EDL on a Boox Note3

middle_tree · 07-10-2024, 01:28 PM

Hi.

I have a Boox Note3 (non-Air) that I would like to have a complete backup of.

I can't seem to get EDL working. Renate's utility says

Code:

HWID: 000cc0e100000000, JTAG: 000cc0e1, OEM: 0000, Model: 0000
Hash: 7be49b72f9e43372-23ccb84d6eccca4e-61ce16e3602ac200-8cb18b75babe6d09 (x3)

which seems to say that it uses the same loader as Poke3/Leaf.
This is a UFS device. cat /proc/scsi/scsi returns flash model "KM5H7001DM-B424".

From scrolling through older posts (can't seem to find it now), someone tried to use EDL on a Note3 a while ago and couldn't get it to work either.

Any suggestions?

Output of edl /lnote3.bin /v

Code:

Found EDL 9008, handshaking...
Received 0x01 command
Version 2.1
Received 0x0b command
Received 0x0e command
HWID: 000cc0e100000000, JTAG: 000cc0e1, OEM: 0000, Model: 0000
Received 0x0e command
Hash: 7be49b72f9e43372-23ccb84d6eccca4e-61ce16e3602ac200-8cb18b75babe6d09 (x3)
Received 0x01 command
Sending note3.bin 100% ok, starting...
Received 0x06 command
Ok, waiting for Firehose...
<log value="Binary build date: Feb  4 2018 @ 00:51:33"/>
<log value="Chip serial num: 0 (0x0)"/>
<log value="Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke "/>
Ok

Output of edl /u /g /v

Code:

Found EDL 9008, configuring...
<log value="fh.attrs.MaxPayloadSizeToTargetInBytes of 65536 > fh.channel_buffer_capacity of 32768"/>
<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
<response value="NAK" MinVersionSupported="1" MemoryName="UFS" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="32768" MaxPayloadSizeToTargetInBytesSupported="32768" MaxXMLSizeInBytes="4096" Version="1" TargetName="MSM8996" DateTime="Feb  4 2018 - 00:51:33" />
Nope, configuring...
<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
<response value="ACK" MinVersionSupported="1" MemoryName="UFS" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="32768" MaxPayloadSizeToTargetInBytesSupported="32768" MaxXMLSizeInBytes="4096" Version="1" TargetName="MSM8996" DateTime="Feb  4 2018 - 00:51:33" />
Ok
Requesting info on LUN 0... no response

Output of edl /r /u0 test.img /s0 /c1 /v (just to test)

Code:

Found EDL 9008, configuring...
<log value="fh.attrs.MaxPayloadSizeToTargetInBytes of 65536 > fh.channel_buffer_capacity of 32768"/>
<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
<response value="NAK" MinVersionSupported="1" MemoryName="UFS" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="32768" MaxPayloadSizeToTargetInBytesSupported="32768" MaxXMLSizeInBytes="4096" Version="1" TargetName="MSM8996" DateTime="Feb  4 2018 - 00:51:33" />
Nope, configuring...
<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
<response value="ACK" MinVersionSupported="1" MemoryName="UFS" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="32768" MaxPayloadSizeToTargetInBytesSupported="32768" MaxXMLSizeInBytes="4096" Version="1" TargetName="MSM8996" DateTime="Feb  4 2018 - 00:51:33" />
Ok
Requesting info on LUN 0... no response

Then when I ask it to reboot

Code:

Found EDL 9008
<log value="ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 0"/>
<log value="ERROR: Failed to open the device 3 slot 0 partition 0"/>
<log value="ERROR: Failed to get device info slot:0artition:0"/>
<log value="ERROR 14: Line 1270: HANDLE_STORAGE_INFO_FAILURE"/>
Requesting reboot... ok

This is all using the driver from Zadig.
Bkerler's Linux EDL tool (what I originally used) said the same.

I tested the using QFIL (replacing the driver with QDLoader 9008 driver), essentially the same stuff (reading partitions).

