How to Root the Onyx Boox Note Air 2 Plus (Windows)

[Renate]

Originally Posted by sleepyy

adb reboot bootloader
fastboot reboot fastboot

You're going around in circles a bit.
"adb reboot bootloader" brings you to the abl with fastboot and a blank screen
"adb reboot fastboot" brings you to recovery with fastbootd and a menu
"adb reboot edl" is what I mostly use these days.

The NoteAir2[Plus] uses the SDM662 chip. The Firehose loader is:
https://github.com/bkerler/Loaders/b...4665_FHPRG.bin

Edit: Oops, I meant 2.

[sleepyy]

Originally Posted by Renate

You're going around in circles a bit.
"adb reboot bootloader" brings you to the abl with fastboot and a blank screen
"adb reboot fastboot" brings you to recovery with fastbootd and a menu
"adb reboot edl" is what I mostly use these days.

The NoteAir3[Plus] uses the SDM662 chip. The Firehose loader is:
https://github.com/bkerler/Loaders/b...4665_FHPRG.bin

Thanks for your reply, I spent some more time lurking around (and finally read the documentation your EDL tool ) and got a (better) handle of things. I managed to flash my device without anything blowing up with the following commands (and for reference to anyone else stumbling upon this thread, the steps below replace Chitter's guide at section 'Flash the Patched Boot Image', Step 5):

adb reboot edl
edl.exe /l0014d0e100000000_d40eee56f3194665_FHPRG.bin

(Optional): For every LUN (which you can check with edl.exe /u /g), do a backup (possibly superfluous, but just to be safe). In my case, that was:
edl.exe /u0 /r u0.img
edl.exe /u1 /r u1.img
edl.exe /u2 /r u2.img
edl.exe /u3 /r u3.img
edl.exe /u4 /r u4.img
edl.exe /u4 /r u5.img

Then, the moment of truth:

edl.exe /u /w /pboot_a <you modified boot image>.img
edl.exe /z

[Renate]

Once you know what you're doing you can combine a few operations in a single line.
This can be helpful when reading or writing big chunks or the entire flash.
Putting the /z on the same line will cause it to reboot when done.
Then you can hear the disconnect and know that it's done when doing something else.

edl /lpoke5.bin /r backup.img /z

[Herschenglime]

Edit: In all my searching I somehow failed to go one page back in the thread and see what had changed with fastboot, oops.

When I get a chance, I'll try to translate the commands provided to the bkerler/edl utility and report back on how it went.

[Herschenglime]

Has anyone had luck rooting firmware version 3.5.4?

Since the last firmware update I got (v3.5 in November 2023), I've changed Linux distros and have lost my previous bkerler/edl install and working loader file . I've tried reinstalling and getting the loader again, but I'm unable to extract the boot img with the edl utility.

I'm wondering if I just messed something up with my new environment/edl install, or if the new firmware might have somehow changed the process of extracting boot images?

Any others' experiences would be greatly appreciated, thank you!

[Herschenglime]

It seems like my issues were with the loader I was supplying - I found the one I used before from a backup but even that didn't work.

However, everything just worked when I let edl figure out the loader by itself without me having to specify one. I was able to successfully send the boot.img to my device, patch it, and then send it back.

However, I seem to have run into the issue mentioned by Renate here:
https://www.mobileread.com/forums/sh...6&postcount=21

It seems Onyx has kneecapped fastboot and I am not able to use it to make the Boox boot with the patched image. Has anyone figured out a workaround, or are these devices unrootable for now?

Thanks again!

[Renate]

Originally Posted by Herschenglime

It seems Onyx has kneecapped fastboot...

You can use an EDL client to write the modified boot image back.
Of if you already have a rooted normal system or a rooted and ADB enabled recovery you can use the dd command:

dd if=/cache/magisk_whatever.img of=/dev/block/by-name/recovery_a

Of course, check which slot you are on or flash both.