EDL on a Boox Note3

middle_tree · Today, 12:28 PM

Hi.

I have a Boox Note3 (non-Air) that I would like to have a complete backup of.

I can't seem to get EDL working. Renate's utility says

Code:

HWID: 000cc0e100000000, JTAG: 000cc0e1, OEM: 0000, Model: 0000
Hash: 7be49b72f9e43372-23ccb84d6eccca4e-61ce16e3602ac200-8cb18b75babe6d09 (x3)

which seems to say that it uses the same loader as Poke3/Leaf.
This is a UFS device. cat /proc/scsi/scsi returns flash model "KM5H7001DM-B424".

From scrolling through older posts (can't seem to find it now), someone tried to use EDL on a Note3 a while ago and couldn't get it to work either.

Any suggestions?

Output of edl /lnote3.bin /v

Code:

Found EDL 9008, handshaking...
Received 0x01 command
Version 2.1
Received 0x0b command
Received 0x0e command
HWID: 000cc0e100000000, JTAG: 000cc0e1, OEM: 0000, Model: 0000
Received 0x0e command
Hash: 7be49b72f9e43372-23ccb84d6eccca4e-61ce16e3602ac200-8cb18b75babe6d09 (x3)
Received 0x01 command
Sending note3.bin 100% ok, starting...
Received 0x06 command
Ok, waiting for Firehose...
<log value="Binary build date: Feb  4 2018 @ 00:51:33"/>
<log value="Chip serial num: 0 (0x0)"/>
<log value="Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke "/>
Ok

Output of edl /u /g /v

Code:

Found EDL 9008, configuring...
<log value="fh.attrs.MaxPayloadSizeToTargetInBytes of 65536 > fh.channel_buffer_capacity of 32768"/>
<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
<response value="NAK" MinVersionSupported="1" MemoryName="UFS" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="32768" MaxPayloadSizeToTargetInBytesSupported="32768" MaxXMLSizeInBytes="4096" Version="1" TargetName="MSM8996" DateTime="Feb  4 2018 - 00:51:33" />
Nope, configuring...
<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
<response value="ACK" MinVersionSupported="1" MemoryName="UFS" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="32768" MaxPayloadSizeToTargetInBytesSupported="32768" MaxXMLSizeInBytes="4096" Version="1" TargetName="MSM8996" DateTime="Feb  4 2018 - 00:51:33" />
Ok
Requesting info on LUN 0... no response

Output of edl /r /u0 test.img /s0 /c1 /v (just to test)

Code:

Found EDL 9008, configuring...
<log value="fh.attrs.MaxPayloadSizeToTargetInBytes of 65536 > fh.channel_buffer_capacity of 32768"/>
<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
<response value="NAK" MinVersionSupported="1" MemoryName="UFS" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="32768" MaxPayloadSizeToTargetInBytesSupported="32768" MaxXMLSizeInBytes="4096" Version="1" TargetName="MSM8996" DateTime="Feb  4 2018 - 00:51:33" />
Nope, configuring...
<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
<response value="ACK" MinVersionSupported="1" MemoryName="UFS" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="32768" MaxPayloadSizeToTargetInBytesSupported="32768" MaxXMLSizeInBytes="4096" Version="1" TargetName="MSM8996" DateTime="Feb  4 2018 - 00:51:33" />
Ok
Requesting info on LUN 0... no response

Then when I ask it to reboot

Code:

Found EDL 9008
<log value="ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 0"/>
<log value="ERROR: Failed to open the device 3 slot 0 partition 0"/>
<log value="ERROR: Failed to get device info slot:0artition:0"/>
<log value="ERROR 14: Line 1270: HANDLE_STORAGE_INFO_FAILURE"/>
Requesting reboot... ok

This is all using the driver from Zadig.
Bkerler's Linux EDL tool (what I originally used) said the same.

I tested the using QFIL (replacing the driver with QDLoader 9008 driver), essentially the same stuff (reading partitions).

Code:

06:20:32: DEBUG: Response was 'NAK'
06:20:32: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 32768
06:20:32: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 32768
06:20:32: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
06:20:32: INFO: **INFO Unrecognized tag 'getstorageinfo', so I will simply look for ACK or NAK

Code:

06:20:34: DEBUG: XML FILE (148 bytes): CharsInBuffer=986-148=838
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 65210"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 65210'
06:20:34: DEBUG: XML FILE (127 bytes): CharsInBuffer=838-127=711
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to open the device 3 slot 0 partition 65210"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'ERROR: Failed to open the device 3 slot 0 partition 65210'
06:20:34: DEBUG: XML FILE (123 bytes): CharsInBuffer=711-123=588
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Device type 3, slot 0, partition 65210, error 0"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'INFO: Device type 3, slot 0, partition 65210, error 0'
06:20:34: DEBUG: XML FILE (134 bytes): CharsInBuffer=588-134=454
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="WARN: Get Info failed to open 3 slot 0, partition 65210, error 0"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'WARN: Get Info failed to open 3 slot 0, partition 65210, error 0'
06:20:34: DEBUG: XML FILE (123 bytes): CharsInBuffer=454-123=331
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to get device info slot:0artition:65210"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'ERROR: Failed to get device info slot:0artition:65210'
06:20:34: DEBUG: XML FILE (134 bytes): CharsInBuffer=331-134=197
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="GetStorageInfo Failed - storage_device_get_info() returned FALSE"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'GetStorageInfo Failed - storage_device_get_info() returned FALSE'
06:20:34: DEBUG: XML FILE (118 bytes): CharsInBuffer=197-118=79
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR 14: Line 1270: HANDLE_STORAGE_INFO_FAILURE"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'ERROR 14: Line 1270: HANDLE_STORAGE_INFO_FAILURE'
06:20:34: DEBUG: XML FILE (79 bytes): CharsInBuffer=79-79=0
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="NAK" />
</data>
-------------------------------------------------------------------------------------------

