Rooting the Note Air 3

[dcarvil]

Currently obtaining a boot image for the Note Air 3 is not a straightforward matter. There is no update.upx file from which you can extract the boot image, and the Qualcomm sdm662 edl loader would not work for me. Edited March 28, 2024: There is now an update file containing boot.img. The URL for the file is in this post. https://www.mobileread.com/forums/sh...12&postcount=3

Fortunately, Renate provided a loader (lenovo_motorola/001b80e102e80000_8b2d1c830d9d8576_fhprg_moto_g52.b in) in post 10 of this thread that worked.

https://www.mobileread.com/forums/sh...d.php?t=357326

There are many threads in this forum with excellent, detailed instructions for rooting, so I will not provide detailed instructions here. These are the two threads I used:

https://www.mobileread.com/forums/sh...d.php?t=349397 Linux users see post 33 in this thread.

https://www.mobileread.com/forums/sh...d.php?t=357269

Thanks to Renate for all the help she provided with the edl loader issue, and thanks to the creators of those threads.

[dcarvil]

I found a shortcut for turning on wireless adb without using a app.

1. Open Developer Options.
2. Go to "Quick settings developer tiles" just above "USB debugging".
3. Enable "Wireless debugging".
4. Open the Control Center by swiping down from the top right corner.
5. Wireless debugging should be the first icon. Tap it and answer the popup that appears.
6. Open the Control Center again, and long press "Wireless debugging". The IP/port will be displayed. The port is random every time wireless debugging is started for security.
7. For security, turn off wireless debugging when done.

[dcarvil]

The 3.5.3 update cripples fastboot by removing the boot, flash, and erase commands. This means you can no longer test or install magisk_patched.img with fastboot. You should be able to install it with edl.

[Never_Sm1le]

Originally Posted by dcarvil

The 3.5.3 update cripples fastboot by removing the boot, flash, and erase commands. This means you can no longer test or install magisk_patched.img with fastboot. You should be able to install it with edl.

Apperently it's common across devices, my poke 5s also get the fail:unknown command when i try fastboot erase command

[Renate]

Well, erasing is practically never useful.
Try a (non-functioning) flash.

fastboot flash fishheads file.txt

[munnimann]

Dear dcarvil and Renate,
thank you for all the help and information you provide in this forum. I'm trying to root my Boox Note Air 3c on v3.5.4. I've been reading various posts and got to the point where I have a full EDL backup of my device (though I'm still unclear on whether the motorola loader even allows to write it back anyway) and I got the patched boot.img. As you reported already, the boot command in fastboot fails with "Unrecognized command boot", so I couldn't test it yet. How would I go about installing it with edl? None of the listed partitions match the filesize of my boot.img, so probably I'm missing/misunderstanding something.

[Renate]

Originally Posted by munnimann

... so probably I'm missing/misunderstanding something.

Could be.

The size of the partition only tells you the maximum size of what you could write. It's often 64-100 MB with a boot image 20-40 MB.

fastboot has lost most of its useful commands recently. I don't know whether this is driven by Google standard policy or Onyx policy.

We still have EDL. Cross your fingers that it remains so.

If we're talking about Onyx devices then Motorola Firehose loaders are irrelevant.

[munnimann]

Thanks for the quick reply! It made me realize that I was indeed comparing the wrong numbers. Using EDL, I dumped boot_a and boot_b (without truncating) and both are exactly 100663296 bytes large, the same as the boot.img I extracted from update.upx and the patched version. Checking the md5sum, boot_b and the extracted boot.img are identical, so that's good I guess.

From what I understand, now I should write the patched boot.img back into boot_b with this command, correct?

edl.exe /u /w /pboot_b magisk_patched.img

If we're talking about Onyx devices then Motorola Firehose loaders are irrelevant.

I am using this loader, as was suggested in the first post of this thread:

https://github.com/bkerler/Loaders/b...g_moto_g52.bin

The other two loaders that had come up in this forum (qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin and lenovo_motorola/0000000002e80000_abbcc86fe393b13d_fhprg.bin) fail and result in my tablet disconnecting and reconnecting, so the moto_g52.bin is the only option for me. From what I understood you explained before that this loader is restricted in that it doesn't have read/write access to all partitions. It seems that reading works for all partitions, I haven't tried writing to the device yet though.

[munnimann]

I went ahead and wrote the patched boot_b.img into boot_b using edl.exe as described and can confirm that it worked. Thanks again!

[Renate]

Let me add, in the old days a boot image would be 20-40 MB.

Now, because of a stupid decision to put an AVB footer on images, boot images are still 20-40 MB of "meat", but have 60-80 MB of zeroes after that and then the stupid AVB footer.

I think that all books should be exactly 512 pages long, including ~300 blank pages, then "The End" after that.