How to Root the Onyx Boox Note Air 2 Plus (Windows)

[dcarvil]

Originally Posted by ramensoup150

Do you know where I can find the loader files?

See step 4 of the user guide posted in this thread. If you are a Linux user, also see post 33.

[ramensoup150]

Originally Posted by dcarvil

See step 4 of the user guide posted in this thread. If you are a Linux user, also see post 33.

So im looking at the github, and im confused. I dont see any efl files but instead bin files. Do I need to convert the bin file to efl? And if so how do I convert it?

[Renate]

Originally Posted by ramensoup150

So im looking at the github, and im confused. I dont see any efl files but instead bin files. Do I need to convert the bin file to efl? And if so how do I convert it?

Modern day Qualcomm "loader files" (i.e. xbl/sbl replacements) are all signed ELF format files in either 32 or 64 bit version.
Normally ELF files are named .elf but they can also be named .bin
Most EDL clients don't care in the least how the files are named.

C:\>elfview /p /l poke3.bin
 #  Type     Flags  Filesize  Offset  Address   Memsize
--  -------  -----  --------  ------  --------  -------
 0  null     7           792  000000  00000000  0000000
 1  null     2.2        6856  001000  85e28000  0002000
 2  load     RX       356508  003000  14015000  005709c
 3  load     RWZ           0  05a0a0  14077000  0003000
 4  load     RW        40704  05a0a0  1407a000  0009f00
 5  load     RWX       39176  063fa0  14084800  0013400
 6  load     RWZ           0  06d8b0  85e10000  00176a0
 7  load     RX         7804  06d8b0  146ae000  0001e7c
 8  load     RWZ           0  06f730  146b1000  00000e4
 9  load     RWX      100568  06f730  14098000  00188d8
10  load     RWZ           0  088010  146b2000  0002dec
11  load     RWZ           0  088010  14680000  0018620
12  load     5RX       77248  088010  14699000  0012dc0

CPU:    ARM 64-bit architecture (AARCH64)

In the past .mbn (not ELF) files were used.

[Pentam]

Originally Posted by Renate

Err, I didn't mean a factory reset.
I just meant a long power button reset.

The Sahara protocol is a bit backwards in that the device initiates the conversation so that you can't miss its initial "hello" or else everything is talking at cross purposes.

Tried that three times before I wrote my question here in the forum. No sucess. Only the factory reset solved the issue.

Thanks anyway... ;-)

[ramensoup150]

Originally Posted by Renate

Modern day Qualcomm "loader files" (i.e. xbl/sbl replacements) are all signed ELF format files in either 32 or 64 bit version.
Normally ELF files are named .elf but they can also be named .bin
Most EDL clients don't care in the least how the files are named.

C:\>elfview /p /l poke3.bin
 #  Type     Flags  Filesize  Offset  Address   Memsize
--  -------  -----  --------  ------  --------  -------
 0  null     7           792  000000  00000000  0000000
 1  null     2.2        6856  001000  85e28000  0002000
 2  load     RX       356508  003000  14015000  005709c
 3  load     RWZ           0  05a0a0  14077000  0003000
 4  load     RW        40704  05a0a0  1407a000  0009f00
 5  load     RWX       39176  063fa0  14084800  0013400
 6  load     RWZ           0  06d8b0  85e10000  00176a0
 7  load     RX         7804  06d8b0  146ae000  0001e7c
 8  load     RWZ           0  06f730  146b1000  00000e4
 9  load     RWX      100568  06f730  14098000  00188d8
10  load     RWZ           0  088010  146b2000  0002dec
11  load     RWZ           0  088010  14680000  0018620
12  load     5RX       77248  088010  14699000  0012dc0

CPU:    ARM 64-bit architecture (AARCH64)

In the past .mbn (not ELF) files were used.

okay so i found a proper loader but now im stuck again.

"Found EDL 9008, handshaking... version 2.1
HWID: 001740e100000000, JTAG: 001740e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending 662.bin 100% ok, starting... ok, waiting for Firehose... no response, poking...
Could not write device"

and then after that the device disconnects

"Could not find EDL device"

Im stuck here and I cant figure out what to do next. (I installed the driver and enabled usb debugging)

[dcarvil]

Originally Posted by ramensoup150

okay so i found a proper loader but now im stuck again.

"Found EDL 9008, handshaking... version 2.1
HWID: 001740e100000000, JTAG: 001740e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending 662.bin 100% ok, starting... ok, waiting for Firehose... no response, poking...
Could not write device"

and then after that the device disconnects

"Could not find EDL device"

Im stuck here and I cant figure out what to do next. (I installed the driver and enabled usb debugging)

Did you install all 3 drivers? You have to install a driver for adb mode, fastboot mode, and edl mode. I suspect you do not have the edl mode driver installed.

Also read post 37 and responses. Post 37 was about a similar error, but not quite the same.

[ramensoup150]

Originally Posted by dcarvil

Did you install all 3 drivers? You have to install a driver for adb mode, fastboot mode, and edl mode. I suspect you do not have the edl mode driver installed.

