Bosch MD1 and MG1 Unlocking Service: Korhex EMFI and Voltage Glitch
Bosch MD1 and MG1 ECUs built after June 2020 have extra protection that blocks normal bench mode reading and writing. These are usually called locked ECUs. To unlock one, the microprocessor (MCU) is briefly disrupted, or glitched, while it starts up. This lets the tool get past the new security and into the ECU's flash memory. An unlock patch is then written to the flash, which turns the protection off. After that, the ECU can be read and written on the bench as normal.
ByteFLASH does all of this in house using the MagicMotorSport FLEX tuning tool. We offer two unlock methods. The newer Korhex EMFI method needs no soldering, and the original voltage glitch method involves taking a component off the circuit board. Both give the same result, an unlocked ECU that you can read and write in bench mode with your own FLEX tool.
Korhex EMFI Unlock
£150 + VAT
Electromagnetic Fault Injection. A mask sits over the MCU and an electromagnetic pulse glitches it. No soldering and no parts taken off the board.
Only available for certain ECU types.
About Korhex EMFIVoltage Glitch Unlock
£300 + VAT
The original FLEX boot glitch method. A surface mount resistor is removed so the MCU supply voltage can be isolated and glitched, then put back afterwards.
About Voltage GlitchNot every ECU can be unlocked with Korhex EMFI
Korhex EMFI only works on certain ECU types. Many Bosch MD1 and MG1 ECUs can still only be unlocked by voltage glitch. You do not choose the method. It depends on your ECU, so check the part number with us before you send it in and we will tell you which method and price apply.
EMFI vs Voltage Glitch: What is the Difference?
Both methods do the same job. They glitch the MCU at the right moment during start up so FLEX can get past the security. The difference is how the glitch is delivered.
With a voltage glitch, the supply voltage to the MCU is briefly disrupted. To do that, the MCU supply has to be isolated from the rest of the board, which means taking a surface mount resistor off under a microscope and putting it back once the job is done. It works well, but it takes time and skill, and any rework on a circuit board carries some risk.
With Korhex EMFI (Electromagnetic Fault Injection), a special mask is placed over the microprocessor and an electromagnetic pulse causes the glitch directly. Nothing needs isolating, so no components are removed and no soldering is done. That is why a Korhex unlock costs less and carries less risk to the ECU.
| Korhex EMFI | Voltage Glitch | |
|---|---|---|
| Price per ECU | £150 + VAT | £300 + VAT |
| How the glitch is delivered | Electromagnetic pulse through a mask over the MCU | Disrupting the MCU supply voltage |
| Soldering required | No | Yes |
| Component removal | None | Surface mount resistor removed and refitted |
| Risk to the circuit board | Minimal | Low, but rework is always a risk |
| Verification bench read | ||
| Tool used | FLEX + Korhex add-on | FLEX |
Which method will my ECU need? The method depends on the ECU type, not on preference. Korhex EMFI only supports certain ECUs, and every other ECU needs the voltage glitch method. If Korhex supports your ECU, we will always use EMFI. Send us the part number and we will tell you which method applies.
Service Details
Each ECU has a fixed price with no hidden charges. Prices apply to UK customers. ECUs sent from outside the UK may cost extra to return. The details below apply to both unlock methods.
Bench Read Check
Included
Before it comes back to you, every unlocked ECU gets a bench read to confirm it works correctly.
Return Delivery
Included
The price includes return delivery to a UK address by DHL courier.
Turnaround
Same Day
If we receive your ECU before 12:00 noon, we send it back the same day.
Korhex EMFI ECU Unlock
Korhex is a hardware add-on for the MagicMotorSport FLEX tool. It unlocks locked Bosch ECUs using Electromagnetic Fault Injection (EMFI). A dedicated mask lines Korhex up on the microprocessor, and it fires a precisely timed electromagnetic pulse that glitches the MCU while it starts up. FLEX runs the whole procedure, so once the ECU is unlocked it is read and written in exactly the same way as any other bench job.
Because the glitch comes from an electromagnetic pulse and not from the MCU's power supply, the supply does not need isolating. No resistor removal, no soldering and no rework of the circuit board. That is why a Korhex ECU unlock is half the price of a voltage glitch unlock, and why there is less risk to your ECU.
Korhex EMFI is only available for certain ECU types. If Korhex does not support your ECU, it will need the voltage glitch unlock. Send us the part number and we will confirm which method applies.
