[ASUS ZenFone 8] vgmoose:
Thank you for the partition contents, I tried to modify the values I recognized to the same values on my phone (ISN, SSN, etc) and flash both the sysconf and devinfo partitions. Although fastboot said both "Sending" and "Writing" then "OKAY", it didn't affect anything and none of the changes stuck.

I tried to check out QFIL and EDL mode, using both the open source edl project I linked earlier, and also the actual qfil.exe on windows. Neither gave me great results... I'm not sure if i had the right firehose loader or not (as I am on the ZF10), I just found a few random fhloader programmer elf's that were posted on older ROG/Zenfone recovery forums. Using EDL mode I was hoping to be able to dump and write partitions directly.

To me, the most interesting thing in the sysconf and devinfo partitions you posted is there appear to be three independent 0001's that are present (one in the first line of sysconf, two in the first few lines of devinfo). This feels like it roughly lines up with references to three independent 0x1's in the bootloader disassembly. I could just be seeing three dots and drawing a line, but it seems likely that for one of those values, on locked devices, an 0x0 needs to be changed to a 0x1.

There are two fastboot commands that appear to dump info that is contained in these partitions. They are: fastboot oem device-info and fastboot oem system-info. But I'm unable to dump my own partitions to fully verify this.

There are topics on xda where it seems like you can flash and overwrite a SSN (and so likely an ISN too) via EDL, but maybe a different fhloader is needed for ZF10? If someone has a locked ZF8 they might be able to experiment a little more in EDL mode by dumping and modifying their partitions to resemble more like these posted ones. I don't have a link to a working fhloader for ZF8, but this user seems to have had it working.

It's appreciated, but I think I'm out of things to try, without being able to make a backup or actually flash partitions I'm not going to be able to poke at much more. If those three bytes are the unlock/dev mode checks, it feels too big of an oversight to "just" be able to flash them via bootloader or EDL. And then my other theory requires a known unlock secret for a given (and also flashable) ISN already, which appears to be deleted or unavailable after its used.

There is this very detailed thread on the OnePlus forum for how to unbrick a recent OP11 via EDL. I don't see any specific standalone firehose files, however, it looks like someone paid for the third-party unlock, captured the key they used, and then using EDL to flash the phone to work with that key + mitm proxy strategies discussed earlier. I feel like I'm missing a lot of context, but so much of that post seems to line up with info that we already know about how the asuskey should work.

Unfortunately that "secret-key-opt" variable doesn't appear to exist in the bootloader anymore. You can use fastboot getvar to list all variables. I'm assuming this is part of what they moved to the server.

Hopefully stuff I've posted here can be useful to someone else. If there's a fhloader EDL programmer (not sure where these are supposed to originate from) that works for the ZF10 chipset I could dig a little deeper, but I'm not going as far as to try to reverse-engineer the third-party unlocking flow more directly (the way that it seems like the OnePlus users have).

Also it's October now... 😭 Where's the official unlock tool at, ASUS?!