[GUIDE]How to reboot to EDL from fastboot

[emuzychenko]

Most Qualcomm-based Android PDAs support emergency download (EDL) mode allowing to unbrick device, unlock bootloader or modify protected device parameters. If ADB interface is accessible, "adb reboot edl" can be used to reboot to EDL mode.

Many bricked PDAs cannot be booted with full ADB support while FastBoot mode is accessible. But if bootloader is locked, there is no way to flash a partition or boot an image.

Some firmwares support rebooting to EDL in Android Bootloader aboot module (the "reboot-edl" command) but fastboot utility doesn't recognize "reboot-edl" in the command line and refuses to sent the command to the device.

Since FastBoot command protocol is simple and text-based, it is enough to send a packet containing "reboot-edl" text over USB. The simplest way to do that is to patch Windows fastboot.exe file, replacing "reboot-bootloader" text with "reboot-edl". As "reboot-bootloader" string is found in the command line, fastboot.exe sends the same constant string to the device. So if "reboot-bootloader" is replaced with "reboot-edl", you can specify "reboot-edl" in the command line and the same text will be sent to the device.

In the attached example, the mentioned string is located at offset 2685c.

I occasionally locked bootloader in my unlocked/rooted Xiaomi Redmi Note 3 Pro (Snapdragon) so it could boot to FastBoot or Diagnostic 900E modes. Tried to swich from 900E to 9008 with QPST but it reported unspecified error.

Analyzing aboot (emmc_appsboot.mbn), found that it supports "reboot-edl" so the only remaining thing was to find a way to send it to the bootloader.

With the attached fastboot.exe, successfully rebooted to EDL mode (9008) and re-flashed proper partition images.

Of course, patched version does not support "reboot-bootloader" command because it has been replaced by "reboot-edl".

There also is a detailed guide.

 

[Santhosh M]

Works perfectly for me

 

[s_wheel]

It's working and for me also! Great work!
Many users can to reject the test point method.

 

[emuzychenko]

It's working and for me also!

Please don't forget to vote to collect a proper statistics.

 

[marabujo]

Thank you very much. You are a genius ;D

 

[alessiobnb]

Thank you so much.

I was able to enter edl-mode but miflash gives error 0x80070008 max buffer sector is 256. What can i do?

 

[emuzychenko]

Unfortunately, I'm not familiar with MiFlash so cannot help you. It is better to search other threads (here and on Xiaomi).

 

[tecno789]

It doesn't work on xiaomi Mi5
What a pity, I saw for the moment the hope

 

[emuzychenko]

It doesn't work on xiaomi Mi5

Will take a look at Mi 5 bootloader. Maybe there is a solution too.

 

[tecno789]

Will take a look at Mi 5 bootloader. Maybe there is a solution too.

Thanks too much.

I will appreciate it

 

[emuzychenko]

Who has no success with this method, please upload somewhere (or post URL to an existing file) the image file of your "aboot" partition from FastBoot firmware, I will try to analyze them. For Redmi Note 3 Pro, image file is named "emmc_appsboot.mbn". If your FastBoot firmware contains a batch file that calls fastboot.exe, the appropriate image file name can be found there.

 

[scarletnokarasu]

hi i can't get it work on xiaomi mi max
here is my aboot and emmc_appsboot.mbn
https://drive.google.com/open?id=0B2M9hEQgSgheZjFNeFR4U2tCb00

 

[emuzychenko]

can't get it work on xiaomi mi max

Your bootloader supports the following oem commands in FastBoot mode:

oem unlock
oem lock
oem edl
oem device-info
oem enable-charger-screen
oem disable-charger-screen
oem off-mode-charge
oem poweroff
oem select-display-panel

So "oem edl" should switch the phone to EDL mode (any fastboot.exe will support that).

Additionally, "oem poweroff" should power the phone off.

 

[emuzychenko]

Checked Mi 4c, Mi 5 and Mi Max bootloaders - all of them support "oem edl" to switch to EDL mode. Looks like a kind of "protection" is implemented in RN3P bootloader that supports only "reboot-edl" command.

 

[anil4523]

emmc_appsboot.mbn file from Fastboot firmware of 7.3.5.0 MAAMIDD Global Stable of Mi 5 - https://mega.nz/#!OUZ1QaoI!EIgsKTOn6PQZ236pluhHmVRQ5D9HCKWeNRfzqgFbkgM

This will support all of that mentioned by @emuzychenko



But it is mentioned that edl is blocked in 7.3.x.x firmware, so how to check whether edl is working or not ??

Thanks

 

[emuzychenko]

https://mega.nz/#!OUZ1QaoI!EIgsKTOn6PQZ236pluhHmVRQ5D9HCKWeNRfzqgFbkgM

Sorry but cannot download the file - mega.nz asks me for creating an account.

 

[Kanth's]

you are a genius . I can now say bye bye to testpoint method

 

[Thri11]

Awesome guide ...
Worked for me also....

 

[anil4523]

Here is google drive link of boot.img & emmc_appsboot.mbn file of 7.3.5.0 MAAMIDD Global Stable for Mi5 - https://drive.google.com/open?id=0B0M_ponZ2Qxjd0lueS1fREtWRkE

Video - https://www.youtube.com/watch?v=4GOi61S-qUs

 

[Kanth's]

my miflash is giving error 0x80070008 Open Serial Port "\\.\COM8"