I inspected the activation flows implemented in the program. Activation is done over an SSH connection (Renci.SshNet) after an iproxy port-forward; file transfers use Renci.SshNet ScpClient (not a shell scp binary). Below I list the relevant scp (Upload/Download) operations and every SSH command string executed by the code, grouped into the two activation paths and put in the order the code runs them (using the same variable names the code uses).
Notes:
•	local port forwarding is started with iproxy.exe (e.g. iproxy.exe 2222 22 or iproxy.exe 2222 86) before any SSH/SCP work.
•	the SSH connection is to 127.0.0.1 at the forwarded local port (default in code: 2222). Credentials used in code: root with password alpine or TgRam2022 depending on the method/version.
•	scp operations shown are calls to ScpClient.Upload(...) / ScpClient.Download(...).
1.	Hello-screen activation flow (called from method_8(), invoked by FRM_Onii "hello_activation")
Pre-SSH preparatory step:
•	Start iproxy: iproxy.exe <localPort> 22 or iproxy.exe <localPort> 86 (code uses int_0 e.g. 2222 → device port 22/86)
SSH / SCP sequence (approximate order executed in method_8()):
•	(SSH) find internal container path:
•	find /mnt2/containers/Data/System -iname 'internal' (used to compute text2 / internal path)
•	(SSH) cleanup any previous uploads:
•	rm -rf /mnt2/mobile/Media/Downloads/hello_screen
•	rm -rf /mnt2/mobile/Media/hello_screen
•	(SSH) create remote staging dir:
•	mkdir /mnt2/mobile/Media/Downloads/hello_screen
•	(SCP Upload) upload local ActivationFiles/<UDID>/ directory to:
•	Upload local .\ActivationFiles\<udid>\ → remote /mnt2/mobile/Media/Downloads/hello_screen/ (via ScpClient.Upload(new DirectoryInfo(...), "/mnt2/mobile/Media/Downloads/hello_screen/"))
•	(SSH) move into final location and fix ownership/permissions:
•	mv -f /mnt2/mobile/Media/Downloads/hello_screen /mnt2/mobile/Media/hello_screen
•	chown -R mobile:mobile /mnt2/mobile/Media/hello_screen
•	chmod -R 755 /mnt2/mobile/Media/hello_screen
•	chmod 644 /mnt2/mobile/Media/hello_screen/activation_record.plist
•	chmod 644 /mnt2/mobile/Media/hello_screen/Wildcard.der
•	(SSH) FairPlay / IC-Info.sisv handling:
•	rm -rf /mnt2/mobile/Library/FairPlay
•	mkdir -p -m 00755 /mnt2/mobile/Library/FairPlay/iTunes_Control/iTunes
•	mv -f /mnt2/mobile/Media/hello_screen/IC-Info.sisv /mnt2/mobile/Library/FairPlay/iTunes_Control/iTunes/
•	chmod 00664 /mnt2/mobile/Library/FairPlay/iTunes_Control/iTunes/IC-Info.sisv
•	chown -R mobile:mobile /mnt2/mobile/Library/FairPlay
•	(SSH) activation records placement:
•	rm -rf <text2>/Library/activation_records  (where <text2> is the internal path found earlier)
•	mkdir <text2>/Library/activation_records
•	chflags nouchg <text2>/Library/activation_records
•	mv -f /mnt2/mobile/Media/hello_screen/activation_record.plist <text2>/Library/activation_records/activation_record.plist
•	mv -f /mnt2/mobile/Media/hello_screen/com.apple.purplebuddy.plist /mnt2/mobile/Library/Preferences/com.apple.purplebuddy.plist
•	chmod 755 <text2>/Library/activation_records/activation_record.plist
•	chmod 777 <text2>/Library/activation_records/activation_record.plist
•	chflags uchg <text2>/Library/activation_records/activation_record.plist
•	(SSH) commcenter plist edits and activation ticket injection:
•	chflags nouchg /mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
•	plutil -dict -kPostponementTicket /mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
•	plutil -kPostponementTicket -ActivationState -string Activated /mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
•	plutil -kPostponementTicket -ActivityURL -string https://albert.apple.com/deviceservices/activity /mnt2/wireless/.../com.apple.commcenter.device_specific_nobackup.plist
