If you handle tuning or repair on post-mid-2020 vehicles, you’ve likely hit a wall with Bosch MD1 and MG1 control units. The internal Hardware Security Modules (HSM) on TriCore TC298 and TC299 processors block traditional reading methods. To get around this, you need a tool that can perform a boot-glitch unlock to access the internal Flash and EEPROM directly.
Here is a breakdown of 5 popular tools on the market today capable of bypassing this security.
1. OBDSTAR Platform
OBDSTAR has expanded its coverage for BMW and other Bosch MD1/MG1 units significantly.
Standard Read/Write & Unlock (B48/B57/B58 TC298 & TC299):
Choose any device below:
- X300 Classic G3 Full Version/G3 with ECU Flasher Software + MP001 Programmer + C4-06 Adapter (from RH850/V850 kit)
- DC706 ECU Tool+ MP001 Programmer+ C4-06 Adapter
- ECU Master Full Version/Configuration C+ C4-06 Adapter
Bosch MD1/MG1 TC298TP/TC299TP (2021+ Locked Models – Read/Write & BMW ISN Read):
- OBDSTAR G3 Full Version/G3 with ECU Flasher Software+ MP001 Programmer (included)+ RH850/V850 kit C4-06 Adapter + ECM-003 Wiring Harness
- OBDSTARDC706 + MP001 Programmer + C4-06 Adapter + ECM-003 Harness
- OBDSTARECU Master Full Version/Configuration A + C4-06 Adapter + ECM-003 Harness + BENCH-D V1 Cable
Learn more:
http://blog.cardiagtool.co.uk/obdstar-unlock-encrypted-bosch-md1-mg1-ecus-upgrade-info-faqs/
2. FormulaFlash ECU TCU Chip Tuning Programmer
FormulaFlash is introducing boot mode unlocking in an upcoming update.
Features: Bypasses security, allows full Flash reading and writing, and calculates checksums automatically.
Requirements: An active FormulaFlash software license.
ECU Compatibility:
- VAG: MG1CS163 (TC298), MG1CS031 H80 (TC298)
- BMW: MD1CP032 (TC299), MG1CS024 (TC298)
- Ford: MD1CP006 (TC298)
- JLR: MD1CP017 (TC298), MD1CP007 (TC298)
- Stellantis: MG1CS042 (TC298)
- Isuzu: MD1CS089 (TC299)
- FCA: MD1CS069 (TC299 – Fiat Ducato)
FLEX uses a Boot Glitch-Bench protocol via Port E using FLX4.1 adapter (standard in Flex Kit).
The glitch process takes anywhere from 10 seconds to 25 minutes depending on the ECU.
Once unlocked, reading takes around 2.5 minutes and writing takes about 2 minutes.
Supported Functions: Internal Flash (Read/Write/Checksum), Internal EEPROM (Read/Write), Full Backup.
Licensing: Requires FLS0.5M (Master) or FLS0.5S (Slave)
Supported ECU Hardware: MD1CE101, MD1CS069, MD1CS005, MG1CS024, MG1CS201, MD1CP032, MG1CS002 H80, MG1CS031 H80, MG1CS163, MD1CS004 H80, MD1CS003, MG1CS042, MD1CP007, MD1CP017, MG1CS028, MD1CS012.
Vehicle Examples: Audi RS3 8YA (2021), BMW 118i F40 (2021), Cupra Formentor 2.0L TDI (2021), DS 9 1.6L PHEV (2021), Iveco Eurocargo 4.5L (2021), Land Rover Defender L663 3.0L (2021), Opel Corsa F 1.5L (2021), Peugeot 308 III / Partner III (2021), VW Golf VIII 2.0L TDI (2021).
FLEX Protocol Evolution:
- 1.0.0: FCA MD1CS069 TC299 (Fiat Ducato V 2.2L), BMW MD1CS001 TC298 (220d MHEV, 420d), Ford MD1CP006 TC298 (F-250/F-350 6.7L V8).
- 2.0.0: Porsche MG1CP007 TC299 (Cayenne GTS V8), Porsche MG1CS047 TC299 (911 Carrera 992), Porsche/VAG MG1CS008 TC299 (Audi RSQ8, Urus, Bentayga, 718 GTS).
- 3.0.0: BMW MG1CS049 TC298 (BMW M2 G87, M4 G82), Isuzu MD1CS089 TC299 (D-Max III, MG Gloster).
- 4.0.0: VAG MD1CS014 TC299 (VW Touareg III, Audi S7 C8, SQ5, Q8).
- 6.0.0: VAG MG1CS011 TC298 (Audi A3 8Y, A5 F5, Formentor, Leon).
- 8.0.0: MAN MD1CE100 TC299 (MAN Trucks TGL, TGM, TGX 2020-2021).
CG FC200 is rolling out support for encrypted BMW B48/B58 ECUs (MG1CS201, MG1CS204) and diesel MD1CS089 units in an upcoming update.
Method: You will need to open the ECU cover to perform the initial unlock in boot mode, after which you can read and write the ECU on the bench. Make sure your FC200 subscription is up to date.
