How to Root the Onyx Boox Tab Ultra C (Windows)

[Renate]

Originally Posted by vixxovs

I will try to do that for sure but I'm only scared by the possibility to lose the Wi-Fi. Is something I can restore backwards in case of troubles ?

I don't know what kernel modules you have on your device. Kernel modules are things loaded separately from the kernel but must be built for a specific build of a kernel. When there is a mismatch something is not going to work. The solution is to install a consistent set of kernel/kernel modules.

Do this:

adb shell lsmod

On my Poke3 I get 1 module (wlan), on my Poke5 I get 28 modules, on my Moto phone I get 49.

Magisk'ing a boot image pulled from your device will not break anything. Just keep a copy of your original boot image on your desktop.

Thanks for the question. I hadn't realized how overboard everybody has gotten with kernel modules!

[muser]

Thank you. It comes right in time. I intend to root my tab ultra (b&w) in a try to lower or disable processes and services to increase battery life. But i got some questions.
Its this tuc image functional for tab ultra? If not where i can find a stable version?
How i make a system backup and restore it if thing go wrong?
How can i update after rooting it?

[Renate]

If you have EDL working, the most bomb-proof backup is to use EDL to take a raw copy of your entire flash memory. Yes, this is big and slow if you have 64 or 128 GB. It also is very ungainly if you want some portion of the backup after you have saved it as one lump. It may not even restore to a replacement device (because of key generation for userdata encryption). But restored on the exact same device it will take you back to exactly where you were.

I've done this on my Poke3 a few times. I save a new backup, restore an old backup, hit "Last read" and it pops to the page in the book where I was a few months back. I restore the new backup, hit "Last read" and it's right back on my current book.

Originally Posted by muser

How can i update after rooting it?

Ah, that's a different question.
Onyx has mostly been using full updates so it does not presume what you have on your device, besides checking that you are not rolling back to an earlier version. If your update is over 1 GB it probably is a full update. If it is smaller it could be an incremental update that will keep some parts of the old version. If you have modified things behind Onyx's back there may be collisions. For the simple Magisk case, usually the entire boot image is replaced anyway so you only have to deal with your device being unrooted.

For rolling back versions you will need to modify updater-script in the update.

[petedux]

Thanks for this guide. This works for the new Tab Ultra C Pro, just had to use a different loader (Qualcomm sdm855).

[Mcd1144]

@petedux Great to know it works on the pro! where did you find the loader for the sdm855? I’m looking to root my pro as well.

[Renate]

Originally Posted by petedux

This works for the new Tab Ultra C Pro, just had to use a different loader (Qualcomm sdm855).

Could you quote the HWID/Hash (but not the serial), please?
Also which loader did you use?

[Mcd1144]

Originally Posted by Mcd1144

@petedux Great to know it works on the pro! where did you find the loader for the sdm855? I’m looking to root my pro as well.

I was able to root using the loader found here: https://github.com/bkerler/Loaders/t...factory/sdm855

[Renate]

Originally Posted by Mcd1144

I was able to root using the loader found here: https://github.com/bkerler/Loaders/t...factory/sdm855

Thanks! Could you confirm the HWID and was the Hash this?
ec70ff124179a138 c679962561700ee3 007131713530d4b2 205ead1b11bb915c b52b4c2cb68644c4 fbb0cfe490649ed1
(There's nothing secret about either one.)

[Renate]

Mmm, just a heads up.
Somebody with a Tab10CPro is having a problem with decrypting updates as there have been some changes in strings for DeBooxUpd.
(I'm confused too as to what the heck a Tab10CPro is anyway.)

[mergen3107]

It is “Onyx Boox Tab Ultra C Pro”, it is getting really messy with all these “new” devices

[Mcd1144]

Originally Posted by Renate

Thanks! Could you confirm the HWID and was the Hash this?
ec70ff124179a138 c679962561700ee3 007131713530d4b2 205ead1b11bb915c b52b4c2cb68644c4 fbb0cfe490649ed1
(There's nothing secret about either one.)

Happy to, just let me know how to find them.

[Renate]

Originally Posted by mergen3107

It is “Onyx Boox Tab Ultra C Pro”, it is getting really messy with all these “new” devices

Oh, so I actually posted this in the right thread!

Edit: I get it. This is one of those "Russian" ones.
Still, has anybody decoded an update for the "normal" TabUltraCPro?

Originally Posted by Mcd1144

Happy to, just let me know how to find them.

If you go to EDL mode and then use an EDL client (either the Python one or mine in the sig) the first thing it will tell you is that info.

The following is for mine.

adb reboot edl
edl.exe /l
Serial: <not really that secret, but don't quote>
HWID: <maybe 000a50e1-00000000>
Hash: <maybe ec70ff124179a138...>

[Mcd1144]

Originally Posted by Renate

Oh, so I actually posted this in the right thread!

adb reboot edl
edl.exe /l
Serial: <not really that secret, but don't quote>
HWID: <maybe 000a50e1-00000000>
Hash: <maybe ec70ff124179a138...>

HWID:              0x000a50e100000000 (MSM_ID:0x000a50e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "SM8150"
PK_HASH:           0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87

[Renate]

Originally Posted by Mcd1144

0x000a50e100000000
0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87

You can try these two loaders:
https://github.com/bkerler/Loaders/r...a138_fhprg.bin
https://github.com/bkerler/Loaders/r...4665_fhprg.bin

In point of fact, neither of them are actually d40eee...
But we don't know yet if your device is actually SecureBoot.

The problem with the "Strings" on the Tab10CPro got resolved.

[Mcd1144]

Originally Posted by Renate

You can try these two loaders:
https://github.com/bkerler/Loaders/r...a138_fhprg.bin
https://github.com/bkerler/Loaders/r...4665_fhprg.bin

In point of fact, neither of them are actually d40eee...
But we don't know yet if your device is actually SecureBoot.

The problem with the "Strings" on the Tab10CPro got resolved.

https://github.com/bkerler/Loaders/r...a138_fhprg.bin is what I tried the other day and it worked.

Any recommendations on image backups and restoring from them? I've been searching and it seems like there is no custom recovery for Boox