edl
edl copied to clipboard
bkerler
Loader for Onyx Boox Note 2 - Qualcomm Bengal (aka Snapdragon 662)
I've attached a copy of what came up on Terminal with my device in EDL mode when I ran the command edl printgpt --memory=emmc
It was unable to find a suitable loader for my device and encouraged me to pass this on. So here it is! If you need additional info, please let me know. My main purpose in doing this is to get the boot.img from my device so I can root it with Magisk.
Please try b30f7c9 and make sure you do a submodule init and update to get the latest Loaders directory as well.
Thanks for your response! I'm still learning my way around edl. When you speak of the submodule init and update, do you mean running the git submodule update line in the installation instructions? Thanks again!!
The loader doesn't appear to be working, but I may have installed it incorrectly. How would I install this manually? Thanks!
UbuntuTerminal.txt Attached is a log of my terminal on Ubuntu. Towards the end, it looks like the loader was finally installed but that it was not being recognized. Either I have missed something (highly probable) or perhaps this is the wrong loader?
Thanks for your assistance.
I thought that my Onyx Boox Note Air 2 had a Snapdragon 662 chip. I found out that the code name “bengal” covers more than one chip. I installed the CPU-Z app. It tells me that I have a Snapdragon 665.
Hey guys, I have the same problem cannot make it work with Qualcomm Bengal, please let me know if I can help somehow with logs or testing. I have tried 662 loader, doesn't work for me either. Debug log without loader:
Qualcomm Sahara / Firehose Client V3.53 (c) B.Kerler 2018-2021.
main - Trying with no loader given ...
main - Waiting for the device
UsbClass
UsbClass - [LIB]: ←[95m CONFIGURATION 1: 2 mA ====================================
bLength : 0x9 (9 bytes)
bDescriptorType : 0x2 Configuration
wTotalLength : 0x2c (44 bytes)
bNumInterfaces : 0x1
bConfigurationValue : 0x1
iConfiguration : 0x0
bmAttributes : 0xa0 Bus Powered, Remote Wakeup
bMaxPower : 0x1 (2 mA)
INTERFACE 0: Vendor Specific ===========================
bLength : 0x9 (9 bytes)
bDescriptorType : 0x4 Interface
bInterfaceNumber : 0x0
bAlternateSetting : 0x0
bNumEndpoints : 0x2
bInterfaceClass : 0xff Vendor Specific
bInterfaceSubClass : 0xff
bInterfaceProtocol : 0x10
iInterface : 0x0
ENDPOINT 0x81: Bulk IN ===============================
bLength : 0x7 (7 bytes)
bDescriptorType : 0x5 Endpoint
bEndpointAddress : 0x81 IN
bmAttributes : 0x2 Bulk
wMaxPacketSize : 0x400 (1024 bytes)
bInterval : 0x0
ENDPOINT 0x1: Bulk OUT ===============================
bLength : 0x7 (7 bytes)
bDescriptorType : 0x5 Endpoint
bEndpointAddress : 0x1 OUT
bmAttributes : 0x2 Bulk
wMaxPacketSize : 0x400 (1024 bytes)
bInterval : 0x0←[0m
UsbClass
UsbClass - [LIB]: ←[95mNo kernel driver supported: Operation not supported or unimplemented on this platform←[0m
UsbClass
UsbClass - [LIB]: ←[95mNo kernel driver supported: Operation not supported or unimplemented on this platform←[0m
main - Device detected :)
UsbClass
UsbClass - [LIB]: ←[95mconnect:0x400←[0m
Debug log with loader:
C:\Users\pvtgo\Desktop\edl>python3 edl printgpt --loader C:\Users\pvtgo\Desktop\edl\Loaders\qualcomm\factory\sdm662\0014d0e100000000_d40eee56f3194665_FHPRG.bin --debugmode
Qualcomm Sahara / Firehose Client V3.53 (c) B.Kerler 2018-2021.
