For 16 digit SP good chance to find it in BIN.
Exactly in AMSS. As the Binary contain Bootloaders, some Headerfiles, Partition Table...
You can check it self...
If you have BIN from handsets. Example would be R800 and R810 (many other handsets) ... So search for HEX value...
R810:
2008102120080228
You find this as HEX value in BIN... If you compare R800 it is on "same position"...
So SP is most at Start of AMSS.

So in
theory you can find
easily SP on U960
without special knowledge. Only HEX Editor is needed
AND the BIN or the first 1 MB if you can dump AMSS...
See Screenshot from R810 BIN...
AMSS starts most with visible
QCOM Textstring... Then before SP comes. you have many FFFFFFFFFFFFF

Check this out. With other known SP and leaked BINs...
Best Regards