Reading a Qualcomm EDL handshake, step by step

Emergency Download Mode (EDL) is built into the Qualcomm boot ROM itself, below the bootloader and below Android entirely. It exists so a device can still be recovered when nothing else on it will run — which is exactly why it's the first place UnlockLab looks when a device connects in a state ADB and Fastboot can't reach.

The handshake happens in two stages. First, the device speaks Sahara: a small, fixed protocol whose only job is to identify the chip and receive a signed "programmer" image — a piece of code Qualcomm's boot ROM will only execute if it's signed correctly for that specific chip. UnlockLab reads the device's identifiers during this stage and matches them against known chipset signatures before anything else happens.

Once the programmer loads and the boot ROM hands off execution to it, the device switches to Firehose — a command-response protocol for reading (and, if you choose to, writing) flash storage directly. This is where partition tables actually become readable. UnlockLab's chipset detection reports the moment this handoff completes, and everything in the partition and firmware views comes from Firehose commands issued after that point.

Why the signed-programmer requirement matters: it's the actual security boundary. A device with a locked bootloader can still be read in EDL, but only through a programmer the chip's boot ROM trusts — which is precisely why EDL access alone doesn't imply unrestricted device access. UnlockLab's diagnostic layer works within that boundary; it reports what the device will disclose through a trusted programmer, nothing more.