[G4] pof:
@PiGG: nice, here is what it does:

(bold for commands sent by unlock utility to the bootloader, indented is output returned by the bootloader)

set 1 0

Type (0x1)(Operation mode flag): cOpModeFlag=(0x0)​

set 5 ffffffff

Type (0x5)(Background color value): g-wBColor=(0xFFFFFFFF)​

set 2 0

Type (0x2)(Back color flag): cBackColorShowFlag=(0x0)​

set 6 000000

set 4 000000

Type (0x4)(Front color value): g-wFColor=(0x0) (0x0)​

progressbar 0 239 0 255 ffffff 100 0

shmsg 0 0 " . : | Wizard Unlock | : ."

info 1

shmsg 3 0 " ..detecting device.."

set 32 2

info 0

shmsg 4 0 " >>>Wizard found"

kadc

GSM-Modem-Init: Include DAGON

Copying GSM Data image to SDRAM: 00004000

GSM -dwSize = 345B1

GSM Page0

**GSM Page dwOffsetGSMcodShift:65536

**GSM Page dwOffsetBlock: 1

GSM -dwSize = 45627

GSM Page1

***GSM Page dwOffsetGSMcodShift:131072

***GSM Page dwOffsetBlock: 2

GSM --dwSize = 4B75E

GSM Page2

***GSM Page dwOffsetGSMcodShift:196608

***GSM Page dwOffsetBlock: 3

GSM --dwSize = 4E15B

GSM Page3

***GSM Page dwOffsetGSMcodShift: 0

***GSM Page dwOffsetBlock: 5

GSM --dwSize = 4B3B0

GSM Page4

***GSM Page dwOffsetGSMcodShift: 65536

***GSM Page dwOffsetBlock: 6

GSM --dwSize = 4CA79

GSM Page5

***GSM Page dwOffsetGSMcodShift: 131072

***GSM Page dwOffsetBlock: 7

GSM --dwSize = 28B59

GSM Page6

***GSM Page dwOffsetGSMcodShift: 196608

***GSM Page dwOffsetBlock: 8

GSM --dwSize = C490

GSM Page7

Copying GSM CODE image to SDRAM: 00000000

ARMBOOT = 1 --> boot from CS3

Reset RAM 7

ok

AT-Command Interpreter ready​

AT+GSN

356XXXXXXXXXXXX​

set

shmsg 5 0 " >>> unlock stage 1"

password XTC

ruustart

wdata 8FA00398 4

shmsg 6 0 " preparing."

progressbar 10 229 300 316 ffff 0 0

wdata 91000000 10000

progressbar 10 229 300 316 ffff 8 0

wdata 91010000 10000

progressbar 10 229 300 316 ffff 16 0

wdata 91020000 10000

progressbar 10 229 300 316 ffff 25 0

wdata 91030000 10000

progressbar 10 229 300 316 ffff 33 0

wdata 91040000 10000

progressbar 10 229 300 316 ffff 41 0

wdata 91050000 10000

progressbar 10 229 300 316 ffff 50 0

wdata 91060000 10000

progressbar 10 229 300 316 ffff 58 0

wdata 91070000 10000

progressbar 10 229 300 316 ffff 66 0

wdata 91080000 10000

progressbar 10 229 300 316 ffff 75 0

wdata 91090000 10000

progressbar 10 229 300 316 ffff 83 0

wdata 910A0000 10000

progressbar 10 229 300 316 ffff 91 0

wdata 910B0000 10000

progressbar 10 229 300 316 ffff 100 0

ruuflashdoc 91000000 c0000 71216fd4

shmsg 6 0 " preparing..."

ruurun 12345678

shmsg b 5 "rebooting..."

ruurun 12345678

ResetDevice

--- device resets here ---

set 1 0

Type (0x1)(Operation mode flag): cOpModeFlag=(0x0)​

set 5 ffffffff

Type (0x5)(Background color value): g-wBColor=(0xFFFFFFFF)​

set 2 0

Type (0x2)(Back color flag): cBackColorShowFlag=(0x0)​

set 6 000000

set 4 000000

Type (0x4)(Front color value): g-wFColor=(0x0) (0x0)​

progressbar 0 239 0 255 ffffff 100 0

shmsg 0 0 " . : | Wizard Unlock | : ."

password XTC

set 32 2

+ SD Controller init

- SD Controller init

+StorageInit

***** user area size = 0x3C8C0000 Bytes

g_cKeyCardSecurityLevel = FF​

set

shmsg 5 0 " >>> unlock stage 2"

ruustart

wdata 8FA00398 4

shmsg 6 0 " unlocking."

progressbar 10 229 300 316 ffff 0 0

wdata 92000000 10000

progressbar 10 229 300 316 ffff 33 0

wdata 92010000 10000

progressbar 10 229 300 316 ffff 66 0

wdata 92020000 10000

progressbar 10 229 300 316 ffff 100 0

ruuflashdoc 92000000 30000 7fb33184

shmsg 6 0 " unlocking..."

wdata 8FA00398 4

progressbar 10 229 300 316 ffff 0 0

wdata 91000000 10000

progressbar 10 229 300 316 ffff 8 0

wdata 91010000 10000

progressbar 10 229 300 316 ffff 16 0

wdata 91020000 10000

progressbar 10 229 300 316 ffff 25 0

wdata 91030000 10000

progressbar 10 229 300 316 ffff 33 0

wdata 91040000 10000

progressbar 10 229 300 316 ffff 41 0

wdata 91050000 10000

progressbar 10 229 300 316 ffff 50 0

wdata 91060000 10000

progressbar 10 229 300 316 ffff 58 0

wdata 91070000 10000

progressbar 10 229 300 316 ffff 66 0

wdata 91080000 10000

progressbar 10 229 300 316 ffff 75 0

wdata 91090000 10000

progressbar 10 229 300 316 ffff 83 0

wdata 910A0000 10000

progressbar 10 229 300 316 ffff 91 0

wdata 910B0000 10000

progressbar 10 229 300 316 ffff 100 0

ruuflashdoc 91000000 c0000 86221939

shmsg 6 0 " unlocking....."

shmsg 8 0 " unlocking done"

ruurun 0

shmsg b 5 "rebooting..."

You can extract what is sent encapsulated in HTCS / HTCE blocks in every wdata command by exporting the .lgs file to ANSI Text, and then using a hex editor.