How to discover hidden Fastboot commands in Android

Home Forum Blog Private Support Courses Archive

Our courses are now on YouTube! Start Watching

Hovatek Forum OPERATING SYSTEMS Android How to discover hidden Fastboot commands in Android

How to discover hidden Fastboot commands in Android

How to discover hidden Fastboot commands in Android

View a Printable Version

Pages (2): 1 2 Next

hovatek
Administrator

51,003

16-12-2017, 09:28 AM

#1

It usually starts with you running some common Fastboot commands but hitting a dead end. This tells you your device's Fastboot is configured a little differently. In such a situation, it's a good idea to try finding out what commands you're allowed to run and in the process, discover new/hidden commands. This is done by reading the phone's Bootloader file.

I'll be using a Qualcomm Android phone and its aboot.img as an example in this guide. This would also work with a Mediatek phone's LK.bin and a Spreadtrum phone's Uboot.bin / Fdl2.bin files.

Requirements

Enable USB debugging on the device
Setup ADB and fastboot on the PC
Root the phone or at least gain temporary root

Steps to finding hidden Fastboot commands

Step 1: Find out the phone's mount points

We'd already dropped a guide on this at https://www.hovatek.com/forum/thread-11203.html but let's go through a different technique in finding the by-name folder and thereby finding out the path we need to run our command.

*Note, When I say "run" I mean type then press Enter

Let's ensure ADB can read the device with the command below

Code:

adb devices
If adb detects the device then run the following commands

Code:

adb shell su
Navigate to dev/block/platform where we're to begin mapping

Code:

cd dev/block/platform
Let's find out what's in the platform folder by running the command below

Code:

ls
In my example, I have a soc.0 folder so I'll look inside this folder

Code:

cd soc.0 ls
In this example, I have 7824900.sdhci and 7864900.sdhci so I'll look into both using the cd command hoping to find a by-name folder

Code:

cd 7824900.sdhci ls
I've found the by-name folder so I can cd\ or just exit and get back to the ADB shell su part of the guide (before I began cd-ing into dev/block/platform)
Now, I run this command to print out the phone's mount points (according to the location of the by-name folder in this example)

Code:

ls -al /dev/block/platform/soc.0/7824900.sdhci/by-name
The Bootloader in this example is aboot located at /dev/block/mmcblk0p19

Step 2: Dump the Bootloader

While still in adb shell su (#) , it is time to dump the Bootloader file (aboot.img in this example) using the dd command:

Code:

dd if=/dev/block/mmcblk0p19 of=/sdcard/aboot.img

Check your phone's Internal Storage for the aboot.img file and copy it to a folder on your PC.

Step 3: Read the Bootloader file

In this example, I'm using a Windows PC so I'll be reading the aboot.img using Strings.

Create a folder on your Desktop and name it Hovatek
Download strings at https://docs.microsoft.com/en-us/sysinte...ds/strings or download v2.53 attached below
Extract the contents of the Strings zip into the Hovatek folder then copy the aboot.img into the Hovatek folder so strings and aboot.img files are in the same folder
Hold the Shift key on your keyboard then right-click on any empty space in the Hovatek Folder and select Open command window here
Now, in the command prompt, let's say I want to know what OEM commands I can run in fastboot, I'll run this command

Code:

strings aboot.img | findstr /i oem

This post was last modified: 26-11-2023, 07:57 AM by hovatek.

Attached Files

Strings.zip
Size: 151.93 KB / Downloads: 263

Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.

Fermín“Letrix”Cirella
Newbie

1

17-12-2017, 06:06 AM

#2

This is my output

output.png
Size: 23.47 KB / Downloads: 160

hovatek
Administrator

51,003

18-12-2017, 01:03 PM

#3

(17-12-2017, 06:06 AM)Fermín“Letrix”Cirella This is my output

no OEM command there. You can try searching for other strings used in fastboot commands. OEM was just an example

This post was last modified: 18-12-2017, 01:04 PM by hovatek.

Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.

ryfoz
Senior Member

310

18-07-2018, 11:36 AM

#4

(18-12-2017, 01:03 PM)hovatek no OEM command there. You can try searching for other strings used in fastboot commands. OEM was just an example

How can I run the commands?

I don't know the lines to use to get those fastboot commands

hovatek
Administrator

51,003

18-07-2018, 09:11 PM

#5

Mediatek Course

Mediatek Course

(18-07-2018, 11:36 AM)ryfoz How can I run the commands?

I don't know the lines to use to get those fastboot commands

already replied to https://www.hovatek.com/forum/thread-23381.html

Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.

ryfoz
Senior Member

310

18-07-2018, 09:47 PM

#6

(18-07-2018, 09:11 PM)X3non already replied to https://www.hovatek.com/forum/thread-23381.html

Thanks...seen it

ryfoz
Senior Member

310

07-12-2018, 07:26 PM

#7

Hi I am trying to use this procedure on alcatel one touch idol 3 cricket version (non-rooted & running OS.6.0) so I can get the bootloader unlock command then proceed from there to root the device by flashing TWRP and SuperSU but I am stuck now at

dd if=/dev/block/mmcblk0p24 of=/sdcard/aboot.img

Response is access denied

What am I missing here or can't I get it from a non-rooted device cos su was denied as well but I got the mount points

Did I specified a wrong path to my internal storage?

PLS HELP ME ???

This post was last modified: 07-12-2018, 07:57 PM by ryfoz.

xerxes
Senior Member

10,420

07-12-2018, 08:47 PM

#8

(07-12-2018, 07:26 PM)ryfoz Hi I am trying to use this procedure on alcatel one touch idol 3 cricket version (non-rooted & running OS.6.0) so I can get the bootloader unlock command then proceed from there to root the device by flashing TWRP and SuperSU but I am stuck now at

dd if=/dev/block/mmcblk0p24 of=/sdcard/aboot.img

Response is access denied

What am I missing here or can't I get it from a non-rooted device cos su was denied as well but I got the mount points

Did I specified a wrong path to my internal storage?

PLS HELP ME ???

You need root access, it is mentioned in requirements section.

Please create a new thread so we can help you root and flash custom recovery.
See https://www.hovatek.com/forum/thread-514.html for how to create a new thread.

Sent from my M5 mini using Hovatek Mobile

ryfoz
Senior Member

310

07-12-2018, 11:49 PM

#9

(07-12-2018, 08:47 PM)innagee You need root access, it is mentioned in requirements section.

Please create a new thread so we can help you root and flash custom recovery.
See https://www.hovatek.com/forum/thread-514.html for how to create a new thread.

Sent from my M5 mini using Hovatek Mobile

But I did this with a MT6750 without root access anyway the thread has been created already https://www.hovatek.com/forum/thread-256...53038.html but I'm not making any headway with the suggested method using Miracle box for backup.

It's just not working on my pc and I don't have access to another pc

shankar1790
Senior Member

474

03-04-2019, 02:41 PM

#10

I got this error when trying this command
Strings64 uboot.img | findstr /i oem
OEM: %x
WARNING : OEM KEY VERIFY FAILED!!!
i trried other string like lock , flash etc.
Works but *oem* failed
Any solution? ?

This post was last modified: 03-04-2019, 02:42 PM by shankar1790.

Pages (2): 1 2 Next

View a Printable Version

Users browsing this thread:
1 Guest(s)

Users browsing this thread:
1 Guest(s)