Welcome to Blogs @ Andrew Qu
Blog Index
All blogs
Search results

Android Fastboot Protocol


Fastboot is a protocol to flash Android devices. This post describes the main features of the protocol and implementation details.

For full details, see Fastboot protocol specifications

Basic Mechanism
  1. The phone device is connected to a host PC via USB
  2. The host directly controls all data communication.
  3. Data communication is synchronous
  4. Uses packet based communication
  5. Max. packet size is 64 bytes for full-speed USB and 512 bytes for high-speed USB
Command Packet

There are two types of data packets: command packet and data packet.

  1. Command packets consist of ASCII strings of < 64 bytes.
  2. Standard commands start with a lower case letter.
  3. OEM commands should start with an upper case letter.
  4. Commands are always sent from host to phone device.
  5. Commands are sent without ending \0 \r \n. For example, reboot command is 6 bytes long.
Reply Packet

For each command packet sent to the device, the device will send back a REPLY packet to the host. The maximum length of a reply packet is 64 bytes. A reply packet consists of ASCII characters. There are 4 types of reply packets, as listed below

  1. OKAYok_message
  2. FAILfail_message
  3. INFOinfo_message
  4. DATA%08x
%08x - The digits following DATA is the number of bytes to be transferred in hexidecimal format. It must be 8 digits. If less than 8 digits, then leading 0s must be inserted. For example, to transfer 32 bytes, the packet will be DATA00000020

List of Commands
download:%08xWrite data to memory which will be later used by "boot", "ramdisk", "flash", etc. The client will reply with "DATA%08x" if it as enough space in RAM or "FAIL" if not. The size of the download is remembered.
verify:%08xSend a digital signature to verify the downloaded data. Required if the bootloader is "secure" otherwise "flash" and "boot" will be ignored.
flash:partition_nameWrite the previously downloaded image to the named partition (if possible).
erase:partition_nameErase the indicated partition (clear to 0xFFs)
bootThe previously downloaded data is a boot.img and should be booted according to the normal procedure for a boot.img
continueContinue booting as normal (if possible)
rebootReboot the device.
reboot-bootloaderReboot back into the bootloader. Useful for upgrade processes that require upgrading the bootloader and then upgrading other partitions using the new bootloader.
powerdownPower off the device.
getvar:variable_nameRead a bootloader system variable from the device, see table below for the list of variable names

List of Variable Names
versionVersion of FastBoot protocol supported.
version-bootloaderVersion string for the Bootloader.
version-basebandVersion string of the Baseband Software
productName of the product
serialnoProduct serial number
secureIf the value is "yes", this is a secure bootloader requiring a signature before it will install or boot images.
OEM variables

Data Packet

A data packet can be any binary data. It can be sent to or received from the phone device. The maximum packet length can be 64 bytes for full speed USB or 512 bytes for high speed USB. Zero length packets are ignored. Shorter packets (< max. packet length) are always acceptable.

When the specified number of bytes(set in the download command) have been sent to the phone device, the phone device will send back a reply packet of OKAY, FAIL or INFO.

If data are being transferred from the phone device to the host, an OKAY, FAIL, INFO packet will follow the last data packet.

Illustration of Uploading a Partition Image
*** END ***
Ads from Google
Dr Li Anchor Profi
Engineering anchorage plate design system
©Andrew Qu, 2015. All rights reserved. Code snippets may be used "AS IS" without any kind of warranty. DIY tips may be followed at your own risk.