Code:

06:20:32: DEBUG: Response was 'NAK'
06:20:32: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 32768
06:20:32: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 32768
06:20:32: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
06:20:32: INFO: **INFO Unrecognized tag 'getstorageinfo', so I will simply look for ACK or NAK

Code:

06:20:34: DEBUG: XML FILE (148 bytes): CharsInBuffer=986-148=838
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 65210"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 65210'
06:20:34: DEBUG: XML FILE (127 bytes): CharsInBuffer=838-127=711
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to open the device 3 slot 0 partition 65210"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'ERROR: Failed to open the device 3 slot 0 partition 65210'
06:20:34: DEBUG: XML FILE (123 bytes): CharsInBuffer=711-123=588
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Device type 3, slot 0, partition 65210, error 0"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'INFO: Device type 3, slot 0, partition 65210, error 0'
06:20:34: DEBUG: XML FILE (134 bytes): CharsInBuffer=588-134=454
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="WARN: Get Info failed to open 3 slot 0, partition 65210, error 0"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'WARN: Get Info failed to open 3 slot 0, partition 65210, error 0'
06:20:34: DEBUG: XML FILE (123 bytes): CharsInBuffer=454-123=331
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to get device info slot:0artition:65210"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'ERROR: Failed to get device info slot:0artition:65210'
06:20:34: DEBUG: XML FILE (134 bytes): CharsInBuffer=331-134=197
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="GetStorageInfo Failed - storage_device_get_info() returned FALSE"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'GetStorageInfo Failed - storage_device_get_info() returned FALSE'
06:20:34: DEBUG: XML FILE (118 bytes): CharsInBuffer=197-118=79
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR 14: Line 1270: HANDLE_STORAGE_INFO_FAILURE"/>
</data>
-------------------------------------------------------------------------------------------

06:20:34: INFO: TARGET SAID: 'ERROR 14: Line 1270: HANDLE_STORAGE_INFO_FAILURE'
06:20:34: DEBUG: XML FILE (79 bytes): CharsInBuffer=79-79=0
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="NAK" />
</data>
-------------------------------------------------------------------------------------------

06:20:34: DEBUG: Response was 'NAK'

Renate · 07-10-2024, 06:07 PM

Yup, you did most of the correct things.
Your device is UFS (as confirmed by the chip number) and an SDM636.
The Poke3 loader (which I've used a zillion times on the Poke3/eMMC) seems to misbehave on UFS.
It could be that the OEM tried to patch something in and broke things.

Normally the Firehose protocol allows something to blather as much as it likes but it must end with an ACK or a NAK and then shut up after that. The fact that the edl /z shows queued up messages shows that it broke that contract.

Ok, you'll have to do some 'spearminting.

Code:

edl /lnote3.bin
edl /u /i /v
edl /x /v "<getstorageinfo slot='0' physical_partition_number='0'/>"

I'm not sure that "slot" is interpreted.
I'm not sure if you have a non-standard slot.
Play with slot, small numbers and partition 0-6.
Note anything different.
Be aware that messages can queue up to the next command.

middle_tree · 07-10-2024, 06:37 PM

edl /u /i /v returns the same as edl /u /g /v.
As you said, output seems to get queued to the next one, and running edl with the custom XML returns

Code:

<log value="ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 0"/>
<log value="ERROR: Failed to open the device 3 slot 0 partition 0"/>

regardless of the slot and partition I put (always says slot 0 partition 0, which seems to be from /u /i /v). Further commands just returns "bad XML".

I forgot to mention, in between edl /u /g /v and edl /r /u0 test.img /s0 /c1 /v, I had to reset, it just says "no response".

Renate · 07-10-2024, 06:57 PM

I was not clear.
Do the /l once
Do the /u /i /v once
Do the /x /v multiple times in a row, changing as you go.
Of course you can do the same /x twice in a row then you get the delayed results.
You must be able to get different partitions numbers at least.
Leave /g and /r alone.

Do you have an xbl from an update? In payload.bin?

middle_tree · 07-10-2024, 07:12 PM

Sorry, I wasn't clear, let me try to explain again.
I did the /u /i /v, followed by /x /v.
The first time I run /x /v right after /u /i /v always returns, regardless of the slot/partition number I put in,

Code:

Failed to open the device 3 slot 0 partition 0

Anything else I run after that returns either "bad XML" or "no response".

Attached xbl.
I forgot to mention, I do have root already (fastboot flash boot, etc.), so let me know if there's any partition that you want to look at.

Thanks!

Renate · 07-10-2024, 08:36 PM

Please try this Firehose loader

middle_tree · 07-10-2024, 09:47 PM

Nope, same thing

.

