Bricked Note Air 2

[darcity]

While I tried to root my Note Air 2 using magisk, I bricked that thing. I flashed the wrong boot.img without securing the original one in first place.

So I need the latest boot.img from the update.upx for this device. But I cannot find it on the onxy download page. https://downloads.boox.com/download/note
The page also states that updates will only be provided to the device's update center.

- Is there some way to download the updates via http?
- Does someone have an idea how to get the device booting again?

[Renate]

Onyx/NoteAir2/NoteAir2:11/2022-10-31_17-02_3.3.1_f1fa27fb32/36569:user/dev-keys
http://firmware-us-volc.boox.com/cad...80d/update.upx
Download and DeBooxUpd it.

[darcity]

Originally Posted by Renate

Onyx/NoteAir2/NoteAir2:11/2022-10-31_17-02_3.3.1_f1fa27fb32/36569:user/dev-keys
http://firmware-us-volc.boox.com/cad...80d/update.upx
Download and DeBooxUpd it.

Thank you for sharing. So here is what I did.
- DeBooxUpd to obtain the zip
- unziped and extracted partition images from payload.bin via payload_dumper
- booted into fastboot => fastboot flash boot boot.img
- reboot

It is stuck in a reboot loop. Shows the ONYX logo, then screen flashes.

In fact the only thing I changed was the boot partition. I purchased the device in europe. Could it be that the firmware here is different?

Thanks and best regards!

[Renate]

There are probably a lot of interdependencies.
Your original system may be older or even incompatible.

Did you have ADB enabled before this all happened.
When a "bootloop" occurs the Linux-ish part of Android could be running fine.
It could be that the trivial Android/screen part is broken.
You can't tell without looking.

I had a recovery that I made for the NA2 some months ago. I just updated it.
Could you try this with just fastboot boot recmod?
I usually don't have much luck with fastboot boot image (vs. fastboot flash partition image).

This will show a white screen. Just try to access ADB.

C:\>adb shell
# getenforce
0
# ls

No, you don't have to quote it, just did it get ADB, did it get #, did it not complain about timezones?

I sent you a link in PM.

[darcity]

Before I bricked it, I updated to the latest firmware version.

Had ADB enabled. But the device is not recognized by adb within the bootloop. Kernel ringbuffer notifies a new xhci_hcd USB device in each loop.

fastboot boot recmod

did not work for me. Therefore flashed it on boot partition.

fastboot flash boot recmod

As the device boots up, it stops with a white screen. But it still doesn't show up as a adb device.

Maybe ADB was disabled during firmware update.

Is it also possible to flash the whole update.zip?

Thank you!

[darcity]

In recovery mode it displays in the 3rd row:

11/RKQ1.210614.002/200

Might that be the recovery version out of the last firmware update?

[Renate]

update.zip can only be update-binary'ed not flashed

The problem with fastboot boot recmod or fastboot flash boot recmod is that in neither case does it get the right command line.

Have you had EDL working before?
Only proceed if you can dig yourself out of a hole.

C:\>fastboot flash recovery recmod
C:\>fastboot flash misc misc-rec
C:\>fastboot reboot

(You can rename it without .prc)

[Renate]

Originally Posted by darcity

Kernel ringbuffer notifies a new xhci_hcd USB device in each loop.

Huh? Are you looking at the hardware console with a UART?

[darcity]

Originally Posted by Renate

Huh? Are you looking at the hardware console with a UART?

It's the kernel buffer from my linux workstation that I connected the air2 to. It gives some information about how the air2 announces itself as a usb device.

In fastboot mode for example it is recognized like this

[  +0.018321] usb 2-1: New USB device found, idVendor=18d1, idProduct=d001, bcdDevice= 4.19
[  +0.000003] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  +0.000002] usb 2-1: Product: NoteAir2
[  +0.000001] usb 2-1: Manufacturer: QUALCOMM
[  +0.000001] usb 2-1: SerialNumber: 84840743
[  +8.421444] usb 2-1: USB disconnect, device number 8
[  +1.793377] usb 1-1: new full-speed USB device number 98 using xhci_hcd
[  +9.186646] usb 1-1: new full-speed USB device number 99 using xhci_hcd
[  +5.040085] usb 2-1: new SuperSpeed USB device number 9 using xhci_hcd
[  +0.018384] usb 2-1: New USB device found, idVendor=18d1, idProduct=4ee0, bcdDevice= 4.19
[  +0.000004] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  +0.000002] usb 2-1: Product: NoteAir2
[  +0.000001] usb 2-1: Manufacturer: QUALCOMM
[  +0.000001] usb 2-1: SerialNumber: 84840743

[darcity]

Originally Posted by Renate

update.zip can only be update-binary'ed not flashed

The problem with fastboot boot recmod or fastboot flash boot recmod is that in neither case does it get the right command line.

Have you had EDL working before?
Only proceed if you can dig yourself out of a hole.

C:\>fastboot flash recovery recmod
C:\>fastboot flash misc misc-rec
C:\>fastboot reboot

(You can rename it without .prc)

I will try this in the evening. I had EDL configured but was stupid enough to not dump the boot partition before flashing it. Before flashing the recovery and misc partition I will secure the existing ones this time

[Renate]

The Tab Ultra has a mysterious broken? or new style? update.
Please check your update.zip (with 7zip l or whatever) that it has META-INF/com/google/android/update-binary, .../updater-script.

[darcity]

Originally Posted by Renate

The Tab Ultra has a mysterious broken? or new style? update.
Please check your update.zip (with 7zip l or whatever) that it has META-INF/com/google/android/update-binary, .../updater-script.

In fact it has neither of these files. The META-INF directory that I extracted from the update.zip looks like this

λ  tree update/META-INF 
META-INF
└── com
    └── android
        ├── metadata
        └── otacert

[Renate]

Originally Posted by darcity

In fact it has neither of these files.

Oh, great. They're throwing another freaking spanner in the gears.

Renate goes back to writing device drivers for DOS.

[darcity]

Originally Posted by darcity

I will try this in the evening. I had EDL configured but was stupid enough to not dump the boot partition before flashing it. Before flashing the recovery and misc partition I will secure the existing ones this time

Ok I have trouble getting the device in edl mode, because in recovery it shows up as "unauthorized"

λ  adb devices
List of devices attached
84840743	unauthorized

Is there another way to get into edl?

In edl mode I am planning to secure the partitions like this. Is it correct?

 edl --loader ./Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin --memory=ufs r recovery recovery.img.bak
 edl --loader ./Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin --memory=ufs r misc misc.img.bak

[darcity]

I read that there exists a special mode (EDL) 900E that should work on bricked devices. But there is no useful loader available for this mode (https://blog.tho.ms/hacks/2021/03/27...-note-air.html)