Go Color 7 Gen II in EDL 9008, xbl_config zeroed in both slots – need a donor dump

Mormyxa · Yesterday, 06:05 PM

Hi all,

My Boox Go Color 7 Gen II is stuck in EDL 9008 (no LED, no screen). I need a dump of two tiny partitions from a working Gen II unit, and would really appreciate help.

What happened
I was trying to recover the device and by mistake flashed images extracted from the Gen I firmware (pre-device=GoColor7): xbl, abl, boot, dtbo, recovery, vbmeta, vbmeta_system (both slots). I have since realized the mistake and restored all of these from the correct Gen II OTA, and verified by reading them back that they match the OTA images in both slots.

Current state
- EDL works fine: loader 0000000000000000_bdaf51b59ba21d8a_fhprg.bin (bkerler/Loaders), --memory=emmc, bkerler edl on Windows. printgpt shows an intact GPT, and I can read and write partitions.
- Active slot is b.
- A full read of the small partitions shows that xbl_config_a and xbl_config_b (128 KiB each) are completely zeroed. Everything else in the boot chain has data (xbl, tz, hyp, aop, devcfg, keymaster, multiimgoem, featenabler, qupfw, uefisecapp, imagefv, abl, persist).
- The device returns to 9008 after reset, which is what I would expect with an empty xbl_config.
- The OTA payload does not contain xbl_config. It only has: abl, boot, dtbo, modem, odm, product, recovery, system, system_ext, vbmeta, vbmeta_system, vendor, xbl. So I cannot restore it from firmware.

Device info
- Firmware used (Gen II OTA): pre-device=GoColor7_2, post-build ONYX/TabBoox/TabBoox:13/TKQ1.230615.001/GV2.027.SQ83A, incremental 546, security patch 2026-04-01
- HWID: 0x0013f0e100000000 (MSM_ID 0x0013f0e1), CPU "bitra_SDM"
- PK_HASH: 0xd40eee56f3194665574109a39267724ae7944134cd53cb76 7e293d3c40497955bc8a4519ff992b031fadc6355015ac87
- eMMC: prod_name C21E00, total_blocks 122142720

What I am asking
Could someone with a working Go Color 7 Gen II please read just these two small partitions and share the files?

adb reboot edl
edl.py --loader=go7_loader.bin --memory=emmc r xbl_config_a xbl_config_a.img
edl.py --loader=go7_loader.bin --memory=emmc r xbl_config_b xbl_config_b.img

(each file should be exactly 131072 bytes)

Please also tell me your firmware build. Ideally GV2.027.SQ83A or newer; if yours is older, please let me know so I can judge whether it is safe to use.

Please do NOT share persist, devinfo, frp or any other partitions, they contain device-specific data.

If anyone knows another source for a valid Gen II xbl_config (for example from a QFIL package or a service image), that would also be very helpful. I have a full backup of all readable partitions, so I can verify and compare.

Thank you very much in advance!

Renate · Yesterday, 11:11 PM

I don't have any experience with those and have never looked into them.

On my Go6 the two xbl_config_x are identical.
They are typical SecureBoot signed 32 bit ELF images.
Besides the header and signing there are three program sections.
They seem to have gobble-dee-gook configuration data.

I know this is advice after the fact, but since you have EDL you could have made a complete, raw backup in one file.

Mormyxa · Today, 02:00 AM

Thanks a lot for taking the time to answer, that's very helpful to know (identical a/b, signed ELF). Agreed on the full raw backup, lesson learned. I'll keep looking for a Gen II owner who can read xbl_config_a, and I'll only write something once I've verified it's a proper ELF of the right size. Thanks again!

