Boox Tab Ultra Questions

[chrisridd]

OK, nothing more than that. Wait and see I guess..

[ottischwenk]

Originally Posted by chrisridd

OK, nothing more than that. Wait and see I guess..

I got an update and now it works

[BanditoB]

Is there a general update available for the Tab Ultra or did they provide the fix privately to you for testing?

[Renate]

I don't see any name for Tab Ultra under DeBooxUpd.
Does anybody know what it's called? I tried "TabUltra", "Tab Ultra", "Ultra".

Has anybody routed this?
Has anybody found a Firehose loader for the Leaf2 or the TabUltra?
Has anybody done a "fastboot getvar all" and seen what "secure" says?

[rexbanner]

Originally Posted by Renate

I don't see any name for Tab Ultra under DeBooxUpd.
Does anybody know what it's called? I tried "TabUltra", "Tab Ultra", "Ultra".

Has anybody routed this?
Has anybody found a Firehose loader for the Leaf2 or the TabUltra?
Has anybody done a "fastboot getvar all" and seen what "secure" says?

I’ve rooted the Tab Ultra (with your help in the other thread). As you suggested, I used the loader

 qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin

On my Leaf 2 this didn’t work, so I rooted the Leaf 2 by decrypting the firmware for which there was a download link in some thread. I’ve also rooted a friend’s Nova Air 2 which was introduced at the same time as the Leaf 2 and TabUltra with the loader

xiaomi/001360e100720000_1bebe3863a6781db_fhprg_redmi9t.bin

I had to try multiple times because it sometimes said “device disconnected” or something like that, but in the end I was able to download the boot image.

When I extracted the fingerprints from the device using the apk on GitHub, the fingerprint weirdly was

 # fingerprint: ONYX/BOOX/BOOX:11/RKQ1.210614.002/200:userdebug/release-keys

However, since I’ve blocked almost all apps from accessing the internet using AFWall, I can see that the device tries to open the following domain when I click on “Update History” in “System Settings / System Update”

 https://en-data.boox.com/api/firmware/update/list?where={"buildNumber":36840,"buildType":"user","deviceMAC":"","fingerprint":"Onyx/TabUltra/TabUltra:11/2022-11-23_15-20_3.3.1_c1227659ca/36840:user/dev-keys","fwType":"release","lang":"en_US","model":"TabUltra","size":0,"submodel":""}

So it seems, the model is indeed called “TabUltra”.

I also just ran the fastboot command which gives

 (bootloader) secure:yes

[ottischwenk]

Originally Posted by BanditoB

Is there a general update available for the Tab Ultra or did they provide the fix privately to you for testing?

I donot know.
It is version 2023-1-13.10-11_3.3.1_d41eddfea

[Renate]

Originally Posted by rexbanner

As you suggested...

Oops. I deal so much with devices that I don't own that I forget sometimes.

Also, we got bogged down in that 7 minute directory listing thing.

Originally Posted by rexbanner

I also just ran the fastboot command which gives

 (bootloader) secure:yes

Yeah, I'm not sure if this corresponds directly to SecureBoot being enabled or not. My Poke3 does not have SecureBoot enabled. It also shows:

(bootloader) secure:no

Also, things get so complicated with those loader files. There are files in the Qualcomm/factory directory which may in fact be equivalent to original files but they are signed by Xiaomi. So the TabUltra having zeroes in the second half of the HWID (001740e100000000) seems to indicate that it's not SecureBoot. But if it is then it accepts a Xiaomi signing?

So if you unlock flashing in the fastboot you get "Orange state" and the abl throws in a 30 second delay. (Which is pointless, because unlike an LCD display showing the warning the Onyx just shows a logo.) We can only get rid of that 30 seconds if we patch abl. I know where to patch it but I haven't got around to the onerous re-packing of UEFI images yet. You can only run a patched abl if SecureBoot is off. Moreover, I'm interested if Onyx is going to make things more evil.

SecureBoot state is printed out on the internal UART when you boot. Another way is to try a patched Firehose loader. On my Poke3 I can make a spelling change, generate a new hash (which still breaks the signing) and run it successfully.

