Root Boox Note Air 3C

[SuiVu1fa]

I wonder whether it is possible to root Onyx Boox Note Air 3C? I do not see any post on it.

The output of `cat /proc/cpuinfo` is

Hardware	: Qualcomm Technologies, Inc KHAJE

which seems to be Qualcomm Snapdragon 680 (SM6225). I failed to find an EDL loader for that.

Thanks.

[Renate]

Originally Posted by SuiVu1fa

I do not see any post on it.

You just started one.

Model:  NoteAir3C
Finger: Onyx/NoteAir3C/NoteAir3C:11/2023-10-17_09-55_3.5_a37b266eb/2482:user/test-keys
Link:   http://firmware-us-volc.boox.com/34a441f633e667cf64adaa74dbe0e477/update.upx
Size:   1575084503
MD5:    34a441f633e667cf64adaa74dbe0e477

There's a full update available, so you should be able to install Magisk easily.
We don't have the strings yet.
The easiest would be if you could pull and post this as there have been some changes recently.

adb pull /system/lib64/libota_jni.so

As far as EDL goes, that's very good to have but its absence won't prevent rooting.
I don't see any loaders offhand for that either, but loaders usually cover lots of models.
There can be problems with the memory and peripherals like PMIC.

You can go to EDL mode and then perform a basic query to get the info we need for loader.

adb reboot edl
edl.exe /l

That's for my Windows EDL client, the Python is similar but different.

[SuiVu1fa]

The decryption is slightly different. See https://github.com/Hagb/decryptBooxU...ent-1805154847

After that, there is no difficulty patching boot partition and flashing via fastboot. Does the root survive after upgrades? Or it might be usually possible to boot the previously patched boot partition then perform a "Direct Install" to the updated boot partition after every upgrade? Thanks.

[Renate]

Originally Posted by SuiVu1fa

Or it might be usually possible to boot the previously patched boot partition then perform a "Direct Install" to the updated boot partition after every upgrade?

No. After an update grab the new boot image. Most problems with Magisk are because somebody flashed a boot image which was not related to the existing boot image.

[SuiVu1fa]

Originally Posted by Renate

No. After an update grab the new boot image. Most problems with Magisk are because somebody flashed a boot image which was not related to the existing boot image.

I am ignorant, but if I understand correctly, the boot partition contains a Linux kernel and an initramfs. There should be very few kernel-level updates in minor system upgrades, thus I guess that boot partitions should be pretty much compatible with various versions (my experience of backporting Linux kernels on computers seems to coincide with this).

Anyway, the approach I proposed does not involve "flashing a boot image not related to the existing boot image". I wanted to say that, use `fastboot boot` to boot the system with an old (Magisk-patched) boot image, and use Magisk to install itself on the boot partition.

[Renate]

Boot images have a kernel, maybe a DTB, usually not a ramdisk.
Recovery images will have a ramdisk.
Version conflicts between kernel modules and kernels will prevent them from loading.

[SuiVu1fa]

Now let me try to seek a loader for EDL.

I run the python version of EDL without parameter (I am under Debian Linux), which returns

main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x2
------------------------
HWID:              0x001b80e100000000 (MSM_ID:0x001b80e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "divar"
PK_HASH:           0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87
Serial:            0x146292ab

I hope that these help.

[Renate]

Originally Posted by SuiVu1fa

Now let me try to seek a loader for EDL.

There are three that pop out:

qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin
lenovo_motorola/0000000002e80000_abbcc86fe393b13d_fhprg.bin
lenovo_motorola/001b80e102e80000_8b2d1c830d9d8576_fhprg_moto_g52.bin

Try them.

[SuiVu1fa]

lenovo_motorola/001b80e102e80000_8b2d1c830d9d8576_fhprg_moto_g52.bin

I do not see this one. I tried the first two with

./edl printgpt --loader=[LOADER]

and it always ends up with (the loader shown in "Uploading loader ..." changes, but everything else remains the same: USB Error 19)

sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader Loaders/lenovo_motorola/0000000002e80000_abbcc86fe393b13d_fhprg.bin ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')

I tried to use a different cable, a different USB port, and connect it to a USB Hub, and it does not help.

[Renate]

Originally Posted by SuiVu1fa

I do not see this one.

It's newish, 3 months ago.
https://github.com/bkerler/Loaders/b...g_moto_g52.bin

[SuiVu1fa]

Thanks. It starts to work miraculously (with any of these three loaders). It looks like that this is an A/B device from the result of printgpt. Unfortunately, the OTA update reboots the system automatically (otherwise one can patch boot right after the update), but it seems possible to set the active slot to the "older" one after update, patch the other boot partition of the updated slot, then reboot to the updated and patched slot.

[Renate]

Originally Posted by SuiVu1fa

It starts to work miraculously...

Then only use the Qualcomm factory one. While the two Lenovo/Motorola ones (somewhat) work they have Motorola limitations built in.

Don't mess around with slots. The update gives you the boot image on a platter. Use it.

[kyokugen]

I'm looking at getting one of these, so as of now, can these be rooted? If so, has anyone typed up any instructions yet?

[SuiVu1fa]

Originally Posted by kyokugen

I'm looking at getting one of these, so as of now, can these be rooted? If so, has anyone typed up any instructions yet?

Yes, they can be rooted.

1. Download the ROM that you want to root (usually the one that you are using).
2. Decrypt the ROM (decryptBooxUpdateUpx is already updated for Note Air 3C, thus now the usage is no different from that for other devices).
3. Patch the boot partition.
4. Flash the patched boot partition via fastboot.

I am using Linux (and I did not record the procedure), but as far as I see, the usual manual for Windows works as is.

[Renate]

Originally Posted by kyokugen

I'm looking at getting one of these, so as of now, can these be rooted? If so, has anyone typed up any instructions yet?

It's pretty similar to this thread.
Of course you start with the the correct update.upx