Boox Page adb / fastboot / recovery /edl walkthrough

[Anghirrim]

Hi,

I recently purchased a Boox Page (QC Snapdragon 662) and decided to play a bit with it and find out the different boot options.

Goal is of course to be able to backup and restore the firmware images in case some experimentation go wrong.

So far, different boot modes I managed to get into (Page running the 3.5.1 firmware). Unless otherwise specified, everything has been tested and proven to work fine:

First, enable adb:
- Open Apps tab
- Top right menu ⇒ Manage apps
- Then enable Android Debug Bridge (adb)

Boot into bootloader (Fastboot):
- From adb ⇒ adb reboot bootloader
- From recovery => Reboot to bootloader

Boot into Recovery:
- Command line:
- From adb ⇒ adb reboot recovery
- From bootloader ⇒ fastboot reboot recovery
- Buttons:
- Poweroff the page (unplugged)
- Press power until blue led turns on and keep pressed for 7 seconds then release
- Right after, press and release power 5 times
- Your device should enter recovery

Boot into Fastbootd:
- From recovery ⇒ Enter fastboot
- From adb ⇒ adb reboot fastboot

Boot into EDL (9008):
- From adb ⇒ adb reboot edl
- Buttons ==> No option. To be confirmed
- edl cable (https://romprovider.com/make-qualcom...ype-c-devices/ ): Works fine (tested)
- Device off ==> Plug the cable to the device, shortcut green (Data+) and black (Ground) cables, plug onto the computer, once booted into EDL, release shortcut.
- Device on ==> Plug the cable to the device and the computer, shortcut green (Data+) and black (Ground) cables, press the Page power button until it forces reboot, once booted into EDL, release shortcut.

Exit from EDL (9008):
- Buttons ==> Press an maintain power button for 10 to 15 seconds.
- edl utility ==> Depends on the utility you're using

Boot into EDL (900e):
- From Recovery ⇒ Reboot bootloader
- Plug your device to your computer
- Once booted under bootloader ==> Press vol Up (or Down, both work) + Power

Exit EDL (900e):
- PRess power for at least 15 seconds

Setting up and EDL working environment:
I've had hard time getting https://github.com/bkerler/edl to work (some python issues on both Archlinux and Debian).
So decided to use @Renate edl utility (http://temblast.com/edl.htm) under Windows with the following loader

- Step 1 ==> Boot under Windows and install the 15 second adb/fastboot installer
- Step 2 ==> Download @Renate edl utility (link above) + [url}https://zadig.akeo.ie/] Zadig USB installer [/url] and extract them where you want (at least in a drive that has enough space for your future edl backups).
- Step 3 ==> With your Page booted and connected to your PC, open a PowerShell or a cmd tool from the C:/adb folder and do:

adb reboot edl

- Step 4 ==> Launch Zadig, once your device is detected, install the WinUSB driver. Once done, your Device Managers + Zadig should look like in the screenshot in the attachments.
- Step 5 ==> Force reboot your device under Android (using the power button pressed for 10-15 seconds until the blue led turns on).
- Step 6 ==> Plug your Boox Page to your computer, and re-do the "adb reboot edl" thing. Keep it plugged on your PC. You should now be under edl mode with the proper driver installed on Windows.
- Step 7 ==> Use the edl utility with the loader provided by @Renate in the second post of this thread. As proposed, it is good practice to make a full backup of your NAND in case of you start messing around with your device partitions and need to restore it at some point.

From now on, every time you'll want to use the edl utility, only steps 6 and 7 will be needed.

I left the list of the Boox Page partitions in the attachments for those who need it.

Root:
Just follow @Renate's thread instructions ( https://www.mobileread.com/forums/sh...d.php?t=357269 ) and use the boot.img backup you did via EDL.

For now, having access to the Recovery is enough to play a bit with "adb shell pm uninstall" to debloat the Boox Page and recover a working state in case of debloating went too far...

Edit: Added a list of the Page partitions. It's a AB device with a super partition.
Edit 2: Updated OP following recent success

[Renate]

Originally Posted by Anghirrim

It keeps saying "Can't open device".

You probably still have the (silly) Qualcomm virtual port driver installed which hogs the USB bulk endpoints.
Try reinstalling the WinUsb drivers with Zadig.

The Page is an SDM662 so use:
https://github.com/bkerler/Loaders/b...4665_FHPRG.bin
You're allowed to rename it something more menmonic.

