[Verizon Samsung Galaxy S III] E:V:A:
I doubt that the bootloader code is reinvented. It must be out there somewhere. Much of the Qualcomm stuff is available, and I seriously doubt the developers are writing their code from scratch. Please continue searching. Perhaps looking around at the CodeAurora code for any interesting stuff..

Just for readability:

param.img

[SIZE=2]# "header" structure
struct param_header {
int status; // need to investigate more. some relationships between this and boot modes. 4 == firmware error
int unk_04; // haven't seen this used anywhere
int unk_08; // haven't seen this used anywhere
int emmc_checksum_attempted;
int emmc_checksum_ok;
int nvdata_backup; // says whether we have a backup of modemst1 in "fsg" partition and a backup of modemst2 in "backup" partition?
int unk_18[16]; // haven't seen this used anywhere
};

# debug variables
struct param_debug {
int debug_level;
int unk_04; // 4 in dumps. haven't seen this used anywhere
int unk_08; // 0 in dumps. haven't seen this used anywhere
int emmc_checksum_attempted; // mirror of param_header.emmc_checksum_attempted
int emmc_checksum_ok; // mirror of param_header.emmc_checksum_ok
};[/SIZE]

and param_debug.debug_level:

[SIZE=2]1. 0x574F4C44 ([B]DLOW[/B]) - Low debug setting

strcat(boot_img_hdr->cmdline, " androidboot.debug_level=0x4f4c"); // "[B][COLOR=Red]OL[/COLOR][/B]"
strcat(boot_img_hdr->cmdline, " sec_debug.enable=0");
strcat(boot_img_hdr->cmdline, " sec_debug.enable_user=0");

2. 0x44494D44 ([B]DMID[/B]) - Mid-level debugging

strcat(boot_img_hdr->cmdline, " androidboot.debug_level=0x494d"); // "[B][COLOR=Red]IM[/COLOR][/B]"
strcat(boot_img_hdr->cmdline, " sec_debug.enable=1");
strcat(boot_img_hdr->cmdline, " sec_debug.enable_user=0");

3. 0x47494844 ([B]DHIG[/B]) - Full debugging

strcat(boot_img_hdr->cmdline, " androidboot.debug_level=0x4948"); // "[COLOR=Red][B]IH[/B][/COLOR]"
strcat(boot_img_hdr->cmdline, " sec_debug.enable=1");
strcat(boot_img_hdr->cmdline, " sec_debug.enable_user=1");
strcat(boot_img_hdr->cmdline, " slub_debug=FPUZ");
[/SIZE]

Key generation:

[SIZE=2]# Expanding the 4 byte PSN to 8 bytes
char first_half[14];
snprintf(first_half, 13, "%08x", mmc_get_psn());
memcpy(aes_initial_key, first_half, 8);

# Calc 2nd half..
char custom_check_index_shuf_table[] = { 1, 3, 2, 4, 5, 1, 0, 4, 4, 5, 4, 0 };
char custom_check_table[] = { 0x40, 0x74, 0x25, 0x61, 0x21, 0x74, 0x70, 0x62, 0x62, 0x24, 0x33, 0x5E }; // "@t%a!tpbb$3^"
char romtype_enc_key_buf[32];

char* custom_check_shuffle_calc(signed int always_199, int count) {
int out_index; // r3@2
int last_index; // r2@2
int odd_index; // r4@3
int table_index; // r2@3
char table_value;

if ( count <= 0 ) {
out_index = 0;
} else {
out_index = 0;
last_index = 0;
do {
odd_index = always_199 & 1;
always_199 >>= 1;
table_index = odd_index + 2 * last_index;
table_value = custom_check_table[table_index];
last_index = custom_check_index_shuf_table[table_index];
romtype_enc_key_buf[out_index++] = table_value;
} while ( out_index != count );
}
romtype_enc_key_buf[out_index] = 0;
return romtype_enc_key_buf;
}

# This function is used like this (the parameters are always 199 and 8 in the vzw aboot):
char* second_half = custom_check_shuffle_calc(199, 8);
memcpy(&aes_initial_key[8], second_half, 8);

# Now we have 16 bytes in aes_initial_key, but it's shuffled again with the following function
char custom_check_final_index_table[] = { 0, 4, 5, 0xD, 3, 8, 0xE, 9, 0xA, 2, 1, 7, 0xB, 6, 0xC, 0xF };
void custom_check_shuffle_final_key(char *iv, char *final) {
int v2; // r3@1
int v5; // r3@3
v2 = 0;
do {
final[custom_check_final_index_table[v2]] = iv[v2];
v2++;
} while ( v2 != 16 );

v5 = 0;
do {
final[custom_check_final_index_table[v5]] = iv[v5] ^ final[v5];
v5++;
} while ( v5 != 16 );
}

char aes_final_key[16];
custom_check_shuffle_final_key(aes_initial_key, aes_final_key);
[/SIZE]