06:20:34: DEBUG: Response was 'NAK'

Renate · Today, 05:07 PM

Yup, you did most of the correct things.
Your device is UFS (as confirmed by the chip number) and an SDM636.
The Poke3 loader (which I've used a zillion times on the Poke3/eMMC) seems to misbehave on UFS.
It could be that the OEM tried to patch something in and broke things.

Normally the Firehose protocol allows something to blather as much as it likes but it must end with an ACK or a NAK and then shut up after that. The fact that the edl /z shows queued up messages shows that it broke that contract.

Ok, you'll have to do some 'spearminting.

Code:

edl /lnote3.bin
edl /u /i /v
edl /x /v "<getstorageinfo slot='0' physical_partition_number='0'/>"

I'm not sure that "slot" is interpreted.
I'm not sure if you have a non-standard slot.
Play with slot, small numbers and partition 0-6.
Note anything different.
Be aware that messages can queue up to the next command.

middle_tree · Today, 05:37 PM

edl /u /i /v returns the same as edl /u /g /v.
As you said, output seems to get queued to the next one, and running edl with the custom XML returns

Code:

<log value="ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 0"/>
<log value="ERROR: Failed to open the device 3 slot 0 partition 0"/>

regardless of the slot and partition I put (always says slot 0 partition 0, which seems to be from /u /i /v). Further commands just returns "bad XML".

I forgot to mention, in between edl /u /g /v and edl /r /u0 test.img /s0 /c1 /v, I had to reset, it just says "no response".

Renate · Today, 05:57 PM

I was not clear.
Do the /l once
Do the /u /i /v once
Do the /x /v multiple times in a row, changing as you go.
Of course you can do the same /x twice in a row then you get the delayed results.
You must be able to get different partitions numbers at least.
Leave /g and /r alone.

Do you have an xbl from an update? In payload.bin?

middle_tree · Today, 06:12 PM

Sorry, I wasn't clear, let me try to explain again.
I did the /u /i /v, followed by /x /v.
The first time I run /x /v right after /u /i /v always returns, regardless of the slot/partition number I put in,

Code:

Failed to open the device 3 slot 0 partition 0

Anything else I run after that returns either "bad XML" or "no response".

Attached xbl.
I forgot to mention, I do have root already (fastboot flash boot, etc.), so let me know if there's any partition that you want to look at.

Thanks!

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Boox Page adb / fastboot / recovery /edl walkthrough	Anghirrim	Onyx Boox	26	05-20-2024 06:28 AM
Sell Onyx BOOX Note3, for sale for nice price	norweger	Flea Market	0	03-03-2023 04:49 PM
Battery Replacement: Boox Note Air vs. Note3	tommyer	Onyx Boox	8	11-05-2021 09:47 AM
Hello from Iowa - Kindle / Boox Note3	Nursken	Introduce Yourself	1	10-01-2021 09:17 PM
Onyx Boox is releasing Note3 & Nova3 in China	winstonma	Onyx Boox	23	10-20-2020 10:49 PM

Today, 05:07 PM	#2
Renate Wizard Posts: 2,688 Karma: 11749035 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5	Yup, you did most of the correct things. Your device is UFS (as confirmed by the chip number) and an SDM636. The Poke3 loader (which I've used a zillion times on the Poke3/eMMC) seems to misbehave on UFS. It could be that the OEM tried to patch something in and broke things. Normally the Firehose protocol allows something to blather as much as it likes but it must end with an ACK or a NAK and then shut up after that. The fact that the edl /z shows queued up messages shows that it broke that contract. Ok, you'll have to do some 'spearminting. Code: edl /lnote3.bin edl /u /i /v edl /x /v "<getstorageinfo slot='0' physical_partition_number='0'/>" I'm not sure that "slot" is interpreted. I'm not sure if you have a non-standard slot. Play with slot, small numbers and partition 0-6. Note anything different. Be aware that messages can queue up to the next command.

Today, 05:37 PM	#3
middle_tree Junior Member Posts: 3 Karma: 10 Join Date: Jul 2024 Device: Boox Note 3	edl /u /i /v returns the same as edl /u /g /v. As you said, output seems to get queued to the next one, and running edl with the custom XML returns Code: <log value="ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 0"/> <log value="ERROR: Failed to open the device 3 slot 0 partition 0"/> regardless of the slot and partition I put (always says slot 0 partition 0, which seems to be from /u /i /v). Further commands just returns "bad XML". I forgot to mention, in between edl /u /g /v and edl /r /u0 test.img /s0 /c1 /v, I had to reset, it just says "no response".

Today, 05:57 PM	#4
Renate Wizard Posts: 2,688 Karma: 11749035 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5	I was not clear. Do the /l once Do the /u /i /v once Do the /x /v multiple times in a row, changing as you go. Of course you can do the same /x twice in a row then you get the delayed results. You must be able to get different partitions numbers at least. Leave /g and /r alone. Do you have an xbl from an update? In payload.bin?