How to Bypass and Remove Tuner lock from an LS Pcm

160plus
Posts: 90
Joined: Thu Sep 21, 2017 3:00 pm

How to Bypass and Remove Tuner lock from an LS Pcm

Post by 160plus »

The following method will work to temporally bypass the security check commonly used as a method to lock a pcm by tuner's wanting to hide their work. It will also work to unlock a pcm if the KEY becomes corrupted for what ever reason. You will be able to read the bin file out from the pcm with commercial tools, you will also be able to write back to the pcm with commercial tools but it will have to be done in a "Recovery" mode FULL FLASH. Now depending on the software you use to flash the pcm it may also change the Seed and Key back to stock values that can be calculated in a normal manner but again that will depend on the tool used and what version of the software you are running.

This method will work on the P01 512K pcm as well as on the P59 1mb pcm


ENJOY :thumbup:

[youtube]https://www.youtube.com/watch?v=oGeMK6LvQck[/youtube]
160plus
Posts: 90
Joined: Thu Sep 21, 2017 3:00 pm

Re: How to Bypass and Remove Tuner lock from an LS Pcm

Post by 160plus »

This can also be taken a step further when using the previous method in conjunction with an Android App I have been developing over the last couple of months. The P01 pcm's can have the tuner lock easily removed in just a couple of minutes, the same method to force unlock the pcm I covered in my previous post is used. While the PCM is in the unlocked state it won't respond to normal commands but it can be written to if your program is expecting the PCM to be in this state.

The P59 can also be done with a similar method but it is a lot more involved on the software side. In time a method for this pcm will also be added into LS Droid but for the time being this should be considered exclusive to the P01 pcm's only.

I need to clean up a few things in the App and write up some basic usage instructions but expect this to be avaible for download in the next week or two https://github.com/LegacyNsfw/PcmHacks/ ... roid_Tools.

[youtube]https://www.youtube.com/watch?v=11GoY_rElKc[/youtube]
julespatch
Posts: 159
Joined: Fri Aug 25, 2017 5:28 pm
cars: liberty gen 5
Location: Adelaide

Re: How to Bypass and Remove Tuner lock from an LS Pcm

Post by julespatch »

Nice! I'll try this out in the next few days. thank you mate
User avatar
Tre-Cool
Posts: 265
Joined: Tue Oct 16, 2012 12:17 pm
cars: VY SS UTE, VX Drag Car
Location: Perth
Contact:

Re: How to Bypass and Remove Tuner lock from an LS Pcm

Post by Tre-Cool »

very cool, with the age of the old ls1 controllers now I stopped locking my stuff a while ago. I don't even bother locking the e38's now too.

I still however have to unlock a bunch of them for other shops though.
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: How to Bypass and Remove Tuner lock from an LS Pcm

Post by VX L67 Getrag »

If this works in the way it does as described, even if the controller is bricked if you force it to recieve the key pass message it will force a write entire of full file(if selected) & then recover bricked controllers.

I wonder where the pin is located on the E38 controllers to be able to do the same thing?
Dylan
Posts: 3355
Joined: Mon Aug 02, 2010 6:35 pm
cars: VR Commodore V8

Re: How to Bypass and Remove Tuner lock from an LS Pcm

Post by Dylan »

Unlocked plenty with that pin, although I've never tried to write while in recovery like that
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: How to Bypass and Remove Tuner lock from an LS Pcm

Post by antus »

It wont fix a full brick, the boot portion of the os needs to run and believe the initial calibration is not loaded then it gets ready for the initial load on the factory floor. The jump shorts an address pin that breaks the cal segment programmed check (higher address) but only while its pulled low at power on when the check occurs. When you go to read or write the full chip is normally accessible again.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
MudDuck514
Posts: 397
Joined: Wed Jul 05, 2017 8:30 am
cars: 2001 Pontiac Grand AM SE
LD9 2.4l I4, 4T40E
2005 Chevrolet Venture
LA1 3400 V6, 4T65E
Location: North TX, USA

Re: How to Bypass and Remove Tuner lock from an LS Pcm

Post by MudDuck514 »

Hi all,

Will this Android App work with USB devices (such as the AllPro you all have been working on) or ONLY Bluetooth devices?

If only Bluetooth, how difficult is it to add theBT Module to the AllPro USB? (I noticed someone had ordered BOTH in the main dev thread)

Mike.
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

Re: How to Bypass and Remove Tuner lock from an LS Pcm

Post by Vampyre »

any idea where this pin runs to, I want to try this on a v6 pcm but schematic is different
Thomas
Posts: 2
Joined: Mon May 17, 2021 2:57 pm
cars: Vn group commodore

Re: How to Bypass and Remove Tuner lock from an LS Pcm

Post by Thomas »

Hi
I tried this with a friends ecu. Manage to bypass the lock and read the ecu but after saving the tune it wouldn’t open it because the file was tuner locked. Have you had that before?
I’m using hp tuner
Post Reply