MD1CS003 Tuning protection from 2020 onwards
First unlock solutions hit the market — tool manufacturers began offering MD1CS003 unlock via send-off service.
Three methods now exist: Flex Boot Glitch, Flex Korhex (EMF), and CMDFlash EMF injection. All require opening the ECU or sending it off. No risk-free bench solution yet.
We are aware of all current unlock methods but are not offering the service at this time. We think the current methods are too risky and too time consuming, plus it’s more than likely a pure bench mode solution will be available in less than a year. We will wait and invest in which ever tool can do this first.
We do offer a full remap service for all ECUs up to and including 0281037101. If your ECU is not locked, feel free to send it in.
For vehicles produced from 2020 onwards, MD1CS003 ECUs with Bosch part numbers 0281037198 and higher are locked. The lock bit is written into a One Time Programmable (OTP) zone on the Infineon Aurix TC298 processor — once set, it cannot be reversed by anyone, including Bosch themselves. However, it would appear that another part of the software can be patched to allow reading and writing of the ECU.
Note: Locked Bosch part numbers differ between vehicle brands. This article specifically covers PSA, Toyota, and Opel/Vauxhall vehicles with the MD1CS003.
All MD1CS003 ECUs below part number 0281037198 can be bench programmed without any unlock procedure. No need to open the unit — communication runs over CAN High, CAN Low, Power, and Ground directly at the ECU connector. As of 2026, there is still no OBD-based programming for any variant of this ECU on any platform.
Three approaches now exist for unlocking locked MD1CS003 ECUs. All require either opening the ECU yourself or sending it to a specialist. There is no clean, no-open bench solution available yet for PSA/Opel MD1CS003, although it is possible if the ECU is sent to AT, likely this will be released to tuners at some point.
The Flex tool from Magic Motorsport now supports boot glitching on the MD1CS003. The method sends a precisely timed voltage pulse during the ECU’s boot sequence to interrupt the security check and gain processor access.
This requires desoldering a microscopic resistor from the board. The process works, but there is a significant failure rate — many users have reported dead ECUs after attempting it. It’s not yet fully clear whether this is purely user error or whether the method itself carries an inherent overvoltage risk to the processor. Some users are simply losing or vaporising the miniature resistor. I personally couldn’t solder this without strong magnification, my eyes have aged too much from looking at a screen all day long and my hands are likely not precise enough either.
Our view: It works in the right hands, but it is not something we would ask our workshop team to perform on a customer’s ECU, and for myself the director of the company I simply don’t have enough time in the day to deal with jobs like this and also run the file service and develop custom tuning software.
Korhex is a dedicated add-on module for the Flex platform. Rather than injecting voltage through soldered wires, it uses Electromagnetic Fault Injection (EMFI) — a contactless technique where a focused electromagnetic pulse is directed at the processor to disrupt its security routines at exactly the right moment.
The ECU still needs to be opened so the Korhex probe can be positioned directly over the processor, but critically no soldering is required. This makes it significantly less destructive than boot glitch. Magic Motorsport uses this module across several ECU families including Mercedes MDG1 and DAF Delphi ETC3 — so it is a maturing platform, not a one-trick tool.
The Korhex module carries a high price tag, and accurate probe positioning is critical — it is not plug-and-play. A trained operator is required. Safer than boot glitch, but still a specialist job.
CMDFlash has implemented an MDG1/MD1CS003 unlock using electromagnetic fault injection, leveraging hardware similar in principle to the ChipSHOUTER — a professional EMFI tool widely used in embedded security research. The ECU must be opened and the EMF probe placed over the target processor.
Like the Korhex approach this avoids soldering, but requires specialist knowledge. CMDFlash has publicly warned that the method used matters — poorly executed glitching can still permanently damage an ECU. They have explicitly flagged the risks associated with less-controlled implementations of this technique.
Several tool manufacturers and specialist companies now offer a send-off unlock service. You ship the ECU to them, they perform the unlock using their in-house equipment and expertise, and return it ready to program.
This is currently the safest route for most workshops — no risk of damaging the ECU yourself, no large tooling investment. The trade-off is cost per unit, turnaround time, and dependency on a third party for every single job. For a high-volume operation this quickly becomes expensive and slow.
A safe bench solution is coming. We’ve already seen no-open, no-solder bench solutions arrive for BMW-platform MD1CS003 variants (BIT Box and others). There is little doubt a similar approach will follow for PSA/Opel MD1CS003 — we’d estimate within six months or so. When it does, we’ll invest in it. Until then, we’re not going to open and solder every locked ECU that comes through the door.
The current methods demand advanced skills. Boot glitch requires soldering under magnification. EMFI still require precise positioning and has yet to be tested by tuners, it’s a completely new release. These are not tasks for a general workshop — and as the manager, I don’t have time to personally handle every locked ECU that comes in.
We will not take risks with your ECU. Until there is a method that is reliable, repeatable, and genuinely safe, we’re not offering it. A bricked ECU is never worth the hassle for us and our customers.
If your Bosch number is below 0281037198, send it in — we offer a full bench remap service.
Yes — all MD1CS003 ECUs below Bosch number 0281037198 can be bench programmed and tuned. If your ECU falls in that range, send it in. We offer a full remap service for these units and they are well supported on our bench equipment.
In theory this sounds like a simple workaround — in practice it doesn’t work. Software versions, option codes, and vehicle-specific calibrations differ enough between production years that retrofitting an older ECU results in a vehicle full of faults and warnings. We’ve been through this ourselves.
Please do not order an unlocked ECU from our store intending to retrofit it to a newer model. We will request a photo of your existing ECU before any order so we can confirm the correct part.
Yes, for all variants we can access with our programming equipment — everything below 37198. These will be listed in our webshop over time. Because every ECU needs to be configured to match the specific vehicle, it is a time-consuming process. If you need an unlocked ECU due to a fault, get in touch directly. If you just want a remap, the easiest route is to send in your own ECU.
Yes — when a safe, reliable, no-open bench solution exists. We’re watching the market closely and have no doubt this is coming. Safe bench tools already exist for BMW-platform MD1 variants and the same will follow for PSA/Opel. When it arrives and we’re satisfied it’s reliable, we’ll invest and start offering the service.