Renate · 07-10-2024, 10:37 PM

And you tried from a clean reset? Then /l, then /u /g?

That's very strange that they both work the same.
I can run that new loader on my Poke3.
Most loaders support a dozen different processor models.

Well, if I had one of these here I could blow through 900 loaders in the time it takes to do the dishes.

middle_tree · 07-10-2024, 11:58 PM

Previous post disappeared for some reason.

Yeah, this is always right after adb reboot edl.
Is checking the output of /u /g (and whatever overflows) enough to tell if the loader is working correctly or not? As in, I run /u /g, then /z. The output of /z carries some information from /u /g that I could just parse.
If I need to run anything else that's not /z after /u /g, it will return either "no response" or "cannot write", and I have to then hard reset by holding down power button.

By the way, I looked through the Boox devices I know of, only Max Lumi is the other one with 636 and UFS. I couldn't find anyone with working EDL there.

Renate · 07-11-2024, 07:55 AM

Ok, I did some of the work for you. I checked 1003 loaders on my Poke3 (SDM636). There are 31 that work. I suggest that you go to the bkerler and hoplik repos and either clone or zip them down to your local drive. The paths given are for local files.

Code:

bkerler\asus_wingtech\3006000000010000_7cd366ef83a08283_fhprg.bin
bkerler\asus_wingtech\3006000000010000_cd47cd2fd76e812d_fhprg_peek.bin
bkerler\asus_wingtech\3006000000010000_e5e07a6beb0800fa_fhprg_peek.bin
bkerler\lenovo_motorola\0008c0e100010000_172aff6024730ca1_fhprg.bin
bkerler\lenovo_motorola\0008c0e100010000_982b2ece2e68f82c_fhprg.bin
bkerler\lenovo_motorola\0008c0e100010000_982b2ece2e68f82c_fhprg_peek.bin
bkerler\lenovo_motorola\0008c0e100010000_a7b8b82545a98eca_fhprg_edlauth.bin
bkerler\lenovo_motorola\0008c0e100010000_f8ab20526358c4fa_fhprg.bin
bkerler\lenovo_motorola\3006000000010000_0374637d23c4e2ee_fhprg.bin
bkerler\meitu\0008c0e100010000_c0806e891f7d5537_fhprg.bin
bkerler\meizu\3006000000010000_9e7f8ef2d5f16d8c_fhprg_e3_peek.bin
bkerler\nokia_foxconn\3006000000010000_7fe240ddea200f42_fhprg_peek.bin
bkerler\nokia_foxconn\3006000000010000_b14a27de186e77c9_fhprg.bin
bkerler\oppo\3006000000010000_82446e2f29ccb297_fhprg_peek.bin
bkerler\qualcomm\factory\sdm630\000ac0e100000000_7be49b72f9e43372_fhprg_asus_peek.bin
bkerler\qualcomm\factory\sdm636\000cc0e100000000_7be49b72f9e43372_fhprg_bqx2_peek.bin
bkerler\qualcomm\factory\sdm660\3006000000010000_54736aebeaaf4167_fhprg.bin
bkerler\qualcomm\factory\sdm660\3006000000010000_7e425bcb25364725_fhprg_peek.bin
bkerler\qualcomm\factory\sdm660\3006000000010000_b73514537ffc38a0_fhprg_peek.bin
bkerler\qualcomm\factory\sdm660\3006000000010000_f8ab20526358c4fa_fhprg_peek.bin
bkerler\sharp\3006000000010000_07046415532823b0_fhprg_peek.bin
bkerler\sonim\0008c0e100010000_1b55c83cc1c00f4f_fhprg_peek.bin
bkerler\vivo\3006000000010000_f188b3bc5198fb41_fhprg_peek.bin
bkerler\xiaomi\0005e0e100010000_a7b8b82545a98eca_fhprg_peek_mi_a2.bin
bkerler\xiaomi\0008c0e100010000_a7b8b82545a98eca_fhprg_peek.bin
bkerler\xiaomi\000ba0e100720000_57158eaf1814d78f_fhprg_redmi7.bin
bkerler\xiaomi\EDLAuth\0008c0e100010000_f8ab20526358c4fa_fhprg_edlauth_peek.bin
bkerler\xiaomi\EDLAuth\0008c0e100720000_a7b8b82545a98eca_fhprg_edlauth.bin
bkerler\zte\3006000000010000_158d0f5f0552472f_fhprg_peek.bin
hoplik\fh_collection\57E3C370\4\prog_emmc_firehose_Sdm660_ddr.mbn
hoplik\fh_collection\BD25D20B\asus.elf

middle_tree · 07-11-2024, 12:09 PM

OMG!
Exactly one of them (sdm660/3006000000010000_7e425bcb25364725_fhprg_peek.bin) worked!