main - Using loader C:\Users\pvtgo\Desktop\edl\Loaders\qualcomm\factory\sdm662\0014d0e100000000_d40eee56f3194665_FHPRG.bin ...
main - Waiting for the device
UsbClass
UsbClass - [LIB]: ←[95m CONFIGURATION 1: 2 mA ====================================
bLength : 0x9 (9 bytes)
bDescriptorType : 0x2 Configuration
wTotalLength : 0x2c (44 bytes)
bNumInterfaces : 0x1
bConfigurationValue : 0x1
iConfiguration : 0x0
bmAttributes : 0xa0 Bus Powered, Remote Wakeup
bMaxPower : 0x1 (2 mA)
INTERFACE 0: Vendor Specific ===========================
bLength : 0x9 (9 bytes)
bDescriptorType : 0x4 Interface
bInterfaceNumber : 0x0
bAlternateSetting : 0x0
bNumEndpoints : 0x2
bInterfaceClass : 0xff Vendor Specific
bInterfaceSubClass : 0xff
bInterfaceProtocol : 0x10
iInterface : 0x0
ENDPOINT 0x81: Bulk IN ===============================
bLength : 0x7 (7 bytes)
bDescriptorType : 0x5 Endpoint
bEndpointAddress : 0x81 IN
bmAttributes : 0x2 Bulk
wMaxPacketSize : 0x400 (1024 bytes)
bInterval : 0x0
ENDPOINT 0x1: Bulk OUT ===============================
bLength : 0x7 (7 bytes)
bDescriptorType : 0x5 Endpoint
bEndpointAddress : 0x1 OUT
bmAttributes : 0x2 Bulk
wMaxPacketSize : 0x400 (1024 bytes)
bInterval : 0x0←[0m
UsbClass
UsbClass - [LIB]: ←[95mNo kernel driver supported: Operation not supported or unimplemented on this platform←[0m
UsbClass
UsbClass - [LIB]: ←[95mNo kernel driver supported: Operation not supported or unimplemented on this platform←[0m
main - Device detected :)
UsbClass
UsbClass - [LIB]: ←[95mconnect:0x400←[0m
In both cases I was using libusb1.2.6
I am using OpenSuse Linux and I have the problem, that I loose the connection to the device (onyx boox note air 2) as soon as the message Successfully uploaded programmer :) appears in the Terminal. Here is the output with and without debug mode:
edl_onyx_boox_note_air2_emmc.txt
edl_onyx_boox_note_air2_emmc_debugmode.txt
One reason for our difficulties may be, as I have said before, the CPU in the Note Air 2 is a Snapdragon 665, not 662, as I previously thought. The loader and programmer(s) we use need to be compatible with the 665.
A little context,
I've been digging for the correct loader to fix an Unknown mode. Aborting. issue on Ubuntu 20.04
@baqlias I believe the CPU-Z app has a bug in it. I installed it and confirmed it said 665, however, DevCheck shows 662. All I can find in documentation points to 662 which is code named "BENGAL". I found this with adb shell cat /proc/cpuinfo and on phonedb
I believe the one you mention is 665 "Trinket"
Just wanted to verify this for my own sanity and share with others
Thanks for clarifying this. I installed CPU Identifier Pro and it tells me I have a Qualcomm Snapdragon Bengal, but does not give a number such as 662 or 665. The adb shell command does likewise. Everything else I've seen points to 662, as you said.
Similar experience with the new BOOX Note 5, with the same CPU. I know next to nothing but am willing to learn and test.
I'm also willing to test, as long as there's a way to back things up first, just in case!
I had a PM from someone for whom bkerler's 662 loader worked. This person says that memory in the Note Air 2 is UFS mode, not eMMC mode. Once this person posts on Mobileread, you can all check it out. I'll post a link to that post here. It still didn't work for me, but this person was kind enough to upload the boot.img.
Using --memory=ufs didn't work for me for some reason! It worked for someone else, whose post appeared on Mobileread today!
