Encrypted ECU Files on MD1 and MG1: Virtual Read vs Encrypted Read vs Decrypted File

A Duster 1.5 dCi with MD1CS006 (DACIA DUSTER MD1CS006 0281035669 10SW036647 10SW041931 DUMP) comes in for an EGR solution. The tuner reads it with a KESS3, gets a file, sends it to a mate with a Flex to write, and the Flex refuses it. No tool is faulty. The file is encrypted, and the two tools speak different encryption. Here’s what the words mean.

Three things people call “a read”

Virtual read

The tool identifies the ECU over OBD (hardware number, software ID, sometimes the calibration ID) and downloads the matching stock file from the tool maker’s server. No memory leaves the ECU. You get the file the factory would have flashed, which is fine for building a tune from stock, and useless if you needed to know what is in the ECU now. Autotuner, KESS3, Flex and bFlash all do this on the current Bosch generation.

Encrypted read

The tool really reads the flash over OBD, but the data comes out of the ECU scrambled. On MD1 and MG1 (Bosch’s TC27x/TC29x generation) and on the newer Continental units the bootloader encrypts what it sends, and the tool maker’s server holds the keys. The file you see on your laptop is either still encrypted (slave tools) or has been decrypted on the server and returned to you (master tools). Either way it went through the maker’s cloud, which is why an internet connection is required and why “offline” versions of these tools don’t exist for these ECUs.

Decrypted file

A plain .bin, the same thing a bench read of an older EDC17 gives you: open it in WinOLS, see the maps. What we sell is this. What a master KESS3, Flex or Autotuner exports after decryption is this. What a slave tool keeps in its project folder is not.

Why a file from one tool won’t write with another

• Container encryption. A KESS3 project file is readable only by KESS3, an Autotuner slave file only by the Autotuner that made it and its master. Nothing to do with the ECU; it’s the tool’s own licensing.
• What was read. Some tools read the calibration area only (about 1 to 2 MB), some read the full internal flash (4 MB or more on TC29x), some add the external flash. Two “reads” of the same AUDI A3 MG1CS011 0261S21826 05E906012Q 1319 10SW080448 DUMP can differ in size and neither is wrong. A file written back has to be the size and layout the writing tool expects.
• Tool patches. To make OBD writing possible on these ECUs the tool changes small areas of the bootloader or the checksum region. Tool A’s patch is not tool B’s; writing A’s patched file with B can leave the ECU with neither patch and no OBD access.
• Software version. Same as always: MERCEDES E220D W213 MD1CP001 0281033490 6549034512 10SW027171 10SW054679 DUMP and MERCEDES W213 MD1CP001 0281036840 6549032012 10SW027171 10SW054910 10SW087409 DUMP are both W213 and both MD1CP001. Different calibration, different file.

What that means for a file from us

We deliver a decrypted, plain .bin for the specific hardware and software on your label. To write it you need a master tool (or a slave whose master imports it for you) with the OBD write protocol for that ECU, and the tool will encrypt it on the way in. Tell us which tool you’ll use: for some MD1/MG1 versions we send the calibration-area file for OBD and the full file for bench, and they aren’t interchangeable. For BMW units like MINI COOPER F60 MD1CS001 0281035230 10SW034412 O 8SFP0-0000580A-003 DUMP, bench with the newer adapters gives a full plain read; OBD gives a virtual one.

Can I decrypt a slave file myself?

No. And if a website offers to, it is either the tool maker’s own service in disguise or a scam. The clean route is a master licence or a bench read.

Does an immo off exist on MD1/MG1?

On some. Where the immo data is in an EEPROM area the tool can reach on the bench, yes; where the ECU pairs cryptographically with the BCM or the key module (most Mercedes MD1CP001, BMW MD1CS001 with the newer CAS/BDC), an immo off on the engine ECU alone doesn’t start the car and we’ll tell you that before you pay. See immo off explained for the general logic.

Is the virtual read good enough for a DPF or EGR file?

Yes if the ECU is stock. If a previous tuner has been in, ask us for the stock file for that software ID and compare your virtual read with a real bench read before deciding.

Our MD1 and MG1 catalogue lives under MD1CS006, MG1CS011 and MD1CP001, with the software IDs in the titles. If yours isn’t there, the label photo and your tool’s ID screen on the request form is enough to match it.