Android Fastboot Protocol
SummaryFastboot is a protocol to flash Android devices. This post describes the main features of the protocol and implementation details.
For full details, see Fastboot protocol specifications
Basic Mechanism- The phone device is connected to a host PC via USB
- The host directly controls all data communication.
- Data communication is synchronous
- Uses packet based communication
- Max. packet size is 64 bytes for full-speed USB and 512 bytes for high-speed USB
There are two types of data packets: command packet and data packet.
- Command packets consist of ASCII strings of < 64 bytes.
- Standard commands start with a lower case letter.
- OEM commands should start with an upper case letter.
- Commands are always sent from host to phone device.
- Commands are sent without ending \0 \r \n. For example, reboot command is 6 bytes long.
For each command packet sent to the device, the device will send back a REPLY packet to the host. The maximum length of a reply packet is 64 bytes. A reply packet consists of ASCII characters. There are 4 types of reply packets, as listed below
- OKAYok_message
- FAILfail_message
- INFOinfo_message
- DATA%08x
List of Commands
| Command | Description |
|---|---|
| download:%08x | Write data to memory which will be later used by "boot", "ramdisk", "flash", etc. The client will reply with "DATA%08x" if it as enough space in RAM or "FAIL" if not. The size of the download is remembered. |
| verify:%08x | Send a digital signature to verify the downloaded data. Required if the bootloader is "secure" otherwise "flash" and "boot" will be ignored. |
| flash:partition_name | Write the previously downloaded image to the named partition (if possible). |
| erase:partition_name | Erase the indicated partition (clear to 0xFFs) |
| boot | The previously downloaded data is a boot.img and should be booted according to the normal procedure for a boot.img |
| continue | Continue booting as normal (if possible) |
| reboot | Reboot the device. |
| reboot-bootloader | Reboot back into the bootloader. Useful for upgrade processes that require upgrading the bootloader and then upgrading other partitions using the new bootloader. |
| powerdown | Power off the device. |
| getvar:variable_name | Read a bootloader system variable from the device, see table below for the list of variable names |
List of Variable Names
| Name | Description |
|---|---|
| version | Version of FastBoot protocol supported. |
| version-bootloader | Version string for the Bootloader. |
| version-baseband | Version string of the Baseband Software |
| product | Name of the product |
| serialno | Product serial number |
| secure | If the value is "yes", this is a secure bootloader requiring a signature before it will install or boot images. |
| OEM variables |
Data Packet
A data packet can be any binary data. It can be sent to or received from the phone device. The maximum packet length can be 64 bytes for full speed USB or 512 bytes for high speed USB. Zero length packets are ignored. Shorter packets (< max. packet length) are always acceptable.
When the specified number of bytes(set in the download command) have been sent to the phone device, the phone device will send back a reply packet of OKAY, FAIL or INFO.
If data are being transferred from the phone device to the host, an OKAY, FAIL, INFO packet will follow the last data packet.
Illustration of Uploading a Partition Image
*** END ***