Diags

Diags is a diagnostic image that is installed on devices, and is used for testing in factories. It is commonly located in /AppleInternal/Diags/bin/diag.img4 for 64 bit devices, or /AppleInternal/Diags/bin/diag.img3 for 32 bit devices.

A iPhone 8 running diags

Commands

DiagShell builtin commands:
 "time"		time <command-line ...>
 "echo"		echo <arguments ...>
 "waitfor"	waitfor <timeout-milliseconds> <string-to-match>
 "lua"		lua [options] [script [args]]
 "repeat"	repeat <time-spec> <command line ...>
 "alias"	alias [<name>[=<command line>]]
 "unalias"	unalias <name>
 "true"		true
 "false"	false
 "args"		args <command line ...>

EDK Boot Loader commands (help <command> for more info):
 "aboutCB"	display conrolbit information on the screen
 "aboutdev"	display device information on the screen
 "accessory"	Command to change power settings as well as identifying accessories connected to the unit
 "aes"		Command for AES encryption/decryption
 "als"		ALS Tests and Calibration
 "amux"		Analog Mux selection command
 "aspversion"	ASP Protocol Version - current and expected
 "audio"	General command to hande resetting/blanking/scripting of the audio subsystem
 "audioparam"	Audio parameter retrieval/setting utility
 "audioreg"	Manages register operations on audio blocks in the system
 "barcode"	Show S/N and ECID barcode
 "baseband"	Command to control/test baseband functionality
 "battery"	Command to display basic information about the battery
 "baud"		<baud rate> : Set UART Baud rate
 "bl"		BackLight Test
 "blockdevice"	Show information about boot devices
 "bluetooth"	Command to control/test bluetooth functionality
 "boardid"	Get the board ID
 "boardrev"	Get the board revision
 "bonfire"	Run Bonfire
 "bootcfg"	Get the boot configuration
 "buckcheck"	Buck voltage check
 "button"	Test individual buttons on the unit
 "buttoncnt"	[--dqe] Count button presses on the unit
 "camisp"	camera command that can run in seperat steps.
 "cat"		Print the contents of a file.
 "cbcolor"	iPX Control Bit - Set screen color based on number of passed stations
 "cbdump"	iPX Control Bit - Dump the CB area from the NAND
 "cberase"	iPX Control Bit - Erase a control bit
 "cbinit"	iPX Control Bit - Initialize control bit area
 "cbread"	iPX Control Bit Read
 "cbreadall"	iPX Control Bit - read all
 "cbwrite"	iPX Control Bit Write
 "charge"	set charge for system
 "chipid"	 :Show ChipID
 "clcd"		[--id (--iqc)]
 "clkmon"	[signal/off]; Set Clock Test out pin to specified signal or switch it off
 "consoleformat"	Command to control the formatting of text display on serial output mediums like the console
 "consolerouter"	Main command that deals with all things console in the system
 "daisy"	return X162 daisy chain  GPIO state
 "debug"	Turns on/off global debug levels in the system
 "device"	Interfaces with a devices of the system.
 "dfufile"	Use dfu protocol to transfer file.
 "directory"	 dirdev [*match]; directory listing of dirdev. opt match a substring
 "DisCfg#"	Display CFG systemcfg
 "DisOpts"	Display OPTS systemcfg
 "display"	Command to control display
 "displayid"	Get the display ID
 "displaytext"	Display text on the unit's screen
 "dumpmemmap"	Dumps memory map
 "dwi"		backlight test using DWI
 "filelog"	Log formatted console output to a file
 "getnonce"	iPX Control Bit - generate a salt value for control-bit write authentication
 "getvol"	Gets volume information/values from the various audio blocks
 "hash"		compute Hash
 "help"		[cmd]; Help on cmd or a list of all commands if cmd is ommited
 "i2c"		generic read/write to I2C device
 "key"		Read buttons' status from AP side and PMU side
 "legal"	Outputs the copyright for any libraries used by Diags.
 "loopaudio"	Plays/Record full-duplex audio out/in through selected 'playable' and 'recordable' ports on an audio block
 "mbt"		Menu Button Test
 "memcat"	Read memory into file or a file into memory
 "memrw"	Read/write/or/and from memory
 "menu"		: Navigate menu items in Display
