Max 3 Rooted

[diabl0w]

Originally Posted by ROKENO

These two links are dead. I have found these, but i am not sure if they are correct:
https://androidfilehost.com/?fid=1395089523397893197
https://androidfilehost.com/?fid=11410963190603873739

Thanks.

yes those files are correct. you can try wiping /userdata in edl mode.. only problem is that I am unsure if onyx puts proprietary files in /data that are required for boot. its worth a shot though.

[diabl0w]

Originally Posted by ROKENO

These two links are dead. I have found these, but i am not sure if they are correct:
https://androidfilehost.com/?fid=1395089523397893197
https://androidfilehost.com/?fid=11410963190603873739

Thanks.

also that sounds like a major bug, I would inform onyx. its a pain, but you can also do a return

[RCGCoder]

Hello.
Finally, it's possible to root Max3? Somebody has rooted the device?

What is the method to use? If bootloop there's a way to reset to fabric status?

Thanks
Sorry about a lot of questions but is a very expensive device and I wouldn't like to brick this

[diabl0w]

Originally Posted by RCGCoder

Hello.
Finally, it's possible to root Max3? Somebody has rooted the device?

What is the method to use? If bootloop there's a way to reset to fabric status?

Thanks
Sorry about a lot of questions but is a very expensive device and I wouldn't like to brick this

Finally?... This root came out 2 days after the first Max 3 were received by the public. "Already" might describe it better.

I am not sure how to answer your questions in any other way than how they are already answered in the original post

[RCGCoder]

Sorry but I'm so noob rooting this kind of devices

In first post
"This means that we take our modified recovery.img and flash it to the recovery partition, then when we boot into recovery mode, Magisk automatically boots into a rooted system."

Where is de recovery.img?

I can run The others steps ... adb reboot, fastboot ... etc... but I can't locate the recovery img

Thanks

[uniqdom]

hello diabl0w

Originally Posted by diabl0w

**I am not responsible for any damage to your device, and I am sure this probably voids your warranty**

Hello everyone,

I am hoping the potential of the Max 3 can be unlocked with the help of you guys, the community. To start it off, I found a way to obtain root on the Max 3. Hopefully, others can now help develop further.

The root method uses Magisk in recovery mode. You can read about it here under "Knowing Your Device": https://topjohnwu.github.io/Magisk/install.html

Our device uses "system as root" and is a NON-A/B partitioned device.

This means that we take our modified recovery.img and flash it to the recovery partition, then when we boot into recovery mode, Magisk automatically boots into a rooted system.

The only problem with this, is that Max3 has no way of booting to recovery using hardware buttons, and adb reboot recovery bypasses magisk and goes to recovery. This isnt a big deal, but just means that any time reboot you will lose root.

To gain root, run "adb reboot-bootloader" , then the screen will not look like anything happened due to e-ink, but if you run "fastboot devices" your device should appear. then you just run "fastboot boot magisk_patched.img"

make sure your bootloader is unlocked first, i believe it already is from factory "fastboot flashing unlock"

I have uploaded the patched recovery here: https://anonfiles.com/i7t1Gb6fnf/magisk_patched_img

One of the first things I propose to look into is restoring the native android Recents screen so that we can put apps into Multi-window mode.

The problem is that onyx removed this ability and have their own "OnyxRecentsActivity". I have already tried to modify the SystemUI.apk, but can't get the system to run properly with the modified file. I think its a signature issue. Maybe someone with more knowledge can help

I'm interested in the process that you have done to achieve the root to add that knowladge to my brain.

As I understand, I need to get the recovery.img from an update from the vendor, but I couldn't find an update. There are no updates for Max3 in https://www.boox.com/downloads/#max-series nor in https://onyxboox.com/firmware. There is no OTA incomming for my device, as I'm in the latest update. I have read that OTA files are downloaded in /cache, but you can't open that directory without root access. Maybe you were able to catch the update URL with logcat. I couldn't do that as my device is already at the latest update, so no URL shown in logcat. So, how you managed to get the update file?

Does a recovery.img for a different phone/tablet/ereader, but with the same chipset works here?

Can you share the OTA URL if you have that?

Regards

[diabl0w]

Originally Posted by uniqdom

hello diabl0w




I'm interested in the process that you have done to achieve the root to add that knowladge to my brain.

As I understand, I need to get the recovery.img from an update from the vendor, but I couldn't find an update. There are no updates for Max3 in https://www.boox.com/downloads/#max-series nor in https://onyxboox.com/firmware. There is no OTA incomming for my device, as I'm in the latest update. I have read that OTA files are downloaded in /cache, but you can't open that directory without root access. Maybe you were able to catch the update URL with logcat. I couldn't do that as my device is already at the latest update, so no URL shown in logcat. So, how you managed to get the update file?

