MEDC17 UDS Flashing Exploit

Just finished writing the backbone of my flashtool last week. Can flash any MEDC17(presently only UDS based). Here’s a snippet of a EDC17C46 being flashed on bench:

It’s not just an FRF flash. Any modified file can be flashed(code and data area). An exploit in the bootloader is leveraged to allow RSA check(TPROT) to be bypassed and allow unsigned code to execute.

Presently using Tactrix Openport 2.0(J2534) as an interface and Arduino Due for logging CAN traffic.

Mercedes EDC15C Mapswitch

With this ECU, I have implemented mapswitch on all EDC15 ECUs released in the market by Bosch! This version has 4 datablocks switched by:
1. Press and hold Gear lever +
2. Press Cruise control cancel once to view selected datablock
3. Press cruise control cancel again to switch datablocks
4. Release Gear lever + when done.
Here is a video:

EDC15 Scrambling

A lot of tuners work hard on the dyno to make tunes, only to be copied by rivals. I have come up with a solution to protect the maps by scrambling them. This means that maps are protected from being copied in boot and OBD mode read. Only the tuner who has my tool(unique for each tuner) will be able to descramble the file.

Keep on Reading!

Live-tune for E85 blend

A tuner contacted me to make a special version of map switching. Basically they needed a way to adjust KRKATE for varying alcohol content. Timing maps are also switched depending on the alcohol percentage selected in the cruise control speed display. Speed of 98km/hr in cruise control display corresponds to 98 Octane mode. 85 corresponds to E85. And so on.

MED17 MapSwitch

A lot of tuners contacted us for a solution to switch between maps on the newer generation MED17 ECUs. After a few weeks of rigorous testing we have been able to come up with a robust solution. Here is a video of it in action on an VW Golf MED17.5:

Contact us for a quote and we would be happy to design a solution suiting your requirements.

Bosch EDC15 MapSwitch

So for years tuners have tried various different techniques to have multiple tunes in one ECU. There are several advantages to this:
1. Multiple tunes with different output power levels
2. One tune can be tuned so that engine won’t start: sort of like an added level of security as the driver needs to switch into the tune which will start the engine
3. Different fuels need different ignition parameters such as ignition timing and duration to name a couple.

The present method to achieve this was with methods that involved opening the ECU and changing the hardware(flash memory with double the size to have 2 tunes as an example). In this post I am going to write about my journey to achieve a software based solution on the Bosch EDC15 ECUs.

Here is a video of it in action:

Keep on Reading!