Hovatek Forum DEVELOPMENT Android [Development] How to discover hidden Fastboot commands in Android
Try our Online TWRP Builder..its free!
Can't login? Please, reset your password.


[Development] How to discover hidden Fastboot commands in Android

[Development] How to discover hidden Fastboot commands in Android

Pages (2): 1 2 Next
hovatek
hovatek
hovatek
Administrator
49,612
16-12-2017, 09:28 AM
#1



It usually starts with you running some common Fastboot commands but hitting a dead end. This tells you your device's Fastboot is configured a little differently. In such a situation, it's a good idea to try finding out what commands you're allowed to run and in the process, discover new/hidden commands. This is done by reading the phone's Bootloader file.

I'll be using a Qualcomm Android phone and its aboot.img as an example in this guide. This would also work with a Mediatek phone's LK.bin and a Spreadtrum phone's Uboot.bin / Fdl2.bin files.

Requirements


Steps to finding hidden Fastboot commands


Step 1: Find out the phone's mount points



We'd already dropped a guide on this at https://www.hovatek.com/forum/thread-11203.html but let's go through a different technique in finding the by-name folder and thereby finding out the path we need to run our command.

*Note, When I say "run" I mean type then press Enter

  1. Let's ensure ADB can read the device with the command below

    Code:

    adb devices

    [Image: How-to-discover-hidden-Fastboot-commands...one-1.webp]

  2. If adb detects the device then run the following commands

    Code:

    adb shell
    su

    [Image: How-to-discover-hidden-Fastboot-commands...one-2.webp]

  3. Navigate to dev/block/platform where we're to begin mapping

    Code:

    cd dev/block/platform

    [Image: How-to-discover-hidden-Fastboot-commands...one-3.webp]

  4. Let's find out what's in the platform folder by running the command below

    Code:

    ls

    [Image: How-to-discover-hidden-Fastboot-commands...one-4.webp]

  5. In my example, I have a soc.0 folder so I'll look inside this folder

    Code:

    cd soc.0
    ls

    [Image: How-to-discover-hidden-Fastboot-commands...one-5.webp]

  6. In this example, I have 7824900.sdhci and 7864900.sdhci so I'll look into both using the cd command hoping to find a by-name folder

    Code:

    cd 7824900.sdhci
    ls

    [Image: How-to-discover-hidden-Fastboot-commands...one-6.webp]

  7. I've found the by-name folder so I can cd\ or just exit and get back to the ADB shell su part of the guide (before I began cd-ing into dev/block/platform)

  8. Now, I run this command to print out the phone's mount points (according to the location of the by-name folder in this example)
    Code:

    ls -al /dev/block/platform/soc.0/7824900.sdhci/by-name

    [Image: How-to-discover-hidden-Fastboot-commands...one-7.webp]

  9. The Bootloader in this example is aboot located at /dev/block/mmcblk0p19

Step 2: Dump the Bootloader



While still in adb shell su (#) , it is time to dump the Bootloader file (aboot.img in this example) using the dd command:

Code:

dd if=/dev/block/mmcblk0p19 of=/sdcard/aboot.img

Check your phone's Internal Storage for the aboot.img file and copy it to a folder on your PC.

Step 3: Read the Bootloader file



In this example, I'm using a Windows PC so I'll be reading the aboot.img using Strings.
  1. Create a folder on your Desktop and name it Hovatek
  2. Download strings at https://docs.microsoft.com/en-us/sysinte...ds/strings or download v2.53 attached below
  3. Extract the contents of the Strings zip into the Hovatek folder then copy the aboot.img into the Hovatek folder so strings and aboot.img files are in the same folder

    [Image: How-to-discover-hidden-Fastboot-commands...one-9.webp]

  4. Hold the Shift key on your keyboard then right-click on any empty space in the Hovatek Folder and select Open command window here

    [Image: How-to-discover-hidden-Fastboot-commands...ne-10.webp]

  5. Now, in the command prompt, let's say I want to know what OEM commands I can run in fastboot, I'll run this command

    Code:

    strings aboot.img | findstr /i oem

    [Image: How-to-discover-hidden-Fastboot-commands...one-8.webp]
This post was last modified: 26-11-2023, 07:57 AM by hovatek.
Attached Files
.zip
Strings.zip
Size: 151.93 KB / Downloads: 182

