Rooting the Poke5

[Renate]

I bought a Poke5 half a year ago but kept on using my Poke3 because of two (for me) intolerable things that I had fixed on the Poke3 but hadn't on the Poke5. I prefer to root without Magisk if I can, with Magisk if I must.

So, the first step is to update to the latest Poke5 update.
If you use Wifi on your device you could do the normal update.
But since you need the update anyway, download the update to your desktop.
Also, since the listing for this update just disappeared you can't do it directly on the device.

Model:  Poke5P
Finger: Onyx/Poke5P/Poke5P:11/2023-11-17_05-41_3.5_801526b7d/6777:user/dev-keys
Link:   http://firmware-us-volc.boox.com/9ba08e866b3617763dadb55a2ccda422/update.upx
Size:   1600986982
MD5:    9ba08e866b3617763dadb55a2ccda422

When it's on your desktop:

adb push update.upx sdcard
am start -a onyx.settings.action.firmware

Say yes to update.
If all you wanted to do was update to 3.5 without rooting, just stop now.

Now you need to get stuff from the update.upx for your own nefarious purposes.
We will be using DeBooxUpx.py.
This has just been updated, so you need to grab DeBooxUpx.py and BooxKeys.csv and put them together somewhere.
You need to have Python installed. It might handle .py files automatically or you might have to say "python DeBooxUpx.py".

DeBooxUpx.py Poke5P update.upx update.zip

Notice that that says "Poke5P" with a "P" at the end.
This should make update.zip which is the same size, 1600986982

Now you use your normal unzipper (7zip or friends) to get payload.bin:

7zip x update.zip payload.bin

You should have a file 1,600,983,123.

Now you want to get a few files out of that.
You need https://drive.google.com/file/d/1Qps...lK6v2gJSi/view
You can unzip this and there is only one file you need "payload_dumper.py".
The other file is obsolete and you use the attached file "update_metadata_pb2.py".
The two files must be put in the same directory.

payload_dumper.py payload.bin

When it's done you should have boot.img and vbmeta.img and some other files.

Now get Magisk from https://github.com/topjohnwu/Magisk, "Latest release" and install it.

 adb push boot.img sdcard

Run Magisk, select install, select /sdcard/boot.img and let it fly.

 adb pull sdcard/Download/magisk_patched-12345678.img

(It will be named something random.)

Now we're ready to burn!

adb reboot fastboot
fastboot devices
fastboot getvar current-slot

This is your slot, remember it, do all the commands with _a or _b using your own letter.

fastboot --disable-verity --disable-verification flash vbmeta_a vbmeta.img
fastboot flash boot_a magisk_patched-12345678.img
fastboot reboot

That's all there is to it!
Ok, this is intentionally complete so anybody can follow it if things change.
Some civic-minded person can post completed things which will work only if your device is the same.

[Logseman]

So far, in a Windows 11 install, I've found the following:

1. The DeBoox thing is called DeBooxUpd, not DeBooxUpx (a typo, obviously, but it kinda sets the mood )
2. I had to install Python (expected in Windows as Python is not installed by default), but when i ran DeBooxUpd I had to install a dependency for DeBooxUpd (Cryptodome) first.
3. Once I ran the payload_dumper.py, it failed first because "no module named 'google'" (another dependency install)
4. After fixing the dependency issue, the current blocker is an Assertion Error in payload_dumper.py:

Traceback (most recent call last):
  File "C:\Users\logse\Downloads\payload_dumper.py", line 64, in <module>
    assert magic == b'CrAU'
           ^^^^^^^^^^^^^^^^
AssertionError

This doesn't look like a dependency issue.

[Renate]

Originally Posted by Logseman

The DeBoox thing is called DeBooxUpd, not DeBooxUpx (a typo, obviously, but it kinda sets the mood )

Edit: Well, I screwed that all up. Hopefully I got things finally straightened out.

I'm not the biggest fan of Python. It's like cooking over at someone else's house. "Next we need some olive oil..." "Oh, I don't have any."

With Python, the average program just dumps the stack if anything unexpected happens.

