Help me rooting the Go Color 7

SleepWithMachine · 06-20-2024, 07:46 AM

where to start please ?

debugging turned on, connected over USB, in Windows device manager listed as ADB Device, android composite ADB interface. Guess no driver is needed ?

╔═════════════════════════════════════════════════ ═══════════════════════╗
║ Checking connected Device(s)... ║
╚═════════════════════════════════════════════════ ═══════════════════════╝
Device: GoColor7
Model: GoColor7
Brand: Onyx
Android: 12
Firmware: 2024-06-14_05-27_3.5.3_80cba0e00
Security Patch: 2024-02-01

it can enter recovery /fastboot mode

There was already a new firmware via OTA, but it is not available on the onxy site for download

Edit: Are the steps described in this guide the same or useful in any way?

edit2: the above guide seems to work until :

\edl.exe /l662.elf
Found EDL 9008, handshaking... version 2.1
HWID: 001b80e100000000, JTAG: 001b80e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending 662.elf 100% ok, starting... ok, waiting for Firehose... no response, poking...
Could not write device

i assume its because of the wrong loader file, i need one for the QTI SM6225 ?

Renate · 06-20-2024, 12:11 PM

So, here's the latest update:

Code:

Model:  GoColor7 (English)
Finger: Onyx/GoColor7/GoColor7:11/2024-06-14_05-27_3.5.3_80cba0e00/5209:user/release-keys
Link:   http://firmware-us.boox.com/d08ae8f901b66505094edbabef4874a6/update.upx
Size:   1,760,121,604
MD5:    d08ae8f901b66505094edbabef4874a6

We don't have the keys for this, so it's up to you.
Please post /system/lib64/libota_jni.so (if it's there).

You apparently have a Qualcomm Snapdragon 680 4G SM6225
Now you need a Firehose loader. Here is a shot in the dark:
https://github.com/hoplik/Firehose-F...rehose_ddr.elf

Yes, Chitter did a nice write-up.

SleepWithMachine · 06-20-2024, 01:51 PM

libota_jni.so isnt there

firehose_ddr.elf seems to match

Code:

Found EDL 9008, handshaking... version 2.1
HWID: 001b80e100000000, JTAG: 001b80e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending 663.elf 100% ok, starting... ok, waiting for Firehose... ok

but downloading fails anyway

Code:

C:\adbtest>edl.exe /u /r /pboot_a boota.img /t
Found EDL 9008, configuring...
<log value="ERROR: Secure Boot *not* enabled BUT VIP *is* enabled. Therefore will *not* check digital signature on Digest Table. This allows easier testing on non-secure targets." />
<log value="ERROR: VIP table contains more than 54 hashes, 1681656382/32=52551761" />
Nope, configuring...
Could not write device

yes, thanks for the write up to chitter
and thank you too, renata

Renate · 06-20-2024, 02:24 PM

Quote:

Originally Posted by SleepWithMachine

libota_jni.so isnt there

Oh, so they're getting sneaky?
How about /system/priv-app/OnyxOtaService/OnyxOtaService.apk
Or if they screwed around with the name?

Quote:

Originally Posted by SleepWithMachine

Code:

Sending 663.elf 100% ok, starting... ok, waiting for Firehose... ok

Well, I can look at killing VIP. We have that luxury.

Renate · 06-20-2024, 08:01 PM

Here's two others that you can try. I think that the first is very likely.

https://github.com/hoplik/Firehose-F...ephgsm_com.elf

https://github.com/hoplik/Firehose-F...fhprg_peek.bin

SleepWithMachine · 06-21-2024, 03:13 AM

with the first one

Code:

Found EDL 9008, configuring... ok
Requesting info on LUN 0... no ack/nak

the 2nd one (bin) returns

Code:

Error 0x29, Incompatible ELF file header

messed around with firehose finder, no success

Renate · 06-21-2024, 07:32 AM

Oops, that 2nd one was just wrong, forget it.

The first one, did you remember the "/u" ?

