There are a few excellent threads on this process over on GMTnation actually, in fact I joined over there before I joined over here because they were the best data I could find. But they don't do much in the way of custom tuning and ROM reverse engineering so here I am. The basic process is, if you have a tool that already supports the PID you want, you use an OBD2 Y-cable with your existing tool and a ELM327 class device that allows rs232 port emulation mode on your device (that's a topic for another day, there's a lot of variance in quality and device support between both devices and OSes) and set up your filters on the elm327, record a big data collection and troll through it till you get past the setup handshaking and find the repeated requests to a small set of PIDs you don't recognize, then investigate them more closely till you figure out what they do.

The second is to cast a wide net by creating a script or program that just requests one PID after another while recording responses till it's got the whole set, then filter out the ones rejected as invalid, then begin probing each new unknown PID while exercising hardware inputs till you find the one you are looking for. It is very time consuming.

Another method I'm hoping to use is to simply reverse engineer the firmware on the ECU and find which input it is reading and where it's putting it in memory, combine that with factory service manual wiring diagrams and knowledge of OBD2 standards and you can find PIDs working backwards from the way most people do.