Rooting the Poke5

[Never_Sm1le]

Originally Posted by Renate

@Never_Smile: You need at least 10 posts to message someone here.

ah ok, thank you

[fforc9e]

Hey, how can I get the upx file for 3.5.3 from 2024-07-01. I mindlessly update the reader just after first boot. I don't want to downgrade. I tried API for Poke5P but I'm getting 3.5.1 from here http://data.onyx-international.cn/api/firmware/update

[Renate]

Model:  Poke5P (English)
Finger: Onyx/Poke5P/Poke5P:11/2024-07-01_23-50_3.5.3_7f5c78ff3/8815:user/release-keys
Link:   http://firmware-us.boox.com/0737a7499fb1677d14132780b26ec3ca/update.upx
Size:   433,563,057
MD5:    0737a7499fb1677d14132780b26ec3ca

This is an incremental update.

[fforc9e]

Thanks! Can I use it to do the rooting procedur?

Edit. Could you hit how to get this upx links for future reference?
Edit 2. Ok so you can use the payload_dumper on incremental bin files.
Edit 3. It seems that I can't flash the boot.img or vbmeta. Getting

Sending 'vbmeta_b' (8 KB)                          OKAY [  0.005s]
Writing 'vbmeta_b'                                 FAILED (remote: 'unknown command')
fastboot: error: Command failed

Tried oem unlock and flashing unlock but did not help

[Renate]

There has been a trend lately of eviscerating flashing commands out of abl.
I don't know how much this is being driven by Google or Onyx.
For now, for the models for which we have Firehose loaders, it's no big deal.
It could be a deal breaker later. Cross your fingers.

If you have space on your desktop (32 GB), definitely make a full, raw backup.
That means that there will be nothing that you can do to your Poke5 that can't be fixed by a restore and a cup of coffee.

C:\>edl /lpoke5.bin
C:\>edl /r bigbackup.img /z

I like making things complicated, so I'm working on a new way to install incremental updates with a custom recovery,

[fforc9e]

Got my poke5 bricked for about half an hour. I had enough common sense to do full backup alongside boot/vbmeta partitions.

Funny thing was that I bricked it by flashing vbmeta from the unpacked 3.5 update. Had to DIY EDL cable and re-flashed the boot/vbmeta with backed-up files and then just flash magisk's patched boot.img and it worked!

Are you porting TWRP, or something different? Just wondering how to enter recovery on poke5 without volume buttons. When bricked I've tried some sequence found on the internet but fortunately plugging the EDL cable did the trick.

Thanks you for this tutorial, now I can make my reader really mine.

[ArkVlad]

Hello there!

I would like to root my Poke 5 (FW 1.3.5) as well, however I do not have that much experience with EDL (more with adb & fastboot). For me it was the same situation, that I could not write the Magisk patched "boot.img" file, neither "vbmeta" (a & b) through the fastboot.

Could someone control me, that I have done a correct plan (nothing except backup was done) to fix it through the EDL?

1) We connect to the Reader in EDL mode, by typing:

edl /l001860e100000000_d9357db88795b5a8_Qcm2290_ddr_fhprg.elf (the loader Renate linked in the first page of this thread)

2) Secondly, we make a backup, just in case something goes wrong:

edl /r backup.img

3) Here I am unsure. Do we write the Magisk patched boot.img only (depending if it is A or B partition, of course)?

edl /w /pboot_a patched-boot.img

4) Do we need to disable vbmeta's verification thing through EDL?
In case yes, how do we do it?
I have found a tool that patches vbmeta files, but I am not sure, if it is the correct solution, or if we tamper the "boot.img" partition with EDL, do we need to do something with the vbmeta partitions?
If it is fine, do we simply do like that?

edl /w /pvbmeta-a patched-vbmeta.img

Also, where does "poke5.bin" come from? Is it simply the backup we took earlier? If so, why does it have ".bin" extension then? ><

C:\>edl /lpoke5.bin

P.S.: Do I understand correctly, that EDL utility is taken from here?

(Pardon if formatting is wrong, first time I am using a forum.)

[Renate]

I renamed the Firehose loader poke5.bin so I didn't have to type qcm2290-etc.
They are ELF files, but that's a needless point.

I call my backup images (32 GB) poke5a.img, poke5b.img...

Magisk normally doesn't care about AVB/vb-meta so you don't have to worry about that.

[ArkVlad]

Aha, I did not know that file extension did not matter.
Is it only for the Firehose loader or some other stuff do not care about file extension as well? Like I know in Linux (UNIX?) environment the file extension does not really matter for the system & programs.

[ArkVlad]

Otherwise, for other reading people that are inexperienced as I am, this worked for me, as Renate said, nothing else was needed except writing the boot image:

(check whether "boot_a" is "Boot" and "boot_b" is "Inactive" or vice versa, and choose correct partition for the next command)

edl /g

edl /w /pboot_a patched-by-Magisk-boot.img

Thank you Renate for the help for me and other rooting people for such detailed explanation and a hard work!

One day I will make it into a YouTube video, so people would have easier times in the future!