Repo: https://github.com/dcherrera/n100-be2012-crossflash

What it covers:

EDL cross-flash from macOS via bkerler/edl driven by an XML-based partition plan generator. Sidesteps the patched-MSM project-ID guard by never implementing it. Uses OnePlus's own signed Firehose loader, vendored via the bkerler/Loaders submodule.

Bootloader unlock via the OnePlus carrier-shim app removal trick (the five packages holding sys.oem_unlock_allowed=0). No SWID hex-edit required for the unlock itself; the param exploit is documented in the repo as Plan B if the carrier-shim approach ever stops working.

UBports recovery patching on-device via magiskboot from the Magisk APK, because the rubencarneiro recovery's gpg 1.4.13 can't verify the SHA512 sigs on modern system-image files. No firmware rebuild needed.

A SIM-init binary patch on /usr/sbin/ofonod that fixes a silent blocker leaving Modem.Features stuck at ['sim'] on first boot. Disassembly + offset table in the README.

Reproducible from a fresh clone — 7 shell scripts, ~230 KB of source. Tested on a single unit. Brick risk is the usual EDL-low.

Carrier caveats (T-Mobile bands only, Verizon SIMs read but won't sustain attach) in the README's cellular section.

Standing on the shoulders of the BE2015 install-success thread for the unlock approach, and rubencarneiro/billie2 for the bootstrap images.