Could you do an experiment some time? Here is the same loader for the Ultra with a spelling change (patch -> potch) and a re-hash. Could you tell me if this works? Just do a GPT listing or something. You can rename this .bin

[rexbanner]

Originally Posted by Renate

Could you do an experiment some time? Here is the same loader for the Ultra with a spelling change (patch -> potch) and a re-hash. Could you tell me if this works? Just do a GPT listing or something. You can rename this .bin

I just tried your loader and it worked the same as with the other loader (I tried edl printgpt).

Other question: Is there a possibility to install an OTA update on the rooted device? In the settings application the update always fails. I also tried to install it using "adb sideload" in recovery but I always ended up with "Error applying update: 7 (ErrorCode: :kInstallDeviceOpenError)".

[Renate]

Originally Posted by rexbanner

I just tried your loader and it worked...

Great! Thank you. That indicates you've not got SecureBoot enabled.

Originally Posted by rexbanner

Is there a possibility to install an OTA update...

Since there doesn't seem to be any Tab Ultra updates on the normal channel, I presume you mean something it downloaded by itself? How big is it? 1.5 GB or so?
You've rooted with Magisk? Yes you can install the update but you'll need to re-Magisk the new boot image (if it's different) and flash it.

If you're using the update decoded you'll have to manually add the strings to DeBooxUpd.py yourself since they haven't migrated in yet.

I do my updates manually through a custom recovery.
If you like, I can make a custom recovery for the Tab Ultra.
It's a low risk since you have EDL working.
Pull a copy of recovery using EDL or dd.
Is this UFS or eMMC? What does ls -l /dev/block/by-name/misc say?

[rexbanner]

Originally Posted by Renate

Since there doesn't seem to be any Tab Ultra updates on the normal channel, I presume you mean something it downloaded by itself? How big is it? 1.5 GB or so?
You've rooted with Magisk? Yes you can install the update but you'll need to re-Magisk the new boot image (if it's different) and flash it.

If you're using the update decoded you'll have to manually add the strings to DeBooxUpd.py yourself since they haven't migrated in yet.

I do my updates manually through a custom recovery.
If you like, I can make a custom recovery for the Tab Ultra.
It's a low risk since you have EDL working.
Pull a copy of recovery using EDL or dd.
Is this UFS or eMMC? What does ls -l /dev/block/by-name/misc say?

Yes, it's the version mentioned above which I downloaded using the built-in updater. I then pulled the update.upx which I decrypted using DeBooxUpd.py so that I know have the update.zip, it's only around 180MB.

And yes, I've rooted using magisk.

The ls command yields

BOOX:/ $ ls -l /dev/block/by-name/misc
lrwxrwxrwx 1 root root 15 1970-01-01 01:14 /dev/block/by-name/misc -> /dev/block/sda3

How do I find out if it's UFS or eMMC?

Edit: EDL reports

firehose - mem_type:UFS

Thanks for your help.

[Renate]

The sda3 tells you that it's UFS also.
eMMC would be something like mmcblk0p38

[rexbanner]

Originally Posted by Renate

The sda3 tells you that it's UFS also.
eMMC would be something like mmcblk0p38

I see, good to know.

How would updating through a custom recovery work? And how would creating that custom recovery work?

I just pulled images of recovery_a and recovery_b using edl…

[Renate]

As far as your update goes, I believe this is the first incremental update from Onyx.
That's presuming that the small size is not because of an aborted download.
Did you decrypt it before you tried to do anything with it?
Did you manually put the strings in DeBooxUpd.py?
Could you do a listing of the decrypted version?
It should only be 20 lines or so.

C:\>7zip l update.zip

If you can find the "META-INF/com/google/android/updater-script" and "update-binary" please extract and post just those files.

Use fastboot getvar all and look at what your active slot is.
Then post the recovery that came from that slot.

To make a custom recovery there is a bunch of stuff that needs to patched.
I have to look closely at this because you've got an A/B

Hey! There's a new "Tab X"? https://shop.boox.com/products/tabx

[ottischwenk]

Originally Posted by Renate

Hey! There's a new "Tab X"? https://shop.boox.com/products/tabx

Yes, this is a new Max Lumi with the new screen control.
For "Tab" he lacks the (landscape) format, the SD card and the camera.

[Renate]

Originally Posted by ottischwenk

For "Tab" he lacks the (landscape) format...

Say what? Why would any device lack any of the four orientations? Ok, for some devices some orientations have less general utility, but why would you rule them out?

Even for normal devices I want more options, like auto-rotate when you're on your side.