I would bet it’s a lot simpler than somehow getting a rom onto a locked device and then executing it (which, if they could do would take a lot less than six days and probably wouldn’t have a two day variance in possible execution time). I think the big clue here is the need for the the constant cable connection, the…