Code:

edl /lA235F_LOADER_BIT5_Alephgsm_com.elf
edl /u /i /v

And how about that apk?

SleepWithMachine · 06-21-2024, 08:10 AM

the apk is there but i cant pull it (0 byte after download)

Code:

edl /lA235F_LOADER_BIT5_Alephgsm_com.elf
edl /u /i /v

returns

Code:

Found EDL 9008, configuring...
<log value="INFO: Calling handler for configure" />
<log value="INFO: Storage type set to value UFS" />
<response value="ACK" MemoryName="UFS" MinVersionSupported="1" Version="1" MaxPayloadSizeToTargetInBytes="65536" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" DateTime="Jan 10 2024 - 18:16:46" />
Ok
Requesting info on LUN 0...
<log value="INFO: Calling handler for getstorageinfo" />
No ack/nak

Renate · 06-21-2024, 08:20 AM

Well, try it without the /u (but I can't believe it's not UFS).

Quote:

Originally Posted by SleepWithMachine

The apk is there but i can't pull it (0 byte after download)

Are you sure that you're using the double name and getting the apk and not the directory?
Try:

Code:

cp /system/priv-app/OnyxOtaService/OnyxOtaService.apk /sdcard
^D
adb pull sdcard/OnyxOtaService.apk

SleepWithMachine · 06-21-2024, 08:49 AM

Code:

C:\adbtest>edl /i /v
Found EDL 9008
<log value="ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 0" />
<log value="INFO: UFS EDC max_count = 34" />
<log value="ERROR: [EDLFAIL_127_UFS_UICCMDERROR#a0]ufs_error_code 0 :: 0x11" />
<log value="ERROR: ufs_error_code 1 :: 0x3" />
<log value="ERROR: ufs_error_code 2 :: 0x3" />
<log value="ERROR: ufs_error_code 3 :: 0x3" />
<log value="ERROR: ufs_error_code 4 :: 0x3" />
<log value="ERROR: ufs_error_code 5 :: 0x3" />
<log value="ERROR: ufs_error_code 6 :: 0x3" />
<log value="ERROR: [EDLFAIL_105_UFS_LINKSTARTUPFAIL#bc]ufs_error_code 7 :: 0xa" />
<log value="ERROR: [EDLFAIL_127_UFS_UICCMDERROR#c0]ufs_error_code 8 :: 0x11" />
<log value="ERROR: ufs_error_code 9 :: 0x3" />
<log value="ERROR: ufs_error_code 10 :: 0x3" />
<log value="ERROR: ufs_error_code 11 :: 0x3" />
<log value="ERROR: ufs_error_code 12 :: 0x3" />
<log value="ERROR: ufs_error_code 13 :: 0x3" />
<log value="ERROR: ufs_error_code 14 :: 0x3" />
<log value="ERROR: [EDLFAIL_105_UFS_LINKSTARTUPFAIL#dc]ufs_error_code 15 :: 0xa" />
<log value="ERROR: last ufs_error_code 16 :: 0xa" />
<log value="ERROR: Failed to open the device:3 slot:0 partition:0 error:0" />
<log value="ERROR: OPEN handle NULL and no error, weird 203922644" />
<log value="ERROR: Failed to open device, type:UFS, slot:0, lun:0 error:3" />
<response value="NAK" rawmode="false" />
Configuring...
<log value="INFO: Calling handler for configure" />
<log value="INFO: Storage type set to value eMMC" />
<response value="ACK" MemoryName="eMMC" MinVersionSupported="1" Version="1" MaxPayloadSizeToTargetInBytes="65536" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" DateTime="Jan 10 2024 - 18:16:46" />
Ok
Requesting info on LUN 0...
<log value="INFO: Calling handler for getstorageinfo" />
<log value="INFO: Device Total Logical Blocks: 0x747c000" />
<log value="INFO: Device Block Size in Bytes: 0x200" />
<log value="INFO: Device Total Physical Partitions: 0x4" />
<log value="INFO: Device Manufacturer ID: 0x32" />
<log value="INFO: Device Serial Number: 0x6de715ba" />
<log value="INFO: {&quot;storage_info&quot;: {&quot;total_blocks&quot;:122142720, &quot;block_size&quot;:512, &quot;page_size&quot;:512, &quot;num_physical&quot;:4, &quot;manufacturer_id&quot;:50, &quot;serial_num&quot;:1843860922, &quot;fw_version&quot;:&quot;3&quot;,&quot;mem_type&quot;:&quot;eMMC&quot;,&quot;prod_name&quot;:&quot;MMC64G&quot;}}" />
<log value="INFO: eMMC Extended CSD Revision: 0x8" />
<log value="INFO: eMMC Firmware Version: 0x3" />
<log value="INFO: eMMC_RAW_DATA[0:177]00000000000000000000000000000000010100106B02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000002000000000010000000000000000000000000000000000000000000000000000B50900070001000000150020000000000000000000" />
<log value="INFO: eMMC_RAW_DATA[178:355]003800000000010000000000000008000200571FFFFF00000000000808080808080100C047070F151408081001110108200007F7F755110000000000000001640000000000FF32000600000003000000000000000000010801010101000000000000000000000000000000000000000000000000000000000000000000000000001F010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" />
<log value="INFO: eMMC_RAW_DATA[356:532]0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001FFFF0000000001032905000301203C010101000000000000004D01013232014FD0FF03598FEFFFFFFF0000408A" />
<response value="ACK" rawmode="false" />
Ok