5. EngineDance X5 2-in-1 ECU Programming &Truck Diagnostics
EngineDance X5 offers two options depending on your preference for opening the ECU:
Option 1: Workshop Boot-Glitch Unlocking
Hardware: EngineDance X5 Programmer (Item No.HKSH112/HKSH113) + MD1/MG1 Boot-Glitch Adapter
How it Works: Open the ECU cover, connect the adapter according to the diagram, trigger the glitch sequence, and perform direct bench reading/writing
Supported Post-2021 Bench Models:
- Bosch MD1CE100 TC299: MAN, VW Trucks, SITRAK, FAW, WEICHAI, SDEC/Hongyan
- Bosch MD1CS089 TC299: HOWO, ISUZU, IVECO, Deutz-Fahr, Maxus, GWM Cannon Poer, GWM Haval, SAIC, Foton, JAC, JMC, BAIC, MG, Dr Motor, EVO, ICH-X, Same/Lamborghini Tractors
- Bosch MD1CE101 TC299: IVECO FPT, New Holland, Case Construction/IH, Landini Tractors, Steyr
- Bosch MD1CE102 TC299: Iveco
- Bosch MD1CS012 TC298: Hyundai/KIA, Genesis
- Bosch MD1CS003 TC298 / MG1CS042 TC298: Stellantis (PSA)
- Bosch MD1CP006 TC298: Ford
- Bosch MD1CS069 TC299: IVECO, Fiat Ducato, Case IH Farmall, John Deere, Landini, Massey Ferguson, McCormick, New Holland, Steyr
Option 2: Remote Unlocking (€90 for Per ECU Unlock)
How it Works: If you want to avoid opening the ECU, hook the ECU to X5 on the bench. Read the software and hardware numbers in the app, take a photo of the ECU label, install ToDesk on your PC, and schedule a session with EngineDance support.
Supported Post-2021 Remote ECUs:
[0281020645] DONGFENG-MD1CE108-P1892-SPC5898
[0281020654] YUNNEI-MD1CE108-P1961-SPC5898
[0281020695] YUNNEI-MD1CC878-P2270-SPC5898
[0281020692] YUCHAI-MD1CC878-P2061-SPC5898
[0281037071]I VECO-MD1CS089-P2096-TC299
[0281037078] IVECO-MD1CS069-P1768-TC299
[0281036675] JAC-MD1CS089-P2031-TC299
[0281020677] JAC-MD1CS089-P1968-TC299
[0281036215] JMC-MD1CS089-P1853-TC299
[0281036399] JMC-MD1CS089-P1741-TC299
[0281037336] JMC-MD1CS089-P1853-TC299
[0281036372] JMC-MD1CS089-P1917-TC299
[0281020652] ISUZU-MD1CE108-P1963-SPC58
[0281039460] JIM-MD1CS089-P2327-TC299
[0281039581] JIM-MD1CS089-P2213-TC299
[0281039581] JIM-MD1CS089-P2266-TC299
[0281039679] JIM-MD1CS089-P1967-TC299
[0281039593] JIM-MD1CS089-P2266-TC299
[0281037245] MAXUS-MD1CS089-P1816-TC299
[0281036116] MAXUS-MD1CS089-P1816-TC299
[0281036114] MAXUS-MD1CS089-P1817-TC299
[0281037248] MAXUS-MD1CS089-SK83-TC299
[0281035944] MAXUS-MD1CS089-P1826-TC299
[0281020693] SDEC-MD1CE100-P1958-TC299
[0281020600] SAICHONGYAN-MD1CE101-P1603-TC299
[0281021127] SAICHONGYAN-MD1CE101-P1603-TC299
[0281020801] QUANCHAI-MD1CC878-P1966-SPC5898
[0281020621] QUANCHAI-MD1CC878-P1966-SPC5898
[0281020599] SITRAK-MD1CE100-P1708-TC299
[0281021190] SITRAK-MD1CE100-P1158-TC375
[0281020755] SANY-MD1CC878-P2089-SPC5898
Note: Always verify your specific ECU part number and software version before attempting to unlock, as manufacturer updates are frequent.
Summary
Unlocking post-2020 encrypted Bosch MD1 and MG1 ECUs (TriCore TC298/TC299) requires specialized hardware capable of executing a boot-glitch or HSM security bypass. Depending on your workshop needs and budget, each platform offers specific strengths:
- OBDSTAR (G3/DC706/ECU Master): Highly cost-effective solution for automotive technicians, offering dedicated harnesses (like ECM-003) for seamless BMW ISN reading and OBD/bench programming.
- Magicmotorsport FLEX: The premier choice for comprehensive European vehicle coverage, delivering rapid read/write speeds, robust software updates, and reliable boot-glitch protocols.
- EngineDance X5: Highly versatile platform tailored for heavy-duty commercial vehicles, trucks, and agricultural equipment, providing both local boot-glitch unlocking and a no-disassembly remote service option.
- FormulaFlash & CG FC200: Rapidly evolving tools providing budget-friendly boot-mode unlock capabilities for targeted VAG, BMW, and commercial ECU variants.