Advanced ECU Unlocking & Programming
Locked ECU? We have ways in.
KorHex • Boot Glitch • Bench • Boot • OBD
For vehicle owners, garages and professional remappers
Modern ECUs are becoming increasingly difficult to access. Manufacturers are using more sophisticated processor security and programming protection, and on some of the latest vehicles a conventional tuning tool simply cannot read or write the ECU.
At Turner Performance, we have invested heavily in the equipment, software and electronics capability required to work with these control units.
Our latest addition is Magicmotorsport KorHex, working alongside Flex and our existing professional ECU programming systems.
But KorHex is only part of the story.
Our service is not tied to one tool or one unlocking method.
We use the appropriate equipment and procedure for the ECU in front of us — whether that means OBD, Bench, Boot, Boot Glitch, direct MCU access or another supported programming method.
For the vehicle owner, that means a car previously described as locked or untunable may now be possible.
For professional remappers and garages, it means you don't necessarily have to invest in every new piece of specialist equipment yourself.
Send the difficult work to us.
KorHex – a new generation of ECU access
KorHex is Magicmotorsport's specialist hardware system for accessing certain highly protected ECU microcontrollers.
Working with Flex, it uses EMFI — Electromagnetic Fault Injection — during the Boot Glitch procedure. The KorHex system is precisely positioned over the required area of the microcontroller while Flex controls the access procedure.
On supported ECUs, this can substantially reduce the physical intervention previously required to gain access to the processor.
Procedures which could involve soldering, PCB work, resistor removal or other component-level operations can, on supported applications, now be performed using the KorHex Boot Glitch process.
For an expensive modern ECU, reducing unnecessary physical intervention is a significant advantage.
And this isn't equipment we're waiting for.
Our KorHex system is here, in our workshop, and available for ECU work now.
The KorHex equipment and Bosch MD1CS003 shown on this page are our own equipment and ECU — not generic promotional photographs.
Bosch MD1CS003 TC298 – KorHex Boot Glitch
The Bosch MD1CS003 using the Infineon TC298 processor is an excellent example of how quickly ECU access technology is developing.
With the latest Flex/KorHex Boot Glitch procedure, supported MD1CS003 ECUs can be accessed without the component removal required by some earlier procedures.
Available operations include:
Internal Flash read/write
Internal EEPROM read/write
Full ECU backup
Checksum correction
Unlocking for subsequent Bench programming
The MD1CS003 is found across later Stellantis applications, including vehicles from Peugeot, Citroën, DS, Opel/Vauxhall, Fiat and related marques.
For vehicles and ECUs which previously required considerably more involved specialist intervention, this represents an important development.
Bosch MG1CS032 SPC58
KorHex support also extends to the Bosch MG1CS032 using the SPC58 processor.
The supported Flex Boot Glitch procedure uses KorHex and EMFI to access the processor without the PCB soldering or component removal required by more invasive methods.
Applications include later Stellantis vehicles using supported petrol engine families across marques including Peugeot, Citroën/DS, Opel/Vauxhall, Fiat and Jeep.
As with every ECU, we check the exact hardware and available protocol before commencing work.
Mercedes MD1CP001 & MG1CP002
KorHex isn't limited to Stellantis vehicles.
Supported Mercedes Bosch MD1CP001 and MG1CP002 ECUs using the SPC5777 processor can also be accessed using the Flex/KorHex Boot Glitch procedure.
Depending upon the supported ECU, this provides access to Internal Flash, Internal EEPROM and Full Backup without requiring the PCB soldering or component removal associated with some previous access methods.
This is precisely why our ECU programming capability continually evolves.
There is no longer one universal definition of a “locked ECU”.
Ford SID212 & SID212EVO
The Continental SID212 and SID212EVO, widely encountered on later Ford EcoBlue vehicles, provide another excellent example.
These ECUs have presented considerable difficulties for tuners and remappers.
That situation has changed.
Current Flex support provides direct access to supported SID212 and SID212EVO ECUs without requiring a separate unlock procedure, with access to the calibration area and internal EEPROM through supported OBD and Bench protocols.
Applications include vehicles such as:
Ford Transit
Ford Transit Custom
Ford Ranger
Ford Kuga
Ford Mondeo
This illustrates an important point about our service:
Not every locked or protected ECU needs KorHex.
Some require Boot Glitch.
Some require conventional Boot.
Some require Bench access or unlocking.
Others which previously required specialist unlocking can now be accessed directly.
And some can be programmed completely through OBD.
We select the method to suit the ECU — not the ECU to suit the tool.
More than KorHex
Turner Performance operates multiple professional ECU programming platforms.
That gives us considerably broader capability than relying upon one manufacturer or one programming tool.
ECU technology changes constantly. A particular ECU may be supported by one tool but not another, while a new protocol can completely change the procedure required for an ECU which was difficult only months earlier.
That is why we continually invest in equipment and keep our programming capability current.
