[Miscellaneous Android Development] amrmo:
I've looked a bit further into the official firmware booting sequence.

The process appears similar to that of Intel 'Edison' SoC platform. In particular, you can see that the 'mysterious' file IFWI_v89.0040_CRAK_DEV.bin from the official firmware contains strings like:

******************************

PSH KERNEL VERSION: %X

WR: %X

******************************

that are part of the dump saved i.e. here: http://forum.osdev.org/viewtopic.php?f=1&p=242715. That bootloader seems to be a product of Intel's 'Wind River Systems' subsidiary, running on the development machine from D:/WindRiver/viper-2.0 (see http://www.windriver.com/products/linux/open-source-leadership/#open_source_lab). I suspect that this is the stage, where firmware authentication takes place. On some other platforms the rest of the booting is then handed over to U-Boot, see i.e. here: http://image.slidesharecdn.com/edis...5/how-to-hack-edison-17-638.jpg?cb=1415105984. On the ZenPad, perhaps simply the UEFI Bootstub loader.

A way to replace that with a bootloader which is more under control (ideally 2.19.40.20 for ZenFone 2 ZE550ML from i.e. http://dlcdnet.asus.com/pub/ASUS/ZenFone/ZE551ML/UL-Z00A-WW-2.19.40.20-user.zip; so as to then apply the unlocking trick:

http://xdaforums.com/zenfone2/general/congrats-to-bootlocker-unlocked-t3138547:

adb shell getprop ro.isn > /factory/asuskey

reboot bootloader

After updating, it will restart again and ASUS splash screen should be white)

...may be through Intel SoC Cross Platform Firmware & Software Tool Kit (xFSTK Downloader tools, https://sourceforge.net/projects/xfstk/).

If you compile it (apt-get install g++ qtcreator build-essential devscripts libxml2-dev alien doxygen graphviz libusb-dev libboost-all-dev ; make build; cd build; cmake ..; make), the 'xfstk-build/linux-source-package/build/docs/html/index.html' guide contains in particular an illustrative screenshot of available capabilities. These are the same described i.e. here:

http://techtrickz.com/how-to/unbrick-a-bricked-zenfone-2-ze550mlze551ml-restore-bootloader/ ; in particular, the 'GP flag override value: 0x800000807' means, converted from hexadecimal to binary (LSB convention), '100000000000000000000000100000000111': "cold reset after FW recovery" (bit 1), "cold reset after OS recovery" (bit 2), "?reserved?" (bit 3), "?reserved?" (bit 12), "always set to 1" (bit 31). Of potential interest: "disable soft fuse" (bit 8).

Under Linux, the GUI can be launched as:

./ancillary/configure/gui/downloader-ui/xfstk-dldr-gui

... and the CLI version of the same as:

./ancillary/configure/core/downloader-solo/xfstk-dldr-solo --gpflags 0x800000807

In practice, it means that for the ZenFone_2_ZE551ML (with files taken from http://techtrickz.com/how-to/unbrick-a-bricked-zenfone-2-ze550mlze551ml-restore-bootloader/, rather than the official archive: droidboot.img and droidboot_dnx.img.POS_sign.bin; ifwi_ann_a0-mofd_v1-ze551ml.bin and ifwi.bin are different; while dnx_fwr.bin and dnx_fwr_ann_a0-mofd_v1-ze551ml.bin are the same) it should be:

xfstk-dldr-solo --fwdnx /tmp/dnx_fwr_ann_a0-mofd_v1-ze551ml.bin --fwimage /tmp/ifwi_ann_a0-mofd-v1-e551ml.bin --osimage droidboot_dnx.img.POS_sign.bin --gpflags 0x800000807

[notice that the option --osdnx /intel/osdnx.bin was skipped]

[notice that droidboot.img is not a standard android boot image, as abootimg would recognize. Where does it come from? chk commands below:]

I haven't tried more, until understanding better i.e. the stuff above in square brackets.

Have fun,

--

a.