Bricked Leaf. Factory Reset, Wipe cache still in bootloop. Can't flash firmware?

[bazookajoe]

Hi,

I bricked my Leaf. Badly. My fault, I'm so obsessed with getting OTG SD cards to work fully in all apps that I want them to with root that I've changed storage permissions in packages.xml (and other places) that I probably should not have.

I did systemless root via Magisk though I don't know if I broke that with permission modes I did get into system/etc/ today in frustration. Prolly. Root was working prior to that though.

I can get to recovery, I've done multiple Wipe Data/Factory resets and multiple Wipe cache but no. Still in bootloop, just this time it reverts back to Chinese language instead of English, trying to start setup...I get to the pick language menu for a couple of seconds and then it just falls back into bootloop (subsequent loops we don't even get to that menu it cuts out too quick).

Sometimes it then gives me an error screen after awhile telling me it failed, I need to factory reset which I do and then we're bootlooping again.

My computer can't read the device. ADB won't recognise there's a device. Reboot to bootloader via recovery I can't access anything though to be honest I have no idea what I should be doing there/typing anyway. fastboot devices returns ???????????? devices.

I've been looking at the Poke 3 Soft Brick thread...I'm not following it well plus I'm not sure I even have access to fastboot either. Typing some of the commands I saw in that thread just leave me with "waiting for any device".

I do have update.upx, update.zip and patched magisk boot.img on PC. I also have the Onyx card reader and FAT32 USBs at the ready. I do not have a recovery.img though and limited info on the Leaf as it's such a new device.

There's no options on their recovery to select a zip or storage to restore from there either like I'm used to (though that could be TWRP...I've not had to root in nearly 6 years so I've not gone near a stock or TWRP recovery in 6 years).

I can't see how I'm going to even get anything to fix/restore with no "update from zip" or adb or fastboot . I need a Download mode or Odin lol.

I do have the case so the buttons at my disposal are volume up and down and power.

I'm so bummed out and I don't have the technical knowledge to work this out on my own.

Thanks for any help.

[Renate]

If you can get it into EDL mode we can sort it out.
The most foolproof way to do that is using the hardware test points that (probably) are inside the unit.
I'm not saying that there isn't another way to get there, but without ADB or Fastboot...
I've never had any success with EDL cables, although maybe it's just me.

So, in short, if you want to open your device and take a good photo of the PCB we can proceed from there.
If you know some voodoo to get it into EDL mode, like standing on your head and pushing three buttons at once that will be easier.

Me? I put a magnetic reed switch inside my Poke3 so that I don't have to ever open it.

Edit: Are you getting fastboot ????? on a Linux system or Windows? If Linux, have you checked lsusb to see what you've got? Udev? Permissions?

[bazookajoe]

Originally Posted by Renate

If you can get it into EDL mode we can sort it out.
The most foolproof way to do that is using the hardware test points that (probably) are inside the unit.

So, I've taken the two mini-screws out at the bottom of the Leaf. That's the only sign of anything other than the little hole next to one of the screws which is probably the mic anyway. Any tips for opening it because I don't know where to pry or if I'm going to break it. The Leaf is very sleek it's very hard to pry or get any movement there, I'm supposed to pull the case off from the screen? Another thing that is going to get in the way possibly is the pins on the left side of the device which are used to snap into the case.

Edit: Are you getting fastboot ????? on a Linux system or Windows? If Linux, have you checked lsusb to see what you've got? Udev? Permissions?

Windows, sadly.

One thing I just noticed is that maybe I'm getting into EDL 900E mode though I don't know what that does. I just saw it on the tutorial I used to root with Magisk (it's probably the one most people use Thomas' Random Hackery). It does appear in Device Manager when plugged in in that mode as QUSB_BULK_SN:015B9110 with a little yellow ! icon like when your driver isn't right though I don't know if that is relevant/useful. I've seen talk of installing Qualcomm/Snapdragon thing I just didn't think that was relevant. Would that be a help?

I'm going to order some cables too as a back up I never knew they existed thanks for that shoutout. On a slow boat from China though (literally) so won't be here until end of April lol.

[Renate]

Yeah, I can't really tell how that comes apart. Some devices you just run your fingernail around and others you need a hammer (not really). The Nook Glow2 is put together with special double stick tape and you'd better have a supply if you want it to go back as it was. Is the back shell on the Leaf seamless and the only crack is on the front *inside* the outer shell? I've not seen one with screws like that. Any chance now that the screws are gone that holding it face-down and giving it a gentle whack that that bottom edge drops out of the shell? I think that it's more likely that this is stuck together with tape and the two screws are just to keep the Type C connector more secure, since you'd actually need clearance to pull that bottom edge out.

