[Upgrading, Modifying and Unlocking] soyoeml:
use logcat -b radio to get some useful logs

use logcat -b radio to get some useful logs. The logs is below. You can see the funtion call sequence. Now the focus is on function ipc_debug_send_ipc. Currently I don't know where it send to. If the destination is a modem or a chip. That would be very hard to crack or read chip rom or memory. I will continue to research.

D/RILJ ( 285): [0073]> OEM_HOOK_RAW[04020004]
D/RILC ( 3309): [0073]> OEM_HOOK_RAW (raw_size=4)
W/RILSWITCH( 3309): RIL REQUEST: OEM_HOOK_RAW received. Switch state is Vendor
D/RILSWITCH( 3309): Routing to vendor RIL: RIL_REQUEST_OEM_HOOK_RAW - VVM Fix
W/RILSWITCH( 3309): RIL REQUEST: OEM_HOOK_RAW --> FORCED TO VENDOR RIL
E/RIL ( 3309): onRequest: OEM_HOOK_RAW
E/RIL ( 3309): CreateRequest(): req(0x1b548), id(59), tok(0x1b530) - FUNC(0x
8011e8e9)
E/RIL ( 3309): [EVT]:Req(1), RX(0)
E/RIL ( 3309): requestOEMHookRaw
E/RIL ( 3309): requestPersonalization
E/RIL ( 3309): sub_func_id is <2>
E/RIL ( 3309): <requestPersoStatus>
E/RIL ( 3309): TxSEC_GetPhoneLock()
E/RIL ( 3309): get_msg_sequence()
E/RIL ( 3309): ipc_debug_send_ipc: timestamp 1322228661596210
E/RIL ( 3309): TX: Time: 3673701724 / 29841235
E/RIL ( 3309): TX: (M)IPC_SEC_CMD (S)IPC_SEC_PHONE_LOCK (T)IPC_CMD_GET le
n:8 mseq:37 aseq:0
E/RIL ( 3309): TX: ---- DATA BEGIN ----
E/RIL ( 3309): TX: 05
E/RIL ( 3309): TX: ---- DATA END ----
E/RIL ( 3309): WaitForExpectedCmd(): cur_time: 29841235, cur_req->timeout: 2
9901235, ph->near_timeout: 29901235
E/RIL ( 3309): processLine():
E/RIL ( 3309): processLine: got a single frame.
E/RIL ( 3309): ipc_debug_send_ipc: timestamp 1322228661597858
E/RIL ( 3309): [EVT]:Req(1), RX(1)
E/RIL ( 3309): RX: Time: 3673701725 / 29841237
E/RIL ( 3309): RX: (M)IPC_SEC_CMD (S)IPC_SEC_PHONE_LOCK (T)IPC_CMD_RESP l
en:9 mseq:0 aseq:37
E/RIL ( 3309): RX: ---- DATA BEGIN ----
E/RIL ( 3309): RX: 05 01
E/RIL ( 3309): RX: ---- DATA END ----
E/RIL ( 3309): requestOEMHookRaw
E/RIL ( 3309): requestPersonalization
E/RIL ( 3309): sub_func_id is <2>
E/RIL ( 3309): <requestPersoStatus>
E/RIL ( 3309): RxSEC_ResPhoneLock
E/RIL ( 3309): TxSEC_GetPhoneLock()
E/RIL ( 3309): get_msg_sequence()
E/RIL ( 3309): ipc_debug_send_ipc: timestamp 1322228661598011
E/RIL ( 3309): TX: Time: 3673701726 / 29841237
E/RIL ( 3309): TX: (M)IPC_SEC_CMD (S)IPC_SEC_PHONE_LOCK (T)IPC_CMD_GET le
n:8 mseq:38 aseq:0
E/RIL ( 3309): TX: ---- DATA BEGIN ----
E/RIL ( 3309): TX: 06
E/RIL ( 3309): TX: ---- DATA END ----
E/RIL ( 3309): WaitForExpectedCmd(): cur_time: 29841237, cur_req->timeout: 2
9846237, ph->near_timeout: 29846237
E/RIL ( 3309): processLine():
E/RIL ( 3309): processLine: got a single frame.
