A possible solution to my other question related to this.
Having root access, what's there to prevent me from manually flashing a custom recovery from my running operating system? If my bootloader is locked, can I still do:
dd if=openrecovery-twrp-2.7.0-deb.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
If so, then I'd be able to flash a custom recovery from inside of a running Android operating system, bypassing a locked bootloader. I suppose if someone has root access to a running operating system, you're pretty much hosed anyway, but would this at least in theory work?
Can I use something similar to the above command to flash a recovery in a live, running Android device?