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
17-12-2017, 06:06 AM
#2
This is my output

.png
output.png
Size: 23.47 KB / Downloads: 97
hovatek
hovatek
hovatek
Administrator
49,612
18-12-2017, 01:03 PM
#3
(17-12-2017, 06:06 AM)Fermín“Letrix”Cirella This is my output

no OEM command there. You can try searching for other strings used in fastboot commands. OEM was just an example
This post was last modified: 18-12-2017, 01:04 PM by hovatek.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
ryfoz
ryfoz
ryfoz
Senior Member
297
18-07-2018, 11:36 AM
#4
(18-12-2017, 01:03 PM)hovatek no OEM command there. You can try searching for other strings used in fastboot commands. OEM was just an example

How can I run the commands?

I don't know the lines to use to get those fastboot commands
hovatek
hovatek
hovatek
Administrator
49,612
18-07-2018, 09:11 PM
#5



(18-07-2018, 11:36 AM)ryfoz How can I run the commands?

I don't know the lines to use to get those fastboot commands

already replied to https://www.hovatek.com/forum/thread-23381.html
ryfoz
ryfoz
ryfoz
Senior Member
297
18-07-2018, 09:47 PM
#6
(18-07-2018, 09:11 PM)X3non already replied to https://www.hovatek.com/forum/thread-23381.html

Thanks...seen it
ryfoz
ryfoz
ryfoz
Senior Member
297
07-12-2018, 07:26 PM
#7
Hi I am trying to use this procedure on alcatel one touch idol 3 cricket version (non-rooted & running OS.6.0) so I can get the bootloader unlock command then proceed from there to root the device by flashing TWRP and SuperSU but I am stuck now at

dd if=/dev/block/mmcblk0p24 of=/sdcard/aboot.img

Response is access denied

What am I missing here or can't I get it from a non-rooted device cos su was denied as well but I got the mount points

Did I specified a wrong path to my internal storage?



PLS HELP ME ???
This post was last modified: 07-12-2018, 07:57 PM by ryfoz.
xerxes
xerxes
xerxes
Senior Member
8,357
07-12-2018, 08:47 PM
#8
(07-12-2018, 07:26 PM)ryfoz Hi I am trying to use this procedure on alcatel one touch idol 3 cricket version (non-rooted & running OS.6.0) so I can get the bootloader unlock command then proceed from there to root the device by flashing TWRP and SuperSU but I am stuck now at

dd if=/dev/block/mmcblk0p24 of=/sdcard/aboot.img

Response is access denied

What am I missing here or can't I get it from a non-rooted device cos su was denied as well but I got the mount points

Did I specified a wrong path to my internal storage?



PLS HELP ME ???

You need root access, it is mentioned in requirements section.

Please create a new thread so we can help you root and flash custom recovery.
See https://www.hovatek.com/forum/thread-514.html for how to create a new thread.

Sent from my M5 mini using Hovatek Mobile
ryfoz
ryfoz
ryfoz
Senior Member
297
07-12-2018, 11:49 PM
#9
(07-12-2018, 08:47 PM)innagee You need root access, it is mentioned in requirements section.

Please create a new thread so we can help you root and flash custom recovery.
See https://www.hovatek.com/forum/thread-514.html for how to create a new thread.

Sent from my M5 mini using Hovatek Mobile

But I did this with a MT6750 without root access anyway the thread has been created already https://www.hovatek.com/forum/thread-256...53038.html but I'm not making any headway with the suggested method using Miracle box for backup.

It's just not working on my pc and I don't have access to another pc
shankar1790
shankar1790
shankar1790
Senior Member
474
03-04-2019, 02:41 PM
#10
I got this error when trying this command
Strings64 uboot.img | findstr /i oem
OEM: %x
WARNING : OEM KEY VERIFY FAILED!!!
i trried other string like lock , flash etc.
Works but *oem* failed
Any solution? ?
This post was last modified: 03-04-2019, 02:42 PM by shankar1790.
Pages (2): 1 2 Next
Users browsing this thread:
 1 Guest(s)
Users browsing this thread:
 1 Guest(s)
YtWhTl