Code:

<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
<response value="ACK" MinVersionSupported="1" MemoryName="UFS" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="65536" MaxPayloadSizeToTargetInBytesSupported="65536" MaxXMLSizeInBytes="4096" Version="1" TargetName="MSM8996" DateTime="Dec  8 2017 - 13:33:11" />
Ok
Requesting info on LUN 0...
<log value="INFO: Device Total Logical Blocks: 0xd7d800"/>
<log value="INFO: Device Block Size in Bytes: 0x1000"/>
<log value="INFO: Device Total Physical Partitions: 0x0"/>
<log value="INFO: Device Manufacturer ID: 0x1ce"/>
<log value="INFO: Device Serial Number: 0x4d53554e"/>
<log value="INFO: {&quot;storage_info&quot;: {&quot;total_blocks&quot;:14145536, &quot;block_size&quot;:4096, &quot;page_size&quot;:4096, &quot;num_physical&quot;:6, &quot;manufacturer_id&quot;:462, &quot;serial_num&quot;:1297306958, &quot;fw_version&quot;:&quot;400&quot;,&quot;mem_type&quot;:&quot;UFS&quot;,&quot;prod_name&quot;:&quot;KM5H7001DM-B424&quot;}}"/>
<log value="UFS fInitialized: 0x1"/>
<log value="UFS Current LUN Number: = 0xd0"/>
<log value="UFS Total Active LU: 0x6"/>
<log value="UFS wManufacturerID: 0x1ce"/>
<log value="UFS Boot Partition Enabled: 0x1"/>
<log value="UFS Raw Device Capacity: = 0x7734000"/>
<log value="UFS Min Block Size: 0x8"/>
<log value="UFS Erase Block Size: 0x2000"/>
<log value="UFS Allocation Unit Size: 0x1"/>
<log value="UFS RPMB ReadWrite Size: = 0x40"/>
<log value="UFS Number of Allocation Uint for This LU: 0x0"/>
<log value="UFS Logical Block Size: 0x0"/>
<log value="UFS Provisioning Type: 0x0"/>
<log value="UFS LU Write Protect: 0x0"/>
<log value="UFS Boot LUN ID: = 0x0"/>
<log value="UFS Memory Type: 0x0"/>
<log value="UFS LU Total Blocks: 0x0"/>
<log value="UFS Supported Memory Types: 0x800f"/>
<log value="UFS dEnhanced1MaxNAllocU: 0x3b9a"/>
<log value="UFS wEnhanced1CapAdjFac: 0x200"/>
<log value="UFS dEnhanced2MaxNAllocU: = 0x0"/>
<log value="UFS wEnhanced2CapAdjFac: 0x0"/>
<log value="UFS dEnhanced3MaxNAllocU: 0x0"/>
<log value="UFS wEnhanced3CapAdjFac: 0x0"/>
<log value="UFS dEnhanced4MaxNAllocU: 0x0"/>
<log value="UFS wEnhanced4CapAdjFac: 0x0"/>
<log value="UFS LUN Enable Bitmask: 0x3f"/>
<log value="UFS Logical Block Count: 0x0"/>
<log value="UFS bConfigDescrLock: 0x0"/>
<log value="UFS iManufacturerName String Index: 0x0"/>
<log value="UFS iProductName String Index: 0x1"/>
<log value="UFS iSerialNumber String Index: 0x2"/>
<log value="UFS iOemID String Index: 0x3"/>
<log value="UFS Inquiry Command Output: SAMSUNG KM5H7001DM-B424 0400 "/>
<response value="ACK" />
Ok
Requesting GPT 0 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 3"/>
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 1 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 3"/>
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 2 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 3"/>
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 3 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 3"/>
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 4 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 4"/>
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 5 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 3"/>
<response value="ACK" rawmode="false" />
Ok

