How to Unlock Bosch MD1CS003 TC298 with Flex and Korhex Boot Glitch?

Magic Motorsport Flex update version 8.23.0.0 adds a non-invasive Boot Glitch procedure for Bosch MD1CS003 control units found in 2021+ Stellantis 1.5L diesel models.

Unlike standard Voltage Fault Injection (VFI) methods, the Korhex method uses Electromagnetic Fault Injection (EMFI) targeted at the TC298 processor. This eliminates the need to remove components from the board, preventing physical board damage. Once unlocked via Boot Glitch, the ECU accepts standard Bench mode reading and writing.

Operational Prerequisites

Required License:20 (Boot Glitch Master/Slave) or Flex Full Master FLS0.5 M/Slave FLS0.5S
Positioning Tool:Korhex F mask

Note: With Flex software V8.23.0.0, the STL files can be downloaded for the dedicated Korhex positioning masks used during Boot Glitch procedures.

Protocol Benchmarks & Specifications

Connection:~10 seconds
Reading Time: ~2 minutes 30 seconds
Writing Time:~2 minutes
Memory Access:Internal Flash (Read/Write/Checksum), Internal EEPROM (Read/Write), Full Backup

Main steps

Step 1: Connect the ECU

Power the Korhex device using the provided power cable and connect the PCB/accessories to your Flexbox as outlined in the specific manual for your ECU.

Look for the blinking blue indicator light on Korhex which confirms a successful connection and power state.

Step 2: Follow Flex Software

Open the Flex software on your PC and select the specific vehicle, protocol, and ECU/TCU you want to work on (ensuring you hold the required FLS0.5 or FLS0.20 license).

Let the software guide you through the initial preparation steps

Step 3: Position on the MCU

Use the dedicated Korhex adapter and mask to precisely position the device onto the exact microcontroller (MCU) contact point indicated by the active Flex software procedure.