of the USB so that I can always have ADB with no MTP. Stock seems to strong-arm MTP on all the time.
#3 disable overwrite of custom recovery
#4 my own bootanimation
#5 rooted without Magisk. (Probably a bit too convoluted for most users.)

[adlerx]

Originally Posted by SleepWithMachine

I'm getting ready to read everything here again, new firmware 3.2.3 is coming soon

Hello all ! Have you tried to root 3.2.3 ? Does it still work ? Thank you

[Herschenglime]

It worked fine! I had some trouble getting Magisk to actually install the patched boot image, but after trying a couple times and using the hidden instead of the non-hidden magisk app, it sorted itself out.

[csdvrx]

Originally Posted by adlerx

Hello all ! Have you tried to root 3.2.3 ? Does it still work ? Thank you

Could someone post the URL or the package?

I'd like to have a look at it with https://github.com/Hagb/decryptBooxUpdateUpx

On http://firmware-us-volc.boox.com/e6c...661/update.upx I could only get the 3.3 using the trick from https://github.com/Hagb/decryptBooxU...ment-704006389

[Renate]

Originally Posted by csdvrx

Could someone post the URL or the package?

Onyx/NovaAirC/NovaAirC:11/2022-10-31_07-44_3.3.1_611ec93db4/36562:user/dev-keys
http://firmware-us-volc.boox.com/252...f55/update.upx

[jljtgr]

Seems as though the activity for this device has dropped off, but I'm hoping there are still answers to be found.

I have a new device with firmware 3.3.2 that I am trying to root, but it's not quite going as planned.

I got as far as patching the extracted boot image, but I'm somewhat stuck there. The testing phase sort of doesn't work. To begin with, fastboot doesn't see the device... fastbogus thankfully does. However the device is unimpressed with the boot command.

>fastbogus.exe boot magisk_patched.img
Sending 'boot.img' (39000 KB)                      OKAY [  0.894s]
Booting                                            OKAY [  0.119s]
Finished. Total time: 1.052s

The device just sits there as though nothing happened. I can reboot back into fastbootd or the main OS, but when in the bootloader it just doesn't care that it was sent the boot command.

Though there was no error, I thought maybe it didn't like the file for some reason so I tried telling it to boot the extracted image:

>fastbogus.exe boot boot_orig.img
Sending 'boot.img' (38520 KB)                      OKAY [  0.888s]
Booting                                            FAILED (Status read failed (Too many links))
fastboot: error: Command failed

Of course this error could happen for many reasons, but oddly enough it did reboot immediately. Unfortunately it is now stuck in an early stages bootloop. Never shows more than the ONYX screen before resetting a few seconds later. Plugged into a PC, it never shows as a USB device and adb/fastboot/fastbogus wait forever when trying to catch a device.

I was going to wait it out and hopefully it would run out of batteries and undo whatever went wrong... but I got bored waiting and tried some more. If I hold power until the blue LED turns off and immediately release, it stops bootlooping and stays on the ONYX screen. It connects as yet another USB device(05C6 900E)/QUSB_BULK_SN:#######. Forcing it to use WinUSB technically works but doesn't really work.

>edl /zf
Found EDL 900e
Requesting reset to fastboot... No response

All commands return no response. So I'm back to waiting for it to run out of batteries while bootlooping and hopefully fix itself somehow. I'm not completely new at this, but I'm not an expert either. I wouldn't have thought that just using the boot command while never flashing anything could cause something like this.

[Renate]

Originally Posted by jljtgr

... I'm hoping there are still answers to be found.

There are! Hopefully. There are many different issues here.

"fastboot boot whatever.img" is great when it works, but unfortunately it doesn't always work for all devices and all images. I think that it has to do with how the cmdline that gets handed to the kernel is generated but I've never had a chance to deep dive. The "gold standard" for system images is always to flash and then reboot. Of course there is some risk with this too.

Just as an aside, I rip out my hair every time I see "FAILED (Status read failed (Too many links))". What is happening is that your device is disconnecting. That is reported internally in Windows as "A device attached to the system is not functioning", which returns an error code of 0x0000001f. A bad (since years) implementation of fastboot.exe is blithely (and ignorantly) converting that to a Linux error code of 31 (EMLINK). Then it happily tells you that you have used a chain of too many symbolic links.

Qualcomm actually has many different USB test modes, the most famous are 9008 and its stupid cousin 900e. 900e is mostly incapable of doing anything useful. I don't think you want to even waste your time talking to it.

