(adsbygoogle = window.adsbygoogle || []).push({}); i was thinking about a Custom recovery menu and thought i would about this and i thought this would be the only way (ModChip)
For the exploit to work its needed to interfacte some output/input pins of syscon, to controll communications with CELL and to controll the areas used by syscon to store "temporal data"
This way you can "emulate" the syscon or make it work for you

The rest is a cake... having controll of the comunications with syscon means you have your root_key_0 (inside cell) and the rest of the bootchain stages is in flash (bootloader--->lv0-->etc, etc...), in other words... you can resign and regenerate all the contents in flash

To be able to write the flash (from a brick state)... maybe there are several ways... initially what writes the flash in a stock motherboard is the "southbridge"
Syscon has a connection with southbridge (or in other words... southbridge is an slave of syscon and does what the boss wants)
So maybe by sending commands from syscon to southbridge... we can write the flash !!! without a flasher !!!
Either way... if this idea of writing flash using southbridge doesnt works it makes no difference... this kind of modchip needs a way to write/read a 100% corrupted flash

To make a good recovery its needed to redirect the boot chain to another device (e.g: HDD or USB)... or as an alternative emulate the flash (a little eeprom in the modchip maybe is enought because we only need to load 1 stage more of the bootchain modifyed with a recovery menu)
Also the same idea can be used to make a multiboot with a selector menu (or a button)