Locked Bosch MD1 / MG1: how ECU unlocking really works

Since 2021, more and more workshops hit the same wall: a recent Golf, 3 Series or C-Class comes in for a remap, the tool reads the ECU identification… and refuses to read the flash. The culprit has a name: a locked Bosch MD1 / MG1. The good news is that these ECUs can be unlocked. Here is what really happens during an unlock, why people talk about “glitching” and electromagnetic pulses, and how to do it without killing an ECU that often costs more than €1,000.

MD1 and MG1: the platform behind a large part of today’s car park

MD1 (diesel) and MG1 (petrol) make up Bosch’s MDG1 family. It is fitted to a large share of today’s vehicles: the Volkswagen Group, BMW, Mercedes-Benz, Stellantis, Ford, Renault, Hyundai-Kia and many more. At its heart sits a multicore Infineon AURIX microcontroller (TC2xx, then TC3xx families).

These ECUs were designed to resist modification: signed software, secure boot and protected debug access.

What does “locked” actually mean?

On early software versions, OBD or bench reading was still possible thanks to weaknesses found by tool makers. Bosch closed those doors with each update, first with tuning protection (TPROT), then by shutting the programming access on recent software. The result:

• OBD reading is refused;
• bench reading returns nothing, or only part of the memory;
• the microcontroller will not open its programming access without authentication.

The ECU is not faulty: it is doing exactly what it was designed to do. To read it, you first have to unlock it.

The three main families of unlock methods

1. Software exploits

The historical method: use a weakness in the ECU software to gain read access. Fast and no need to open the housing, but it only works on certain software versions, and any Bosch update can make it useless.

2. Voltage glitching

At the very start of boot, while the processor checks whether it may open access, an extremely brief, perfectly timed disturbance of its power supply can make it “skip” that check. The technique comes from chip-security research (it is a form of fault injection) and has since been industrialised by tuning tool makers.

3. Electromagnetic pulses

Same idea, different means: instead of acting on the supply, the fault is induced at the critical moment by a very short, very localised electromagnetic pulse above the chip, with no contact with its power circuit. More targeted, but even more demanding in precision.

What the KESS3 does with its unlock module

Alientech has industrialised the job with the KESS3 unlock module for Bosch MD1 / MG1. Used with the KESS3, it unlocks the ECU in Boot mode, step by step:

1. the software identifies the exact ECU reference and shows the wiring diagram;
2. the module runs the unlock procedure designed for that reference;
3. once unlocked, the ECU is read and written in Bench mode like any other.

In other words, a car you used to turn away becomes one more customer.

Before you start: the workshop checklist

• Check compatibility of the reference and software version in the Alientech list: it grows with every update.
• Stable power on the bench, from a lab power supply or a quality battery support unit.
• Full backup (flash, EEPROM, identification) before any write, filed under the customer’s name.
• Follow the wiring diagram to the letter, on an ESD-protected workstation.
• Removal time for the ECU included in your quote: this is a bench job, not an OBD one.

And who writes the file?

Once the read is done, the most important part remains: the calibration. With the MFT Dev Files Service, you upload the read from your garage account and an engineer sends back a custom file, checksums corrected, ready to write. You follow every step live, right down to Telegram.

What about the law?

Reading and modifying ECU software is not illegal in itself. But for a road vehicle, the modification must comply with local rules: type approval, emissions standards and notifying the insurer. Both the professional and the vehicle owner must take this into account.