This guide covers the non-invasive unlocking procedure for locked Bosch MD1 ECUs (demonstrated on a 2022 Peugeot/Citroën MD1CS003 1.5 BlueHDi). Utilizing Magic Motorsport Flex and Korhex tool, Electromagnetic Fault Injection (EMFI) replaces legacy voltage glitching, removing the need to desolder board resistors.
Requirements
- Main Interface: Magic Motorsport Flex Master+ 5 M/Flex Slave+ SFLS0.5S or Flex with FLS0.20M/S
- Flex software: 23.0.0or above
- Glitch Hardware: Korhex Tool Kit (Main unit, adapter board, USB cable, probe antennas, power cable)
- Alignment Tool: Processor Alignment Mask (F Mask)
- Positioning Gear: Articulating mounting arm
Operations Procedure
Step 1: Wiring Diagram Checking
Open Flex software, navigate to Vehicle list, search md1cs003 to find Peugeot BOSCH MD1CS003 [Locked]
Select Manuals to check the PCB and connector manual
Step 2: Probe Positioning
- Open the ECU casing to access the main board.
- Place the F Maskonto the microcontroller.
- Clamp Korhex unit into the support arm. Position the antenna probe perpendicular (90°) through the hole in the alignment mask.
Step 3: Flexbox Harness Pinout
Connect Flexbox harness to the ECU pin header:
- Main Power: Pin A4
- Aux Power: Pin A1
- Ground Feed: Pin GND
- CAN High/Low: Pins B5 and B6
Do not remove any SMD resistors. Do not connect pin G6.
Step 4: Software Execution
- In the Flex software suite, open the Locked Boot Glitch
- Initiate the connection sequence. Korhex MCU tool delivers targeted EMFI pulses to interrupt chip processing.
- The software will take a backup reading and automatically write the unlock file.
Step 5: Reconfiguring for Bench Mode
- Remove Korhex tool from the workspace.
- Swap power pins on the Flexbox harness:
- A4->A1
- A1->A4
- Maintain existing ground and CAN lines.
- Launch standard bench protocols to read and write ECU data.
