Have you looked at any of the files under the N5's /vendor/firmware directory? Specifically, I believe the .bXX and .mdt files are modules that can be runtime-loaded into the secure element. .b00 and .mdt always seem to be some ELF wrapped file. They look to contain X.509 certificates so I'm guessing you can't just ask qseecom to load arbitrary files... without an exploit in the TZ. ;-) /vendor/firmware/discretix/dxhdcp2.b02 is interesting because it has many strings in plaintext and other bytes that seem to disassemble to valid Thumb-2 code. Is TZ code all Thumb or can you mix Thumb and ARM like in regular context?