Noob to Android Rooting and modding here. Can't we just extract a copy of the boot.img (That is the right file, right?), decompile it and try to reverse engineer it to find an unlocking method? Is that even possible, even with root permissions?
EDIT:
Ran "dd if=/dev/mtd/mtd2 of=/sdcard/boot.img bs=4096" in Android Terminal Emulator as root to copy the boot.img, and it appears as if the file either does not exist or Kyocera used a different file name for the bootloader.
if Reverse Engineering Was Theoretically possible,which im unsure of,youre using the wrong type of mountpoint i beileve.
after giving Terminal emulator root permissions via su,
changing the directory to /dev/block(cd /dev/block)
and running the ls command,my output lists an mmcblk0,
trailing with mmcblk0x,where x is a number 1-20.
it also lists an mmcblk1,and mmcblk1p1.
subsequently,changing directories back to /dev/ and running the same command(ls),gave me no mtd directory,which in theory is more than likely why its creating a file with 0 bytes,becuase that file and/or directory doesnt exist in our file system.
i think you should be eyeballing /dev/block/mmcblk0px where the general file structure would put the boot partition in one of the first numbers 1-20 being x
EDIT:also,after reviewing some of the other mmcblk devices,in this instance,i used the galaxy exhibit 2 4g,the filesystem mountpoints are as follows:
Partition Table
/dev/block/mmcblk0p1 secboot2 partition map
/dev/block/mmcblk0p2 dbl.mbn (boot loader)
/dev/block/mmcblk0p3 osbl.mbn (boot loader)
/dev/block/mmcblk0p4 MBR extended partition table
/dev/block/mmcblk0p5 EMMCBOOT.MBN (boot loader, has odin download mode)
/dev/block/mmcblk0p6 amss.mbn
/dev/block/mmcblk0p7 emmcparam.bin
/dev/block/mmcblk0p8 boot.img (linux kernel)
/dev/block/mmcblk0p9 adsp.mbn (baseband)
/dev/block/mmcblk0p10 rmt
/dev/block/mmcblk0p11 rmt
/dev/block/mmcblk0p12 persist.ext4
/dev/block/mmcblk0p13 recovery.img (linux kernel+initrd for recovery mode)
/dev/block/mmcblk0p14 param
/dev/block/mmcblk0p15 system.ext4
/dev/block/mmcblk0p16 cache.ext4
/dev/block/mmcblk0p17 data.ext4
/dev/block/mmcblk0p18 preload.ext4
/dev/block/mmcblk0p19
/dev/block/mmcblk0p20 all 0's
/dev/block/mmcblk0p21 all 0's
/dev/block/mmcblk0p22 all 0's
/dev/block/mmcblk0p23 all 0's
/dev/block/mmcblk0p24 all 0's
/dev/block/mmcblk0p25 all 0's
/dev/block/mmcblk0p26 all 0's
/dev/block/mmcblk0p27 efs (encrypted fs)
/dev/block/mmcblk0p28 /mnt/sdcard
note the bold partitions.after running an ls -l command on the /dev/block directory on our kyocera rise,ALL the partitions are owned by ROOT,except for mmcblk0px,Where X is a number 15-18,which is quite identical to the listing here.
im not sure how close this will get us to unlocking the bootloader,but i would figure if theyre not gunna unlock it for us,we might as well understand it first.