 "meta"		[cmd]; Execute cmd as if it was entered at the shell (useful for scripting)
 "mikey"	 Mikey Tests
 "mipi"		Command to interact with mipi
 "mipitest"	[--ecc (--iqc)]
 "mkdir"	mkdir directory_name ...
 "nandcsid"	 Read Nand Chip ID and detect ID mismatch
 "nandppnfwver"	 Prints the PPN Firmware version for all populated CE's
 "nandsize"	 Nand testing
 "nanduid"	 Read Unique ID from each Nand die
 "network"	Command to control network interfac
 "nvram"	Print or modify NVRAM variables
 "oscar"	General command that manages the Oscar chipset
 "pattern"	[--iqc [#]|--dqe [#]|--fatp [#]|--other [#]|--fill [rgb #] [n]:Test LCD display pattern[n]
 "pcie"		qucik pcie test
 "physaddr"	Decodes a physical address into bank/column/row/etc
 "playaudio"	Plays audio out through a selected 'playable' port
 "pmuadc"	PMU ADC Command for Calibration/Reading/Listing Channels
 "pmubutton"	pmu button test
 "pmuevent"	[all|chipid|btn|vbus|chgr|gpio|misc|temp|fault|ouv|clear] 
 "pmugpio"	Set a PMU GPIO to a certain state
 "pmureg"	Print the values of all the pmu registers
 "pmurw"	generic read/write to PMU Registers
 "pmuset"	set the buck and ldo voltages value
 "pmustat"	[all|chipid|btn|vbus|chgr|gpio|misc|temp|fault] 
 "pmutemp"	PMU TEMP test
 "processaudio"	Post-processes audio data using various audio filters registered in the system
 "profile"	Turns profiling on/off, dumps data, and resets profiling data.
 "qrbarcode"	Command for showing the QRbarcode
 "quit"		Quit EBL
 "ramdisk"	Mount/Eject a RAM disk from a dmg file downloaded through USB/DFU.
 "ramlog"	Command to manage the ramlog console sink which can be used for logging text to RAM for timing sensitive issues
 "recordaudio"	Records audio in through a selected 'recordable' port
 "reset"	Resets the system
 "routeaudio"	Sets up audio routing.
 "rtc"		Set or get the RTC from PMU
 "script"	[filename]; Execute the commands in the specified file
 "sensor"	General command that interfaces with the various sensors in the system
 "sensorreg"	General command that allows for reading/writing sensor chipset registers
 "setvol"	Sets volume levels within the various audio blocks
 "sha"		compute sha1
 "siostart"	Starts SIO block 
 "sleep"	Set system to specified sleep state
 "smokey"	EFI diag scripting sequencer
 "smokeyshell"	EFI diag scripting sequencer debug shell
 "sn"		Read/Write serial number
 "soc"		Command for displaying SoC info
 "socgpio"	Set a GPIO to a certain state
 "spi"		Test Spi buses
 "spkid"	Return 1 bit Speaker ID
 "stockholm"	Command to control/test stockholm functionality
 "strobe"	Command to control the Strobe on the System
 "syscfg"	[init | add | print | list | type | delete] <KEY> <value1> <value2> ...; System Config
 "sysinfo"	Dumps system information
 "system"	Command to display basic information about the unit
 "tag"		Turns tagging of data on/off.
 "temperature"	Dump Readings from various Temperature Sensors in the System
 "testCDMADDR"	CDMA DDR test
 "testmemory"	Run data and address patterns to exercise DRAM subsystem
 "touch"	Command for the Touch subsystem
 "tristar"	TriStar test commands
 "uartloopback"	Perform a loopback test on the specified uart. Note that you will have to put the chip into loopback mode using separate commands.
 "uartpassthrough"	pass through uart traffic from dock uart to select uart
 "uartrx"	Receive and store message from uart <uart #>. It will send the message back to uart <uart #> when a <ExitString> is detected.
 "uarttx"	send message to the selected uart
 "usbfs"	Enables/Disables UsbFS (Filesystem-over-USB)
 "usbp"		Test USB Present
 "vbat"		Get the battery voltage from the PMU ADC channel
 "version"	Diag Version
 "vibrator"	Vibrator Test
 "wait"		[ms]; Wait ms milliseconds
 "wakeevent"	Select wake event for wakeup for PMU STANDBY or Hibernate mode
 "wifi"		Command to control/test wifi functionality
 "writefile"	Overwrite the contents of an existing file with console input
 "zerofile"	Zero the contents of an existing file