[Verizon Samsung Galaxy S 4] slango20:
Not sure if you guys have seen this yet, but strings reveals some interesting things in NK1's sbl2, mainly what appears to be the original source directory's contents, as well as a reference to a "ChipIdOverride" thing as well as a list of chip IDs or something, in addition to a url with no (public) DNS entry [can't post the (non-working) link due to anti-spam, run "strings [nk1 sbl2.mbn] | grep http" for the link]

device/chip IDs

MDM1000
QST1000
MDM2000
MDM3000
QST1100
MDM6200
MSM7200
MDM8200
MDM9200
FSM9200
QST1500
MSM7500
QST1600
MDM6600
MSM7600
MDM9600
QST1700
MSM7800
FSM9800
MDM8900
MSM8110
MDM6210
MSM8210
MDM9310
MDM6610
MSM8610
MSM8810
MDM8220
MDM9320
APQ8030
MSM8130
MSM7230
MSM8230
MSM7630
MSM8630
MSM8930
ESC6240
QSC6240
QSD8250
QSD8550
QSD8650
QSD8850
APQ8060
MSM6260
MSM8260
MSM8660
MSM8960
ESC6270
QSC6270
MDM6270
MSM6280
ESM6290
MSM6290
MSM7225-1
MSM7625-1
MSM7227-1
MSM7627-1
MSM7201
MSM7601
ESC6240D1
QSC6240D1
ESC6270D1
QSC6270D1
MDM6270D1
MSM8225D1
MSM7225AD1
MSM7227AD1
MSM7225AAD1
MSM7227AAD1
MSM7225ABD1
MDM9225_1
MDM9225M_1
MSM7625-2
QSC6195-2
MSM7627-2
MSM8212
MSM8612
MSM8812
MPQ8062
QSD8672
MPQ8092
APQ8064
MPQ8064
MSM8974
APQ8084
QST1005
QST1105
ESM7205
MDM6215
MDM8215
MDM9215
MDM6615
MDM9615
MSM8125
ESM7225
MSM7225
MDM8225
MSM8225
MDM9225
MSM7525
MSM7625
MSM8625
MDM9625
ESM6235
MSM6245
APQ8055
QSC6155
MSM6255
MSM8255
MSM8655
QSC6165
QSC6175
QSC6185
QSC6285
QSC6195
ESC6295
QSC6295
QSC6695
ESM7206
MSM8226
MSM8626
MSM8826
ESM6246
MSM6246
ESM7227
MSM7227
MSM8227
MSM7627
MSM8627
MSM7200A
MDM8200A
MSM7500A
QSD8250A
QSD8650A
APQ8060A
MSM8260A
MSM8660A
MSM7201A
ESM7205A
MSM7125A
MSM7225A
MSM7625A
MSM6255A
ESM7206A
MSM7127A
ESM7227A
MSM7227A
MSM7627A
APQ8030AA
MSM8130AA
MSM8230AA
MSM8630AA
MSM8930AA
MSM7225AA
MSM7625AA
MSM7227AA
MSM8227AA
MSM7627AA
MSM8627AA
APQ8030AB
MSM8130AB
MSM8230AB
MSM8630AB
MSM8930AB
APQ8060AB
MSM8260AB
MSM8660AB
MSM8960AB
MSM7225AB
MSM7625AB
MDM8110M
MDM9624M
MDM9215M
MDM8615M
MDM9615M
MDM9225M
MSM9625M
UNKNOWN
APQ8064V2P
APQ8064V2SP
MSM8125Q
MSM8225Q
MSM8625Q

Directory contents:

/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/hw/msm8960/sbl2/sbl2_mc.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/hw/msm8960/sbl2/sbl2_hw.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/hw/msm8960/sbl2/sbl2_config.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_loader.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_mc.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_pbl_v1.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_clobber_prot.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_flash_dev_if.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_hash.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_error_handler.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_config.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_hash_if.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_auth_if.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_sys_loader.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_ddr_info.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_sbl_authenticator.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_config_data.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_sdcc_hotplug.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_clobber_prot_local.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_flash_target.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_logger_ram.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_rollback_version.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_flash_trans_sdcc.c
/home/dpi/qb5_8814/workspace/JFLTE_USA_VZW/nhlos/ap/boot_images/core/boot/secboot3/src/boot_flash_dev_sdcc.c

maybe what we should be looking for isn't in aboot, but at the sbl level? if aboot had loki, maybe sbl1/2/3 have a similar vulnerability that sammy/qcom forgot about?