[Huawei P20 Pro Guides, News, & Discussion] xsacha:
HOW TO FLASH IN EMUI10 VIA SOFTWARE TESTPOINT

1. Enter USB Update Mode

On older EMUI versions you would use vol up + vol down + power. This has changed now.

On EMUI 10, enter eRecovery by holding volume up and power until you see the Huawei logo appear. Then let go and press volume up again and wait for eRecovery screen. Then press USB Update and it should show an update screen at 5% complete.

2. Enable Software Testpoint

Using the update.app of the same firmware that you are currently on, turn factory mode on via whichever app you happen to be using. Personally I am using Octoplus Huawei Tool (paid), but you could also use Chimera (paid), Sigmakey (paid) and many others. There are free methods too by manual flashing in Linux but it is too involved to discuss here.

Output from Octoplus looks like:

Starting ON/OFF Factory Mode
Selected phone model: CLT-L29
To Enable Factory mode put the phone in Upgrade mode and connect USB cable!
To Disable Factory mode connect the phone in Factory mode or Factory Fastboot mode!
Checking the existence of the auto firmware file...
Selected firmware file file: C:/Users/srefs/Documents/HiSuite/ROM/Charlotte-L29C10.0.0.171_Firmware_EMUI10.0.0_05015AMH/Software/dload/UPDATE_BASE.APP
Performing ON Factory Mode operation...
Checking firmware package type
Searching device in Upgrade mode...
Connecting to phone..
Phone connect successfully!
Writing firmware partitions...
Writing ‪SHA256RSA‬ partition...
Writing ‪CRC‬ partition...
Writing ‪BASE_VERLIST‬ partition...
Writing ‪BASE_VER‬ partition...
Writing ‪PACKAGE_TYPE‬ partition...
Writing ‪HISIUFS_GPT‬ partition...
Writing ‪XLOADER‬ partition...

ON/OFF Factory Mode done.
Performed by ‪1.2.3‬ Software version.

You should now see this in Device Manager on Windows, which means you successfully entered testpoint mode without disassembling your hardware. You can now literally do anything to your hardware.

View attachment 5172299

3. Write factory fastboot.

If you are using Octoplus, you just go to the Update backup tab, make sure 'Update OEMInfo' is NOT ticked and click Update. As soon as you see fastboot is flashed, you can cancel. For free method, see: Downgrade/Unbrick Huawei device (if other methods doesn't work) | XDA Developers Forums (xda-developers.com)

4. Flash whatever you want

Now you can flash whatever the heck you want over EMUI 10, such as a kernel. You will also need to disable verified boot so you can load unsigned images without getting the dreaded "your device has failed verification". Have fun!

PS C:\adb> .\fastboot flash kernel .\KERNEL.img
target reported max download size of 471859200 bytes
sending 'kernel' (24576 KB)...
OKAY [ 0.183s]
writing 'kernel'...
OKAY [ 0.275s]
finished. total time: 0.462s
PS C:\adb> .\fastboot flash kernel .\image-new.img
target reported max download size of 471859200 bytes
sending 'kernel' (20664 KB)...
OKAY [ 0.155s]
writing 'kernel'...
OKAY [ 0.081s]
finished. total time: 0.241s
PS C:\adb> .\fastboot oem get-build-number
...
(bootloader) :CLT-L29 10.0.0.171(C432E3R1P3)
OKAY [ 0.008s]
finished. total time: 0.011s
PS C:\adb> .\fastboot oem get-lockstate
...
(bootloader) locked
OKAY [ 0.004s]
finished. total time: 0.005s

5. Turn off Software Testpoint

Turn factory mode off in same software you used in step 2.

Performing OFF Factory Mode operation...
Searching Fastboot devices...
Found a fastboot device:

Device Model: ‪CLT-L29‬
System: ‪CLT-L29 10.0.0.171(C432E3R1P3)‬
...
Writing secure data...
Rebooting device...

ON/OFF Factory Mode done.
Performed by ‪1.2.3‬ Software version.

Now either you did the right thing by this stage and it boots up nicely... or you screwed up something and it doesn't boot up. As long as you can get to eRecovery again, you can let Huawei automatically recover. Note: If recovery fails the first time complaining about 'authorization', just run recover again and it will work.