Also read post 37 and responses. Post 37 was about a similar error, but not quite the same.

I rechecked everything and it seems I did install adb and edl. I also tried 3 other loaders that have the first part of the device's hash being d40eee56f3194665. I also redid the entire process through another laptop ssd. And the problems still remain (though I haven't tested the other 3 loaders again)
I also checked loaders that have my devices hwid numbers in it but I cant find any in the github. I also tried to look for something related to bengal-iot cpu but i havent found a loader connected so far to that either ( though Im still trying to see if the cpu has a number id or any other classification)

[Renate]

Originally Posted by ramensoup150

Sending 662.bin 100% ok, starting... ok, waiting for Firehose... no response, poking...
Could not write device

The Firehose loader you loaded crashed the device.
It's not a question of Windows drivers.

After any failure like this you have to do a long power press reset.

Somebody said above that the factory SDM662 loader didn't work.
You need one of those Lenovo/Motorola loaders.

[ramensoup150]

Originally Posted by Renate

The Firehose loader you loaded crashed the device.
It's not a question of Windows drivers.

After any failure like this you have to do a long power press reset.

Somebody said above that the factory SDM662 loader didn't work.
You need one of those Lenovo/Motorola loaders.

If you mean pressing the power button for a long time to reset the device(after each failure), I did that multiple times. And then redid everything with the other loaders I mentioned. Still didn't work

I will try the lenovo/motorola loaders

[dcarvil]

Originally Posted by ramensoup150

If you mean pressing the power button for a long time to reset the device(after each failure), I did that multiple times. And then redid everything with the other loaders I mentioned. Still didn't work

I will try the lenovo/motorola loaders

Are you getting that same "Could not write device" error on all loaders? I do not think trying other loaders will help with that error. The error seems to indicate the loader is not being sent.

I tried 4 different loaders before finding one that worked, and the edl --loader command worked successfully on all of them. My failure was with the edl commands after the loader.

Did you read post 37 and responses as I suggested earlier? That error seems similar to yours. Post 64 states they needed a factory reset to get past the error. A factory reset will remove your data, though. If you have not already done so, try a different USB cable first.

The lenova_motorola loader that worked for me was
lenovo_motorola/001b80e102e80000_8b2d1c830d9d8576_fhprg_moto_g52.b in from the NoteAir3C thread. It was not on GitHub.

[Renate]

I don't know. There is something screwy going on here. I wish that I had one here to work on. Anybody got one with a broken screen that they want to send me for free?

[ramensoup150]

Originally Posted by dcarvil

Are you getting that same "Could not write device" error on all loaders? I do not think trying other loaders will help with that error. The error seems to indicate the loader is not being sent.

I tried 4 different loaders before finding one that worked, and the edl --loader command worked successfully on all of them. My failure was with the edl commands after the loader.

Did you read post 37 and responses as I suggested earlier? That error seems similar to yours. Post 64 states they needed a factory reset to get past the error. A factory reset will remove your data, though. If you have not already done so, try a different USB cable first.

The lenova_motorola loader that worked for me was
lenovo_motorola/001b80e102e80000_8b2d1c830d9d8576_fhprg_moto_g52.b in from the NoteAir3C thread. It was not on GitHub.

okay so I factory reseted the device and it still doesn't work. Im unsure if a different usb cable would work either, since im using the stock cable. I will try the uh lenova stuff :v

also dumb question but am I supposed to also changed the filename to 662 for other devices as well.

[ramensoup150]

and before you ask yes ive been doing the file change name to 662 for the previous loaders and the current one

im asking because so far another error ive been noticing is:
Error 0x29, Incompatible ELF file header

[Renate]

Originally Posted by ramensoup150

and before you ask yes ive been doing the file change name to 662 for the previous loaders and the current one

That's fine. I usually keep the original name until I'm certain, then I rename it after the device. So I have loaders called poke3.bin and motog.bin

Originally Posted by ramensoup150

im asking because so far another error ive been noticing is:
Error 0x29, Incompatible ELF file header

All the current Onyx use 64 bit ELF files. If you check, that loader will probably be 32 bit ELF. I try to make the error messages as specific as possible, but sometimes the exact cause is not clear.

This is a 64 bit ELF:

000000  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00  .ELF............

This is a 32 bit ELF:

000000  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  .ELF............

[dcarvil]

Originally Posted by ramensoup150

okay so I factory reseted the device and it still doesn't work. Im unsure if a different usb cable would work either, since im using the stock cable. I will try the uh lenova stuff :v

also dumb question but am I supposed to also changed the filename to 662 for other devices as well.

The EDL GitHub page (https://github.com/bkerler/edl) offers a LIVE DVD that contains a complete, ready to go Linux environment. Since you've tried everything else, that may be your last resort. I haven't tried it, since I am already on Linux.

I would try a different USB cable first, though. Cables can develop problems. You should also try different USB ports, although you pretty much covered that when you tried a different computer.