Unfortunately, I realized this isn’t going to work. The bootloader stored on the eMMC is the second stage in the boot process. The first is a smaller bootloader stored on a ROM, that verifies the second stage, so patching the second stage would require desoldering the rom and reprogramming it. I would still like to find a temp-root, as there is a TrustZone exploit which could be upgraded for this version of android which could unlock the phone.
I’m currently working on a pull request that reads the public keys from a file instead of being hard coded. Distributing those files with a custom haveno.properties file could allow people to join separate networks using the same codebase unless there is some functional difference