I'd like to know the proper process of "hacking" emmc_appsboot.mbn in order to flash already an unlocked bootloader from start. I didn't want to ask for a file from an already unlocked phone because I'm interested in the process and how it works.
What I did
I tried myself editing with a hex editor the line after
ANDROID BOOT! and changed the hex from 00 to 01 but the phone was perfectly bricked :D and I had to spend some times with the drivers (Qualcomm 9008) and learning how to put it in EDL mode with the phone not even fastbooting, afterwards I was able to "msmdownload" it again reflashing everything. I can now in fastboot and recovery.
I also tried replacing the recovery, with twrp, and actually it failed when going to recovery because of the md5 checksum.
I hex-edited both md5.img and md5sum.md5 files replacing the md5 of recovery.img with the one of twrp (renamed recovery.img of course) but still, it failed nonetheless the md5 checksum.
I suppose there is some other file where these hash's are stored and are checked during boot.
Is it safe to assume that emmc_appsboot.mbn as well is checksumed and if it fails it doesn't load at all?
What's the correct process in:
1) Editing emmc_appsboot.mbn in order to unlock the bootloader
2) Making the system actually boot and work after we edited those files (probably security checks / hash's are involved).
IMPORTANT: Please do not suggest "how to unlock the bootloader" with usb-debugging etc, the well known methods that are well known, kindly
Reference : You can download here the MSMDownloadTool with all the ROM / OP3 related files.