i cant pull the apk, maybe because of wrong adb ..no clue
but in the folder is see libota_jni.so

cannot opend in editor anyway

SleepWithMachine · 06-21-2024, 10:09 AM

here is the apk

SleepWithMachine · 06-21-2024, 10:11 AM

this one:

Renate · 06-21-2024, 10:19 AM

Quote:

Originally Posted by SleepWithMachine

this one:

Thanks. This was my second choice when you said libota_jni.so did not exist.
Could you please get libota_jni.so ?

The last EDL experiment you got all "OK"s. Why didn't you pursue it from there?
Apparently this is eMMC, so don't ever say "/u".

Code:

edl /lwhatever.bin
edl /i
edl /g
edl /r /pboot_a boota.img

SleepWithMachine · 06-21-2024, 11:20 AM

this worked so far and i patched the image, yeah !

but it cant be written

Sending 'boot.img' (98304 KB) OKAY [ 2.448s]
Booting FAILED (remote: 'unknown command')
fastboot: error: Command failed

Renate · 06-21-2024, 11:48 AM

Quote:

Originally Posted by SleepWithMachine

this worked so far and i patched the image, yeah !

but it cant be written

Sending 'boot.img' (98304 KB) OKAY [ 2.448s]
Booting FAILED (remote: 'unknown command')
fastboot: error: Command failed

Ya killing me.
What was the exact command you typed?
Were you "fastboot boot" -ing?
As long as you have the original boot image safely backed up, you can:

Code:

fastboot flash boot_a Magisked-whatever
fastboot reboot

BUT, first verify which slot you are on:

Code:

fastboot getvar
fastboot getvar all

Make sure that the boot image you are using is from the active slot.

How's that libota_jni.so coming along?

06-20-2024, 07:46 AM	#1
SleepWithMachine Zealot Posts: 109 Karma: 1924 Join Date: Dec 2019 Location: Puddingtown Device: some ..	Help me rooting the Go Color 7 where to start please ? debugging turned on, connected over USB, in Windows device manager listed as ADB Device, android composite ADB interface. Guess no driver is needed ? ╔═════════════════════════════════════════════════ ═══════════════════════╗ ║ Checking connected Device(s)... ║ ╚═════════════════════════════════════════════════ ═══════════════════════╝ Device: GoColor7 Model: GoColor7 Brand: Onyx Android: 12 Firmware: 2024-06-14_05-27_3.5.3_80cba0e00 Security Patch: 2024-02-01 it can enter recovery /fastboot mode There was already a new firmware via OTA, but it is not available on the onxy site for download Edit: Are the steps described in this guide the same or useful in any way? edit2: the above guide seems to work until : \edl.exe /l662.elf Found EDL 9008, handshaking... version 2.1 HWID: 001b80e100000000, JTAG: 001b80e1, OEM: 0000, Model: 0000 Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3) Sending 662.elf 100% ok, starting... ok, waiting for Firehose... no response, poking... Could not write device i assume its because of the wrong loader file, i need one for the QTI SM6225 ? Last edited by SleepWithMachine; 06-20-2024 at 12:15 PM.