•	plutil -kPostponementTicket -PhoneNumberNotificationURL -string https://albert.apple.com/deviceservices/phoneHome /mnt2/wireless/.../com.apple.commcenter.device_specific_nobackup.plist
•	plutil -kPostponementTicket -ActivationTicket -string '$(cat /mnt2/mobile/Media/hello_screen/Wildcard.der)' /mnt2/wireless/.../com.apple.commcenter.device_specific_nobackup.plist
•	(SSH) update data_ark.plist build/activation flags (several commands; combine find/ls/plutil):
•	key=$(find /mnt2/containers/Data/System -iname 'data_ark.plist'); build=$(ls /mnt2/root/Library/Caches/com.apple.coresymbolicationd); plutil -' - BuildVersion' -string $build $key (code contains several plutil manipulations: remove/set ActivationState, remove BrickState, set ActivationState string Activated, run plutil -binary $key)
•	(SSH) final chflags and baseband handling:
•	chflags uchg /var/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
•	chflags uchg <text2>/Library /internal/data_ark.plist
•	if device SN equals F97SF2AQFFGD then:
•	chflags -R nouchg /mnt6/*/usr/local/standalone/firmware/
•	mv -f /mnt6/$(cat /mnt6/active)/usr/local/standalone/firmware/Baseband /mnt6/$(cat /mnt6/active)/usr/local/standalone/firmware/Baseband2
•	else:
•	chmod 644 /mnt2/mobile/Media/hello_screen/com.apple.commcenter.device_specific_nobackup.plist
•	mv -f /mnt2/mobile/Media/hello_screen/com.apple.commcenter.device_specific_nobackup.plist /mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
•	chflags -R nouchg /mnt6/*/usr/local/standalone/firmware/
•	mv -f /mnt6/$(cat /mnt6/active)/usr/local/standalone/firmware/Baseband /mnt6/$(cat /mnt6/active)/usr/local/standalone/firmware/Baseband2
•	(SSH) reboot to apply changes:
•	kill 1
2.	Activation from backup (restore a previously saved backup) — main flow (method_7() / method_0(string)):
Pre-SSH preparatory step:
•	Start iproxy: iproxy.exe <localPort> 22 or iproxy.exe <localPort> 86 (based on device / iOS version)
SSH / SCP sequence (approximate order executed):
•	(SSH) find internal container path:
•	find /mnt2/containers/Data/System -iname 'internal' (to get text5)
•	(SSH) find activation and data_ark:
•	find /mnt2/containers/Data/System -name activation_record.plist
•	find /mnt2/containers/Data/System -name data_ark.plist
•	(SCP Download) when creating a backup (Class21.method_0):
•	scpClient.Download( text5 + "Library/activation_records/activation_record.plist", local "\\Backups\\<ecid>\\1" )
•	scpClient.Download( "/mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist", local "\\Backups\\<ecid>\\3" )
•	scpClient.Download( text5 + "Library/internal/data_ark.plist", local "\\Backups\\<ecid>\\2" )
•	and later scpClient.Download("/mnt2/mobile/Library/FairPlay", new DirectoryInfo(...\\FairPlay\\"))
•	(SCP Upload) when restoring (Class21.method_7):
•	Upload local .\Backups\<ecid>\ → remote /mnt2/mobile/Media/Downloads/<ecid> (via ScpClient.Upload(new DirectoryInfo(Backups\<ecid>), "/mnt2/mobile/Media/Downloads/<ecid>"))
•	(SSH) move uploaded backup into place and fix ownership/permissions:
•	mv -f /mnt2/mobile/Media/Downloads/<ecid> /mnt2/mobile/Media/<ecid>
•	chown -R mobile:mobile /mnt2/mobile/Media/<ecid>
•	chmod -R 755 /mnt2/mobile/Media/<ecid>
•	chmod 644 /mnt2/mobile/Media/<ecid>/1
•	chmod 644 /mnt2/mobile/Media/<ecid>/2
•	chmod 644 /mnt2/mobile/Media/<ecid>/3
•	(SSH) same FairPlay and activation injection steps as above:
•	rm -rf /mnt2/mobile/Library/FairPlay
•	mv -f /mnt2/mobile/Media/<ecid>/FairPlay /mnt2/mobile/Library/
•	chmod -R 755 /mnt2/mobile/Library/FairPlay/
•	chown -R mobile:mobile /mnt2/mobile/Library/FairPlay
•	chmod 664 /mnt2/mobile/Library/FairPlay/iTunes_Control/iTunes/IC-Info.sisv
•	chflags nouchg <text5>/Library /internal/data_ark.plist