To exit EDL mode after loading a Firehose loader using my EDL client:

edl /z

[Anghirrim]

Originally Posted by Renate

You probably still have the (silly) Qualcomm virtual port driver installed which hogs the USB bulk endpoints.
Try reinstalling the WinUsb drivers with Zadig.

The Page is an SDM662 so use:
https://github.com/bkerler/Loaders/b...4665_FHPRG.bin
You're allowed to rename it something more menmonic.

To exit EDL mode after loading a Firehose loader using my EDL client:

edl /z

Thanks for looking at my thread.

So, I made another attempt this morning and was at least able to handshake my device.

I don't know what went wrong yesterday with the WinUSB driver. I am pretty sure I did install it correctly, but apparently not... I must have missed something.

That being said... Seems like I need to find the correct loader.

I indeed took this loader from your website yesterday (assuming that the page was a SN662 device, and of the same generation than the Tab Ultra/Tab Ultra C).

I also tried another one then. See attachment.

So now, I just need to find the correct loader, correct?

Note: Just to avoid drivers conflicts, etc... I just took my old W7 laptop for my attempts. I also have access to a W10 machine, and my daily driver (on which I usually do all my Android building stuff) running Archlinux.

[Anghirrim]

While for entering edl mode, is there any other know method but adb (for Onyx devices)?

I tried the two fastboot commands, but they are not working.

[Renate]

Originally Posted by Anghirrim

So, I made another attempt this morning and was at least able to handshake my device.

No, you didn't. The conversation was all one-sided.

The Sahara protocol is very fragile. That means between entering EDL mode and using edl.exe you can't do anything. The Windows driver has to already be installed. You can't disconnect the USB cable at any time.

Reset the device and try again.

Originally Posted by Anghirrim

Seems like I need to find the correct loader.

You're not even getting to any point where the Firehose loader matters.

[Anghirrim]

Originally Posted by Renate

No, you didn't. The conversation was all one-sided.

The Sahara protocol is very fragile. That means between entering EDL mode and using edl.exe you can't do anything. The Windows driver has to already be installed. You can't disconnect the USB cable at any time.

Reset the device and try again.


You're not even getting to any point where the Firehose loader matters.

Ok, so. Assuming the USB driver is the correct one and now installed, I connect my device to my laptop and adb reboot into edl mode.

Keep it connected to my laptop, make sure it's the right driver and then launch edl.

Correct?

Is the USB driver installed the good one?

[Renate]

Yes, the Windows driver is fine.

Also, if you have any sort of USB flakiness you will have problems.
Virtual machines are not a good bet either.

After a reset to EDL the processor gives out one squawk.
That squawk can not be lost.

[Anghirrim]

Originally Posted by Renate

Yes, the Windows driver is fine.

Also, if you have any sort of USB flakiness you will have problems.
Virtual machines are not a good bet either.

After a reset to EDL the processor gives out one squawk.
That squawk can not be lost.

That squawk is sent and should be caught by the host machine right? Even before launching any edl tool command?

While for the USB cable, it should be ok. I have a reliable one that I use for all my android flashing activities. At least adb and fastboot work perfectly with it.

And I never use any virtual machines no. So good for that part.

[Renate]

Just try.

[Anghirrim]

Originally Posted by Renate

Just try.

Yep, I will when I am back home.

Thanks for the support!

[Anghirrim]

Ok, I guess it somehow worked.

After this, I was able to "edl /z" at least once.

I also tried to "edl /u /g" to list the partition table, without success.

And now, whenever I reboot under edl, I cannot even load the loader.

That's kinda weird...

I will reboot the computer and try again

[Renate]

Why is it always saying "daemon not running"?
It should only say that once after you power up your desktop.

I thought that the Page is eMMC?

Don't say /u

[Anghirrim]

Originally Posted by Renate

Why is it always saying "daemon not running"?
It should only say that once after you power up your desktop.

I thought that the Page is eMMC?

Don't say /u

Oh it's just because I rebooted my computer to see if it would help it working.

You're right for the emmc, I have misread the Onyx Wikipedia table.


I have just tried again after cleanly rebooting the device and with another USB cable and it works again.

I'll play a bit with it then.

[Anghirrim]

Side question, is there a way to backup the system partition instead of the entire super partition?

Edit: I think I backed up the core partitions.
- vbmeta
- boot
- recovery
- super

The output .img files sizes all match 512*block count (taken from "edl /g").

Thanks for your tool @Renate !

[Renate]

If you have the space on your desktop, just do:

edl /r thirtytwogeefile

Then you have one-stop restore no matter what you do.