Does NOT work for Palma 2 Pro

[fonix232]

I presumed given the hardware between the Palma 2 and Palma 2 Pro are practically the same (where it matters anyway) that the same approach would work.

Firehose file works, as it should since same SoC, pulled images are fine... But the device won't boot regardless of original or patched version being written back.

Fastboot doesn't have either flashing unlock or oem unlock, refuses to write or boot even the original boot.img

@jdkruzr I actually ran into the same issue you did with your Go 10.3 and Palma 2 - tried writing back the original boot_a and boot_b images to the right partitions, and the device still refuses to boot beyond EDL/fastboot.

[fonix232]

Update:

Managed to revive my unit through a handful of not too obvious steps:

• Flashed a more up to date, properly unlocked ABL from the latest e/OS/ build for the FairPhone 4. This resulted in more commands (such as fastboot boot, fastboot flashing lock/unlock etc.) to work, but was still locked out due to lock status
• Flashed an unlocked FRP to handle the OEM locking status, which allowed me to unlock flashing locks
• Booting the boot images directly from the initial firmware dump did NOT work. It seems like the boot chain, even though secure boot is off, actively rejects even the stock boot.img
• However, writing back the original (and current) boot slot via fastboot set_active (something that didn't work with the stock one!) fixed the boot issues and resulted in a workable state

After this, OTA was still failing, but flashing stock ABL back, I managed to fix that too.

Once the latest update 2025-11-15_16-27_4.1.1-REL_1115_8c4c763ab was installed, I tried rooting again. Pulled the B slot boot.img (now the active slot after the OTA update), patched via Magisk, re-flashed the FP4 ABL, and managed to boot the patched image directly - which then can be used to allow Magisk to patch the current slot.

[libelle1995]

Hi @fonix232, thanks for the update! I'm planning to root my Palma 2 Pro soon. Could you please share the specific Fairphone 4 ABL file you used? I want to be super careful not to brick my device. Thanks!

[fonix232]

@libelle1995 I literally just went onto the e/OS/ website and downloaded the latest A15 build for the FP4. In the ZIP you'll find an abl.img which you can write onto the device via EDL using the abl_a and abl_b partitions. Make sure you do a backup of BOTH, as OTAs seem to update it. In fact, use EDL to dump the entire super partition, just to be safe!

I'd also recommend you update to the latest 1115 firmware before trying to root - my device came with an earlier October build and trying to root that led to the above post. Rooting the 1115 build with the FP4 ABL using the guide went flawlessly.

[libelle1995]

@fonix232 Perfect, thanks for the help!

[jdkruzr]

@libelle1995 I literally just went onto the e/OS/ website and downloaded the latest A15 build for the FP4. In the ZIP you'll find an abl.img which you can write onto the device via EDL using the abl_a and abl_b partitions. Make sure you do a backup of BOTH, as OTAs seem to update it. In fact, use EDL to dump the entire super partition, just to be safe!

I'd also recommend you update to the latest 1115 firmware before trying to root - my device came with an earlier October build and trying to root that led to the above post. Rooting the 1115 build with the FP4 ABL using the guide went flawlessly.

If you want to document what you learned and add it to the document I'd be happy to incorporate the PR.

[Kisuke-CZE]

@fonix232 Thank you for showing the direction. At first I replicated procedure you described and it did not work.
But after I tried to read eOS documentation for FP4, I was able to get working procedure. I've added it into my repository I created some time ago.

Please feel free to include it into your docs. You got me on the right track with bunch of other people from MobileRead.

[fonix232]

@jdkruzr sure I can make a write-up but I think @Kisuke-CZE has already got a good start on it.

@Kisuke-CZE a few small changes to your guide, nothing serious, just to optimise it a teensy little bit:

1. You don't need to dump the entire flash, as tons of it will be empty or deletable. For example you're dumping the entirety of userdata, which is 100GB of mostly empty space (especially on a first boot device). Just pass --skip=userdata to the rl command to reduce dump times by about 85%.

2. Also, no need to specify --memory=ufs - EDL can figure it out on its own from the device report.

3. With the above you can skip the manual r command block.

4. Totally no need to install abandonware crap like Nova Launcher (sorry, had a semi-personal beef with the developer, especially after he sold the project off) to launch settings. You can just use ADB, via adb shell am start -a android.settings.SETTINGS. I'll whip up a quick APK that adds these icons to the launcher proper later on.

5. No need to tinker system to unlock the bootloader. I'll be uploading a modified FRP partition that does the very same thing, which you just need to write into the frp partition via edl [...] w frp frp_unlocked.img. It does the same as that switch, but from EDL.

6. Unfortunately step 5 above kind of invalidates the crypto key of userdata so you'll need to wipe it anyway (fastboot flashing unlock does take care of that, doing it this way you'll need to do it manually, although recovery should pop up offering you the option to wipe user data).

7. A small difference I noticed going my way:

❯ fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: true
(bootloader) Charger screen enabled: false
OKAY [  0.001s]
Finished. Total time: 0.001s

Charger screen seems to be disabled on my end. Not sure how to turn it on.