•	mv -f /mnt2/mobile/Media/<ecid>/2 <text5>/Library/internal/data_ark.plist
•	chmod 755 <text5>/Library/internal/data_ark.plist
•	chflags uchg <text5>/Library/internal/data_ark.plist
•	mkdir <text5>/Library/activation_records
•	mv -f /mnt2/mobile/Media/<ecid>/1 <text5>/Library/activation_records/activation_record.plist
•	chmod 755 <text5>/Library/activation_records/activation_record.plist
•	chmod 777 <text5>/Library/activation_records/activation_record.plist
•	chflags uchg <text5>/Library/activation_records/activation_record.plist
•	chflags nouchg /mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
•	mv -f /mnt2/mobile/Media/<ecid>/3 /mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
•	chown root:mobile /mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
•	chmod 755 /mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
•	chflags uchg /mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
•	(SSH) service reloads / cleanup:
•	launchctl unload /mnt1/System/Library/LaunchDaemons/com.apple.mobileactivationd.plist > /dev/null 2>&1
•	launchctl load /mnt1/System/Library/LaunchDaemons/com.apple.mobileactivationd.plist
•	mv -f /mnt2/mobile/Media/<ecid>/com.apple.purplebuddy.plist /mnt2/mobile/Library/Preferences/com.apple.purplebuddy.plist
•	rm -rf /mnt2/root/Library/Preferences/com.apple.MobileAsset.plist
•	chmod 600 /mnt2/mobile/Library/Preferences/com.apple.purplebuddy.plist
•	/usr/bin/uicache --all && chflags uchg /mnt2/mobile/Library/Preferences/com.apple.purplebuddy.plist
•	rm -rf /mnt2/root/Library/Preferences/com.apple.MobileAsset.plist
•	/bin/chmod 600 /mnt2/root/Library/Preferences/com.apple.MobileAsset.plist
•	/bin/launchctl unload -w /mnt1/System/Library/LaunchDaemons/com.apple.mobile.obliteration.plist
•	/bin/launchctl unload -w /mnt1/System/Library/LaunchDaemons/com.apple.mobile.softwareupdated.plist
•	/bin/launchctl unload -w /mnt1/System/Library/LaunchDaemons/com.apple.OTATaskingAgent.plist
•	/bin/launchctl unload -w /mnt1/System/Library/LaunchDaemons/com.apple.OTACrachCopier.plist
•	/bin/launchctl unload /mnt1/System/Library/LaunchDaemons/com.apple.CommCenter.plist
•	(SSH) final reboot:
•	kill 1
Other lower-level SSH commands used elsewhere (mounting etc.)
•	Disk mount and partition inspection commands used earlier in method_3(string) and related:
•	/sbin/mount_apfs -R /dev/<disk>s1 /mnt1
•	/System/Library/Filesystems/apfs.fs/apfs.util -p /dev/<disk>s1 (and similar for s2..s7)
•	/sbin/mount_apfs -R /dev/<disk>sXsY /mnt6 /mnt7 /mnt5 etc.
•	/usr/libexec/seputil --gigalocker-init
•	/usr/libexec/seputil --load /mnt6/*/usr/standalone/firmware/sep*
•	mount_filesystems
•	/sbin/mount_apfs -R /dev/disk0s1s2 /mnt2
•	/sbin/mount_apfs /dev/disk1s2 /mnt2
•	/usr/sbin/nvram oblit-inprogress=1 rev=2 and related nvram commands
ScpClient download/upload calls used in code (summary):
•	Downloads:
•	/mnt2/mobile/Library/FairPlay → local .\Backups\<ecid>\FairPlay\  (Directory download)
•	<internalPath>Library/activation_records/activation_record.plist → local .\Backups\<ecid>\1 (file)
•	<internalPath>Library/internal/data_ark.plist → local .\Backups\<ecid>\2
•	/mnt2/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist → local .\Backups\<ecid>\3
•	Uploads:
•	local .\Backups\<ecid>\ → remote /mnt2/mobile/Media/Downloads/<ecid> (directory upload)
•	local .\ActivationFiles\<udid>\ → remote /mnt2/mobile/Media/Downloads/hello_screen/ (directory upload)
That is the complete set of scp (ScpClient) operations and the SSH commands the code builds and executes for the two main activation flows. If you want, I can extract these into a single linear script (with placeholders) in the exact order the code would execute them for one chosen flow (hello activation or backup restore).