LUN   #  Name                   Start       Count  Type
───  ──  ────────────────  ──────────  ──────────  ────────────────────
 0    1  ssd                        6           2  Secure SW download
 0    2  persist                    8        8192  Persist
 0    3  misc                    8200         256  Misc
 0    4  keystore                8456         128  Key store
 0    5  frp                     8584         128  FRP
 0    6  system                  8712      786432  System
 0    7  cache                 795144       65536  Cache
 0    8  logdump               860680       16384  Log dump
 0    9  onyxconfig            877064        8192  System
 0   10  userdata              885256    13260275  User data

 1    1  xbl                        6         896  Bootloader
 1    2  last_parti               902         117  Empty

 2    1  xblbak                     6         896  Bootloader
 2    2  last_parti               902         117  Empty

 3    1  cdt                        6           1  CDT
 3    2  ddr                        7         256  DDR
 3    3  last_parti               263       32500  Empty

 4    1  rpm                        6         128  Resource/power mgmt
 4    2  tz                       134        1024  TrustZone
 4    3  hyp                     1158         128  Hypervisor
 4    4  pmic                    1286         128  PMIC
 4    5  modem                   1414       28160  FAT32
 4    6  bluetooth              29574         256  Bluetooth
 4    7  dsp                    29830        4096  DSP
 4    8  abl                    33926         256  Android bootloader
 4    9  keymaster              34182         256  Key master
 4   10  mdtpsecapp             34438        1024  MDTP secure
 4   11  mdtp                   35462        8192  MDTP
 4   12  boot                   43654       16384  Boot
 4   13  cmnlib                 60038         256  Common lib
 4   14  cmnlib64               60294         256  Common lib64
 4   15  devcfg                 60550         256  Device config
 4   16  vbmeta                 60806          16  VB meta
 4   17  vendor                 60822      204800  System
 4   18  recovery              265622       16384  Recovery
 4   19  fsg                   282006         512  Modem storage
 4   20  sec                   282518           4  Sec
 4   21  dip                   282522         256  DIP
 4   22  devinfo               282778           1  Device info
 4   23  apdp                  282779          64  APDP
 4   24  msadp                 282843          64  MSADP
 4   25  dpo                   282907           1  DPO
 4   26  splash                282908        8356  Splash
 4   27  limits                291264           1  Limits
 4   28  toolsfv               291265         256  Tools FV
 4   29  logfs                 291521        2048  Log FS
 4   30  sti                   293569         512  STI
 4   31  storsec               294081          32  Store secure
 4   32  rawdump               294113       32768  RAM dump
 4   33  last_parti            326881      721690  Empty

 5    1  modemst1                   6         512  Modem ST1
 5    2  modemst2                 518         512  Modem ST2
 5    3  fsc                     1030           1  FSC
 5    4  last_parti              1031      392180  Empty

I double checked and pulled a partition via EDL and double checked its hash against the partition pulled from live system, same values!
Time to party!

Thanks so much!

Renate · 07-11-2024, 12:37 PM

Quote:

Originally Posted by middle_tree

Time to party!

I'm glad that it worked out.
It's funny that that is one of the older ones.

Code:

Dec  8 2017 - 13:33:11

aaron42195 · 09-19-2024, 05:19 PM

Quote:

Originally Posted by middle_tree

OMG!
Exactly one of them (sdm660/3006000000010000_7e425bcb25364725_fhprg_peek.bin) worked!
[

My note3 get some problem with this loader

C:\Temp>edl /l
Found EDL 9008, handshaking... version 2.1
HWID: 000cc0e100000000, JTAG: 000cc0e1, OEM: 0000, Model: 0000
Hash: 7be49b72f9e43372-23ccb84d6eccca4e-61ce16e3602ac200-8cb18b75babe6d09 (x3)

C:\Temp>edl /l3006000000010000_7e425bcb25364725_fhprg_peek.bin
Found EDL 9008, handshaking... nope, resetting... version 2.1
HWID: 000cc0e100000000, JTAG: 000cc0e1, OEM: 0000, Model: 0000
Hash: 7be49b72f9e43372-23ccb84d6eccca4e-61ce16e3602ac200-8cb18b75babe6d09 (x3)
Sending 3006000000010000_7e425bcb25364725_fhprg_peek.bin 100% ok, starting... ok, waiting for Firehose... no response, poking...
Could not write device

