Comment by threeseed

I think it means to say that:

1) The got the code by bruteforcing the login credentials on device.

2) Server-side code is not accessible which is where the LAM runs.