Korhex Boot Glitch Unlock for Bosch MD1CS069 and MD1CS089

Korhex: New Support for Bosch MD1CS069 and MD1CS089.

Flex version 8.26.0.0 is now available

Unlock Bosch MD1CS069 and MD1CS089 ECUs without working on the PCB.

With the latest Flex update, Korhex can now also be used on ECUs installed on commercial and industrial vehicles, accessing the TriCore TC299 processor through a dedicated procedure.

The new solution allows the procedure to be carried out without working on the ECU PCB, simplifying connection operations and reducing working time.

Using the reference positioning mask as indicated in the operating manual, you can identify the glitch point and connect Korhex easily and accurately. Once the connection is established, you can choose whether to complete the procedure directly in Boot Glitch mode or perform the Unlock and then continue programming in Bench mode.

No work on the PCB, fewer steps, and greater operational flexibility.

To use the protocol, an FLS0.20 license or the Flex Full FLS0.5 configuration is required.

Key Insights:

All Bosch MD1CS069 — TC299

All Bosch MD1CS089 — TC299

Working Mode: Boot Glitch

Memories: Read/Write/Checksum Internal Flash, Read/Write EEPROM, Full Backup

Licenses: FLS0.20M/S — FLS0.5M/S

Connect/Glitch Time: ~ 30 seconds

Reading Time: ~ 2 minutes 30 seconds

Writing Time: ~ 2 minutes

Some of the supported vehicles:

• FIAT Ducato (V) (2021MY) 2.2L MultiJet III 16v 138HP
• Dr Motor PK8 (I) (2023MY) 2.0L Turbo 16v 134HP
• John Deere 5G Series (5115G) (2022MY) 3.6L 16v 114HP
• Massey Ferguson MF 3xx (I) (2023MY) 3.6L 16v 104HP
• New Holland T5 Series II (2021MY) 3.6L L4 99HP

Flex Korhex Unlocks Bosch MD1CS003 in Bench Mode

Finally! Flex Korhex released new Boot Glitch unlocking solution for Stellantis Bosch MD1CS003 ECUs.

Version 8.23.0.0 of Flex Out Now

New Flex update, new possibilities. Now you can perform Boot Glitch operations on Stellantis Group Bosch MD1CS003 with Korhex by leveraging the EMFI — Electromagnetic Fault Injection technology on the TC298 processor.

Compared with the VFI procedure already available, Korhex allows technicians to operate without removing components from the unit, reducing the risks associated with working directly on the control unit. Moreover, the ECU can be unlocked and subsequently programmed in Bench mode.

Use the F mask to operate with Korhex. Alternatively, this software version also introduces the possibility to download the STL files for the dedicated Korhex positioning masks used during Boot Glitch procedures.

In order to use the protocol, an FLS0.20 Boot Glitch license or the Flex Full FLS0.5 configuration is required.

Key Insights

• Stellantis Bosch MD1CS003 — TC298
• Working Mode: Boot Glitch
• Memories: Read/Write/Checksum Internal Flash, Read/Write Internal EEPROM, Full Backup
• License: FLS0.20M/S — FLS0.5M/S
• Connection: ~10 seconds
• Reading Time: ~2 minutes 30 seconds
• Writing Time: ~2 minutes

Some of the supported vehicles:

• DS 7 Crossback (I) (2021MY) 1.5L BlueHDi 16v 130HP
• FIAT Scudo (III) (2021MY) 1.5L MultiJet 16v 118HP
• Opel Mokka (B) (2021MY) 1.5L TDCi 16v 108HP
• Peugeot 5008 (II) (2021MY) 1.5L BlueHDi 16v 130HP
• Toyota Proace City (I) (2021MY) 1.5L D4-D 16v 74HP

How to Check a PSA MD1CS003 ECU is Locked or Not?

Question: It’s a Peugeot Partner 1.5 132hp with Bosch MD1CS003 ECU.

Car build date is 2020/06. Try to read this ECU with Flex programmer.
How do i know if ecu needs to be boot glitched or not?
Is there any danger of trying to connect and reading on non locked protocol if ecu requires boot glitch?

Here is the clue.

How to determine whether the MD1CS003 ECU is locked or not?

Way 1:

Just try normal bench read and you will know if its blocked. If locked then flex tell you.