E/RIL ( 3309): ipc_debug_send_ipc: timestamp 1322228661604938
E/RIL ( 3309): [EVT]:Req(1), RX(1)
E/RIL ( 3309): RX: Time: 3673701733 / 29841244
E/RIL ( 3309): RX: (M)IPC_SEC_CMD (S)IPC_SEC_PHONE_LOCK (T)IPC_CMD_RESP l
en:9 mseq:0 aseq:38
E/RIL ( 3309): RX: ---- DATA BEGIN ----
E/RIL ( 3309): RX: 06 00
E/RIL ( 3309): RX: ---- DATA END ----
E/RIL ( 3309): requestOEMHookRaw
E/RIL ( 3309): requestPersonalization
E/RIL ( 3309): sub_func_id is <2>
E/RIL ( 3309): <requestPersoStatus>
E/RIL ( 3309): RxSEC_ResPhoneLock
E/RIL ( 3309): TxSEC_GetPhoneLock()
E/RIL ( 3309): get_msg_sequence()
E/RIL ( 3309): ipc_debug_send_ipc: timestamp 1322228661605274
E/RIL ( 3309): TX: Time: 3673701733 / 29841244
E/RIL ( 3309): TX: (M)IPC_SEC_CMD (S)IPC_SEC_PHONE_LOCK (T)IPC_CMD_GET le
n:8 mseq:39 aseq:0
E/RIL ( 3309): TX: ---- DATA BEGIN ----
E/RIL ( 3309): TX: 07
E/RIL ( 3309): TX: ---- DATA END ----
E/RIL ( 3309): WaitForExpectedCmd(): cur_time: 29841244, cur_req->timeout: 2
9901244, ph->near_timeout: 29846237
E/RIL ( 3309): processLine():
E/RIL ( 3309): processLine: got a single frame.
E/RIL ( 3309): ipc_debug_send_ipc: timestamp 1322228661607105
E/RIL ( 3309): [EVT]:Req(1), RX(1)
E/RIL ( 3309): RX: Time: 3673701735 / 29841246
E/RIL ( 3309): RX: (M)IPC_SEC_CMD (S)IPC_SEC_PHONE_LOCK (T)IPC_CMD_RESP l
en:9 mseq:0 aseq:39
E/RIL ( 3309): RX: ---- DATA BEGIN ----
E/RIL ( 3309): RX: 07 00
E/RIL ( 3309): RX: ---- DATA END ----
E/RIL ( 3309): requestOEMHookRaw
E/RIL ( 3309): requestPersonalization
E/RIL ( 3309): sub_func_id is <2>
E/RIL ( 3309): <requestPersoStatus>
E/RIL ( 3309): RxSEC_ResPhoneLock
E/RIL ( 3309): TxSEC_GetPhoneLock()
E/RIL ( 3309): get_msg_sequence()
E/RIL ( 3309): ipc_debug_send_ipc: timestamp 1322228661607349
E/RIL ( 3309): TX: Time: 3673701735 / 29841246
E/RIL ( 3309): TX: (M)IPC_SEC_CMD (S)IPC_SEC_PHONE_LOCK (T)IPC_CMD_GET le
n:8 mseq:3a aseq:0
E/RIL ( 3309): TX: ---- DATA BEGIN ----
E/RIL ( 3309): TX: 08
E/RIL ( 3309): TX: ---- DATA END ----
E/RIL ( 3309): WaitForExpectedCmd(): cur_time: 29841247, cur_req->timeout: 2
9901247, ph->near_timeout: 29901244
E/RIL ( 3309): processLine():
E/RIL ( 3309): processLine: got a single frame.
E/RIL ( 3309): ipc_debug_send_ipc: timestamp 1322228661608875
E/RIL ( 3309): [EVT]:Req(1), RX(1)
E/RIL ( 3309): RX: Time: 3673701736 / 29841248
E/RIL ( 3309): RX: (M)IPC_SEC_CMD (S)IPC_SEC_PHONE_LOCK (T)IPC_CMD_RESP l
en:9 mseq:0 aseq:3a
E/RIL ( 3309): RX: ---- DATA BEGIN ----
E/RIL ( 3309): RX: 08 00
E/RIL ( 3309): RX: ---- DATA END ----
E/RIL ( 3309): requestOEMHookRaw
E/RIL ( 3309): requestPersonalization
E/RIL ( 3309): sub_func_id is <2>
E/RIL ( 3309): <requestPersoStatus>
E/RIL ( 3309): RxSEC_ResPhoneLock
E/RIL ( 3309): perso Lock Status <1><0><0><0>
E/RIL ( 3309): RIL_onRequestComplete: tok(0x1b530)
D/RILSWITCH( 3309): RILD <-- RIL (token 0x1b530)
D/RILSWITCH( 3309): atdToken : 0x1b530, bEMCRedirected 0
D/RILC ( 3309): [0073]< OEM_HOOK_RAW
E/RIL ( 3309): [RM REQ]: req(0x1b548), tok(0x1b530)
E/RIL ( 3309): [EVT]:Req(0), RX(0)
E/RIL ( 3309): [EVT]:Req(0), RX(0)
D/RILJ ( 285): [0073]< OEM_HOOK_RAW [B@40688f90
D/RILJ ( 285): response processed : mRequestMessagesPending = 0, mRequestMes
sagesWaiting = 0
D/RILJ ( 285): wakelock released : mRequestMessagesPending = 0, mRequestMess
agesWaiting = 0