Default {Q}How it reads DRM keys and gets bootloader state?

How ServiceMenu.apk gets bootloader state? And how other apps read DRM keys? I mean i`ve decomiled ServiceMenu.apk and still can`t understand it..where it reads it from? If we know it we can simulate normal DRM keys