Same trick work for oem sec_unlock?

[bm16ton]

I would very much like to remove the boot signature check so i can replace parts of the bootloader on my mate 9 with the pieces from hikey960. Unfortunately it requires a different "password" as fastboot calls it, then unlocking the bootloader did. Im not sure where the sec_unlock password is stored (maybe not even in nv, i dunno) but if it is in nv does it seem likely using the same trick of placing our own in its place would work? Anybody know what KEYB1 and KEYB2 apply to?