firmwares support booting to Emergency Download (EDL) mode in Android Bootloader aboot
Since FastBoot protocol is simple and text-based, it is enough to send a packet containing "reboot-edl" text over USB. The simplest way to do that is to patch Windows fastboot.exe file, replacing "reboot-bootloader" text with "reboot-edl". As "reboot-bootloader" string is found in the command line, fastboot.exe sends the same constant string to the device. So if "reboot-bootloader" is replaced with "reboot-edl", you can specify "reboot-edl" in the command line and the same text will be sent to the device. I occasionally locked bootloader in my officially unlocked/rooted Xiaomi Redmi Note 3 Pro (Snapdragon) so it could only boot to FastBoot or Diagnostic 900E modes. Tried to swich from 900E to 9008 with QPST but it reported unspecified error. Analyzing aboot (emmc_appsboot.mbn) found that it supports "reboot-edl" so the only thing remaining was to find a way to send it. With patched fastboot.exe, successfully rebooted to EDL mode
Download
Since FastBoot protocol is simple and text-based, it is enough to send a packet containing "reboot-edl" text over USB. The simplest way to do that is to patch Windows fastboot.exe file, replacing "reboot-bootloader" text with "reboot-edl". As "reboot-bootloader" string is found in the command line, fastboot.exe sends the same constant string to the device. So if "reboot-bootloader" is replaced with "reboot-edl", you can specify "reboot-edl" in the command line and the same text will be sent to the device. I occasionally locked bootloader in my officially unlocked/rooted Xiaomi Redmi Note 3 Pro (Snapdragon) so it could only boot to FastBoot or Diagnostic 900E modes. Tried to swich from 900E to 9008 with QPST but it reported unspecified error. Analyzing aboot (emmc_appsboot.mbn) found that it supports "reboot-edl" so the only thing remaining was to find a way to send it. With patched fastboot.exe, successfully rebooted to EDL mode
Download