On the Glow I worked around the edges with a single edge razor blade. When I was through I cleaned up the old tape and used some new double stick (special) Tesa. I'd hate to see you mess up your new device.

https://www.microcenter.com/product/...tape-4-mm-wide

900E is the DIAG interface for Qualcomm devices. It's much less powerful than the 9008 actual EDL interface. I guess there might be a way to switch modes, but I have no experience of that. You might try with some more button acrobatics to see if you can get 9008. 900E is like a serial port and should/will appear under Device Manager there.

The 9008 is different. I'm running it with a generic driver. "Zadig" is a generic WinUSB driver. Just google it.

Edit: Are you sure that your Fastboot is broken. That usually doesn't happen, it's more likely that you have no driver for it. Google minimal fastboot.

[bazookajoe]

I'm very nervous about breaking it open. It's going to be real difficult (broken two fingernails so far lol) I think I will leave that as last resort for now if all else fails I'll have to razorblade it.

I have found a cable with good reviews that will get here by early April to see if that might be an option too.

In the meantime RE: fastboot, what commands can you recommend me test here? My minimal adb and fastboot was a bit outdated it was returning me two devices, device and emulator which was making running the commends to root difficult even with -d so I upgraded using 15 second ADB and updated drivers. They all appear to be up-to-date. I also used fastboot fine to test if my patched boot.img worked and then again to flash it permanently.

fastboot devices command is the only thing that "works", as said it returns ???????????? device. Not that I've tried to type much else because I don't understand what I'm supposed to be doing there anyway. I read one of your posts you linked to via Poke 3 Softbrick but I don't even know what a fresh fastboot boot recovery is. I got a bad feeling it's not going to like the commands.

I must have really messed up system. I went crazy in there with storage permissions tinkering not really knowing what I was doing. I'm used to bricking devices but being able to fix them lol.

[Renate]

Yeah, as I said, I don't think that's an easy device to open. Me, I'd open it because I'm a bit cavalier about a few nicks or dings. I've actually destroyed a brand-new device once before I even used it in the slightest! Oh, well, such is the price of a little bit of fun.

Did you try reinstalling drivers for the fastboot? Is it showing warnings in the Device Manager? Does anything work?

C:\>fastboot getvar all

Normally ??????? is a pretty big failure, meaning that it couldn't get the serial number off the device. This could be as simple as a bad USB cable. It could be that the interface was never correctly initialized.

Download this utility. Run it. Plug in your Leaf and/or unplug it and see what appears/disappears. Select the Leaf in the left hand panel, look at the right hand panel, it had better be longer than two short paragraphs.
https://www.ftdichip.com/Support/Uti...crosoftUSBView

You can also run my utility at the same time. It's unrelated and won't interfere with anything.
http://www.temblast.com/windows.htm -> usblog.exe
It tells you when things are connected/disconnected. If you get Windows "bongs" but the list in UsbLog doesn't change then you're probably missing a driver or hardware problem.

Did you have ADB working on the regular boot previously?

[bazookajoe]

Welp I'm an idiot. Einstein here was using her 2 Samsung cables interchangeably because they were on hand and forgot there was a cable in the Leaf box never before used. Thankfully I only removed the screws and broke 2 nails and not the device lolol.

I've got fastboot now with that cable. It's showing my device properly. I was also able to get the command to reboot and reboot to recovery to work (don't know anything beyond that other than the magisk flash). No adb though. I'm not 100% confident what to do next though Renate, would you mind giving me a little procedure or explaining/linking if there's bits in the Poke thread that's going to apply for me to follow?

Thanks you've been a gem.

[Renate]

Did you have a copy of the Magisk-ed boot on your desktop?
If so, you should try booting (not flashing) that first, because it's painless.
Go to fastboot:

C:\>fastboot boot Magisk-whatever

Do you have any other images?
I might be able to turn your Magisk-ed image into a recovery.
If so, post it and give me a link.

Edit: I'm lazy (and my internet sucks). Here is an update for the Leaf which you will be needing:
http://firmware-us.boox.com/3c1a22db...b0b/update.upx
It's about 1.3GB (probably).
Then you'll need this to decrypt it:
https://github.com/Hagb/decryptBooxU...r/DeBooxUpx.py
Fortunately, somebody got the encryption strings already.
Now, you've got a big zip file.
Does it have a boot image in it? A recovery image in it?
You're going to need this in any case because you have to do a manual update.

[bazookajoe]

Fastboot boot of Magisk boot.img didn't help still bootloop.

Unfortunately there is no recovery.img in update.zip, only boot.img.

