Recovery boot pin locations

[antus]

This is old news but I can't find a good on-site thread with the details so I am starting a new one here.

Most VPW type GM PCMs have a bootloader with build in functionality to see if the flash memory is corrupt or requires first time programming on the production line when the PCM starts up. This feature can be abused to hack around the software lock in the operating system for read and write operations. It is often used to fix a corrupted PCM when the seed is damaged. I'll add to this list over time.

What is happening? The flash memory has a an address bus with a number of pins which the CPU uses to ask the flash to respond with the data at a given address. The data bus is pulled high, meaning by default each pin as a value of '1'. When the CPU wants to set an address bit to 0 it will put a ground signal on the pin, which changes the state to a '0'. In this case we are using a physical wire to put the ground state on the pin. The pin is Address pin A12.This means that memory reads where Address pin 12 is a '1' (which is all addresses above the boot sector) will instead get a '0' in that location and read from a different address. This means 2 things. Firstly the operating system code that runs above this address will crash due to the CPU reading the wrong opcodes. The PCM has protection against this kind of corruption (known as the watchdog, or sometimes COP - Computer Operating Properly). So the watch dog wont get updated as it does every couple of milliseconds during normal operation, and it hardware resets the PCM. Next the bootloader initialises the PCM. It is at the start of the chip, so all of its code is below the section where A12 matters, so it runs properly. Then it looks for the 'calibration OK' signature at the end of the calibration segement, and the 'OS OK' signature at the end of the OS segment. One or both of these are affected by A12 being forced to 0, so the bootloader sees a (temporary) problem and does not hand off to the operating system. Instead it opens the door for remote programming to recover the system. This all happens quicker than we humans can move, so all we need to do is connect the end of a wire to ground, then touch the other end of the wire to the pin in the picture, and the PCM will reboot in to recovery ready for PCM Hammer (or other software) to begin a recovery read or write operation. The moment we lift our wire off the flash is operating normally again, so a read bin will be able to read the entire flash correctly, or write it correctly.

P01:

Recovery Boot P01.jpg

P59:

Recovery boot P59.jpg

P08:

Recovery boot P08.jpg

These PCMs are believed to not have a recovery mode:
P04
Black Box (4 pin)

These PCMs are believed to have it, but we still need to gather the documentation. If you have that information let us know.
E54
P10
P12

[darkman5001]

I still have the boards from the P10 and P12 that I dismantled to help PCM Hammer development of the P10 and the P12. Maybe I can take a look at these boards and pins off the CPUs for both and come up with something that I can test.

[antus]

Yep that'd be cool. I remember using this mode in development, it may be documented on the site somewhere, too. I just havn't had the time to search. Even if you can find a thread with the info I'll make up a pic like the above and store it here.

[Ken]

These PCMs are believed to not have a recovery mode:
P04
Black Box (4 pin)

I Haven't had the chance to validate this yet, though found this some time ago.

2005_Buick_P04_Unlock_Pin.JPG

Edit,
Another P04 pic, intel.

P04 BDM Pinout Fixed.jpg

These PCMs are believed to have it, but we still need to gather the documentation. If you have that information let us know.
E54
P10
P12

Edit2:
Found some E54 screens.

E54_Flash_Chip.JPG

E54-Mainboard-Back_New.JPG

I have a folder on one of my laptops with more unlock pin screens, i'll have to go digging I guess.
Haven't yet had the chance to test any of the above, though when I found them, was posted as having been tested by the original poster of the info.

[04silverado6.0]

I have successfully unlocked a e54 with this method. Can confirm that the photo is correct.

[antus]

P05 and P12 viewtopic.php?p=133842#p133842

[Backwoodsracing]

P08 Ground Pin that has worked for me

IMG_0919.jpeg

P12 Ground Pin

IMG_0295.jpeg

E37 Ground Pin

IMG_1511.jpeg

97 V6 Car

IMG_7023.jpeg

Black Box Ground Pin

IMG_6995.jpeg

[Backwoodsracing]

These PCMs are believed to not have a recovery mode:
P04
Black Box (4 pin)

I Haven't had the chance to validate this yet, though found this some time ago.

2005_Buick_P04_Unlock_Pin.JPG

Edit,
Another P04 pic, intel.

P04 BDM Pinout Fixed.jpg

These PCMs are believed to have it, but we still need to gather the documentation. If you have that information let us know.
E54
P10
P12

Edit2:
Found some E54 screens.

E54_Flash_Chip.JPG

E54-Mainboard-Back_New.JPG

I have a folder on one of my laptops with more unlock pin screens, i'll have to go digging I guess.
Haven't yet had the chance to test any of the above, though when I found them, was posted as having been tested by the original poster of the info.

The P04 is the correct Ground Pin I’ve used it many of times.

[ProfessWRX]

These PCMs are believed to not have a recovery mode:
P04
Black Box (4 pin)

I Haven't had the chance to validate this yet, though found this some time ago.

2005_Buick_P04_Unlock_Pin.JPG

Edit,
Another P04 pic, intel.

P04 BDM Pinout Fixed.jpg

These PCMs are believed to have it, but we still need to gather the documentation. If you have that information let us know.
E54
P10
P12

Edit2:
Found some E54 screens.

E54_Flash_Chip.JPG

E54-Mainboard-Back_New.JPG

I have a folder on one of my laptops with more unlock pin screens, i'll have to go digging I guess.
Haven't yet had the chance to test any of the above, though when I found them, was posted as having been tested by the original poster of the info.

The P04 is the correct Ground Pin I’ve used it many of times.

Is there a certain way of doing it with the p04? It didn’t work on either of my PCMs with bad flashes. I’ve done it twice on my p59 pcm so I assumed the setup was the same.


Edit: One week later tried again. This time it worked the 3rd attempt. There must be a window of when to release the ground that I was missing or got lucky on this time. About to try my other brick.

Edit 2: Second PCM worked on the 5th attempt. Not too dissimilar to the first one, but different enough for me to not be able to tell what i did right or wrong.

[Kdog]

i have recovered p04 aswell but idk if it was posted pin location or this one