Does a recovery.img for a different phone/tablet/ereader, but with the same chipset works here?

Can you share the OTA URL if you have that?

Regards

I do have the URL somewhere but its not needed or useful. our ota's are sent to us via update.upx which are encrypted zips. idk how to decrypt them. the file is downloaded to the sdcard when you check for updates in the settings app so you also wouldnt need the URL for that reason too.

as I explained, I pulled the recovery image directly from the device as a raw image in EDL mode. you can google about that mode. since you have the same chipset, you can use the same edl tool I posted somewhere in this thread. hopefully you can get your device in edl mode... onyx recently pushed an ota update that updated our bootloader that I wasnt able to figure out how to enter edl mode. when I did the procedure, it was still the old bootloader so it was easy.

once you have the recovery image you just put it in your sdcard and download the magisk apk and magisk will patch the image for you. then you flash the patched recivery image in fastboot mode. this is assuming you have the same device type (non-AB device running system as root). you can read more about the device type you have in the magisk github I linked to in the OP

[diabl0w]

yes im not sure why they are not posting our ota's. I think they are afraid because of the rooting that I publicly posted here. right after I got root using EDL and posted publicly here is when they pushed out an update that patched our bootloader. good thing for us max3 owners is that the root I posted still works for updated devices anyway. it may be harder to recover now though if something strange happens to your device and cant enter edl mode. but I dont really think that would happen anyway so its not big deal

[user0983490]

Originally Posted by diabl0w

yes im not sure why they are not posting our ota's. I think they are afraid because of the rooting that I publicly posted here. right after I got root using EDL and posted publicly here is when they pushed out an update that patched our bootloader. good thing for us max3 owners is that the root I posted still works for updated devices anyway. it may be harder to recover now though if something strange happens to your device and cant enter edl mode. but I dont really think that would happen anyway so its not big deal

Do you know if there's been an update or something else that might not make root work? I ran your instructions using the second img you provided, with "fastboot boot magisk_patched.img". The command succeeded and the system booted, but I don't seem to have root. I tried installing software that depends on it, like AFWall+, which complains there's no root, and supersu. Do I need to do something else?

I have the Onyx Boox Max 3, "android version 9", "Version: 2019-11-09_10-06_2.2.1_4b92663"

[user0983490]

I wasn't familiar with Magisk and had to do an additional step: install the Magisk Manager APK. I then did adb and fastboot again, and apps now have root permissions!

I got the manager from: https://www.xda-developers.com/how-to-install-magisk/

[whopper]

Originally Posted by diabl0w

yes im not sure why they are not posting our ota's. I think they are afraid because of the rooting that I publicly posted here. right after I got root using EDL and posted publicly here is when they pushed out an update that patched our bootloader. good thing for us max3 owners is that the root I posted still works for updated devices anyway. it may be harder to recover now though if something strange happens to your device and cant enter edl mode. but I dont really think that would happen anyway so its not big deal

It's an idiocy to fight your customers against root, but you can expect anything from them.

[diabl0w]

Originally Posted by user0983490

I wasn't familiar with Magisk and had to do an additional step: install the Magisk Manager APK. I then did adb and fastboot again, and apps now have root permissions!

I got the manager from: https://www.xda-developers.com/how-to-install-magisk/

See edit below first...

Nice! you may want to update Magisk since its probably out of date. Make sure the "recovery" option is selected and you can use the direct install method when it asks. Also, if you ever reboot, you wont have root, but its not lost. You just have to power off your device (hold power button for 10 seconds while its not plugged in) then after its off hold the he button while plugging in the charger and keep holding home until you get the boot screen. that should boot you into recovery (which in our case is just a booted system with magisk running) . Note, do not take an ota updated while rooted, it will look like it just kinda fails to update and everything will be fine, but there is something weird that happens that im still investigating.

This is definitely still a beta root so beware. Im not responsible for.issues.

I am working on a fix for ota's, I think I have a fix but have to wait to see how if it works

EDIT: Actually if all you did was "fastboot boot magiskrecovery" and didnt do "fastboot flash recovery magiskrecovery" then I would just leave it at that if I were you. It is much safer. Dont do the direct install to update3 magisk then either

[diabl0w]

Originally Posted by whopper

It's an idiocy to fight your customers against root, but you can expect anything from them.

yes, unfortunately root doesn't seem to be very popular for this device. ashame since it has an unlocked bootloader and a very interesting device to tinker with

[mePy2]

Thank you. Really interesting thread. Following although Max2 Pro owner here.
You are welcome to join our Discord https://discord.gg/MJsjcKJ

[nystagmus]

Would this root work on the note2? it is supposed to be similar internaly, isnt it?