Fastboot failing with error: FAILED (remote: unknown command)

Question

I am trying to run the following command against a Samsung Galaxy Tab A7 SM-T505 (2020):

> fastboot flash vbmeta vbmeta.img
target reported max download size of 797411328 bytes
sending 'vbmeta' (9 KB)...
FAILED (remote: unknown command)
finished. total time: 0.016s

But as you can see, it fails with remote: unknown command.

When I check the fastboot options, I get (partial):

> fastboot --help
usage: fastboot [ <option> ] <command>

commands:
  update <filename>                        Reflash device from update.zip.
                                           Sets the flashed slot as active.
  flashall                                 Flash boot, system, vendor, and --
                                           if found -- recovery. If the device
                                           supports slots, the slot that has
                                           been flashed to is set as active.
                                           Secondary images may be flashed to
                                           an inactive slot.
  flash <partition> [ <filename> ]         Write a file to a flash partition.
  flashing lock                            Locks the device. Prevents flashing.
  flashing unlock                          Unlocks the device. Allows flashing
                                           any partition except
                                           bootloader-related partitions.
  flashing lock_critical                   Prevents flashing bootloader-related
                                           partitions.
  flashing unlock_critical                 Enables flashing bootloader-related
                                           partitions.
  flashing get_unlock_ability              Queries bootloader to see if the
                                           device is unlocked.
  flashing get_unlock_bootloader_nonce     Queries the bootloader to get the
                                           unlock nonce.

confirming the particular command I am using is supported:

flash <partition> [ <filename> ]         Write a file to a flash partition.

I believe the arguments are set correctly and the vbmeta.img file exists in the directory I am executing the command from, but have also ran the command fully qualified path. Always the same error.

And

> fastboot devices
R9TR11AW1N     fastboot

So the device is running fastboot.

I have found other posts on FAILED (remote: unknown command), but so far, they have all been about oem option for fastboot, which is not in fastboot help, nor am I using this particular option.

So, what am I missing here? Why is fastboot complaining about flash option?

Background

I am trying to root a Samsung Galaxy Tab A7 SM-T505 (2020) following this guide. I get through all the steps 1-6 without issue, but am stuck on step 7 and unable to get into recovery menu to factory reset. It appears that Knox fuse is triggering and preventing recovery menu. These are my steps.

Step 1) Enable OEM Unlock

Settings > Developer Options > OEM unlocking enabled
power off tablet

Step 2) Unlock bootloader

Press volume button (up+down together) then plug in usb -> tablet will boot into Odin mode.

in Odin mode > volume up to unlock bootloader 

Tablet reboots

verify OEM unlocking is greyed out

Step3) Download firmware package from Samsung official update server

> samloader -m SM-T505 -r BTU checkupdate

T505XXU4CWA1/T505OXM4CWA1/T505XXU4CWA1/T505XXU4CWA1

> samloader -m SM-T505 -r BTU download -v T505XXU4CWA1/T505OXM4CWA1/T505XXU4CWA1/T505XXU4CWA1 -O .

Step 4) Decrypt and Extract

> samloader -m SM-T505 -r BTU decrypt -v T505XXU4CWA1/T505OXM4CWA1/T505XXU4CWA1/T505XXU4CWA1 -V 4 -i SM-T505_3_20230113142541_erh3m0ivc4_fac.zip.enc4 -o SM-T505_3_20230113142541_erh3m0ivc4_fac.zip

Step 5) Use Magisk to patch the firmware image

> adb push AP_T505XXU4CWA1_T505XXU4CWA1_MQB61232139_REV00_user_low_ship_MULTI_CERT_meta_RKEY_OS12.tar.md5 /storage/emulated/0

> adb install /path/to/magisk/Magisk-v25.2.apk

run magisk, select md5 image pushed earlier, and patch it.

> adb pull /storage/emulated/0/Download/magisk_patched-7tzTQ.tar  \path\to\firmware\imagefiles\

Step 6) Flash patched AP firmware using Odin - deselected auto-reboot

rename magisk_patched-25200-7tzTQ.tar to magisk_patched.tar 

Odin crashes at PRISM segment if not renamed:

Faulting application name: Odin3 v3.14.1.exe, version: 2019.5.1.0, time stamp: 0x5cef2bf9
Faulting module name: Odin3 v3.14.1.exe, version: 2019.5.1.0, time stamp: 0x5cef2bf9
Exception code: 0xc0000409
Fault offset: 0x001cb10a
Faulting process id: 0x2f58
Faulting application start time: 0x01d9424e6340c61a
Faulting application path: C:\Users\Me\Documents\Android_OS_Imaging\Odin\Odin3 v3.14.1\Odin3 v3.14.1.exe
Faulting module path: C:\Users\Me\Documents\Android_OS_Imaging\Odin\Odin3 v3.14.1\Odin3 v3.14.1.exe
Report Id: 5faed018-fdf7-422d-b1ba-31f45a6b53dc
Faulting package full name:
Faulting package-relative application ID:

Unplugged USB, restarted tablet (Power + Volume Down), hold Volume whilst plugging USB back into tablet (Odin mode). Start Odin again.

Select respective files and click Start

<ID:0/007> Added!!
<OSM> Enter CS for MD5..
<OSM> Check MD5.. Do not unplug the cable..
<OSM> Please wait..
<OSM> Checking MD5 finished Sucessfully..
<OSM> Leave CS..
<OSM> Enter CS for MD5..
<OSM> Check MD5.. Do not unplug the cable..
<OSM> Please wait..
<OSM> Checking MD5 finished Sucessfully..
<OSM> Leave CS..
<ID:0/007> Odin engine v(ID:3.1401)..
<ID:0/007> File analysis..
<ID:0/007> Total Binary size: 6852 M
<ID:0/007> SetupConnection..
<ID:0/007> Initialzation..
<ID:0/007> Set PIT file..
<ID:0/007> DO NOT TURN OFF TARGET!!
<ID:0/007> Get PIT for mapping..
<ID:0/007> Firmware update start..
<ID:0/007> NAND Write Start!!
<ID:0/007> SingleDownload.
<ID:0/007> abl.elf
<ID:0/007> xbl.elf
<ID:0/007> xbl_config.elf
<ID:0/007> tz.mbn
<ID:0/007> hyp.mbn
<ID:0/007> rpm.mbn
<ID:0/007> devcfg.mbn
<ID:0/007> cmnlib.mbn
<ID:0/007> cmnlib64.mbn
<ID:0/007> km4.mbn
<ID:0/007> storsec.mbn
<ID:0/007> NON-HLOS.bin
<ID:0/007> dspso.bin
<ID:0/007> qupv3fw.elf
<ID:0/007> apdp.mbn
<ID:0/007> uefi_sec.mbn
<ID:0/007> msadp.mbn
<ID:0/007> sec.elf
<ID:0/007> bksecapp.mbn
<ID:0/007> icccgrd.mbn
<ID:0/007> vbmeta.img
<ID:0/007> blgrd.mbn
<ID:0/007> grd_fw.img
<ID:0/007> vaultkeeper.mbn
<ID:0/007> recovery.img
<ID:0/007> dtbo.img
<ID:0/007> super.img
<ID:0/007> userdata.img
<ID:0/007> metadata.img
<ID:0/007> vbmeta.img
<ID:0/007> vbmeta_samsung.img
<ID:0/007> boot.img
<ID:0/007> cache.img
<ID:0/007> omr.img
<ID:0/007> prism.img
<ID:0/007> optics.img
<ID:0/007> RQT_CLOSE !!
<ID:0/007> RES OK !!
<ID:0/007> Remain Port .... 0
<OSM> All threads completed. (succeed 1 / failed 0)

Step 7) Fails - Holding Power + Volume Down for ~7 seconds then when tablet screen turns off Power + Volume Up.

I have not found a way around Knox yet. Any guidance on how to get around or another rooting method altogether would be appreciated.

I am able to get all the way through using original AP file: AP_T505XXU4CWA1_T505XXU4CWA1_MQB61232139_REV00_user_low_ship_MULTI_CERT_meta_RKEY_OS12.tar.md5

instead of magisk_patched.tar - all the way to factory reset, reboot, settings developer options enabled.

Answer 1

After some effort and community assisstance, I finally got root access, which is/was the ultimate goal of the question.

Following this guide, and a little patience, I was able to get through. This guide is very good, but does not mention a rather significant point in my process, or does not give enough detail, which is the display after reboot of the Samsung warning screen, which displays for ~3-5 minutes. It pauses longer after the first reboot than subsequent boots. While it's mentioned that the first boot is long, it does not mention the warning screen. If you wait out this screen and not attempt to access recovery menu (which the guide states as a step), then you should get through.