Looking for Full Firmware / EDL Image – Boox Tab Ultra (Non-C)

[Slifer]

Hi again,

as mentioned in a previous post, I’m still trying to recover my soft-bricked Boox Tab Ultra (original B/W version, not C or Pro). Recovery and ADB work, but sideloading hasn’t resolved the boot issues.

I’m now looking for a full firmware image or EDL-compatible files for this specific model. If anyone has access to such files or knows where they might be shared, I’d really appreciate your help.

Thanks in advance!

[Renate]

The Tab Ultra has a full update here:

Model:  TabUltra (English)
Finger: Onyx/TabUltra/TabUltra:11/2025-04-02_12-29_v4.0-rel_6d15a71551/49344:user/release-keys
Link:   http://firmware-us.boox.com/266e3dc6e455a4bcbf99f8f7a7684349/update.upx
Size:   1,862,304,832
MD5:    266e3dc6e455a4bcbf99f8f7a7684349

There is also the 4.0.2 incremental update, but you should worry about that afterwards.

I've not got specific info about the processor on the TabUltra, but the Firehose loader for the Go6 would be a good starting point.
See: http://www.temblast.com/ref/onyxldr.htm
Please report what the HWID is. (It's not secret or specific to your unit.)

[Slifer]

Originally Posted by Renate

The Tab Ultra has a full update here:

Model:  TabUltra (English)
Finger: Onyx/TabUltra/TabUltra:11/2025-04-02_12-29_v4.0-rel_6d15a71551/49344:user/release-keys
Link:   http://firmware-us.boox.com/266e3dc6e455a4bcbf99f8f7a7684349/update.upx
Size:   1,862,304,832
MD5:    266e3dc6e455a4bcbf99f8f7a7684349

There is also the 4.0.2 incremental update, but you should worry about that afterwards.

I've not got specific info about the processor on the TabUltra, but the Firehose loader for the Go6 would be a good starting point.
See: http://www.temblast.com/ref/onyxldr.htm
Please report what the HWID is. (It's not secret or specific to your unit.)

Hi again,

Sorry for the late reply – I wanted to take some time before continuing and didn't get back as quickly as I should have.

I tried working with the poke6.bin Firehose loader. The device is detected successfully in EDL mode, and I was able to run commands like nop, w boot, and r boot without issues. However, printgpt and gpt don’t return anything, and I can’t retrieve the HWID either – it’s not shown in any command output.

I also tried peekhex 0x0 0x400 but couldn’t identify an obvious HWID string.

Any idea how I can proceed from here? Would a different loader help?

[Renate]

Show your work. I don't know what's going on.
How can you not get the HWID.
Use my EDL client, at least I know that.

[mariocord]

Hi,

I have an Onyx Boox Tab Ultra (non-C, purchased Nov 2022, Snapdragon 662) that got bricked back in January during an OTA firmware update — power/update failed mid-way and it's been stuck at the ONYX boot logo ever since, no matter how I try to reboot it.

It does NOT show up in normal fastboot or adb devices. The only way I can get it to respond at all is using a test-point short cable with a button, which puts it into EDL (Sahara) mode.

I tried various recovery/flashing attempts back in January (with some help from ChatGPT) without success, but at the time I was on Windows. Since then I've migrated my PC to Ubuntu (around April), so I no longer have my old Windows setup or any of the tools/files I used back then.

I set up bkerler's edl.py on Ubuntu and ran `edl printgpt`. Here's what it reports:

```
HWID: 0x001740e100000000 (MSM_ID:0x001740e1, OEM_ID:0x0000, MODEL_ID:0x0000)
CPU detected: "kamorta_IoT_APQ"
PK_HASH: 0xd40eee56f3194665574109a39267724ae7944134cd53cb76 7e293d3c40497955bc8a4519ff992b031fadc6355015ac87
Serial: 0xdb19616f
```

None of the auto-detected generic loaders (quectel mdm9x05, SDM855LA, sdm662 factory, sc8180x factory) work — uploading any of them fails with "Error: Invalid data size received in image header".

Since the CPU string comes back as "kamorta_IoT_APQ", I'm guessing this needs the specific Onyx/kamorta firehose loader (signed for this exact PK_HASH) rather than a generic Qualcomm one, which Onyx doesn't publish publicly.

Does anyone have the correct firehose loader (and ideally the full rawprogram/patch images) for the Tab Ultra (non-C, kamorta platform)? Happy to run any further diagnostics needed. Thanks so much in advance!

[Renate]

As it says in https://www.temblast.com/ref/onyxldr.htm, the Firehose loader is:
https://github.com/bkerler/Loaders/b...dr_patched.elf

The latest update is:

Model:  TabUltra (English)
Finger: Onyx/TabUltra/TabUltra:11/2026-06-30_11-25_4.2-rel_0630_b7cf3517a3/51518:user/release-keys
Link:   http://firmware-us.boox.com/6b7ec9b9bfc68ec1f871ab0c227f0c24/update.upx
Size:   1,866,926,032
MD5:    6b7ec9b9bfc68ec1f871ab0c227f0c24