Originally Posted by Logseman

assert magic == b'CrAU'

Erm, that step should be:

payload_dumper.py payload.bin

Note also that DeBooxUpx.py has changed. Load the new version and the required companion file BooxKeys.csv

[Logseman]

Now I've had success.

[hubertphava]

After the display crack of my BookeenMuse-hd (RIP), i've returned to Onyx with a Poke5. This post to thanks Renate for her detailed instructions for my (successfuly) rooting fo my Poke.
Now, it's time to debloat it :-)

HP

[leader_montanus]

These instructions worked with my Palma and firmware 3.5.1 (08a88fc4595cd359a9e337bb3893b856) that came out a few days ago. Thanks a lot for taking the time to post it here!

[Renate]

I don't know how I missed this, but there is a Firehose loader for QCS2290 (Poke5, Leaf2).
https://github.com/bkerler/Loaders/b..._ddr_fhprg.elf

With a full, raw backup you've got a "get out of jail free" card.
In worst case you might have to open the case to short test points first.
OTOH, the Poke5 does work with "EDL cables", so that would be rare.

C:\>edl /r poke5.img
Found EDL 9008, configuring... nope, configuring... nope, configuring... ok
Requesting info on LUN 0... ok
Requesting read poke5.img... ok, reading 100% ok

C:\>dir poke5.img
04/24/2024  07:29    31,331,450,880 poke5.img

[Renate]

I'm working on some stuff for a custom recovery on the Poke5.
There's been some major changes since the Poke3:
/dev/graphics/fb0 is now /dev/dri/card0 (but /dev/ebc still exists).
The old update-binary is out and the "update engine" is in.

One of the things that had always been a pain was resetting in recovery (without the recovery process).
I whipped up a little reboot executable and it's neat that it works through ADB too.
It explicitly tells you what's up with the BCB.

C:\adb reboot recovery  # going from system to recovery with stock reboot

C:\>adb reboot          # going from recovery to system with custom reboot
Was: boot-recovery
Now: <empty>
Rebooting

[dcarvil]

Originally Posted by Renate

I don't know how I missed this, but there is a Firehose loader for QCS2290 (Poke5, Leaf2).
https://github.com/bkerler/edl/issues/358

With a full, raw backup you've got a "get out of jail free" card.
In worst case you might have to open the case to short test points first.
OTOH, the Poke5 does work with "EDL cables", so that would be rare.

C:\>edl /r poke5.img
Found EDL 9008, configuring... nope, configuring... nope, configuring... ok
Requesting info on LUN 0... ok
Requesting read poke5.img... ok, reading 100% ok

C:\>dir poke5.img
04/24/2024  07:29    31,331,450,880 poke5.img

I don't have a Windows PC, so is there a Linux/Python equivalent to "edl /r poke5.img" to dump an image for a NoteAir3?

Thanks.

[Renate]

Originally Posted by dcarvil

I don't have a Windows PC, so is there a Linux/Python equivalent...

Yes, there's the bkerler Python EDL client.
The command syntax is different.

[Renate]

Oh, I just noticed an update:

Model:  Poke5P (English)
Finger: Onyx/Poke5P/Poke5P:11/2024-03-13_10-15_3.5.1_cb7eaef7e/7997:user/dev-keys
Link:   http://firmware-us.boox.com/c07f713991056ef618ce707994b0aa70/update.upx
Size:   1,629,542,746
MD5:    c07f713991056ef618ce707994b0aa70

[Quyen607]

Can we use this way to root Poke 3 devices?

[Renate]

Originally Posted by Quyen607

Can we use this way to root Poke 3 devices?

Yes, it's all the same, except for which update you download.

[Quyen607]

but there is no any payload.bin file in unzipped folder of Update.zip
"Now you use your normal unzipper (7zip or friends) to get payload.bin"

[Renate]

Originally Posted by Quyen607

but there is no any payload.bin file in unzipped folder of Update.zip

Correct. The Poke3 uses the older Edify (updater-script).
The Poke5 uses the newer payload.bin

In that update.zip for the Poke3 you see boot.img