This guide outlines two distinct methods for reading, writing, and backing up data on modern encrypted Bosch MD1 (diesel) and MG1 (petrol) Engine Control Units using Magic Motorsport FLEX.
Method 1: Direct Bench Mode (World Exclusive Update in August)
The direct Bench mode protocol allows technicians to connect directly to the ECU connector pins without opening the ECU housing. This completely protects the factory casing and eliminates hardware damage risks.
Key Advantages:
- Connect in approximately 10 seconds without casing removal.
- Complete full memory reads in ~2.5 minutes and writes in ~2 minutes.
- Offer full data access, including reading, writing, and automated checksum calculations for Internal Flash, reading/writing Internal EEPROM, and generating full backups.
- Require license: FLS0.1M/S – FLS0.10M/S – FLSo.5M/FLS0.5S
Supported BMW & MINI ECU Models:
Bosch MD1CP032 (TC299)
Bosch MD1CS001 (TC298)
Bosch MG1CS024 (TC299)
Bosch MG1CS049 (TC298)
Bosch MG1CS201 (TC298)
Vehicle Compatibility Examples:
- BMW 4-Series Gran Coupe (I) G26 (2021MY) 2.0L 420d MHEV 187HP
- BMW M2-Series (II) G87 (2023MY) 3.0L Twin-Turbo 24v 453HP
- BMW M4-Series (II) G82 (2021MY) 3.0L Twin-Turbo 24v 542HP
- BMW X2-Series (II) U10 (2023MY) 2.0L 20d sDrive/xDrive MHEV 161HP
- Mini Cooper (F57) (2020MY) 1.5L 139HP
Method 2: Boot Glitch Unlock (Hardware-Level Bench Conversion)
For locked Bosch MD1/MG1 control units featuring Tricore Aurix TC2xx microprocessors (TC298 / TC299), an initial Boot Glitch unlock on the bench is required before standard Bench operations can occur. Performing this one-time unlock gives the user full, independent Bench access without relying on third-party remote services.
Key Features:
- Protocol Type: Boot Glitch-Bench
- Hardware Connection: Port E using adapter 1 (included in the standard Flex kit).
- Connection / Glitch Duration: 10 seconds to 25 minutes (dependent on hardware state).
- Read Time: ~2 minutes 30 seconds
- Write Time: ~2 minutes
- Functions Supported: Read/Write/Checksum Internal Flash, Read/Write Internal EEPROM, Full Backup generation.
Note: Initial connection setup may take a few minutes depending on the hardware interface. Always verify FLX4.1 adapter cable continuity before starting the process.
Compatible Flex Software Packages:
FLS0.5M – SW Flex Full Master Version
FLS0.5S – SW Flex Full Slave Version
Supported ECU Models:
- All Bosch: MD1CE101 (TC299)
- Iveco: MD1CS069 (TC299)
- Ford: MD1CS005 (TC298)
BMW: MG1CS024 (TC298), MG1CS201 (TC298), MD1CP032 (TC299)
VAG Group: MG1CS002 H80 (TC298), MG1CS031 H80 (TC298), MG1CS163 (TC298), MD1CS004 H80 (TC298)
Stellantis: MD1CS003 (TC298), MG1CS042 (TC298)
JLR: MD1CP007 (TC298), MD1CP017 (TC298), MG1CS028 (TC298)
Kia / Hyundai: MD1CS012 (TC298)
Some Supported Models
- Audi RS3 (III) 8YA 2.5L TFSI 20v 394HP (2021MY)
- BMW 1-Series (F40) 1.5L 118i 138HP (2021MY)
- Cupra Formentor (I) 2.0L TDI 16v 148HP (2021MY)
- DS 9 (I) 1.6L PureTech 16v PHEV 222HP (2021MY)
- Iveco Eurocargo (IV) 4.5L Tector 5 16v 183HP (2021MY)
- Land Rover Defender (I) L663 3.0L D250 24v MHEV 245HP (2021MY)
- Opel Corsa (F) 1.5L CDTi 16v 101HP (2021MY)
- Peugeot 308 (III) 1.6L PureTech 16v PHEV 177HP (2021MY)
- Peugeot Partner (III) 1.5L BlueHDi 16v 130HP (2021MY)
- Volkswagen (VW) Golf (VIII) 2.0L TDI 16v 114HP (2021MY)
Click here to check more models supported.
BMW MD1 MG1 Read Write Guide (via BOOT Glitch mode)
1. Software Protocol Selection:
Open FLEX software (V8.0 or newer) and search for your specific ECU type (e.g., MG1CS201 (LOCKED) for B48 engines or MG1CS024 (LOCKED) for B58 engines).
Select BOOT Glitch mode.
2. Hardware Setup & Soldering:
Click “Manual” to check the wiring diagram
Connect standard bench power, CAN lines, and the FLX4.1 adapter to Port E.
Open the top ECU cover to access the PCB board.
Locate and unsolders the designated SMD resistor shown in the software diagram, then solder the E1 wire lead directly to the pad.
3. Memory Backup & Bench Conversion:
Click Connect to create a full backup of the ECU memory and save the Internal Flash file.
Run the BOOT GLITCH unlock routine (glitch duration ranges from 10 seconds up to 25 minutes depending on the hardware).
Solder the original SMD resistor back onto the board, disconnect the boot wires, and seal the ECU casing.
All future reading, writing, and recalibration can now be done using direct Bench mode without opening the box again.
Method Comparison Summary
| Metric / Feature | Method 1: Direct Bench Mode | Method 2: Boot Glitch Unlock |
| Casing Access | Unopened (Pinout connection) | Requires opening top ECU cover |
| Hardware Work | None | Unsolder/resolder SMD resistor & wire E1 lead |
| Connection Time | ~10 seconds | 10 seconds to 25 minutes (glitch dependent) |
| Read / Write Time | ~2.5 min Read / ~2 min Write | ~2.5 min Read / ~2 min Write |
| Hardware Adapter | Standard FLEX connector harness | FLX4.1 Adapter via Port E |
Important Technical Reminders
- Stable Power: Ensure a steady bench power supply during the unlock phase to prevent communication drops.
- Resistor Reinstallation: Always re-solder the SMD resistor back onto the PCB before reinstalling the ECU into the vehicle.
- License & Software: Requires an active FLEX subscription (Full Master or Full Slave) running software version V8.0 or newer. Checksum correction is handled automatically for Internal Flash files.