Yesterday, 06:05 PM	#1
Mormyxa Junior Member Posts: 2 Karma: 10 Join Date: Oct 2026 Device: onyxboox go color gen2	Go Color 7 Gen II in EDL 9008, xbl_config zeroed in both slots – need a donor dump Hi all, My Boox Go Color 7 Gen II is stuck in EDL 9008 (no LED, no screen). I need a dump of two tiny partitions from a working Gen II unit, and would really appreciate help. What happened I was trying to recover the device and by mistake flashed images extracted from the Gen I firmware (pre-device=GoColor7): xbl, abl, boot, dtbo, recovery, vbmeta, vbmeta_system (both slots). I have since realized the mistake and restored all of these from the correct Gen II OTA, and verified by reading them back that they match the OTA images in both slots. Current state - EDL works fine: loader 0000000000000000_bdaf51b59ba21d8a_fhprg.bin (bkerler/Loaders), --memory=emmc, bkerler edl on Windows. printgpt shows an intact GPT, and I can read and write partitions. - Active slot is b. - A full read of the small partitions shows that xbl_config_a and xbl_config_b (128 KiB each) are completely zeroed. Everything else in the boot chain has data (xbl, tz, hyp, aop, devcfg, keymaster, multiimgoem, featenabler, qupfw, uefisecapp, imagefv, abl, persist). - The device returns to 9008 after reset, which is what I would expect with an empty xbl_config. - The OTA payload does not contain xbl_config. It only has: abl, boot, dtbo, modem, odm, product, recovery, system, system_ext, vbmeta, vbmeta_system, vendor, xbl. So I cannot restore it from firmware. Device info - Firmware used (Gen II OTA): pre-device=GoColor7_2, post-build ONYX/TabBoox/TabBoox:13/TKQ1.230615.001/GV2.027.SQ83A, incremental 546, security patch 2026-04-01 - HWID: 0x0013f0e100000000 (MSM_ID 0x0013f0e1), CPU "bitra_SDM" - PK_HASH: 0xd40eee56f3194665574109a39267724ae7944134cd53cb76 7e293d3c40497955bc8a4519ff992b031fadc6355015ac87 - eMMC: prod_name C21E00, total_blocks 122142720 What I am asking Could someone with a working Go Color 7 Gen II please read just these two small partitions and share the files? adb reboot edl edl.py --loader=go7_loader.bin --memory=emmc r xbl_config_a xbl_config_a.img edl.py --loader=go7_loader.bin --memory=emmc r xbl_config_b xbl_config_b.img (each file should be exactly 131072 bytes) Please also tell me your firmware build. Ideally GV2.027.SQ83A or newer; if yours is older, please let me know so I can judge whether it is safe to use. Please do NOT share persist, devinfo, frp or any other partitions, they contain device-specific data. If anyone knows another source for a valid Gen II xbl_config (for example from a QFIL package or a service image), that would also be very helpful. I have a full backup of all readable partitions, so I can verify and compare. Thank you very much in advance!

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
KT3 Request: KT3 (8th Gen) partition table / first MB dump needed (bricked via TTL)	roberto017	Kindle Developer's Corner	0	06-06-2026 03:37 PM
Cannot boot Boox Savi 6 (Go 6) into EDL Mode using an EDL cable	oxgorou	Onyx Boox	8	05-16-2026 11:00 PM
Go Color 7 gen 2 latest Firmware	Serdar1st	Onyx Boox	6	04-23-2026 12:14 AM
BOOX Go Color 7 (Gen II) EDL Mode and Firehose Loader Issues	chatelp	Onyx Boox	13	09-25-2025 05:37 PM
Fujitsu Quaderno A4 3rd Gen 13.3″ COLOR	rrr	Which one should I buy?	1	03-12-2025 03:35 AM

Yesterday, 11:11 PM	#2
Renate Onyx-maniac Posts: 4,545 Karma: 22077803 Join Date: Feb 2012 Location: Germany Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	I don't have any experience with those and have never looked into them. On my Go6 the two xbl_config_x are identical. They are typical SecureBoot signed 32 bit ELF images. Besides the header and signing there are three program sections. They seem to have gobble-dee-gook configuration data. I know this is advice after the fact, but since you have EDL you could have made a complete, raw backup in one file.

Today, 02:00 AM	#3
Mormyxa Junior Member Posts: 2 Karma: 10 Join Date: Oct 2026 Device: onyxboox go color gen2	Thanks a lot for taking the time to answer, that's very helpful to know (identical a/b, signed ELF). Agreed on the full raw backup, lesson learned. I'll keep looking for a Gen II owner who can read xbl_config_a, and I'll only write something once I've verified it's a proper ELF of the right size. Thanks again!

Advert