How to Root the Onyx Boox Tab Ultra C (Windows)

[Renate]

Originally Posted by Mcd1144

Searching and it seems like there is no custom recovery for Boox

Oh, yeah, there are. It just depends on someone making one.
There is one for the Poke3 (I own one).
Please just ship me a Tab Ultra C and a Claxton fruitcake and I'll make one for you.

[mergen3107]

edl is great for this task: you just enter this mode, then make backups or restore them by writing them onto NAND. works like a charm if you screw up

[Mcd1144]

Originally Posted by mergen3107

edl is great for this task: you just enter this mode, then make backups or restore them by writing them onto NAND. works like a charm if you screw up

Any guide you can point me to for using EDL to do this would be greatly appreciated! I'm using EDL on Mac as I don't currently have a Windows box set up.

[Renate]

Originally Posted by Mcd1144

Any guide...

The simplest is to make a full, raw backup of your device.
This will take a bunch of space on your desktop, 128 GB for the TUC, I think.
And because it's raw, you won't even be able to cherry pick a single user file off the encrypted user data partition when a truck runs over your device.
But it will allow you to restore your device exactly as it was to a point in time.

So, backup directly all useful files.
Make a full, raw backup before upgrades that you might not wish or dangerous experiments.

You're on Mac, so you're stuck with the Python EDL client.

Hey! Did anyone post the /system/lib64/libota_jni.so (or figure out the update strings) for the TUC yet? Please do, so I can get the strings for the next update whenever it comes.

[Mcd1144]

Originally Posted by Renate

The simplest is to make a full, raw backup of your device.
This will take a bunch of space on your desktop, 128 GB for the TUC, I think.
And because it's raw, you won't even be able to cherry pick a single user file off the encrypted user data partition when a truck runs over your device.
But it will allow you to restore your device exactly as it was to a point in time.

So, backup directly all useful files.
Make a full, raw backup before upgrades that you might not wish or dangerous experiments.

You're on Mac, so you're stuck with the Python EDL client.

Yup, python EDL client is what I used in the rooting process. I'm seeing two possible options for making a full, raw backup, curious if either of these is correct:

rl # Read all partitions from flash to a directory
rf # Read whole flash to file

wl # Write all files from directory to flash
wf # Write whole filename to flash

[Renate]

Originally Posted by Mcd1144

rl # Read all partitions from flash to a directory
rf # Read whole flash to file

rf will read from device and write a single 128 GB file
rl will read individual partitions from device and write ~70 files to a directory

For Windows fans using my EDL client:

edl /lmyloader.bin
edl /u /r bighonkingfile

[Mcd1144]

I used rf to make the backup, and it ended up giving me 6 backup files *.lunX (0 through 5). I was then able to use wf *.lunX --lun=X to restore successfully.

python3 edl --loader=Loaders/qualcomm/factory/sdm855/000a50e10029003c_ec70ff124179a138_fhprg.bin wf deviceBackup1.lun5 --lun=5

I realized there's one last thing I need to do before making further modifications. Does anyone know if there's are hardware key combination Boox uses to boot into EDL mode? Else would an EDL cable work?

[Renate]

Originally Posted by Mcd1144

I used rf to make the backup...

Um, yeah, I spaced. eMMC gives you a single file, UFS is usually six separate "devices" and therefore six files.

Originally Posted by Mcd1144

Does anyone know if there's are hardware key combination Boox uses to boot into EDL mode? Else would an EDL cable work?

It depends. EDL cables work in my Poke5 but not in my Poke3.
It just depends whether the xbl has the check inside the code.
The best way to test is to power down your device fully without USB connected. Hold the button and plug in. Wait 2 seconds.

The abl is where secret button presses do magic things.
I don't have any with buttons, so I can't say.

abl also will do magic things based upon characters coming in on the internal 1.8V debug UART. Just to show you how obscure this stuff is, if you hit Backspace over 100 times it will go to recovery, if you hit it only over 50 times it will go to EDL.

There are also internal test points to force it to go to EDL. In the past they were very conspicuous, over time they have become inconspicuous.

[Mcd1144]

Holding volume up and down and then inserting usb-c cable already connected to the computer puts it into edl mode. EDL mode can be exited by removing the cable, and then holding the power and volume up until the screen flashes.

Holding down just volume up and then inserting usb-c cable already connected to the computer boots it into recovery.

[ottischwenk]

Originally Posted by Mcd1144

Holding volume up and down and then inserting usb-c cable

Tab Ultra C has no "volume"

[giukas]

hello and thanks for this guide

when I get to Retrieve a Boot Image with EDL and a Loader and type

edl.exe /l662.elf

I get
edl.exe /l662.elf
Found EDL 9008, handshaking... version 2.1
HWID: 0014d0e100000000, JTAG: 0014d0e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Could not open 662.elf

how could I procede?

[giukas]

hello 1st of all thanks for this guide

when I get to
edl.exe /l662.elf

it says 'could not open 662.elf'

I have eld and 662 files in userfolder as in the guide

any idea on how to procede kindly?

[Renate]

Originally Posted by giukas

any idea on how to procede kindly?

This sounds like a simple case of the file not being there.

dir 662.elf

Is it there?

Edit: I even double-checked. I can load a loader while it's already open in another application.

[giukas]

Originally Posted by Renate

This sounds like a simple case of the file not being there.

dir 662.elf

Is it there?

Edit: I even double-checked. I can load a loader while it's already open in another application.

When I get home I'll try to rename the file then because it's definitely there(when unzipped it's called Qualcomm...)

[giukas]

Originally Posted by Renate

This sounds like a simple case of the file not being there.

dir 662.elf

Is it there?

Edit: I even double-checked. I can load a loader while it's already open in another application.

when I type
dir 662.elf
I get

c:\>dir 662.elf
Volume in drive C has no label.
Volume Serial Number is FCF5-57E9

when I type
c:\>edl.exe /l662.elf
'edl.exe' is not recognized as an internal or external command,
operable program or batch file.

but I do have eedl.exe and 662.eld files in my username folder (scratching my head)