E54 Tunerlock Help

[jake9713]

Hi guys,
I have one of those E54 duramax PCM's, looking to bypass the tunerlock on. I popped the cover off and was going to try the LS1 style ground pin trick to read it, but the board doesnt have the spot to ground to. Does anyone know if the grounding pin is just simply relocated? Or is brute force the only way to get a custom key out of the module?

[ironduke]

Intech here has read one using the bootpin.. No idea where it is though.. Maybe he will chime in here..

It is possible though..

[jake9713]

Thanks brother! I feel like it would almost have to be just simply relocated on the board somewhere..

[kur4o]

You can try bruteforcing the seed/key.
Are you sure it is tunerlocked. These pcms are notorious for corrupting eeprom data for no reason.

[jake9713]

Just trying to save 7 days of bruting lol
Allegedly it is tuner locked according to our customer, when we try to read it does flag for wrong key

[kur4o]

Tracing ground pin is the only option. It is tied to some pin of the flash chip. The pin that reads last segment of bin.
When you ground the pin, cpu reads data as FF, and triggers boot block recovery.

[jake9713]

In that case, could I simply lookup the flash chip datasheet, find its corresponding leg, and trace it to a common pad? Wonder how I would identify which leg that may be. Maybe by comparing it to the P01/P59 flash chip?
Wonder if the same process would work for the E38 style ECMs as well

[kur4o]

Some trials will be needed. All gm use the same logic for boot recovery.

Address pins are some times in scrambled order, but with careful board examination it won`t be that hard to find the correct pin. for safety reason you can add some resistor to limit current flow. You don`t want to short some b+ or 5v rails.

[In-Tech]

Sorry Guys/Gals,
I've been really sick since January, still am...4 trips to the ER.
I thought I had a pic of the bootpin location, I can't find it and I haven't had an E54 in a couple years

[In-Tech]

Hiya,
Can you take a picture of the top side of the board where the flash chip is?