Another good trick is to replace the crystal with a bit stream. If you can identify the cycle where the security bits are being read you can insert a runt puls

Another good trick is to replace the crystal with a bit stream. If you can identify the cycle where the security bits are being read you can insert a runt pulse that is much faster than the norflash read time.