As I am running system 7.0, and I had already got the tsec_key, secure_boot_key, device_key.
I can replace save but can't sign it as it Required more key. it memtioned for header key, but from the post above and readme in hactoolnet, only tsec_key, secure_boot_key, device_key is ok. may I know...