Bosch MD1/MG1 Engine Control Units manufactured from June 2020 onward incorporate strict hardware security modules (HSM) and software access controls. Unlocking these units via Boot mode bypasses digital seed-key verification, granting direct access to internal Flash and EEPROM memory. Today, three leading diagnostic platforms—OBDSTAR, FormulaFlash, and Flex—have expanded support for TriCore TC298 and TC299-based Bosch MD1/MG1 control units across major vehicle platforms.
1.OBDSTAR
- Compatible devices: X300 Classic G3, ECU Master, DC706 ECU Tool
Require RH850/V850 Adapter Kit (C4-06 Adapter).
- Target Platforms: TriCore Aurix TC298 / TC299
- Access Level: Direct Software Unlock, Read, and Write
- Supported Models:
-
- BMW MD1CP032 | B57 Engine | TC299 | All Configurations
- BMW MG1CS024 | B48 / B58 Engine | TC298 | All Configurations
- BMW MG1CS201 | B48 / B58 Engine | TC298 | All Configurations
- FCA MD1CS069 | MultiJet / Diesel | TC299 | All Configurations
- Ford MD1CP006 | PowerStroke / Diesel | TC298 | All Configurations
- Isuzu MD1CS089 | Commercial Engines | TC299 | Restricted to ECU MASTER C
- FormulaFlash ECU Programmer (update coming soon)
- Execution Mode: Boot Mode Unlock
- Functions: Software Security Unlock, Full Flash Read, Full Flash Write, Automated Checksum Calculation
- Active Hardware Requirements: Active FormulaFlash software subscription
- Supported Models:
- VAG MG1CS163 (TC298) & MG1CS031 H80 (TC298)
- BMW MD1CP032 (TC299) & MG1CS024 (TC298)
- Ford MD1CP006 (TC298)
- JLR MD1CP017 (TC298) & MD1CP007 (TC298)
- Stellantis MG1CS042 (TC298)
- Isuzu MD1CS089 (TC299)
- FCA MD1CS069 (TC299 – Fiat Ducato)
- Protocol Identifier: Boot Glitch-Bench
- Hardware Interface: Port E using adapter FLX4.1 (Included in Flex Kit)
- Glitch Lock Interval: 10s to 25 minutes (Hardware state dependent)
- Read / Write Cycles: ~2 min 30 sec (Read) | ~2 min 00 sec (Write)
- Memory Support: Internal Flash (R/W/Checksum), Internal EEPROM (R/W), Full Backup
- Software Packages: FLS0.5M (Master) / FLS0.5S (Slave). New users: Full Hardware Kit + Software Package bundles available (FLEX Full Version Master/FLEX Full Version Slave).
Update Info:
| Version | ECU Protocol | Chip | Example Vehicle Applications |
| v8.1.0.0 | FCA MD1CS069 | TC299 | Fiat Ducato V 2.2L MultiJet III |
| BMW MD1CS001 | TC298 | BMW 220d MHEV (2021), 420d (2020) | |
| Ford MD1CP006 | TC298 | Ford F-250 / F-350 6.7L V8 (2023) | |
| v8.2.0.0 | Porsche MG1CP007 | TC299 | Porsche Cayenne GTS V8 (2017) |
| Porsche MG1CS047 | TC299 | Porsche 911 Carrera 992 (2020) | |
| Porsche/VAG MG1CS008 | TC299 | Audi RSQ8, Urus, Bentayga, 718 GTS | |
| v8.3.0.0 | BMW MG1CS049 | TC298 | BMW M2 G87 (2023), BMW M4 G82 (2021) |
| Isuzu MD1CS089 | TC299 | Isuzu D-Max III (2020), MG Gloster | |
| v8.4.0.0 | VAG MD1CS014 | TC299 | VW Touareg III, Audi S7 C8, SQ5, Q8 |
| v8.6.0.0 | VAG MG1CS011 | TC298 | Audi A3 8Y, A5 F5, Formentor, Leon |
| v8.8.0.0 | MAN MD1CE100 | TC299 | MAN Trucks TGL, TGM, TGX (2020-2021) |
Flex Standard Base Compatibility List
- ECU Variants: MD1CE101, MD1CS069, MD1CS005, MG1CS024, MG1CS201, MD1CP032, MG1CS002 H80, MG1CS031 H80, MG1CS163, MD1CS004 H80, MD1CS003, MG1CS042, MD1CP007, MD1CP017, MG1CS028, MD1CS012.
- Base Fleet Applications: Audi RS3 8YA 2.5L TFSI (2021), BMW 118i F40 (2021), Cupra Formentor 2.0L TDI (2021), DS 9 1.6L PHEV (2021), Iveco Eurocargo 4.5L (2021), Land Rover Defender L663 3.0L (2021), Opel Corsa F 1.5L (2021), Peugeot 308 III 1.6L PHEV (2021), Peugeot Partner III 1.5L (2021), VW Golf VIII 2.0L TDI (2021).
Click here to check the complete vehicle list.
Essential Operational Recommendations
To prevent ECU bricking or communication timeouts during the Boot unlock sequence:
1.Power Supply Stabilization:
Maintain a continuous, regulated power supply between 13.5V and 13.8V throughout the entire glitching and bench cycle.
2.Hardware Continuity:
Verify FLX4.1 cable integrity and Port E contact pins prior to initiating the Boot connection sequence.
3.Mandatory Backup:
Always perform a Full EEPROM and Flash Backup immediately after the initial Boot unlock before executing any custom calibration writes.
4.Connection Timeout Protocol:
Glitch execution times vary (10s to 25m). Do not disconnect power or terminate software routines prematurely during the connection phase.
