• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Can't flash anything to Pixel C with `fastboot flash`, and fwtool is nowhere to be found

Search This thread

linuxleah

New member
Dec 4, 2021
1
0
Google Pixel C
This is driving me nuts.

I am trying (without success) to install LineageOS on my Pixel C.

As a first step, I am trying to install TWRP. I have enabled Developer Mode, and the bootloader is unlocked.

However, attempting to flash TWRP (or anything else) yields results like this:

[email protected] ~ % fastboot flash recovery twrp.img
Sending 'recovery' (16516 KB) OKAY [ 0.583s]
Writing 'recovery' FAILED (remote: 'unsupported command')
fastboot: error: Command failed
The actual sending of the data works, but writing yields "remote: 'unsupported command'".

My research has led me to believe that downgrading from Android 8.1 to 6.x may help. However, that fails too. The device reads its own identity (the 'ro.product.device' paramter) as an empty-string instead of 'dragon', resulting in this nonsensical output on the device:

Now send the package you want to apply
to the device with "adb sideload <filename>"...
Finding update package...
Opening update package...
Verifying update package...
Update package verification took 58.2 s (result 0).
Installing update...
Warning: No file_contents
This package is for "dragon" devices; this is a "".

E:Error in /sideload/package.zip (Status 7)

E:Failed to open driver control: No such file or directory
Installation aborted.


The culprit is this line in `META-INF/com/google/android/updater-script` inside the update:

./META-INF/com/google/android/updater-script:getprop("ro.product.device") == "dragon" || abort("This package is for \"dragon\" devices; this is a \"" + getprop("ro.product.device") + "\".");

I've tried editing out that line and rezipping the OTA file, but of course then it fails signature verification and will not flash.

Just about ready to tear my hair out over this.

What I've learned on the Internet suggests that running the "fwtool" utility like:

fwtool vbnv write dev_boot_fastboot_full_cap 1

...may help. However, I do not have this tool, and the only link I could find which SEEMS to be a link to the binary is a dead-ish link (to a locked share on Google Drive).

I've even tried cross-compiling fwtool from the sources available online, but I can't get it to compile.

Someone please help. This is driving me nuts.
 

bernardomarx

Member
Dec 31, 2021
11
2
Hi,
Same problem: after some investigation I realised the same conclusion here.


I would rephrase as the following the possible solutions:

  • Software: set the proper flag even without adb/recovery
    • Using fusée-gelée exploit and starting a recovery from there (fastboot boot recovery.img); I tried with linux but no device is detected when fastboot is enabled...
      Update [2022-01-20]: I think it's impossible because the exploit should run from the recovery mode,
    • Using kind-of fwtool in fastboot context or any other method to set NVRAM flag / GBB flag
  • Hardware: Developer Switch, the last possibility in my opinion...
    Update [2022-01-20]: At the moment the ONLY possibility; seems you can disable write-protection "simply" by detaching the front camera flex (see guide to open the screen)
    Update [2022-01-22]: No does not work. Disconnected the camera flex, device still secure; most probably I should flash W25Q128FW memory using CH341A programmer WTF..

Note: I tried any older version of fastboot (down to 1.0) thinking that the code to distinguish dev/normal mode was related to that tool, but apparently is something related to the chipset itself.
Update [2021-01-20]: yes the code it's inside the bootloader: it prevents to actually flash/boot without the NVRAM flag or HW switch.

@followmsi pls help
 
Last edited: