diff --git a/.gitignore b/.gitignore
index 0240784..0cb58e1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,5 @@ extracted_apk
 secrets
 .DS_Store
 *.pyc
-abootimg
\ No newline at end of file
+abootimg
+mkbootimg
\ No newline at end of file
diff --git a/README.md b/README.md
index 0096f64..e24ff59 100644
--- a/README.md
+++ b/README.md
@@ -49,7 +49,9 @@ In the interactive shell, type `fw` and follow the instructions.
 ### Development Roadmap
 
 Now we can enter diagnosis mode thanks to shankerzhiwu and his/her friend, we can explore more things! The things I am interested in:
-- [ ] Enabling ADB
+- [ ] Enabling ADB in normal Android mode
+- [ ] Enabling faster file transfer in diagnosis mode (so far it takes forever to push a file)
+- [ ] Allowing self-signed pkg (fw package) to flash
 - [ ] Exploring system modifications
 - [ ] Understand the supported apps
 
diff --git a/python_api/libDPT.py b/python_api/libDPT.py
index bc39548..1b162e6 100644
--- a/python_api/libDPT.py
+++ b/python_api/libDPT.py
@@ -102,7 +102,7 @@ class DPT():
         '''
         if not self.diagnosis_isfile(fp):
             return ""
-        resp = self.diagnosis_write("md5sum {}".format(fp))
+        resp = self.diagnosis_write("md5sum {}".format(fp)).splitlines()
         try:
             return resp[1].split()[0]
         except BaseException as e:
@@ -113,36 +113,37 @@ class DPT():
         '''
         check if file exists given file path
         '''
-        cmd = "[ -f {} ] && echo 'YESS' || echo 'NONO'".format(fp)
+        cmd = "[[ -f {} ]] && echo 'YESS' || echo 'NONO'".format(fp)
         return 'YESS' in self.diagnosis_write(cmd)
 
     def diagnosis_isfolder(self, folderp):
         '''
         check if file exists given file path
         '''
-        cmd = "[ -d {} ] && echo 'YESS' || echo 'NONO'".format(folderp)
+        cmd = "[[ -d {} ]] && echo 'YESS' || echo 'NONO'".format(folderp)
         return 'YESS' in self.diagnosis_write(cmd)
 
     def diagnosis_backup_boot(self):
         '''
         back up boot partition to /tmp/ folder
         '''
-        cmd = 'dd if=/dev/mmcblk0p8 of=/tmp/boot.img.bak bs=4M'
+        cmd = 'dd if=/dev/mmcblk0p8 of=/root/boot.img.bak bs=4M'
         self.diagnosis_write(cmd, timeout=999)
-        if not self.diagnosis_isfile('/tmp/boot.img.bak'):
+        if not self.diagnosis_isfile('/root/boot.img.bak'):
             self.err_print('Failed to dump boot.img.bak!')
-            return None
-        return "/tmp/boot.img.bak"
+            return ""
+        return "/root/boot.img.bak"
 
-    def diagnosis_restore_boot(self, fp="/tmp/boot.img.bak"):
+    def diagnosis_restore_boot(self, fp="/root/boot.img.bak"):
         if not self.diagnosis_isfile(fp):
-            self.dbg_print("{} does not exist".format(fp))
+            self.err_print("{} does not exist".format(fp))
             return False
         cmd = "dd if='{}' of=/dev/mmcblk0p8 bs=4M".format(fp)
         self.info_print("Fingercrossing.. Do NOT power off device!")
         # need to be extra careful here
-        self.diagnosis_write(cmd, timeout=99999)
-        return True
+        resp = self.diagnosis_write(cmd, timeout=99999)
+        self.info_print(resp)
+        return not (resp == "")
 
     def diagnosis_write(self, cmd, echo=False, timeout=99):
         '''
@@ -153,6 +154,8 @@ class DPT():
         if 'less ' in cmd:
             self.err_print('do not support less/more')
         try:
+            self.serial.flushInput()
+            self.serial.flushOutput()
             self.serial.write(cmd.encode() + b'\n')
             # change timeout to (nearly) blocking first to read
             self.serial.timeout = timeout
diff --git a/python_api/libInteractive.py b/python_api/libInteractive.py
index 2e1be99..6fb7b1c 100644
--- a/python_api/libInteractive.py
+++ b/python_api/libInteractive.py
@@ -223,11 +223,12 @@ def diagnosis_push_file(
     push file from local to device through echo in diagnosis
     (serial) mode
     using echo is dumb and slow but very reliable
-    limited to 128 bytes per sec since we send raw bytes in
-    string (each byte sent = 4 bytes), and terminal at best
+    limited to 128 bytes per cmd or below, since we send raw bytes
+    in string (each byte sent = 4 bytes), and terminal at best
     allows 1024 bytes to send
     do NOT push large file using this, it will take
     forever to finish..
+    as a reference: push a 16MB file costs you roughly 22min
     '''
     try:
         # get local file path
@@ -274,7 +275,8 @@ def diagnosis_push_file(
                             symbol,
                             remotefp
                         )
-                        dpt.diagnosis_write(cmd)
+                        if dpt.diagnosis_write(cmd) == "":
+                            raise BaseException
                     else:
                         break
                     if firstRun:
@@ -302,7 +304,7 @@ def diagnosis_backup_bootimg(dpt):
     '''
     remotefp = dpt.diagnosis_backup_boot()
     # pull this backup file to current folder
-    if remotefp is not None:
+    if remotefp:
         fp = diagnosis_pull_file(
             dpt, remotefp=remotefp, folder=".", overwrite=True
         )
@@ -318,19 +320,22 @@ def diagnosis_restore_bootimg(dpt, usetmpfp=None, bootimgfp=None):
     restore boot img
     '''
     if usetmpfp is None:
-        resp = input('> Use local boot img? [yes/no]: ')
+        resp = input('> Upload boot img? [yes/no]: ')
         usetmpfp = False if resp == 'yes' else True
     # directly use the original backup, if exists
     if usetmpfp:
-        return dpt.diagnosis_restore_boot(self, fp="/tmp/boot.img.bak")
+        dpt.info_print("Trying to use /root/boot.img.bak")
+        return dpt.diagnosis_restore_boot(fp="/root/boot.img.bak")
     # otherwise we need to first upload our own boot img
     remotefp = diagnosis_push_file(dpt, folder="/tmp", overwrite=True)
     if remotefp is not None:
-        if dpt.diagnosis_restore_boot(self, fp=remotefp):
-            dpt.info_print("Success!")
-            return True
-        dpt.err_print("Failed..")
-        return False
+        resp = input('> Confirm to continue? [yes/no]: ')
+        if resp == 'yes':
+            if dpt.diagnosis_restore_boot(fp=remotefp):
+                dpt.info_print("Success!")
+                return True
+            dpt.err_print("Failed..")
+            return False
     dpt.err_print("Nothing happened..")
     return False