8. I also want to emphasise that your approach of writing the boot_X partitions on the OOTB firmware did not work for me. At all. In fact it sent me down a rabbit hole of trying to fix this damn thing. The only thing that worked was the aforementioned FRP flashing unlock approach, wiping devinfo, flashing ABL from the FP4, wiping userdata, force rewriting current slot, then restoring ABL to allow for an OTA update. After OTA, ABL had extended capabilities (including setting the current slot), though not all, and booting a modified boot.img even without an unlocked FRP (and proper locked state reported by the bootloader) was possible.

[fonix232]

Oh, a few more small details:

1. Installing edl on macOS, the best way to do so is using pipx.

brew install libusb git pipx python python-setuptools
pipx ensurepath

git clone https://github.com/bkerler/edl
cd edl
git submodule update --init --recursive
cd -

CFLAGS="-Wno-error=int-conversion" pipx install edl

This will safely install the edl utility and all other necessary binaries, compiled, prepared, and so on, to a safe path managed by pipx, separate from the system Python environment, and will put it in your PATH.

2. I'd strongly recommend against flashing back any super partition dump. I just managed to brick my unit so bad, even EDL is inaccessible... Will report back later if I manage to revive it.

[Kisuke-CZE]

@fonix232 How bad it is? When you connect Palma to computer, is it detected?
I've got also in near-dead state with mine. But it was being detected by computer as id=900e (in dmesg, not sure about macOS alternative here) and totaly unresponsive. Fortunately Renate adviced to try EDL cable, so I made one (but it is better to buy one with button, instead shorting cables...), and was able to get device into id=9008 mode where I was able to flash original images to revive the unit.

When my device was not booting, it usualy worked for me to switch activeslot, reboot, switch back, reboot. For some reason it sometimes does not even try to boot that slot (when it does, it takes time and vibrates and reboots one more time before fastboot detected) and goes straight into fastboot mode. Until I do this.

About optimalization.
Well, I did wrote whole flash backup as recommended (if somethink breaks, you have a original image of everything). Yes, probably backing up userdata is totaly useless - tried to restore them after wipe and it did not work (but maybe there is some way I do not know)
I do not think skipping manual r block is a good idea. When you do that, then rest of commands won't work if just pasted into terminal (cause different paths).

That settings trick is good! Did not know about that. For rooting purposes it is definitely good.
I just recycled part from different guide where adb is not used - only GUI. I do not say you have to use nova launcher - just any launcher. (Also I would disagree that Nova launcher is abandonware, use it for years - even in car - and still no better option for my usage found)

[fonix232]

How bad it is? When you connect Palma to computed, is it detected?

Nope, not detected at all. Long pressing power button doesn't result in the usual screen flashing, and the device isn't picked up at all, in dmesg or anywhere.

Fortunately Renate adviced to try EDL cable, so I made one (but it is better to buy one with button, instead shorting cables...), and was able to get device into id=9008 mode where I was able to flash original images to revive the unit.

Yep, I've already ordered one, it should be here by EOD tomorrow. Will report back.

About optimalization.
Well, I did wrote whole flash backup as recommended (if somethink breaks, you have a original image of everything). Yes, probably backing up userdata is totaly useless - tried to restore them after wipe and it did not work (but maybe there is some way I do not know)

Backing up userdata is pointless because of Android's default encryption - the moment you unlock the BL, that userdata partition is no longer readable, thus will need formatting anyway.

I do not think skipping manual r block is a good idea. When you do that, then rest of commands won't work if just pasted into terminal (cause different paths).

rl already backs those partitions up. You just need to modify the path from output_path/boot_a.img (for example) to output_path/lun4/boot_a.bin

[fonix232]

Okay, EDL cable actually just arrived, and I managed to restore things.

Now to restore the right partitions so I can OTA the device...

[fonix232]

Actually, @Kisuke-CZE if you wouldn't mind... Could you share a dump of yours with all stock partitions? Presuming you have one. Altogether, lun0/super, lun1/xbl_a, lun2/xbl_b, and lun4 is what I'd need, in an OTA-able format, if you wouldn't mind. A 7Z package uploaded to e.g. Google Drive would be most optimal I think. It would be much appreciated!

Alternatively, if you can check your backups for an ABL image with the SHA256 0B76F836913B3B928AF763DB237CA079ECD7FCA56AB10827B96AB85E4909CD3C that could possibly help me too.

[fonix232]

Okay, actually never mind 🙂 managed to fix it. Turns out the SHA256 hash in question should only apply to the actual binary size of the ABL image, not the entire partition. So only the first 159744b. Meaning, I did have compatible ABL backups...

Anyway managed to update to 1227, finally.

[AuroraWright]

For what it's worth, Fairphone 4 abl does boot on the Note Air 5C and you can reboot into fastboot and trigger the unlocking process (you can actually see the fastboot menu and then the unlock prompt) but it seems the volume buttons aren't mapped the same way as on the Fairphone so the prompt is completely unresponsive and you can't actually unlock (so close!). Tried blindly pressing any combination of them, but no dice.
If anyone has any ideas I'm open to testing as I have an EDL cable too (already checked it's working fine)

[fonix232]

@AuroraWright try flashing the attached FRP partition image (make sure you back the original up first!). This should unlock all fastboot flashing functions.

frp_oemunlock.zip