Using --memory=ufs didn't work for me for some reason! It worked for someone else, whose post appeared on Mobileread today!
Have not been able to get --memory=ufs working either, but the provided factory image on your contact's post is much appreciated. Was able to patch and root. Tyvm @baqlias!
Still unable to pull the boot image from the BOOX Note 5 using --memory=ufs. I can open a new issue since it's a different device. I've tried from a couple different machines and keep getting this:
HWID: 0x0014d0e100000000 (MSM_ID:0x0014d0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected: "SDM662"
PK_HASH: 0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955
Serial: 0xd81532b6
sahara - Possibly unfused device detected, so any loader should be fine...
sahara - Trying loader: /storage/projects/onyx/edl/edlclient/../Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin
sahara - Uploading loader /storage/projects/onyx/edl/edlclient/../Loaders/qualcomm/factory/sdm662/0014d0e100000000_d40eee56f3194665_FHPRG.bin ...
Successfully uploaded programmer :)
USBError(19, 'No such device (it may have been disconnected)') <class 'usb.core.USBError'> 19
I know very little (nothing) about loaders or how they're obtained, or how edl works. I would love to be more helpful but I will need to wait until there is a solution or Onyx releases a new firmware that I can pull the image from. Until then I have a workaround to keep my device from calling back to Onyx and Tencent.
My best guess is that there are different chip revisions or hardware configurations and the edl loader will then fail.
Ok, so:
onyx boox note air2 has 0x0014d0e100000000, which is SDM662.
What msmid does boox note 5 show ? The msmid is the only reliable source for cpu identification.
So, onyx boox note air2 seems to work fine with 0014d0e100000000_d40eee56f3194665_FHPRG.bin and option --memory=ufs.
Ok, so:
onyx boox note air2 has 0x0014d0e100000000, which is SDM662.
What msmid does boox note 5 show ? The msmid is the only reliable source for cpu identification.
@bkerler, the value according to edl's output is: 0x0014d0e1
(The output above is from my BOOX Note 5)
Same problem with Boox Max Lumi2. Device disconnected after 0014d0e100000000_d40eee56f3194665_FHPRG.bin uploaded. Fortunately, I have found a patched loader for SDM662 and it works! Google the keyword: Qualcomm SDM662 Patched Loader MD5: cd7a91985353e0a1a6d581b423e1325c
Same problem with Boox Max Lumi2. Device disconnected after 0014d0e100000000_d40eee56f3194665_FHPRG.bin uploaded. Fortunately, I have found a patched loader for SDM662 and it works! Google the keyword: Qualcomm SDM662 Patched Loader MD5: cd7a91985353e0a1a6d581b423e1325c
Onyx Boox Note X failed, stucked at Trying to read first storage sector
$ edl printgpt --loader=prog_firehose_life_ddr_patched.elf --memory=ufs
Qualcomm Sahara / Firehose Client V3.60 (c) B.Kerler 2018-2022.
main - Using loader prog_firehose_life_ddr_patched.elf ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2.1
main - Mode detected: sahara
sahara -
------------------------
HWID: 0x0014d0e100000000 (MSM_ID:0x0014d0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected: "SDM662"
PK_HASH: 0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955
Serial: 0x04ee17b9
sahara - Protocol version: 2.1
sahara - Uploading loader prog_firehose_life_ddr_patched.elf ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose
firehose - [LIB]: Couldn't detect MaxPayloadSizeFromTargetinBytes
firehose
firehose - [LIB]: Couldn't detect TargetName
firehose - TargetName=Unknown
firehose - MemoryName=UFS
firehose - Version=1
firehose - Trying to read first storage sector...
^CTraceback (most recent call last):
......
KeyboardInterrupt
$ md5sum prog_firehose_life_ddr_patched.elf
cd7a91985353e0a1a6d581b423e1325c prog_firehose_life_ddr_patched.elf
prog_firehose_life_ddr_patched.zip