C:\Temp>

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Boox Page adb / fastboot / recovery /edl walkthrough	Anghirrim	Onyx Boox	32	08-23-2024 04:05 PM
Sell Onyx BOOX Note3, for sale for nice price	norweger	Flea Market	0	03-03-2023 05:49 PM
Battery Replacement: Boox Note Air vs. Note3	tommyer	Onyx Boox	8	11-05-2021 10:47 AM
Hello from Iowa - Kindle / Boox Note3	Nursken	Introduce Yourself	1	10-01-2021 10:17 PM
Onyx Boox is releasing Note3 & Nova3 in China	winstonma	Onyx Boox	23	10-20-2020 11:49 PM

07-10-2024, 06:07 PM	#2
Renate Onyx-maniac Posts: 3,199 Karma: 12537601 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Yup, you did most of the correct things. Your device is UFS (as confirmed by the chip number) and an SDM636. The Poke3 loader (which I've used a zillion times on the Poke3/eMMC) seems to misbehave on UFS. It could be that the OEM tried to patch something in and broke things. Normally the Firehose protocol allows something to blather as much as it likes but it must end with an ACK or a NAK and then shut up after that. The fact that the edl /z shows queued up messages shows that it broke that contract. Ok, you'll have to do some 'spearminting. Code: edl /lnote3.bin edl /u /i /v edl /x /v "<getstorageinfo slot='0' physical_partition_number='0'/>" I'm not sure that "slot" is interpreted. I'm not sure if you have a non-standard slot. Play with slot, small numbers and partition 0-6. Note anything different. Be aware that messages can queue up to the next command.

07-10-2024, 06:37 PM	#3
middle_tree Junior Member Posts: 9 Karma: 580 Join Date: Jul 2024 Device: Boox Note 3	edl /u /i /v returns the same as edl /u /g /v. As you said, output seems to get queued to the next one, and running edl with the custom XML returns Code: <log value="ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 0"/> <log value="ERROR: Failed to open the device 3 slot 0 partition 0"/> regardless of the slot and partition I put (always says slot 0 partition 0, which seems to be from /u /i /v). Further commands just returns "bad XML". I forgot to mention, in between edl /u /g /v and edl /r /u0 test.img /s0 /c1 /v, I had to reset, it just says "no response".

07-10-2024, 06:57 PM	#4
Renate Onyx-maniac Posts: 3,199 Karma: 12537601 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	I was not clear. Do the /l once Do the /u /i /v once Do the /x /v multiple times in a row, changing as you go. Of course you can do the same /x twice in a row then you get the delayed results. You must be able to get different partitions numbers at least. Leave /g and /r alone. Do you have an xbl from an update? In payload.bin?

07-10-2024, 08:36 PM	#6
Renate Onyx-maniac Posts: 3,199 Karma: 12537601 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Please try this Firehose loader

07-10-2024, 09:47 PM	#7
middle_tree Junior Member Posts: 9 Karma: 580 Join Date: Jul 2024 Device: Boox Note 3	Nope, same thing .

07-10-2024, 10:37 PM	#8
Renate Onyx-maniac Posts: 3,199 Karma: 12537601 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	And you tried from a clean reset? Then /l, then /u /g? That's very strange that they both work the same. I can run that new loader on my Poke3. Most loaders support a dozen different processor models. Well, if I had one of these here I could blow through 900 loaders in the time it takes to do the dishes.

07-10-2024, 11:58 PM	#9
middle_tree Junior Member Posts: 9 Karma: 580 Join Date: Jul 2024 Device: Boox Note 3	Previous post disappeared for some reason. Yeah, this is always right after adb reboot edl. Is checking the output of /u /g (and whatever overflows) enough to tell if the loader is working correctly or not? As in, I run /u /g, then /z. The output of /z carries some information from /u /g that I could just parse. If I need to run anything else that's not /z after /u /g, it will return either "no response" or "cannot write", and I have to then hard reset by holding down power button. By the way, I looked through the Boox devices I know of, only Max Lumi is the other one with 636 and UFS. I couldn't find anyone with working EDL there.