|
The way I've got it setup, it'll try reading the ISN/SK from the real location first, and if that returns FFs (which it will if my patches haven't been written), then it'll dump RAM from the left / injection CPU and do a pattern search. I haven't had that fail on me yet, but maybe there's an odd program version I don't have access to where they actually do clear it from RAM.
I do patch the read routine to allow that section to be read out when doing the RSA bypass, so on an already patched DME it will read the ISN/SK directly rather than searching the RAM for it.
|