Here's a Magik patched boot.img I successfully used with vbmeta ticked because technically Leaf returned as having vbmeta (even if it isn't normal):
https://drive.google.com/file/d/1umz...ew?usp=sharing

Here's a Magisk patched boot.img without vbmeta ticked which I didn't use, but made just in case:
https://drive.google.com/file/d/1vUx...ew?usp=sharing

Here's my whole decrypted update.zip from my Leaf running firmware 3.2, because it might help others in future, yes there's an unmodified Leaf boot.img in there:
https://drive.google.com/file/d/1qy7...ew?usp=sharing

[Renate]

Ok, here is an interim test: Check your PMs for the download link.

C:\>fastboot boot rec.img

What you are looking for: Device reboots, "Onyx" splash goes to all white screen, ADB @ 18d1/4ee7 goes "bong".

C:\>adb devices
C:\>adb shell
# id
# getenforce
# start ttyscreen

In the meantime, can you get the first couple of lines (those with "getprop") out of META-INF/com/google/android/updater-script out of your zip? Just post as plain text here, please.

[bazookajoe]

Cool

updater-script:

(!less_than_int(1638429894, getprop("ro.build.date.utc"))) || abort("E3003: Can't install this package (Thu Dec 2 15:24:54 CST 2021) over newer build (" + getprop("ro.build.date") + ").");
getprop("ro.product.device") == "Leaf" || abort("E3004: This package is for \"Leaf\" devices; this is a \"" + getprop("ro.product.device") + "\".");

Not sure about the "bong" part, but I executed the commands and now I have the white screen with "ttyscreen started" on it.

Edit: Oh I should say what adb said to me back too I guess:
adb devices gave: 37C9AA46 recovery

C:\adb>adb shell
# id
uid=0(root) gid=0(root) groups=0(root) context=u:r:su:s0
# getenforce
Permissive
# start ttyscreen
#

[Renate]

Tony the Tiger says, "Grrreat!"
Yeah, you've got rooted, permissive ADB in a recovery. What more in life could you want?

Ok, download a new rec.img from the same link you had.

Do the following commands:

C:\>adb push update.zip /data

If that doesn't go to 100% we'll have to do it differently.

C:\>adb shell
# mount -t ext4 /dev/block/bootdevice/by-name/cache /cache
# /sbin/update-binary 2 1 /data/update.zip

Then cross your fingers. When/if it stops nicely:

# setprop sys.powerctl reboot

[bazookajoe]

Not having much luck sadly. It's probably me being an idiot.

From stock recovery > bootloader > fastboot boot rec.img
C:\adb>adb push update.zip /data
adb: error: failed to read copy response
update.zip: 1 file pushed, 0 skipped. 20.2 MB/s (1370512644 bytes in 64.628s)
adb: error: failed to read copy response

that lost me adb:
C:\adb>adb shell
adb.exe: no devices/emulators found

It did appear to reach 100% after hanging for a bit on 99% but then that error flashed up.

So, back to stock recovery > bootloader > fastboot boot rec.img
C:\adb>adb shell
# mount -t ext4 /dev/block/bootdevice/by-name/cache /cache
# /sbin/update-binary 2 1 /data/update.zip
Unable to open '/data/update.zip': No such file or directory
failed to map package /data/update.zip

Then I tried going through your first lot of commands in case I had to do the thing where I got ttyscreen to show up on the white screen, as I'm in shell I figured I could only try the second method (unless there's away to go back to C:>adb from there. I have no idea).

# mount -t ext4 /dev/block/bootdevice/by-name/cache /cache
# /sbin/update-binary 2 1 /data/update.zip
but I got the same error.

I tried with two spaces between mount and -t just in case as well.

I also downloaded the recovery image from my android phone in case there was a cache issue with download.

I just have update.zip loose in my adb folder. I also tried having update-binary loose in the adb folder too one time, but all the other tries I just had update.zip in my adb folder.

[Renate]

Ok, it looks like you have no room. I was trying to do things the easy way.

Err, one thing to check first:

# ls -l /dev/block

Are you seeing lots of "mmcblk0p??" or lots of "sda??"
If you are seeing lots of sda?? just tell me and stop for now.

Only if you are seeing lots of mmcblk0p?? can you try this.
Do you have a Type C OTG adapter? Or a Type C flash drive?
Stick your update.zip on a flash drive in the \ directory.

First, fresh fastboot boot rec.img
Wait until the screen goes white.

# start ttyscreen
# start autoupdate

Then, when it says, plug in your flash drive and cross your fingers.
Keep a camera ready for error messages.

[bazookajoe]

Yes I got mmcblk0p.

Ran the whole thing. It excecated for quite awhile, lots of writing in 1024's, the progress bar ran through once all black, then it started a second process streaming along with a second progress bar in black .Now we've stopped at this screen for quite some time now and it's doing nothing more.

I don't know if that's it and now I'll have to send a command to reboot or if it's just frozen. The progress bar does look all finished (second time around). Everything else is gibberish to me lol.