Way 2:

Check the ECU label.
If 0281 034, 035 or 036 it’s not locked.
Also, 0281 037 101 not locked.
If more than "037" is locked.

FYI:

How to determine the TPROT lock status of PSA MD1CS003:
It can be quickly determined based on the part number.
Part numbers starting with 3XX indicate not locked;
those starting with 4XX or 5XX indicate a locked state, requiring an unlocking operation before normal data reading and writing can be performed.

Flex V8.16.0.0 Add MG1CA920 SPC58N Boot Unlock Using Korhex

With Magic Motorsport Flex version 8.16.0.0, Korhex extends support to new-generation SPC58N microprocessors.

New support for Bosch MG1CA920 on Rotax engines.

Flex version 8.16.0.0 is now available

With the latest Flex update, Korhex extends support to new-generation SPC58N microprocessors.

The Bosch MG1CA920 control unit from the BRP Group, used on Rotax engines, is now supported with a new dedicated procedure.

Thanks to Flex + Korhex, connection is simpler and more direct: there is no longer any need to remove the resistor on the PCB or manually solder the Boot point.

Fewer steps. More autonomy in the workshop.

Order Korhex and manage the unlocking of supported control units in complete autonomy.

If you are a Flex Full customer, the license is already included in your subscription.

Position Korhex, follow the Flex-guided procedure, and access the SPC58N microprocessor.

Order Korhex, connect it to Flex, and manage the unlocking procedure in complete autonomy.

To access the protocol, you need either the FLS0.20 license or the Flex Full FLS0.5 configuration.

Key Insights:

• BRP Bosch MG1CA920 SPC58N
• Working Mode: Boot Glitch
• Memories: Read/Write/Checksum Internal Flash, Read/Write Internal EEPROM, Full Backup
• Licenses: FLS0.20M/S — FLS0.5M/S
• Connect/Glitch Time: ~ 40 seconds
• Reading Time: ~ 2 minutes
• Writing Time: ~ 2 minutes

Some of the supported vehicles:

• Can-Am Maverick Turbo RR (II) (2022MY) 0.9L Rotax 12v 197HP
• Sea-Doo Switch Sport (I) (2022MY) 1.6L Rotax 1630 ACE 12v 168HP
• Ski-Doo Expedition (IV) (2024MY) 0.9L Rotax 900 ACE Turbo R 12v 177HP

Flex New Updates Support DAF Delphi ETC3 UDS Unlock

With the new Magic Motorsport Flex update, Korhex enables unlocking of DAF Delphi ETC3 UDS control units in Boot Glitch mode, directly inside your workshop and in complete autonomy.

Flex Version 8.15.0.0 Out Now

Korhex leverages EMFI — Electromagnetic Fault Injection technology to act on the processor and allow the Boot Glitch procedure to be performed.

The dedicated accessories included in the kit ensure a simple, stable, and precise connection.

There is no longer any need to use the RFT service and send the control unit to our laboratories: with Flex and Korhex, you can unlock the Delphi ETC3 UDS and continue immediately with programming.

A procedure designed to reduce intervention times, simplify operations, and increase workshop autonomy.

Order Korhex, connect it to Flex, and manage the unlocking procedure in complete autonomy.

In order to access this protocol, you need either the FLS0.20 license or the Flex Full FLS0.5 configuration.

Key insights

• DAF Delphi ETC3 UDS MPC5566
• Working Mode: Boot Glitch
• Memories: Read/Write/Checksum Internal Flash, Read/Write External Flash, Full Backup
• Licenses: FLS0.20M/S — FLS0.5M/S
• Connect/Glitch Time: ~ 40 seconds
• Reading Time: ~ 2 minutes
• Writing Time: ~ 2 minutes

Some of the supported vehicles

• Daf Trucks CF (IV) (2017MY) 10.8L Paccar 24v [MX-11] 362HP
• Daf Trucks CF (IV) (2017MY) 12.9L Paccar 24v [MX-13] 523HP
• Daf Trucks XF 106 (II) (2017MY) 10.8L Paccar 24v [MX-11] 402HP
• Daf Trucks XF 106 (II) (2017MY) 12.9L Paccar 24v [MX-13] 476HP
• Daf Trucks XF 106 (II) (2017MY) 12.9L Paccar 24v [MX-13] 523HP