[LG Optimus L9 P760, P765, P768, P769] omgbossis21:
.rodata:00000E48 aDevice_unlock DCB "device_unlock",0 ; DATA XREF: logger+20o

.rodata:00000E48 ; .text:off_958o

.rodata:00000E56 aExitingFunctio DCB "exiting function.",0xA,0 ; DATA XREF: cleanup+4o

.rodata:00000E56 ; .text:off_968o

.rodata:00000E69 aSigint_handler DCB "sigint_handler called.",0xA,0

.rodata:00000E69 ; DATA XREF: sigint_handler+6o

.rodata:00000E69 ; .text:off_984o

.rodata:00000E81 aDevBlockPlatfo DCB "/dev/block/platform/omap/omap_hsmmc.1/by-name/nv",0

.rodata:00000E81 ; DATA XREF: write_nv+Ao

.rodata:00000E81 ; .text:off_9F0o ...

.rodata:00000EB2 aCanTOpenNvdata DCB "Can't open NVDATA partition ret = %d ",0xA,0

.rodata:00000EB2 ; DATA XREF: write_nv+1Co

.rodata:00000EB2 ; .text:off_9F4o ...

.rodata:00000ED9 aCannotSeekToRe DCB "Cannot seek to real block device footer",0xA,0

.rodata:00000ED9 ; DATA XREF: write_nv+32o

.rodata:00000ED9 ; .text:off_9F8o ...

.rodata:00000F02 aCanTReadUnlock DCB "Can't read unlock bit.",0xA,0

.rodata:00000F02 ; DATA XREF: write_nv+54o

.rodata:00000F02 ; .text:off_9FCo ...

.rodata:00000F1A aGsm_operator_n DCB "gsm.operator.numeric",0

.rodata:00000F1A ; DATA XREF: bootloader_unlock_handler+1Eo

.rodata:00000F1A ; .text:off_B94o

.rodata:00000F2F aNetworkConnect DCB "network connection is not set",0xA,0

.rodata:00000F2F ; DATA XREF: bootloader_unlock_handler+46o

.rodata:00000F2F ; .text:off_BA0o

.rodata:00000F4E a00101 DCB "00101",0 ; DATA XREF: bootloader_unlock_handler+2Ao

.rodata:00000F4E ; .text:off_B9Co

.rodata:00000F54 aTestNetworkIsC DCB "Test network is connected",0xA,0

.rodata:00000F54 ; DATA XREF: bootloader_unlock_handler+60o

.rodata:00000F54 ; .text:off_BA4o

.rodata:00000F6F aNetworkConne_0 DCB "network connection is set operator=%s",0xA,0

.rodata:00000F6F ; DATA XREF: bootloader_unlock_handler+70o

.rodata:00000F6F ; .text:off_BA8o

.rodata:00000F96 aLock_stateXMnc DCB "lock_state=%x, mnc=%d,mcc=%d",0xA,0

.rodata:00000F96 ; DATA XREF: bootloader_unlock_handler+90o

.rodata:00000F96 ; .text:off_BBCo

.rodata:00000FB4 aRo_build_targe DCB "ro.build.target_operator",0

.rodata:00000FB4 ; DATA XREF: bootloader_unlock_handler+A0o

.rodata:00000FB4 ; .text:off_BC0o

.rodata:00000FCD aBootloader_unl DCB "bootloader_unlock_operator_bit_write: unlock_value=0x%04x",0xA,0

.rodata:00000FCD ; DATA XREF: bootloader_unlock_handler+E4o

.rodata:00000FCD ; .text:off_BD0o

.rodata:00001008 asc_1008 DCB "----------------------------------------------",0xA,0

.rodata:00001008 ; DATA XREF: main+94o

.rodata:00001008 ; main+F2o ...

.rodata:00001038 aBootLoaderUnlo DCB "boot loader unlock setup process is starting~~!!!",0xA,0

.rodata:00001038 ; DATA XREF: main+A0o

.rodata:00001038 ; .text:off_D40o

.rodata:0000106B aThreadCreateEr DCB "thread create error : ",0 ; DATA XREF: main+C6o

.rodata:0000106B ; .text:off_D48o

.rodata:00001082 aReturnThread0D DCB "return thread 0 %d",0xA,0 ; DATA XREF: main+DCo

.rodata:00001082 ; .text:off_D4Co

.rodata:00001096 aDeviceUnlockIs DCB "Device Unlock is permitted. But, unlock was not applied",0xA,0

.rodata:00001096 ; DATA XREF: main+FCo

.rodata:00001096 ; .text:off_D54o

.rodata:000010CF aDeviceIsAlread DCB "Device is already unlocked",0xA,0

.rodata:000010CF ; DATA XREF: main+116o

.rodata:000010EB aBootloaderUnlo DCB "Bootloader Unlock is prohibited",0xA,0

.rodata:000010EB ; DATA XREF: main+130o

.rodata:000010EB ; .text:off_D64o

.rodata:0000110C aUnlockBitIsFul DCB "Unlock bit is full!!!",0xA,0 ; DATA XREF: main+146o

.rodata:0000110C ; .text:off_D6Co

.rodata:00001123 unk_1123 DCB 6 ; DATA XREF: logger+14o

.rodata:00001123 ; .text:off_954o

A unlock bit is generated (after checking sim state and verifying service) and written to the nv partition.

