[Pixel C Android Development] funguy2:
Hi!

Thanks for your feedback and encouraging words :cry:

have now tried it on a linux machine with ubuntu, usb2 and a fastboot version from 2016 (version flag was not yet available in this version).

root@myPC:# lsusb

..

Bus 003 Device 059: ID 046d:c534 Logitech, Inc. Unifying Receiver

Bus 003 Device 058: ID 0bda:5412 Realtek Semiconductor Corp. 4-Port USB 2.0 Hub

Bus 003 Device 057: ID 18d1:5201 Google Inc.

Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

.. but with the same errors as in my previous post:

root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot erase boot
******** Did you mean to fastboot format this ext4 partition?
Erasing 'boot' FAILED (remote: 'unsupported command')
fastboot: error: Command failed

root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot erase recovery
******** Did you mean to fastboot format this ext4 partition?
Erasing 'recovery' FAILED (remote: 'unsupported command')
fastboot: error: Command failed

root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot reboot bootloader
Rebooting into bootloader OKAY [ 0.001s]
Finished. Total time: 0.052s
root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot erase system
******** Did you mean to fastboot format this ext4 partition?
Erasing 'system' FAILED (remote: 'unsupported command')
fastboot: error: Command failed

root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot erase vendor
******** Did you mean to fastboot format this ext4 partition?
Erasing 'vendor' FAILED (remote: 'unsupported command')
fastboot: error: Command failed

root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot flash recovery recovery.img
Sending 'recovery' (13200 KB) OKAY [ 0.356s]
Writing 'recovery' FAILED (remote: 'unsupported command')
fastboot: error: Command failed

root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot flash system system.img
Sending sparse 'system' 1/9 (261398 KB) OKAY [ 7.931s]
Writing 'system' FAILED (remote: 'unsupported command')
fastboot: error: Command failed

root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot flash vendor vendor.img
Sending 'vendor' (130771 KB) OKAY [ 3.543s]
Writing 'vendor' FAILED (remote: 'unsupported command')
fastboot: error: Command failed

root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot flash boot boot.img
Sending 'boot' (9068 KB) OKAY [ 0.242s]
Writing 'boot' FAILED (remote: 'unsupported command')
fastboot: error: Command failed
root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005#

#
root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot -w
Erasing 'userdata' FAILED (remote: 'unsupported command')
fastboot: error: Command failed
root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005#

#
root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# /../Xperia_Z2-Tablet/old_try/FlashTool/x10flasher_lib/fastboot.linux.64 -w
erasing 'userdata'...
FAILED (remote: unsupported command)
finished. total time: 0.001s
root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005#

#
root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# fastboot boot recovery.img
creating boot image...
creating boot image - 13518848 bytes
Sending 'boot.img' (13202 KB) OKAY [ 0.351s]
Booting FAILED (remote: 'image verification failed')
fastboot: error: Command failed
root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005#

root@myPC:/../PixelC/ryu-opm8.190605.005/image-ryu-opm8.190605.005# /../old_try/FlashTool/x10flasher_lib/fastboot.linux.64 boot recovery.img
creating boot image...
creating boot image - 13518848 bytes
downloading 'boot.img'...
OKAY [ 0.343s]
booting...
FAILED (remote: image verification failed)
finished. total time: 0.346s
root@myPC:#

My guess is that my problem is the following implementation:

# nvstorage: Add new flag VBNV_DEV_BOOT_FASTBOOT_FULL_CAP (https://chromium.googlesource.com/c...ot/+/9101df2fe3ed4f0e8b65121ffc1c7e8b2d65b35d)

Add a new flag to nvstorage for controlling fastboot capabilities offered in firmware in dev-mode. By default, value of this flag would be ignored in normal mode. Thus, when fastboot-based recovery is

entered from normal mode, only limited capability would be available in firmware.

After switching to dev-mode, this flag can be set automatically by user script after performing the wipe or it can be set manually using crossystem. When fastboot-based recovery is entered from dev mode and

this flag is set, it will provide full fastboot capability in the firmware.

thus in the "limited fastboot functionality" almost only read functions are available, see https://chromium.googlesource.com/c...e-smaug-7900.B/src/fastboot/capabilities.c#39

And are therefore rejected by fastboot due to the missing flag (VBNV_DEV_BOOT_FASTBOOT_FULL_CAP):

Error "unsupported command"

# fastboot.c, https://chromium.googlesource.com/c...are-smaug-7900.B/src/fastboot/fastboot.c#1429

/* Check if this function is allowed to be executed */
if (fb_cap_func_allowed(fb_func_table[i].id) == FB_CAP_FUNC_NOT_ALLOWED) {
FB_LOG("Unsupported command\n");
fb_add_string(out_buff, "unsupported command", NULL);
cmd->type = FB_FAIL;
return FB_SUCCESS;
}

The error "image verification failed"

# fastboot.c, https://chromium.googlesource.com/c...are-smaug-7900.B/src/fastboot/fastboot.c#1083

if (VbVerifyMemoryBootImage(&cparams, &kparams, kernel, kernel_size, 0)
!= VBERROR_SUCCESS) {
if ((!fb_device_unlocked()) ||
(vbnv_read(VBNV_DEV_BOOT_FASTBOOT_FULL_CAP) == 0)) {
/*
* Fail if:
* 1. Device is locked, or
* 2. Device is unlocked, but full fastboot cap is not
* set.
*/
fb_add_string(&cmd->output, "image verification failed",
NULL);
return FB_SUCCESS;
}

and this is the reason why fastboot getvar secure shows "secure: yes"

# fastboot.c, https://chromium.googlesource.com/c...ware-smaug-7900.B/src/fastboot/fastboot.c#359

case FB_SECURE: {
if (fb_cap_func_allowed(FB_ID_FLASH) == FB_CAP_FUNC_NOT_ALLOWED)
fb_add_string(output, "yes", NULL);
else
fb_add_string(output, "no", NULL);
break;
}

Thus, in my opinion, there are only the following options for a solution:

a) Set the flag in NVRAM without ADB, possibly via USB recovery or similar - no idea how

b) the mysterious PixelC "developer switch"

.. quote from https://groups.google.com/a/chromium.org/g/chromium-os-discuss/c/VKK3WXKg7lE

"Our primary kernel dev was told by a Pixel C dev that the "developer switch" is behind the front camera flex and you would need to remove the screen to get access to it. This arose when we were trying to root the Pixel C and flashing SuperSU via TWRP caused the bootloader to relock the partitions as read-only, even though all fastboot commands were still available, we were given a tool by the pixel devs that allowed us to set a flag that would unlock the partitions once again. (link to thread)"

.. also no idea how

c) using crossystem? and set full fastboot capability in the firmware using fwtool, but how?!

d) Fusée Gelée hardware exploit?

e) Gbb-flags?

f) ?

for an idea or a tip, I would be very grateful 👍

best regards and many thanks