@ryne It may be a bit trickier as I have seen most interfaces are locked down. I expect some eMMC/UFS desoldering (or otherwise, butchering of the device) may be involved to get it out for the first time before we can hook to the OTA server and pull it from there ;)