Flex with Korhex New Update for VAG MDG1 TC298 TC299 Unlock

Korhex now supports Bosch MDG1 — TC298 and TC299 ECUs boot glitch unlocking.

Flex version 8.27.0.0 Now Available

New Korhex Access for VAG ECUs

New possibilities for VAG group MDG1 Bosch ECUs: Flex version 8.27.0.0 expands Korhex support to VAG group control units equipped with TC298 and TC299 processors.

Already supported through VFI — Voltage Fault Injection technology, these Bosch MDG1 control units can now also be unlocked using Korhex, following a procedure that reduces intervention times and avoids working directly on the PCB.

With the new Flex protocol, once unlocked the unit, the technician can proceed with read and write operations directly in Bench mode, simplifying the programming process further.

Key insights

• VAG Bosch MG1CS002 H80 — TC298
• VAG Bosch MG1CS008 — TC298
• VAG Bosch MG1CS031 H80 — TC298
• VAG Bosch MD1CS004 H80 — TC298
• VAG Bosch MD1CS014 — TC299
• Working Mode: Boot Glitch
• Memories: Read/Write/Checksum Internal Flash, Read/Write Internal EEPROM, Full Backup
• License: FLS0.20M/S — FLS0.5M/S
• Connection: ~30 seconds
• Reading Time: ~2 minutes 30 seconds
• Writing Time: ~2 minutes

Some of supported vehicles

• Audi SQ5 (II) FY (2021MY) 3.0L V6 TDI 24v MHEV 336HP
• Audi RS5 (II) F5 (2022MY) 2.9L V6 Twin-Turbo 24v 444HP
• Cupra Formentor (I) SE316 (2021MY) 2.0L TSI 16v 187HP
• Lamborghini Urus S (I) (2022MY) 4.0L V8 Twin-Turbo 32v 657HP
• Volkswagen (VW) Golf (VIII) (2021MY) 2.0L TDI 16v 197HP

Magic Motorsport Korhex MASK A-G Compatibility Guide

The Magic Motorsport Korhex boot glitch adapter has several different MASKs: A, B, C, D, E, F, G. Which ECUs does each of these MASKs support?

Check here.

A Mask: Delphi ETC3
B Mask: MG1CS032
C Mask: for feature (not available yet)
D Mask: MG1CA920
E Mask: MD1CP001
F Mask: MD1CS003
G Mask: MD1CP007/ MG1CS047

What if some MASKs are missing? No problem — you can 3D print some MASKs by yourself, like this.

Even if you don’t have a MASK at all, it’s still fine. The Magicmotorsport Help section shows you the exact point on the processor where the KORHEX probe needs to be positioned. Just follow the instructions!

Flex Korhex Red LED Error: Causes and Solutions

Problem: Tried to unlock a Mercedes MD1CP007 ECU with Flex + Korhex programmer.

What concerns me is the LED status:
Software shows Connected
Antenna: Ready
Voltage: 19 V
But the RGB LED near the USB/power connector keeps flashing red continuously
According to the Korhex manual, flashing red indicates an error condition related to voltage or antenna, while green means ready to use.
This is contradictory, because the software shows that the antenna is ready and the voltage is present, but the hardware LED still indicates an error.
Does this indicate a hardware/firmware/power issue?

Solution:

The red light will flash until you open a protocol that needs Korhex. Once you open a protocol that needs Korhex, the light will become green and when it is actually glitching it’ll become blue.

That’s normal until you open the protocol for glitching and then it will change to green.

It actually needs to see a locked ECU on id for it to even activate,
If it does an ID and knows it’s unlocked it will remain flashing red.

So the flashing red LED does not necessarily mean there is a fault — it can simply mean that Korhex is connected but not currently engaged with a locked ECU.

Korhex Boot Glitch Unlock for Bosch MD1CS069 and MD1CS089

Korhex: New Support for Bosch MD1CS069 and MD1CS089.

Flex version 8.26.0.0 is now available

Unlock Bosch MD1CS069 and MD1CS089 ECUs without working on the PCB.

With the latest Flex update, Korhex can now also be used on ECUs installed on commercial and industrial vehicles, accessing the TriCore TC299 processor through a dedicated procedure.

The new solution allows the procedure to be carried out without working on the ECU PCB, simplifying connection operations and reducing working time.

Using the reference positioning mask as indicated in the operating manual, you can identify the glitch point and connect Korhex easily and accurately. Once the connection is established, you can choose whether to complete the procedure directly in Boot Glitch mode or perform the Unlock and then continue programming in Bench mode.

No work on the PCB, fewer steps, and greater operational flexibility.

To use the protocol, an FLS0.20 license or the Flex Full FLS0.5 configuration is required.

Key Insights:

All Bosch MD1CS069 — TC299

All Bosch MD1CS089 — TC299

Working Mode: Boot Glitch

Memories: Read/Write/Checksum Internal Flash, Read/Write EEPROM, Full Backup

Licenses: FLS0.20M/S — FLS0.5M/S

Connect/Glitch Time: ~ 30 seconds

Reading Time: ~ 2 minutes 30 seconds

Writing Time: ~ 2 minutes

Some of the supported vehicles:

• FIAT Ducato (V) (2021MY) 2.2L MultiJet III 16v 138HP
• Dr Motor PK8 (I) (2023MY) 2.0L Turbo 16v 134HP
• John Deere 5G Series (5115G) (2022MY) 3.6L 16v 114HP
• Massey Ferguson MF 3xx (I) (2023MY) 3.6L 16v 104HP
• New Holland T5 Series II (2021MY) 3.6L L4 99HP

Flex Korhex Unlocks Bosch MD1CS003 in Bench Mode

Finally! Flex Korhex released new Boot Glitch unlocking solution for Stellantis Bosch MD1CS003 ECUs.

Version 8.23.0.0 of Flex Out Now

New Flex update, new possibilities. Now you can perform Boot Glitch operations on Stellantis Group Bosch MD1CS003 with Korhex by leveraging the EMFI — Electromagnetic Fault Injection technology on the TC298 processor.

Compared with the VFI procedure already available, Korhex allows technicians to operate without removing components from the unit, reducing the risks associated with working directly on the control unit. Moreover, the ECU can be unlocked and subsequently programmed in Bench mode.

Use the F mask to operate with Korhex. Alternatively, this software version also introduces the possibility to download the STL files for the dedicated Korhex positioning masks used during Boot Glitch procedures.

In order to use the protocol, an FLS0.20 Boot Glitch license or the Flex Full FLS0.5 configuration is required.

Key Insights

• Stellantis Bosch MD1CS003 — TC298
• Working Mode: Boot Glitch
• Memories: Read/Write/Checksum Internal Flash, Read/Write Internal EEPROM, Full Backup
• License: FLS0.20M/S — FLS0.5M/S
• Connection: ~10 seconds
• Reading Time: ~2 minutes 30 seconds
• Writing Time: ~2 minutes

Some of the supported vehicles:

• DS 7 Crossback (I) (2021MY) 1.5L BlueHDi 16v 130HP
• FIAT Scudo (III) (2021MY) 1.5L MultiJet 16v 118HP
• Opel Mokka (B) (2021MY) 1.5L TDCi 16v 108HP
• Peugeot 5008 (II) (2021MY) 1.5L BlueHDi 16v 130HP
• Toyota Proace City (I) (2021MY) 1.5L D4-D 16v 74HP