Rooting Onyx Boox Note Air3C

[ZiA]

TL;DR – Lessons learned the hard way

• Beware of fake EDL cables. Many cables marketed as EDL cables do not work properly
• This is how the computer detects the tablet in EDL mode:

  ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)

  Any other ID, such as

  ID 05c6:f000 Qualcomm, Inc. TA-1004 [Nokia 8]

  means you are not in EDL mode.
• Whether using a DIY cable with a button or manually shorting the black and green wires, the connection needs to be maintained for only a few seconds after plugging the cable in.
• The instant you release the button (or un-shorten the wires), the computer detects the EDL device if the operation was successful. There is no need to wait further.
• Don't use your DIY cable for data transfer as it likely lacks proper shielding and may cause transmission errors during large read/write operations. Once the device enters EDL mode, unplug the DIY cable. The tablet will not leave EDL mode. Connect a standard, high-quality USB cable to run the backup and restore operations.
• Read errors, transmission errors or software errors do happen. If you have disk space create two full backups. Compare the file sizes and checksums of the two sets to ensure they are identical before proceeding.
• Boox firmware implements anti-rollback protection. Once you run a particular firmware version, you cannot run an older one.

Rooting procedure

Step 1: Access EDL Mode and Backup

1. Activate USB Debugging on your device.
2. Enter EDL mode via ADB:

   adb reboot edl

3. Make a full backup using your EDL tool (e.g., edl.exe or edl.py).
4. Disconnect the cable and reconnect it.
5. Create a second full backup.
6. Compare both sets of backup files. If they are identical, you are safe to continue.

Step 2: Extract and Patch Boot Images

1. Read the boot partitions. Using B.Kerler’s tool, this would be:

   edl.py --memory=ufs r boot_a boot_a.bin
   edl.py --memory=ufs r boot_b boot_b.bin

2. Reboot the tablet normally:

   edl.py reset

3. Copy boot_a.bin and boot_b.bin to the tablet’s storage.
4. Install the Magisk app.
5. Patch both boot images. Be extremely careful about the names of the output files so you know which patched file corresponds to boot_a and which corresponds to boot_b.

Step 3: Flash and Root

1. Transfer the patched images back to your computer.
2. Rename with better names, e.g., boot_a_patched.bin, boot_b_patched.bin
3. Re-enter EDL mode:

   adb reboot edl

4. Flash the patched images:

   edl.py w boot_a boot_a_patched.bin --memory=ufs
   edl.py w boot_b boot_b_patched.bin --memory=ufs

5. Reboot:

   edl.py reset

Step 4: Fix the Magisk Bug

1. Run the Magisk app. It will likely get stuck on the green splash screen and do nothing. This is a known bug.
2. Open a shell:

   adb shell

3. Check you can gain root access despite the frozen UI: (in the shell executing on the tablet)

   su

4. A Superuser request confirmation window will appear on the tablet. Grant permission immediately. If you miss this one-time window, you will not get a second chance.
5. The original boox-ams-fix-v1.0.zip of dynamicfire does not work on Note Air3 C with firmware 4.2. You must build a custom fix using this method or use a pre-made compatible version (e.g., my own boox-ams-fix-v1.0-my_air3c.zip).
6. Push the fix to the device:

   adb push boox-ams-fix-v1.0-my_air3c.zip /sdcard/

7. Open a shell:

   adb shell

8. In the ADB shell, install the fix as a Magisk module: (in the shell executing on the tablet)

   magisk --install-module /sdcard/boox-ams-fix-v1.0-my_air3c.zip

9. Perform a final reboot:

   adb reboot

And now the long(er) story.

My harrowing (but successful) journey rooting the Note Air3 C on 4.2 – or: How I learned to stop worrying and love the DIY cable

I’m not one of those wizards who can resurrect a device with a paperclip and a dream. Still, I wanted Magisk on my Onyx Boox Note Air3 C. I read the mobileread threads, collected the tools, ordered an “EDL cable” from the internet – and that’s where the adventure began.

The case of the phantom EDL cable
The cable arrived and I plugged it in with all the ritual: hold button, plug, wait for blue LED, release… nothing. I tried every conceivable timing. I asked AI. I scoured the net. Nothing made the tablet appear as QDL 9008. With a sinking feeling I ran lsusb and saw: ID 05c6:f000 Qualcomm, Inc. TA‑1004 [Nokia 8]. Wait, the tablet is not a telephone. This was a fake EDL cable – the button just connected something that made the tablet think it was a Nokia accessory, not the magic Qualcomm download mode. Hours of life gone.

