[KIN One and Two General] cadogan32:
I found some new commands off a older version of nvflash i was using :

nvflash action [options]

action (one or more) =

--help (or -h)

displays this page

--cmdhelp cmd(or -ch)

displays command help

--resume (or -r)

send the following commands to an already-running bootloader

--quiet (or -q)

surpress excessive console output

--wait (or -w)

waits for a device connection (currently a USB cable)

--create

full initialization of the target device using the config file

--download N filename

download partition filename to N

--setboot N

sets the boot partition to partition N

--format_partition N

formats contents of partition N

--read N filename

reads back partition N into filename

--getpartitiontable filename

reads back the partition table into filename

--getbit filename

reads back BIT into filename

--getbct

reads back the BCT from mass storage

--odm C Data

ODM custom 32bit command 'C' with associated 32bit data

--go

continues normal execution of the downloaded bootloader

options =

--configfile filename

indicates the configuration file used with the following commands:

--create, --format_all

--bct filename

indicates the file containing the BCT

--sbk 0x00000000 00000000 00000000 00000000

indicates the secure boot key for the target device

--bl filename

downloads and runs the bootloader specified by filename

--odmdata N

sets 32bit customer data into a field in the BCT, either hex or

decimal

--diskimgopt N

sets 32bit data required for disk image convertion tool

--format_all

formats all existing partitions on the target device using the config file,

including partitions and the bct

--setbootdevtype S

sets the boot device type fuse value for the device name.

allowed device name string mentioned below:

emmc, nand_x8, nand_x16, nor, spi

--setbootdevconfig N

sets the boot device config fuse value either hex or decimal

--verifypart N

verifies data for partition id = N specified. N=-1

indicates all partitions

Intended to be used with --create command only.

--setbct

updates the chip specific settings of the BCT in mass storage to

the bct supplied,used with --create, should not be with --read,and

--format(delete)_all,format(delete)_partition,--download, and--read

--sync

issues force sync commad

--rawdeviceread S N filename

reads back N sectors starting from sector S into filename

--rawdevicewrite S N filename

writes back N sectors from filename to device starting from sector S

--updatebct <bctsection>

bctsection should refer to the section of the bct we are updating.

Curently we suport updates for following sections

<SDRAM> updates SdramParams and NumSdramSets fields

<DEVPARAM> updates DevParams, DevType and NumParamSets

<BOOTDEVINFO> updates BlockSizeLog2, PageSizeLog2 and PartitionSize

Apart from that i tried everything i could really think of for getting that key.This phone seems to be very locked down and without enough info on the system or where that sbk might be located,i think were back to a dead end again.I know on bitpim there are some files on there that can be downloaded and maybe decompiled or something.(maybe the key is in there)

I was figuring the key would be the same setup as the later tegra devices but i believe its different now.My only guess now is too have someone with a lot of electronics knowledge to find the uart on the board and we could read the nand like that.