---------- Post added at 01:58 PM ---------- Previous post was at 01:54 PM ----------

The full function that unlocks the bootloader :

.text:00000AD4

.text:00000AD4 loc_AD4 ; CODE XREF: bootloader_unlock_handler+5Aj

.text:00000AD4 LDR R1, =(aNetworkConne_0 - 0xAE0)

.text:00000AD6 MOV R2, R4

.text:00000AD8 MOVS R0, #6

.text:00000ADA LDR R6, =(mcc - 0xAEA)

.text:00000ADC ADD R1, PC ; "network connection is set operator=%s\n"

.text:00000ADE LDR R4, =(sim_state - 0xAFA)

.text:00000AE0 BL logger

.text:00000AE4 LDR R1, =(cleanup+1 - 0xAEE)

.text:00000AE6 ADD R6, PC

.text:00000AE8 MOVS R0, #0xE

.text:00000AEA ADD R1, PC

.text:00000AEC LDR R5, =(mnc - 0xAFC)

.text:00000AEE BLX bsd_signal

.text:00000AF2 LDR R0, [R6]

.text:00000AF4 LDR R1, =(aLock_stateXMnc - 0xB00)

.text:00000AF6 ADD R4, PC

.text:00000AF8 ADD R5, PC

.text:00000AFA STR R0, [SP,#0x30+var_30]

.text:00000AFC ADD R1, PC ; "lock_state=%x, mnc=%d,mcc=%d\n"

.text:00000AFE MOVS R0, #6

.text:00000B00 LDR R2, [R4]

.text:00000B02 LDR R3, [R5]

.text:00000B04 BL logger

.text:00000B08 LDR R0, =(aRo_build_targe - 0xB10)

.text:00000B0A LDR R1, =(value_operator - 0xB12)

.text:00000B0C ADD R0, PC ; "ro.build.target_operator"

.text:00000B0E ADD R1, PC

.text:00000B10 BLX __system_property_get

.text:00000B14 LDR R3, [R6]

.text:00000B16 MOVW R2, #0xFFF

.text:00000B1A CMP R3, R2

.text:00000B1C BNE loc_B2A

.text:00000B1E LDR R3, [R5]

.text:00000B20 CMP R3, #0xFF

.text:00000B22 IT EQ

.text:00000B24 LDREQ R3, [R4]

.text:00000B26 BNE loc_B2C

.text:00000B28 B loc_B3C

.text:00000B2A ; ---------------------------------------------------------------------------

.text:00000B2A

.text:00000B2A loc_B2A ; CODE XREF: bootloader_unlock_handler+B0j

.text:00000B2A CBZ R3, loc_B46

.text:00000B2C

.text:00000B2C loc_B2C ; CODE XREF: bootloader_unlock_handler+BAj

.text:00000B2C LDR R1, =(mnc - 0xB32)

.text:00000B2E ADD R1, PC

.text:00000B30 LDR R1, [R1]

.text:00000B32 CMP R1, R2

.text:00000B34 BNE loc_B46

.text:00000B36 LDR R3, =(sim_state - 0xB3C)

.text:00000B38 ADD R3, PC

.text:00000B3A LDR R3, [R3]

.text:00000B3C

.text:00000B3C loc_B3C ; CODE XREF: bootloader_unlock_handler+BCj

.text:00000B3C CMP R3, #0x34

.text:00000B3E IT NE

.text:00000B40 MOVNE.W R3, #0x100

.text:00000B44 BNE loc_B4A

.text:00000B46

.text:00000B46 loc_B46 ; CODE XREF: bootloader_unlock_handler:loc_B2Aj

.text:00000B46 ; bootloader_unlock_handler+C8j

.text:00000B46 MOV.W R3, #0x1000

.text:00000B4A

.text:00000B4A loc_B4A ; CODE XREF: bootloader_unlock_handler+D8j

.text:00000B4A LDR R1, =(aBootloader_unl - 0xB54)

.text:00000B4C MOVS R0, #3

.text:00000B4E STR R3, [SP,#0x30+var_24]

.text:00000B50 ADD R1, PC ; "bootloader_unlock_operator_bit_write: u"...

.text:00000B52 LDR R2, [SP,#0x30+var_24]

.text:00000B54 BL logger

.text:00000B58 LDR R0, [SP,#0x30+var_24]

.text:00000B5A MOV.W R1, #0x4A00

.text:00000B5E BL write_nv

.text:00000B62 CBNZ R0, loc_B6A

.text:00000B64 LDR R1, =(aCanTReadUnlock - 0xB6A)

.text:00000B66 ADD R1, PC ; "Can't read unlock bit.\n"

.text:00000B68 B loc_B80

.text:00000B6A ; ---------------------------------------------------------------------------

.text:00000B6A

.text:00000B6A loc_B6A ; CODE XREF: bootloader_unlock_handler+F6j

.text:00000B6A ADD R0, SP, #0x30+var_20

.text:00000B6C MOVS R2, #0

.text:00000B6E MOV.W R1, #0x4A00

.text:00000B72 STR.W R2, [R0,#-4]!

.text:00000B76 BL read_nv

.text:00000B7A CBNZ R0, loc_B86

.text:00000B7C LDR R1, =(aCanTReadUnlock - 0xB82)

.text:00000B7E ADD R1, PC ; "Can't read unlock bit.\n"

.text:00000B80

.text:00000B80 loc_B80 ; CODE XREF: bootloader_unlock_handler+FCj

.text:00000B80 MOVS R0, #3

.text:00000B82 BL logger

.text:00000B86

.text:00000B86 loc_B86 ; CODE XREF: bootloader_unlock_handler+10Ej

.text:00000B86 MOVS R0, #0

.text:00000B88 ADD SP, SP, #0x14

.text:00000B8A POP.W {R4-R9,PC}

.text:00000B8A ; End of function bootloader_unlock_handler

.text:00000B8A