Frustrated but undeterred, I cut open an old USB cable and twisted black and green together. Plug. Short. One‑Mississippi, two‑Mississippi, three‑Mississippi, release – and bing! 05c6:9008 appeared instantly. I actually shouted with joy. So don’t waste time holding the button: a short 3‑second short is all you need, and the moment you break the shortening the PC detects EDL.

Backup, upgrade, backup, repeat
I was on firmware 4.1. I booted into EDL with my newly blessed DIY cable, loaded the Firehose loader for the GoCo7 (the same processor as the NA3C – thanks, Renate!), and did a full backup. Then, still using the same DIY cable, I upgraded to 4.2, factory‑reset, and pulled another full backup. Then I rooted (more on that later), ran another backup, restored some apps, and did yet another backup. Four full backups total. I felt invincible.

After the rooting, I noticed I’d missed a few crucial files from the 4.1 days. “No problem,” I said, “I’ll just flash the full 4.1 backup, grab the data, then restore 4.2.” Famous last words.

When anti‑rollback punches you in the face
I wrote the entire 4.1 backup to the tablet. Reboot… and stuck at the BOOX logo forever. Linux showed an 18d1:d00d device – fastboot mode with a trimmed bootloader, completely bricked. Anti‑rollback protection had fused the 4.2 version into the chip; the old firmware simply would not boot. I know that one can bypass this by flashing an unlocked bootloader from older firmware (or from a Fairphone 4 on newer Boox devices, truly ingenious), but I wasn’t ready to nuke userdata just yet. So I sighed, re‑entered EDL, and queued up my most recent 4.2 backup to recover.

The great backup corruption disaster
About halfway through the restore, the EDL tool screamed about size mismatch. Panic. I checked the backup files – partition sizes were all over the place, they didn't match . I checked the previous 4.2 backup: same corruption. And the one before that: also corrupted. Every single 4.2 backup I had was damaged. Then the horrible realisation hit: I’d used the DIY cable for all data transfers. The cheap, twisted‑pair abomination had introduced errors. The backup file sizes didn’t match the partition table. I had three useless bricks of data and a tablet that refused to boot anything older than 4.2.

At this point I was looking at a very expensive e‑ink paperweight. I felt sick. But then, in the spirit of “I have nothing left to lose,” I decided to build a Frankenstein firmware.

Frankenstein walks again
I compared all three corrupted backups. Some partitions – like cdt.bin, xbl_a.bin, xbl_config_a.bin, xbl_b.bin, xbl_config_b.bin – were healthy only in the old 4.1 backup. So I borrowed those from the old firmware. For the rest I picked the least‑damaged 4.2 partitions from across the backups. Userdata was completely hosed in every backup, so I simply didn’t flash it, nor its metadata. My logic was: Android will detect the corruption and will reformat the userdata, no need to flash.

I loaded the motley collection into EDL, flashed it with a regular USB cable (lesson learned!), and hit reboot. The screen stayed black for agonising infinite number of seconds. Then the BOOX logo appeared. And it wasn’t a bootloop! It wasn’t stuck! It booted! But wait, what am I seeing?! All my old user data – the very files I’d tried to rollback for – were right there, untouched. The Frankenstein 4.2 system, stitched together with 4.1 bootloaders and a prayer, recognised the existing data partition as if nothing had happened. I literally laughed out loud.

So, not only did I get a rooted Note Air3 C, but I recovered data from the brink of oblivion thanks to a tiny bit of luck and a massive dose of desperation.

I haven’t used Renate’s frp_unlocked.img and I’m still not sure what it does, but for a straightforward Magisk root it wasn’t needed.

The tablet now hums along happily on 4.2, fully rooted, and I have a deep appreciation for the difference between a genuine EDL cable and a cheap knock‑off – and between a proper backup and a corrupted one. If my story saves just one person from losing their data, the hair I pulled out will not have been in vain.

Big thanks to Renate, kawaiishay, dcarvil, dynamicfire, and everyone else in the Onyx rooting threads.

Happy rooting and use a good cable.