The breakthrough came at 2:00 AM. After hours of scouring obscure forums and translating technical docs, he found the exploit. By interrupting the U-Boot sequence and injecting a custom kernel image via TFTP, he bypassed the signature check.