the oem command does not work on this phone. i did find at https://www.xda-developers.com/how-to-discover-hidden-fastboot-commands/ that oem commands are likely sent as strings straight to the device, and can usually be enumerated by grepping for strings in the boot loader. the device has a vbmeta partition, i guess all devices with verified boot enabled likely do. i'm a little surprised the boot thing from russia didn't work. i could ask more at their forum, or ask the dev with the similar device; i think i'd like to learn a little more about it first. i'm a little curious about profiling the bootloader to see what it might be. i could also try to reverse engineer the factory flasher a little, and see if there are some useful codes or identifying information. when I connect the phone to the system, it behaves similar to the mediatek phone, offering a brief serial interface and relating commands via it. it actually responds to my 'backyard mediatek flasher''s handshake, with the same 'READY' exchange protocol. The output of test.py is this: Device preloader version: 0x3 hw_code=0x699 unk1=0x0 hw_subcode=0x8a00 hw_version=0xcb00 unk2=0x2 unk3=0x0 These are very similar values to the mediatek situation. It implies that the two are speaking the same protocol, whatever protocol it is. The chipsets are both based on arm.