I forget which bit it is, but I know kur4o identified it somewhere in the first few pages. Here's steve's check in flashhack:

Code:
COMM::Sent message: F1580370CA7A
COMM::Recieved reply: F15703FEB7
CCM Software unlock: NO
COMM::Sent message: F15803644B05
COMM::Recieved reply: F157032293
CCM Hardware unlock: YES
The second read to $644b is checking for the bit that's changed when the reman pin is grounded.

The first is the eeprom lock, which is toggled back to FE when > ~100 miles are accumulated.

I'm having a difficult time building flashhack so may be beating my head against a wall most of the evening.