MEDC17 UDS Flashing Exploit

Just finished writing the backbone of my flashtool last week. Can flash any MEDC17(presently only UDS based). Here’s a snippet of a EDC17C46 being flashed on bench:

It’s not just an FRF flash. Any modified file can be flashed(code and data area). An exploit in the bootloader is leveraged to allow RSA check(TPROT) to be bypassed and allow unsigned code to execute.

Presently using Tactrix Openport 2.0(J2534) as an interface and Arduino Due for logging CAN traffic.

Audi RS3 MED17.1.62 Mapswitch

On this engine there are a lot of maps for timing control. I have developed a solution to switch all the maps(84!) in the IgnCtl module. This means you have full control on timing for E85 setups.Another solution to change timing by adding a correction factor from a separate map is being developed. Here’s a video:

Mercedes EDC15C Mapswitch

With this ECU, I have implemented mapswitch on all EDC15 ECUs released in the market by Bosch! This version has 4 datablocks switched by:
1. Press and hold Gear lever +
2. Press Cruise control cancel once to view selected datablock
3. Press cruise control cancel again to switch datablocks
4. Release Gear lever + when done.
Here is a video:

EDC15 Scrambling

A lot of tuners work hard on the dyno to make tunes, only to be copied by rivals. I have come up with a solution to protect the maps by scrambling them. This means that maps are protected from being copied in boot and OBD mode read. Only the tuner who has my tool(unique for each tuner) will be able to descramble the file.

Keep on Reading!

Live-tune for E85 blend

A tuner contacted me to make a special version of map switching. Basically they needed a way to adjust KRKATE for varying alcohol content. Timing maps are also switched depending on the alcohol percentage selected in the cruise control speed display. Speed of 98km/hr in cruise control display corresponds to 98 Octane mode. 85 corresponds to E85. And so on.


TDI Swap!

Jan of 2019, I was contacted by a offroad racing team. These guys had been using old mechanical pump Mahindra engines in their builds. They were bothered by how heavy these engines were, produced very little power and had a peak RPM of 2800.

I suggested they use an ALH TDi engine from Skoda Octavia. It met all their requirements as it’s significantly lighter(150kgs! lighter), has a higher RPM limit(5000) and can be tuned/upgraded to produce more than 200HP.

Keep on Reading!

AC Compressor repair

Last year the Air-con on my Skoda Octavia(2002 1U) started behaving erratically. Did some basic diagnosis(pressure check in both lines, fans and compressor clutch check) revealed something wrong either with :-
1. Thermal expansion valve(TXV)
2. Refrigerant control valve(RCV)

After some further diagnosis, I confirmed it was the RCV. I proceeded to take the car apart. Upon examining the compressor internals, my suspicions were confirmed, it was the RCV. But the compressor had some aluminum shavings in the oil. This was very bad news for my wallet

Keep on Reading!