Even within 9008 there are still two personalities, Mr. Hyde and Dr. Jekyll. The first rude and ignorant character only speaks "Sahara". You offer him a Firehose loader and then he begins to eloquently speak "Firehose". One of the problems is determining to whom you are speaking.

In your example you were speaking to 900e (doesn't work at all), trying to use the /z command (only works once you have loaded a Firehose loader) and were trying to do it with /zf (I've only seen Motorola supporting reboot to bootloader).

So, where does that leave you? Power dying might get you out of the loop since you didn't actually flash anything. Worst case is opening the device.

[jljtgr]

Originally Posted by Renate

{...}
Even within 9008 there are still two personalities, Mr. Hyde and Dr. Jekyll. The first rude and ignorant character only speaks "Sahara". You offer him a Firehose loader and then he begins to eloquently speak "Firehose". One of the problems is determining to whom you are speaking.
{...}

Is that what the q662.elf file is for? Making one the other? I guess not if it's hard to determine which is which?

Originally Posted by Renate

{...}
In your example you were speaking to 900e (doesn't work at all), trying to use the /z command (only works once you have loaded a Firehose loader) and were trying to do it with /zf (I've only seen Motorola supporting reboot to bootloader).
{...}

Well, at the time I also tried /zo, /ze and just /z. I hadn't read up yet to understand that 9008 and 900e were different.

Originally Posted by Renate

{...}
So, where does that leave you? Power dying might get you out of the loop since you didn't actually flash anything. Worst case is opening the device.

Well, I hope I don't have to open it... I don't have a hot air gun handy and this looks as sealed a device as I've ever had. I'm curious what is available inside, though. EDL test points? I was looking at how those cables are supposed to work, if they work.

Now that it's night time, I noticed the front-light never turns on and it's just 4 screen refreshes every loop that draws power. I wonder how long that's going to take...

[Renate]

Originally Posted by jljtgr

I'm curious what is available inside, though. EDL test points? I was looking at how those cables are supposed to work, if they work.

I personally have never gotten an "EDL cable" to work, although I am admittedly very stupid at any of these things that require timing or patience. Morevover, my Poke3 has both an external UART connector (so that I can see what is actually happening when it boots) and a magnetic reed switch to boot it into 9008 whenever I want.

Still, if you feel like cutting up a cable, give it a try.
Just leave red and white untouched and insulated and you can't get into too much trouble.
It's the black and green that will be connected.
And all this stuff with whether it has to be on or off, plugged or unplugged, holding your nose or your toes, I don't know.

[jljtgr]

So, I found a voodoo ritual to coax the device into recovery.
https://blog.tho.ms/hacks/2021/03/27...-into-recovery (2nd option)
From recovery, I got into fastbootd. But any reboot into system would just bootloop as before. After finally succeeding again with the ritual, I noticed that I was in slot_a... where I swear it was using slot_b before. So I activated slot_b and rebooted into the OS fully.

I tried to dump both boot_a and boot_b but their hashes were the same... which made no sense if it couldn't boot slot_a properly. Flashing magisk into slot_a and booting would get to the bootloader and then pause there with the fastboot channel immediately open. Flashing into slot_b and booting was the same result... stuck at the bootloader with only fastbogus able to make anything happen.

Of course this meant that I could no longer boot using any partition. Conventional wisdom said that if the original boot.img were the same for both slots, then something else was wrong. Nothing that I flashed to any slot would boot to the OS. So I had to figure out the URL for update.upx, decrypt it and sideload it using the recovery.

So, the device is technically working... but I'm not any closer than I was at the beginning of the day. Two things bother me... #1, fastboot boot .img didn't actually boot the image. #2, flashing the dumped image onto itself killed it instead of doing nothing noticeable.

[Renate]

Sometimes weird things can happen, like the slots switching.
Depending on your system there can be a lot of files in each slot besides boot.
Any of them being bad could cause it not to work.

[popej]

Originally Posted by jljtgr

From recovery, I got into fastbootd.

Fastbootd it is not the same as fastboot. I don't know differences, but I'm sure, that when rooting you better use fastboot.

Your device goes to fastboot, when you select "reboot to bootloader" in recovery. Or you can use adb: adb reboot bootloader

[jljtgr]

I wasn't rooting, I was unbricking. I needed to get anywhere at all and fastbootd was as good a place as any since it was accessible and provided options to go other places.

(My terminology)
fastbootd is where you go when you ask to "adb reboot fastboot" etc and has a user interface that says "fastbootd" at the top. bootloader is sometimes referred to as fastboot and has no user interface... it is waiting for fastboot to tell it to do something. Like boot images which fastbootd won't do.