[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] foobar66:
Sometimes you get into this mode of ramdomly trying things ... without really understanding ...

Just for info then:

> binwalk abl.img
0 0x0 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
4488 0x1188 Certificate in DER format (x509 v3), header length: 4, sequence length: 1279
5771 0x168B Certificate in DER format (x509 v3), header length: 4, sequence length: 1133
6908 0x1AFC Certificate in DER format (x509 v3), header length: 4, sequence length: 1149
12408 0x3078 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 487624 bytes

Extract the files:

> binwalk -e abl.img
> cd _abl.img.extracted
> readelf 0.elf
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x9fa00000
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 3
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0
There are no sections in this file.
There are no sections to group in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
NULL 0x000000 0x00000000 0x00000000 0x00094 0x00000 0
NULL 0x001000 0x9fa30000 0x9fa30000 0x01988 0x02000 0x1000
LOAD 0x003000 0x9fa00000 0x9fa00000 0x30000 0x30000 RWE 0x1000
There is no dynamic section in this file.
There are no relocations in this file.
Dynamic symbol information is not available for displaying symbols.
No version information found in this file.
> mv 3078.7z 3078.lzma
> lzma -d 3078.lzma

Now ... just edit this last file with emacs and search for "oem"; you can see the various "fastboot oem" and "fastboot getvar" commands:

> emacs 3078
> fastboot oem device-info
> fastboot oem enable-charger-screen
> fastboot oem disable-charger-screen
> fastboot oem off-mode-charge
> fastboot oem select-display-panel
> fastboot oem device-info
> fastboot oem lock
> fastboot oem unlock
> fastboot oem get_unlock_code
> fastboot getvar product
> fastboot getvar serialno
> fastboot getvar secure
> fastboot getvar variant
> fastboot getvar logical-block-size
> fastboot getvar erase-block-size
> fastboot getvar version-bootloader
> fastboot getvar version-baseband
> fastboot getvar battery-voltage
> fastboot getvar battery-soc-ok
> fastboot getvar charger-screen-enabled
> fastboot getvar hw-revision
> fastboot getvar current-slot

Probably there are a few more.

What is also worth trying is to dump all the strings in that file ... there's over 2000 lines ... some interesting stuff in there, but I won't dump 2000+ lines here.

> strings 3078
Many strings will be printed ... amongst others: ...

The boot loader is unlocked and software integrity cannot be guaranteed. Any data stored on the device may be available to attackers. Do not store any sensitive data on the device.
Visit this link on another device:
g.co/ABH
PRESS POWER KEY TO PAUSE BOOT
Your device is corrupt. It can't be trusted and will not boot
Visit this link on another device:
g.co/ABH
Your device is corrupt. It can't be trusted and may not work properly
Visit this link on another device:
g.co/ABH
PRESS POWER KEY TO CONTINUE

Also try:

> binwalk boot.img
0 0x0 Android bootimg, kernel size: 12928148 bytes, kernel addr: 0x8000, ramdisk size: 15881429 bytes, ramdisk addr: 0x1000000, product name: ""
4096 0x1000 gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)
12011283 0xB74713 Unix path: /dev/block/platform/soc/1d84000.ufshc/by-name/vendor
12024571 0xB77AFB Unix path: /soc/qmi-tmd-devices/modem/modem_pa
12037755 0xB7AE7B Unix path: /soc/turing_etm0/port/endpoint
12418970 0xBD7F9A Unix path: /dev/block/platform/soc/1d84000.ufshc/by-name/vendor
12432306 0xBDB3B2 Unix path: /soc/qmi-tmd-devices/modem/modem_pa
12445490 0xBDE732 Unix path: /soc/turing_etm0/port/endpoint
12829974 0xC3C516 Unix path: /dev/block/platform/soc/1d84000.ufshc/by-name/vendor
12843262 0xC3F8FE Unix path: /soc/qmi-tmd-devices/modem/modem_pa
12935168 0xC56000 gzip compressed data, from Unix, NULL date (1970-01-01 00:00:00)
15457572 0xEBDD24 MySQL ISAM index file Version 11

I have to go to family now for the Xmas dinner ... more to come ...