[David_Vaz]

Por si os interesa, la parte del script que restaura la flag.

echo -ne "\x$setstate" | dd obs=1 count=1 seek=$offset of=$block;
if [ $hastamper == 1 ]; then
  ui_print "Done!";
  ui_print " ";
  ui_print "Setting tampered bit to false...";
  tamperbit=$(( $offset + 4 ));
  echo -ne "\x00" | dd obs=1 count=1 seek=$tamperbit of=$block;
fi;

Y aquí completo:

#!/sbin/sh
# Nexus BootUnlocker Script: Recovery Flashable Zip
# osm0sis @ xda-developers

OUTFD=$2;
ui_print() {
  echo -ne "ui_print $1\n" > /proc/self/fd/$OUTFD;
  echo -ne "ui_print\n" > /proc/self/fd/$OUTFD;
}
getprop() { test -z `/sbin/getprop $1` && cat /system/build.prop | grep $1= | cut -d= -f2 || /sbin/getprop $1; }
show_progress() { echo "progress $1 $2" > /proc/self/fd/$OUTFD; }
set_progress() { echo "set_progress $1" > /proc/self/fd/$OUTFD; }
abort() {
  ui_print " ";
  ui_print "Your system has not been changed.";
  ui_print " ";
  ui_print "Script will now exit...";
  ui_print " ";
  umount /system;
  exit 1;
}

ui_print " ";
ui_print "Nexus BootUnlocker Script";
ui_print "by osm0sis @ xda-developers";
ui_print " ";
ui_print "For GN, N4, N5 & N10 bootloaders ONLY";
show_progress 1.34 0;

ui_print " ";
ui_print "Verifying device...";
/sbin/busybox mount /system;
set_progress 0.2;
device=`getprop ro.product.device`;
bootloader=`getprop ro.bootloader`;
test -z $device && device=unknown;
test -z $bootloader && bootloader=unknown;
if [ $device == "maguro" -o $device == "toro" -o $device == "toroplus" ]; then
  ui_print "Galaxy Nexus: $device";
  block=/dev/block/platform/omap/omap_hsmmc.0/by-name/param;
  offset=124;
  locked=01;
  unlocked=00;
  hastamper=0;
elif [ $device == "mako" ]; then
  ui_print "Nexus 4: $device";
  block=/dev/block/platform/msm_sdcc.1/by-name/misc;
  offset=16400;
  locked=00;
  unlocked=01;
  hastamper=1;
elif [ $device == "hammerhead" ]; then
  ui_print "Nexus 5: $device";
  block=/dev/block/platform/msm_sdcc.1/by-name/misc;
  offset=16400;
  locked=00;
  unlocked=01;
  hastamper=1;
elif [ $device == "manta" ]; then
  ui_print "Nexus 10: $device";
  block=/dev/block/platform/dw_mmc.0/by-name/param;
  offset=548;
  locked=00;
  unlocked=01;
  hastamper=0;
else
  test $device == "grouper" -o $device == "tilapia" && ui_print "Nexus 7 (2012): $device" || ui_print "Device: $device";
  ui_print "Bootloader: $bootloader";
  ui_print " ";
  ui_print "Unsupported device.";
  test $device == "grouper" -o $device == "tilapia" && ui_print "For N7'12 BootUnlocker Script go to http://v.ht/N7BU";
  abort;
fi;
ui_print "Bootloader: $bootloader";
set_progress 0.4;

ui_print " ";
ui_print "Checking bootloader status...";
lockstate=`dd ibs=1 count=1 skip=$offset obs=1 if=$block 2> /dev/nul | /sbin/busybox od -h | /sbin/busybox head -n 1 | /sbin/busybox cut -c 15-`;
test -z $lockstate && lockstate=00;
set_progress 0.6;
if [ $lockstate == $locked ]; then
  ui_print "Bootloader is locked.";
  ui_print " ";
  ui_print "Unlocking...";
  setstate=$unlocked;
elif [ $lockstate == $unlocked ]; then
  ui_print "Bootloader is unlocked.";
  ui_print " ";
  ui_print "Locking...";
  setstate=$locked;
else
  ui_print "Status does not match known values.";
  ui_print "This is not the intended device or bootloader.";
  abort;
fi;
set_progress 0.8;

echo -ne "\x$setstate" | dd obs=1 count=1 seek=$offset of=$block;
if [ $hastamper == 1 ]; then
  ui_print "Done!";
  ui_print " ";
  ui_print "Setting tampered bit to false...";
  tamperbit=$(( $offset + 4 ));
  echo -ne "\x00" | dd obs=1 count=1 seek=$tamperbit of=$block;
fi;
set_progress 1.0;

umount /system;
set_progress 1.2;
ui_print "Done!";
set_progress 1.34;
exit 0;