06-20-2024, 12:11 PM	#2
Renate Onyx-maniac Posts: 3,177 Karma: 12537601 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	So, here's the latest update: Code: Model: GoColor7 (English) Finger: Onyx/GoColor7/GoColor7:11/2024-06-14_05-27_3.5.3_80cba0e00/5209:user/release-keys Link: http://firmware-us.boox.com/d08ae8f901b66505094edbabef4874a6/update.upx Size: 1,760,121,604 MD5: d08ae8f901b66505094edbabef4874a6 We don't have the keys for this, so it's up to you. Please post /system/lib64/libota_jni.so (if it's there). You apparently have a Qualcomm Snapdragon 680 4G SM6225 Now you need a Firehose loader. Here is a shot in the dark: https://github.com/hoplik/Firehose-F...rehose_ddr.elf Yes, Chitter did a nice write-up.

06-20-2024, 08:01 PM	#5
Renate Onyx-maniac Posts: 3,177 Karma: 12537601 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Here's two others that you can try. I think that the first is very likely. https://github.com/hoplik/Firehose-F...ephgsm_com.elf https://github.com/hoplik/Firehose-F...fhprg_peek.bin Last edited by Renate; 06-20-2024 at 10:47 PM.

06-21-2024, 03:13 AM	#6
SleepWithMachine Zealot Posts: 109 Karma: 1924 Join Date: Dec 2019 Location: Puddingtown Device: some ..	with the first one Code: Found EDL 9008, configuring... ok Requesting info on LUN 0... no ack/nak the 2nd one (bin) returns Code: Error 0x29, Incompatible ELF file header messed around with firehose finder, no success Last edited by SleepWithMachine; 06-21-2024 at 03:52 AM.

06-21-2024, 07:32 AM	#7
Renate Onyx-maniac Posts: 3,177 Karma: 12537601 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Oops, that 2nd one was just wrong, forget it. The first one, did you remember the "/u" ? Code: edl /lA235F_LOADER_BIT5_Alephgsm_com.elf edl /u /i /v And how about that apk?

06-21-2024, 10:09 AM	#11
SleepWithMachine Zealot Posts: 109 Karma: 1924 Join Date: Dec 2019 Location: Puddingtown Device: some ..	here is the apk

06-21-2024, 11:20 AM	#14
SleepWithMachine Zealot Posts: 109 Karma: 1924 Join Date: Dec 2019 Location: Puddingtown Device: some ..	this worked so far and i patched the image, yeah ! but it cant be written Sending 'boot.img' (98304 KB) OKAY [ 2.448s] Booting FAILED (remote: 'unknown command') fastboot: error: Command failed

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Rooting the Nova 3 Color: is it locked?	haxonhax	Onyx Boox	6	08-23-2021 12:16 AM
Rooting Nook Color with 1.2 Firmware On It?	bhartman36	Barnes & Noble NOOK	1	07-01-2011 01:16 PM
I think I bricked Nook Color while rooting	Hanscraft	Nook Developer's Corner	56	06-06-2011 01:41 PM
Rooting Nook Color - Many questions	Ankaa	Nook Developer's Corner	1	12-30-2010 04:04 PM
Made a mistake rooting my Nook Color	woodyear99	Nook Developer's Corner	10	12-24-2010 01:44 PM

Advert

Advert