[Verizon Samsung Galaxy S 4] slango20:
I did a bit more messing around in aboot to see if I could by chance locate or extract the RPMB key (if it "blows" the "fuse" by setting the bit, it has to have the key to unlock write access). I managed to find that the NC5 aboot uses armel sha-1 and sha-256 algorithms. the interesting strings I found in aboot:

Montgomery multiplication for ARMv4, CRYPTOGAMS by <appro@openssl.org>
SHA1 block transform for ARMv4, CRYPTOGAMS by <appro@openssl.org>
SHA256 block transform for ARMv4, CRYPTOGAMS by <appro@openssl.org>
mmc init failed!
target/msm8960/atags.c
ram_ptable.parts[i].size >= SIZE_256M
ERROR: Unable to read RAM partition
_flash_onenand_write_page
flash_onenand_erase_block
_flash_onenand_read_page
platform/msm_shared/nand.c
eMMC set Write Protection mode, Can't be wrote.
Write protect enabled for sector
Authentication Key not yet Programmed. Retrying
Programming of Authentication Key fails.
Generic error on programming Authentication Key
[TEST] ext_csd.
175 : 0x%x.
177 : 0x%x.
179 : 0x%x.
183 : 0x%x.
185 : 0x%x.
[TEST] %s: 1
[TEST] %s: 2
[TEST] %s: [0]req_resp = 0x%x 0x%x.
[TEST] %s: [0]data = %s.
[---IAN---] mac_buf = %s
[TEST] %s: [0]mac data=%s. after
%s failed
[TEST] key_buf = %s.
[TEST] data key_buf = %s.
[TEST] req/resp = %x.
[TEST] result = %x.
%s : not match resp.
Authentication Key not yet Programmed. Retrying
Programming of Authentication Key fails.
Generic error on programming Authentication Key
%s emmc_rpmb_req_cmd failed
%s emmc_rpmb_resp_cmd failed
Read Counter Value fails.
Generic error on Read Counter value.
Counter value is EXPIRED.
Nonce value is not match..
[TEST] counter : 0x%x.
Get WriteCounter success.
[---IAN---] string to write = %s
[---IAN---] string = %s
[---IAN---] counter = %d
write fails.
Write Address fails.
Write Counter Value fails.
Write Authentication fails.
Get WriteCounter and MAC success.
%s: succeed!
ERASING DOWNLOAD INFORMATION SUCCEEDED.
%s: failed.
ERASING DOWNLOAD INFORMATION FAILED.
ERASING ACTIVATION FLAG FAILED.
ERASING ACTIVATION FLAG SUCCEEDED.
[TIMA trusted boot]: SMC call to set the warranty violation fuse failed
[TIMA trusted boot]: SMC call to set the warranty violation fuse succeeded
Device tampered: %s
Device unlocked: %s
[a link to jenkins build server, again can't post due to anti-spam]
bignum routines
rsa routines
Diffie-Hellman routines
digital envelope routines
memory buffer routines
object identifier routines
PEM routines
dsa routines
x509 certificate routines
asn1 encoding routines
configuration file routines
common libcrypto routines
elliptic curve routines
SSL routines
BIO routines
PKCS7 routines
X509 V3 routines
PKCS12 routines
random number generator
DSO support routines
time stamp routines
engine routines
OCSP routines
FIPS routines
CMS routines
HMAC routines
2013:03:11 14:05:03
[a giant block of html]
summary.html
Samsung Attestation CERT1
01 0000000600000009 SW_ID1"0
02 0071B0E100000000 HW_ID1"0 (pretty sure this isn't my device, never flashed this image to a device)
03 0000000000000000 DEBUG0
[more URLs, I think it's the same one as the SBL I looked at earlier]

there's one thing I know of that might screw up using the RPMB key to set the rollback couter: disable until reset routines, or trustzone access only