List of fastboot oem commands on the Pixel 3 XL

[500 Internal Server Error]

I extracted the "fastboot oem" commands supported by the Pixel 3 XL from the firmware.

I haven't tested these, since most don't work when the bootloader is locked:

$ fastboot oem dmesg
FAILED (remote: 'Fastboot OEM command (dmesg) is not allowed when locked')
Finished. Total time: 0.081s

Note that fastboot commands can brick and damage your phone. Be careful when testing.

Here's the list of commands. You can run them with "fastboot oem <command>".

setbrightness
get_config
set_config
rm_config
get_platform_info
set_platform_info
select-display-panel
esim_erase
esim_atp
uart
off-mode-charge
sha1sum
ramdump
ramdump_sahara
rma
dump-chipid
check-hw-security
HALT
set_display_power_mode
citadel
enable-factory-lock
factory-lock
ddrtest
continue-factory
dmesg

 

[npjohnson]

I extracted the "fastboot oem" commands supported by the Pixel 3 XL from the firmware.

I haven't tested these, since most don't work when the bootloader is locked:

$ fastboot oem dmesg
FAILED (remote: 'Fastboot OEM command (dmesg) is not allowed when locked')
Finished. Total time: 0.081s

Note that fastboot commands can brick and damage your phone. Be careful when testing.

Here's the list of commands. You can run them with "fastboot oem <command>".

setbrightness
get_config
set_config
rm_config
get_platform_info
set_platform_info
select-display-panel
esim_erase
esim_atp
uart
off-mode-charge
sha1sum
ramdump
ramdump_sahara
rma
dump-chipid
check-hw-security
HALT
set_display_power_mode
citadel
enable-factory-lock
factory-lock
ddrtest
continue-factory
dmesg

Any idea what OEM citadel does? I have no clue from a precursory look.

 

[slogar25]

Must be super secret. I can't find anything on that

 

[FernBch]

I couldn't find anything about that either.

Pixel 3 XL, haven't crashed it, YET

 

[cmh714]

its in the crosshatch source code....https://android.googlesource.com/de...bfe57aaaf2cdd656a4476bbfb5c01314a09/device.mk

 

[elliwigy]

i believe citadel has to do with the new Titan security chip but I could be wrong

 

[slogar25]

i believe citadel has to do with the new Titan security chip but I could be wrong

It does seem that is the only command new to the 3 XL compared to the 2xl. The latter does not have the Titan chip

 

[FernBch]

NVM, I misunderstood.

Pixel 3 XL, haven't crashed it, YET

 

[xFirefly93]

its in the crosshatch source code....https://android.googlesource.com/de...bfe57aaaf2cdd656a4476bbfb5c01314a09/device.mk

Am I pretty much blind or anything, but it doesn't exist anything regarding what the 'set display power mode' OEM command does within the link to the Crosshatch source(s), or..?

 

[rlewis312010]

Can you "turn off" Titan and then run commands? Is that something to do with Citadel?

 

[xFirefly93]

I extracted the "fastboot oem" commands supported by the Pixel 3 XL from the firmware.

I haven't tested these, since most don't work when the bootloader is locked:

This is the message I am getting when trying to use anyone of the OEM commands, in this case, the possible adjustment of the display power mode.

FAILED (remote: Fastboot OEM command (set_display_power_mode) is not allowed)
finished. total time: 0.378s
PS C:\Users\Christofferwassberg\Downloads\platform-tools_r28.0.1-windows\platform-tools> fastboot oem set_display_power_
mode

Is it any secret restrictions enabled somewhere that is denying us from modifying, or checking the stats of phone, from the bootloader level?

EDIT: Yes, my bootloader is unlocked.

 

[npjohnson]

This is the message I am getting when trying to use anyone of the OEM commands, in this case, the possible adjustment of the display power mode.

FAILED (remote: Fastboot OEM command (set_display_power_mode) is not allowed)
finished. total time: 0.378s
PS C:\Users\Christofferwassberg\Downloads\platform-tools_r28.0.1-windows\platform-tools> fastboot oem set_display_power_
mode

Is it any secret restrictions enabled somewhere that is denying us from modifying, or checking the stats of phone, from the bootloader level?

