Bosch MD1/MG1 Engine Control Units manufactured from June 2020 onward incorporate strict hardware security modules (HSM) and software access controls. Unlocking these units via Boot mode bypasses digital seed-key verification, granting direct access to internal Flash and EEPROM memory. Today, three leading diagnostic platforms—OBDSTAR, FormulaFlash, and Flex—have expanded support for TriCore TC298 and TC299-based Bosch MD1/MG1 control units across major vehicle platforms.
1.OBDSTAR
- Compatible devices: X300 Classic G3, ECU Master, DC706 ECU Tool
All require RH850/V850 Adapter Kit (C4-06 Adapter), OBDSTAR G3 and DC706 also require MP001 programmer (ECU Master does not need).
- Target Platforms: TriCore Aurix TC298 / TC299
- Access Level: Direct Software Unlock, Read, and Write
- Supported Models:
-
- BMW MD1CP032 | B57 Engine | TC299 | All Configurations
- BMW MG1CS024 | B48 / B58 Engine | TC298 | All Configurations
- BMW MG1CS201 | B48 / B58 Engine | TC298 | All Configurations
- FCA MD1CS069 | MultiJet / Diesel | TC299 | All Configurations
- Ford MD1CP006 | PowerStroke / Diesel | TC298 | All Configurations
- Isuzu MD1CS089 | Commercial Engines | TC299 | Restricted to ECU MASTER C
For 2021+ encrypted BMW B48 B57 B58 TC298TP TC299TP ECUs
Functions:
- Read/write data
- Read ISN
Require the tools below:
- OBDSTAR G3/DC706 +MP001 Programmer+C4-06 Adapter+ ECM-003 wiring hraness
- or OBDSTAR ECU Master Full Version/Configuration A+MP001 Programmer+C4-06 Adapter+ ECM-003+BENCH-D V1 Cable
Supported ECU Modules:
- BOSCH MD1CP032 TC299TP
- BOSCH MG1CS024 TC298TP
- BOSCH MG1CS201 TC298TP
- FormulaFlash ECU Programmer (update coming soon)
- Execution Mode: Boot Mode Unlock
- Functions: Software Security Unlock, Full Flash Read, Full Flash Write, Automated Checksum Calculation
- Active Hardware Requirements: Active FormulaFlash software subscription
- Supported Models:
- VAG MG1CS163 (TC298) & MG1CS031 H80 (TC298)
- BMW MD1CP032 (TC299) & MG1CS024 (TC298)
- Ford MD1CP006 (TC298)
- JLR MD1CP017 (TC298) & MD1CP007 (TC298)
- Stellantis MG1CS042 (TC298)
- Isuzu MD1CS089 (TC299)
- FCA MD1CS069 (TC299 – Fiat Ducato)
- Protocol Identifier: Boot Glitch-Bench
- Hardware Interface: Port E using adapter FLX4.1 (Included in Flex Kit)
- Glitch Lock Interval: 10s to 25 minutes (Hardware state dependent)
- Read / Write Cycles: ~2 min 30 sec (Read) | ~2 min 00 sec (Write)
- Memory Support: Internal Flash (R/W/Checksum), Internal EEPROM (R/W), Full Backup
- Software Packages: FLS0.5M (Master) / FLS0.5S (Slave). New users: Full Hardware Kit + Software Package bundles available (FLEX Full Version Master/FLEX Full Version Slave).
Update Info:
| Version | ECU Protocol | Chip | Example Vehicle Applications |
| v8.1.0.0 | FCA MD1CS069 | TC299 | Fiat Ducato V 2.2L MultiJet III |
| BMW MD1CS001 | TC298 | BMW 220d MHEV (2021), 420d (2020) | |
| Ford MD1CP006 | TC298 | Ford F-250 / F-350 6.7L V8 (2023) | |
| v8.2.0.0 | Porsche MG1CP007 | TC299 | Porsche Cayenne GTS V8 (2017) |
| Porsche MG1CS047 | TC299 | Porsche 911 Carrera 992 (2020) | |
| Porsche/VAG MG1CS008 | TC299 | Audi RSQ8, Urus, Bentayga, 718 GTS | |
| v8.3.0.0 | BMW MG1CS049 | TC298 | BMW M2 G87 (2023), BMW M4 G82 (2021) |
| Isuzu MD1CS089 | TC299 | Isuzu D-Max III (2020), MG Gloster | |
| v8.4.0.0 | VAG MD1CS014 | TC299 | VW Touareg III, Audi S7 C8, SQ5, Q8 |
| v8.6.0.0 | VAG MG1CS011 | TC298 | Audi A3 8Y, A5 F5, Formentor, Leon |
| v8.8.0.0 | MAN MD1CE100 | TC299 | MAN Trucks TGL, TGM, TGX (2020-2021) |
Flex Standard Base Compatibility List
- ECU Variants: MD1CE101, MD1CS069, MD1CS005, MG1CS024, MG1CS201, MD1CP032, MG1CS002 H80, MG1CS031 H80, MG1CS163, MD1CS004 H80, MD1CS003, MG1CS042, MD1CP007, MD1CP017, MG1CS028, MD1CS012.
- Base Fleet Applications: Audi RS3 8YA 2.5L TFSI (2021), BMW 118i F40 (2021), Cupra Formentor 2.0L TDI (2021), DS 9 1.6L PHEV (2021), Iveco Eurocargo 4.5L (2021), Land Rover Defender L663 3.0L (2021), Opel Corsa F 1.5L (2021), Peugeot 308 III 1.6L PHEV (2021), Peugeot Partner III 1.5L (2021), VW Golf VIII 2.0L TDI (2021).
Click here to check the complete vehicle list.
How to unlock BMW B48 B58 ECUs by Flex?
Essential Operational Recommendations
To prevent ECU bricking or communication timeouts during the Boot unlock sequence:
1.Power Supply Stabilization:
Maintain a continuous, regulated power supply between 13.5V and 13.8V throughout the entire glitching and bench cycle.
2.Hardware Continuity:
Verify FLX4.1 cable integrity and Port E contact pins prior to initiating the Boot connection sequence.
3.Mandatory Backup:
Always perform a Full EEPROM and Flash Backup immediately after the initial Boot unlock before executing any custom calibration writes.
4.Connection Timeout Protocol:
Glitch execution times vary (10s to 25m). Do not disconnect power or terminate software routines prematurely during the connection phase.
