[AT&T Samsung Galaxy S7 Questions & Answers] Devman-0903:
Hi, I have been attempting to unlock the QUALCOMM US Boot-loaders, and have been able to find flags In the ODIN boot-loader files.

EDIT: got some "keys"

ANY DEVS PARTCIPATING, Sign your packages with one of these

-ffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d

-5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b

-6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296

-4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5

-ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551

-b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef

-3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60

---------------------------------

Also, another interesting part in keymaster.mbn was

KEYMASTER_SECURE_WRITE_PROTECT

0123456789ABCDEFkeymaster

da9008f709

-------------------

all flags from devcfg.mbn are

keystore_retain_wrong_passwd_attempt

OEM_counter_enable_rpmb

OEM_allow_rpmb_key_provision

OEM_disable_rpmb_autoprovisioning

OEM_sec_wdog_bark_time

OEM_sec_wdog_bite_time

OEM_reset_reason_list

OEM_l2_wa_enable

OEM_rot_enable_transfer_APPS

OEM_rot_enable_transfer_MODEM

OEM_rot_pk_hash1_fuse_values

OEM_pil_secure_app_load_region_size

OEM_pil_subsys_load_region_start

OEM_pil_subsys_load_region_size

OEM_disable_secure_app_pimem

client_00

client_01

client_02

client_03

client_04

client_05

client_06

client_07

cmnlib_gppo_rpmb_enablement

cmnlib_gppo_root_path license_data_store_path

proprietary_play_enabler_video_protect

proprietary_play_enabler_default_behaviour

IV_constraint robustness_version

proprietary_play_enabler_profile

proprietary_opl_profile_0

disable_security_stream_check provision_constraint_flag

use_legacy_hdmi_hdcp_check

get_IV_constraint

maximum_hdcp_2x_capability

enable_kcb_logging_flag

hdcp1_storage_type

chamomile_ips

hdcp2p2_storage_type

chamomile_ips_hdcp2p2

kernel_version

kernel_version_str_length

challenges

challenges_array_length fpta_name

gk_timeout_config

QFPROM_rail_id

QFPROM_rail_type

pam_qfprom_rail

ddr_rail_reg

arb_priority_cfg

number_priorities

number_pvc_port

pvc_port_cfg spmi_channel_cfg

spmi_channel_cfg_size

tz_mpu_rg_cfg

rg_cfg_size

pmic_arb_hal_id_xpu

spmi_rg_config

blsp_spi_mosi[6]

blsp_spi_miso[6]

blsp_spi_cs_n[6]

blsp_spi_clk[6]

blsp_spi_mosi[5]

blsp_spi_miso[5]

blsp_spi_cs_n[5]

blsp_spi_clk[5]

blsp_spi_mosi[1]

blsp_spi_miso[1]

blsp_spi_cs_n[1]

blsp_spi_clk[1]

blsp_spi_mosi[7]

blsp_spi_miso[7]

blsp_spi_cs_n[7]

blsp_spi_clk[7]

blsp_spi_mosi[11]

blsp_spi_miso[11]

blsp_spi_cs_n[11]

blsp_spi_clk[11]

blsp_i2c_sda[1]

blsp_i2c_scl[1]

blsp_i2c_sda[2]

blsp_i2c_scl[2]

blsp_i2c_sda[3]

blsp_i2c_scl[3]

blsp_i2c_sda[4]

blsp_i2c_scl[4]

blsp_i2c_sda[5]

blsp_i2c_scl[5]

blsp_i2c_sda[6]

blsp_i2c_scl[6]

blsp_i2c_sda[7]

blsp_i2c_scl[7]

blsp_i2c_sda[8]

blsp_i2c_scl[8]

blsp_i2c_sda[9]

blsp_i2c_scl[9]

blsp_i2c_sda[10]

blsp_i2c_scl[10]

blsp_i2c_sda[11]

blsp_i2c_scl[11]

blsp_i2c_sda[12]

blsp_i2c_scl[12]

blsp1_spi_cs1_n

tlmm_gpio_test_pin

tlmm_base tlmm_offset

tlmm_total_gpio

mst_pd

mst_md

gcc_blsp1_ahb_clk gcc_blsp1_qup5_spi_apps_clk

"fidocrypto" "" "/efs/" "/data/misc/qsee/" "/data/misc/qsee/" "Linux version 3.14.26-g43b1178-00038-g96ef344 (lnxbuild@abait242-sd-lnx) (gcc version 4.9.x-google 20140827 (prerelease) (GCC) ) #1 SMP PREEMPT Fri Jun 5 15:15:57 PDT 2015" authhat

-----------

the most interesting was

-OEM_rot_pk_hash1_fuse_values

as in the efuse value?

I would really love for some people to give some support

I will give these files as-is or I can give as raw text.

Edit: these flags are based off of QA6

Edit2: I wonder if we could find a dev with the Qualcomm version of the s7 (china), grab the Odin files, (AP,BL,CP) (flash your own csc carrier) and use CROM SERVICE