EDIT: Yes, my bootloader is unlocked.

Yes, the device checks whether the PRODUCTION fuse, in our case, likely just QCOM_SEC_BOOT is blown, and if it is it restricts a whole number of commands/functions.

 

[xFirefly93]

Yes, the device checks whether the PRODUCTION fuse, in our case, likely just QCOM_SEC_BOOT is blown, and if it is it restricts a whole number of commands/functions.

Sounds like something that only Samsung would add, but Google? Nah..

 

[npjohnson]

Sounds like something that only Samsung would add, but Google? Nah..

That wasn't said in a questioning way lol -- its just how it is.

Every non-Chinese phone has Qualcomm Secure Boot enabled by that exact means (the SEC_BOT Fuse row). If you Google it, you'll find such. It's why we can't run custom bootloader's (exempting S-OFF HTC devices which are an odd and interesting case where QCOM secureboot only verfies very specific chunks of the bootchain the user doesn't normally touch).

QCOM secure boot is literally the industry standard lol - using the production state to limit OEM commands is new as of the Pixel 2, and correctly restricting them is new to the 3 series.

 

[Nick80835]

Could you maybe provide some info on how you extracted these commands from the firmware? Might be useful to me and others as well.

 

[gee one]

Any idea what OEM citadel does? I have no clue from a precursory look.

This is from sargo. I tried some of the other oem commands that sounded non-destructive, but got a lot of invalid oem command errors.

I didn't try any of these citadel commands, but they do sound interesting. I have no idea if they will apply to the blueline/crosshatch.

root@linus:# fastboot oem citadel
...
(bootloader) citadel <command>
(bootloader) Commands:
(bootloader) 	rescue       Try to rescue Citadel
(bootloader) 	state        Print current Citadel state
(bootloader) 	reset        Reset Citadel
(bootloader) 	reset-locks  Reset AVB locks
(bootloader) 	version      Print citadel OS version
(bootloader) 	reprovision  Reprovision device after a RMA unlock
(bootloader) 	suzyq on|off Enable or disable SuzyQable
FAILED (remote failure)
finished. total time: 0.060s

 

[zimmie]

Does anyone know how to use the citadel commands?

Im trying to restore a bricked 3a. so far here are my attempts

PS C:\Program Files (x86)\Minimal ADB and Fastboot> .\fastboot.exe oem citadel
(bootloader) citadel <command>
(bootloader) Commands:
(bootloader) rescue Try to rescue Citadel
(bootloader) state Print current Citadel state
(bootloader) reset Reset Citadel
(bootloader) reset-locks Reset AVB locks
(bootloader) version Print citadel OS version
(bootloader) reprovision Reprovision device after a RMA unlock
(bootloader) suzyq on|off Enable or disable SuzyQable
FAILED (remote: '')
fastboot: error: Command failed
PS C:\Program Files (x86)\Minimal ADB and Fastboot> .\fastboot.exe oem citadel rescue
FAILED (remote: 'no staged data, use fastboot stage <file>')
fastboot: error: Command failed
PS C:\Program Files (x86)\Minimal ADB and Fastboot> .\fastboot.exe stage bootloader-sargo-b4s4-0.2-5402313.img
Sending 'bootloader-sargo-b4s4-0.2-5402313.img' (8349 KB) OKAY [ 0.355s]
Finished. Total time: 0.413s
PS C:\Program Files (x86)\Minimal ADB and Fastboot> .\fastboot.exe oem citadel rescue
(bootloader) Recovering citadel - it may take a couple of minutes
FAILED (remote: 'failed to rescue citadel Bad Buffer Size')
fastboot: error: Command failed
PS C:\Program Files (x86)\Minimal ADB and Fastboot>

 

[richieboyw99]

Does anyone know how to use the citadel commands?

Im trying to restore a bricked 3a. so far here are my attempts

Did you ever manage to make this work? I'm in the same situation