What the Korhex EMFI procedure involves
Every ECU we receive goes through the same controlled process:
- The ECU casing is opened to get at the microprocessor
- The Korhex mask is placed over the MCU
- FLEX performs the EMFI glitch through Korhex and the ECU is unlocked
- A bench read is carried out to confirm the ECU is working correctly before it is reassembled
Nothing is taken off the board and nothing is soldered. The ECU comes back unlocked and ready for bench mode reading and writing with your own FLEX tool.
MD1CS003 Unlocked with Korhex EMFI
Watch us unlock a Stellantis MD1CS003 with Korhex EMFI, with no resistor removal and no soldering.
Voltage Glitch ECU Unlock
The voltage glitch is the original FLEX boot glitch method and has the widest coverage across Bosch MD1 and MG1 ECUs. Many ECUs that Korhex EMFI does not support can only be unlocked this way. The MCU's supply voltage is disrupted at exactly the right moment during start up. This lets FLEX get past the security and write the unlock patch.
To glitch the supply voltage, the MCU first has to be isolated from the rest of the board, which means taking a surface mount resistor off under a microscope. Because the job is done at hardware level and not in software, not every workshop wants to take it on. If you would rather not open ECUs and work on the circuit board yourself, send the ECU to us and we will take care of the whole process.
What the voltage glitch procedure involves
Every ECU we receive goes through the same controlled process:
- The ECU casing is opened and the circuit board is removed
- A surface mount resistor is temporarily removed under a microscope
- FLEX performs the voltage glitch to unlock the ECU
- The resistor is refitted and the board is inspected
- A bench read is carried out to confirm the ECU is working correctly before it is reassembled
The ECU comes back in the same condition it arrived in, unlocked and ready for bench mode reading and writing with your own FLEX tool.
Want to do the voltage glitch yourself?
If you have the equipment and the soldering skills, you can do the voltage glitch in your own workshop. We have made two videos. One covers the whole process from start to finish, and the other takes a close look at removing the resistor.
Watch both videos before you try the procedure. Taking surface mount components off a board and refitting them carries a real risk of damage, so it is worth knowing exactly what is involved first.
Voltage Glitch Unlock: MD1CS003
A full walkthrough of the voltage glitch on a Stellantis MD1CS003. It covers opening the ECU, removing the resistor, making the glitch connection and taking the read.
Resistor Removal and Refitting
A close look at the step that catches most people out: taking the surface mount resistor off the board under the microscope and refitting it.
Voltage glitch supported ECUs
Choose a manufacturer below to see which MD1 and MG1 ECUs the voltage glitch unlock currently covers.
- Bosch MD1CP032 TC299
- Bosch MG1CS024 TC298
- Bosch MG1CS201 TC298
- Bosch MD1CS001 TC298
- Bosch MG1CS049 TC298
- Bosch MD1CS069 TC299
- Bosch MD1CS005 TC298
- Bosch MD1CP006 TC298
- Bosch MD1CP061 TC298
- Bosch MD1CS089 TC299
- Bosch MD1CS069 TC299
- Bosch MD1CE102 TC299
- Bosch MD1CP007 TC298
- Bosch MD1CP017 TC298
- Bosch MG1CS028 TC298
- Bosch MD1CS012 TC298
- Bosch MD1CE100
- Bosch MG1CP007 TC299
- Bosch MG1CS047 TC299
- Bosch MG1CS008 TC299
- Bosch MD1CS003 TC298
- Bosch MG1CS042 TC298
- Bosch MD1CS004 H80 TC298
- Bosch MG1CS002 H80 TC298
- Bosch MG1CS031 H80 TC298
- Bosch MG1CS163 TC298
- Bosch MG1CS011 TC298
- Bosch MD1CS014 TC299
- Bosch MG1CS008 TC299
- Bosch MG1CS111 TC298
Coverage for both methods grows regularly as FLEX and Korhex updates come out, so this list may not always be fully up to date. If your ECU is not shown, contact us and we will confirm whether it is currently supported and which method it needs.
Frequently Asked Questions
Ready to send us an ECU?
To book an MD1 or MG1 unlock, email us at info@byteflash.co.uk with the ECU part number and the vehicle it came from. We will confirm whether it can be done with Korhex EMFI or voltage glitch, give you the address to send it to and book it in.
If we receive your ECU before 12:00 noon, we send it back the same day by DHL courier.