Pinned Tweet
It's Download Mode Saga again:
Over the last few days I have been researching Samsungs Download Mode, and turns out that the "DMC" lock (Download Mode Control) Lock, that usually appears on devices with a screen lock, has a hidden menu meant for service center employees.
ces.jar, calls VaultKeeper to write the DMC lock every time Android boots (if screen lock is enabled), so:
VaultKeeper -> HAL -> vaultkeeperd -> TEE Applet, which in the end writes to RPMB. The bootloader reads 2 parts in RPMB, 0x10B2 and 0x10B0 (10B0 is a mirror).