If one tool says “not supported”, that isn't necessarily the end of the job.
Trade ECU Unlocking Service
For remappers, tuners and garages
You don't need to own every tool that we own.
And you don't need to turn away a profitable job simply because your existing equipment reports:
ECU locked
Protocol not supported
Unlock required
Bench unlock required
or the procedure requires specialist equipment that you don't have.
Send the ECU to us.
We can carry out the specialist ECU operation and return it ready for you to continue with your customer.
Depending upon the ECU and available protocol, our trade service can include:
ECU identification • Unlocking • Boot Glitch • Bench access • Flash reading • EEPROM reading • Full backup • Programming • Recovery • Readback verification
You retain your customer. We provide the specialist ECU capability behind you.
Already a professional remapper?
You may already own KESS3, AutoTuner, CMD, bFlash, Flex or another professional tuning system.
That doesn't necessarily make it commercially sensible to purchase another complete equipment ecosystem simply to deal with an occasional ECU that falls outside your existing coverage.
That's exactly where our trade service fits.
Rather than turning the job away, send us:
Vehicle make/model/year
Engine
ECU manufacturer and type
A clear photograph of the ECU label
The tool and protocol you have attempted to use
What happened or what the tool reports
If you already have an original read, send that as well.
We will establish the appropriate route before the ECU is worked on.
Vehicle owners – been told your car can't be remapped?
Contact us before assuming that is still the case.
ECU access technology is developing extremely quickly.
A vehicle which genuinely couldn't be programmed previously may now have a completely different solution through OBD, Bench, Boot or Boot Glitch.
That doesn't mean every ECU can be unlocked or programmed.
It means we can identify what is fitted to your vehicle and establish what is currently possible.
If you have been told:
“The ECU is locked.”
“It needs sending away.”
“Nobody can tune this ECU.”
“Our tool doesn't support it.”
send us the vehicle details and let us check the current options.
ECU unlocking isn't the same as tuning
This distinction matters.
Unlocking an ECU only provides access to it. The calibration work comes afterwards.
Turner Performance combines advanced ECU access with vehicle diagnostics, calibration and rolling-road testing.
If a vehicle has an underlying mechanical or electronic fault, unlocking its ECU doesn't fix that fault.
Likewise, simply gaining access to an ECU doesn't guarantee that the calibration subsequently written to it is appropriate.
Access, diagnosis and calibration are different disciplines. We deal with all three.
Full backup and readback verification
Where the protocol provides the facility, we can obtain the available ECU memories before modification.
Depending upon the ECU and access method, this can include:
Internal Flash
Internal EEPROM
Calibration data
Full Backup
Having the appropriate original data can become extremely important if an ECU subsequently requires recovery, cloning or restoration.
We also use readback verification where appropriate, rather than simply assuming that a programming operation has completed correctly.
ECU Recovery
Advanced programming capability is also valuable when something has already gone wrong.
An interrupted programming operation, incorrect file, unsuitable protocol or failed tuning attempt can leave an ECU which no longer communicates normally.
Boot, Bench and direct-memory access can sometimes provide a route to recovering an ECU which cannot be recovered through conventional OBD programming.
If an ECU has failed during programming, stop before making the situation worse.
Tell us:
Exactly what happened
Which programming tool was used
Which protocol was selected
What was read from the ECU
What file was written
What communication remains
And, where possible, send us the original and modified files.
The more accurately we know what happened, the better the chance of establishing the correct recovery route.
Our capability keeps changing
ECU access is developing too quickly for any website to provide a permanent list of everything that is possible.
New Flex, KorHex and other professional programming protocols are released regularly. ECUs which previously required specialist external unlocking can gain Bench access; Bench-only ECUs can gain OBD support; and entirely new Boot and Boot Glitch methods continue to appear.
We continually monitor these developments and update our own equipment and capability accordingly.
If your ECU isn't listed here, ask us.
Yesterday's “locked ECU” can become tomorrow's supported protocol.
For the Trade
Don't lose the customer because you don't have the tool.
If you are a remapper, garage or diagnostic specialist and encounter an ECU outside your current capability, talk to us.
There may be no commercial justification for purchasing thousands of pounds of additional specialist equipment for a protocol you might use only occasionally.
Use our equipment and experience as an extension of your own workshop.
You keep your customer.
You carry out the work you normally perform.
We handle the part you can't.
Locked ECU? Send us the details.
Vehicle owners
Send us your registration number and tell us what you would like to achieve.
We can identify the vehicle and check the currently available ECU programming options.
Remappers, tuners & garages
Send us:
Registration or VIN
Vehicle details
ECU type
Clear photograph of the ECU label
Your tuning/programming tool
What you have already attempted
If you already have ECU reads or backup files, send those as well.
Turner Performance
Advanced ECU Unlocking • KorHex • Boot Glitch • Bench Programming • ECU Recovery • Bespoke Remapping
Professional equipment. In-house electronics capability. Rolling-road development.