I know BULLYDOG came out directly and said they have read the ECM in house, but are storing the base tunes inside the flash unit. So maybe they cracked an ECM open to read the chip directly instead of going through the CAN BUS. H&S said they got them from a database, so who knows.

