E54 Tunerlock Help

[In-Tech]

These pcms are notorious for corrupting eeprom data for no reason.

^^^^^^^^^^^ Yes!!! The parameters area goes FUBAR for no apparent reason.

[In-Tech]

Hiya,
Surely someone has one of these E54's laying around to take a pic of the board and traces of the flash chip. I found some of my hand written notes. It turns out that was back in 2020 and I got sidetracked with Gampy working on reading with PCM hammer, hence no pics. Anyway, I think I can confirm my notes with a pic.
Thanks

[Gampy]

I have an E54 setting withing arms reach, I just don't have the physical ability to do the rest ... Got lucky, my oldest son did it as I asked, that's unusual.

Will these get it done ??

Anything else ask, I'll see what I can do!

-Enjoy

[In-Tech]

Thank You Gampy,
Those pics are perfect. I'll report back soon

[In-Tech]

Hiya's
Sorry for the delay, it's been a couple really sick days.
Gampy, if you like you could clean up my pics and also ohm the pin to the inspection side and make sure I did that correctly. Thanks again Bud.

E54_Flash_Chip.JPG (128.05 KiB) Viewed 771 times

E54-Mainboard-Back_New.JPG (273.77 KiB) Viewed 936 times

[In-Tech]

Hello,
I'm sure most of you know, I am posting anyway for future. Feel free to correct me on any errors in my thoughts. I'm sure some are wondering how you go about picking pin locations to try. Soooo, find the data sheet for the flash chip...All of the Ax pins are data storage on the flash chip. Holding them low(ground) makes the CPU see it as a blank(00 or FF I don't know). The data is still there, it's just a matter of picking the right one that throws it temporarily into engineering mode. Some of the data pins can make it go crazy and require a hard reboot(BATT and IGN). Don't go poking around on the other pins. This one happened to be right next door to the p01/p59 boot pin so I stumbled across it pretty quick

[In-Tech]

Here's another data sheet I found. It appears blanking the parameters(VIN,Seed/Key etc) section is the secret

AMD-AM29F400BB-SectorAddressTable.png (34.29 KiB) Viewed 885 times

[In-Tech]

Hiya's
Did anyone try this yet?
Am I a thread killer or what?

[antus]

The OP hasn't been back on the site for a while, but I am sure the information you gave is good. The only thing i'd add is your tampering with the address bus, not the data bus, so the CPU still reads data back, just it's the wrong data. Initially this causes a crash which resets the PCM and runs the boot code (which is addressed below the range we are glitching, below 0x4000) and then the boot code looks for the "successful write" signature which the OEM tools write as the last step when they flash the PCM. But the data that comes back is from another part of the flash chip. So then the boot code assumes its still on the factory floor for a first time flash and opens up for the initial factory load. Except the glitch we caused was only temporary and as soon as the jumper wire is gone the PCM keeps running off the boot code, but tada! the whole original unmodified flash chip is accessible again. We have to glitch the address line, because if we glitched the data, then all reads would affected and the boot code would not be able to run.

[Gampy]

Sorry no longer have the mental capacity to do so ...

-Enjoy