Beyond AutoTuner/Flex: Looking for researchers who have audited Bosch MD1/MG1 SBOOT (SPC57xx / Aurix TC29x) via VFI/Glitching or Time Attack
I’m getting pretty fed up with how gated and commercial the tuning world has become. Tools like AutoTuner, bFlash and Magic Motorsport are fine if you’re just trying to get jobs in and out of the door, but if the customer has to lose the car while the ECU gets sent off or unlocked through a third party, that’s a pain for everyone. More than that, none of it really helps if you actually want to understand what’s going on at the hardware level and learn how to do it yourself.
I’m trying to connect with anyone doing proper independent research on Bosch MD1 / MG1 ECUs across Mercedes, BMW and VAG, mainly around the NXP SPC57xx and Infineon Aurix TC29x / TC39x stuff. I know the older platforms well enough — EDC15, EDC16, EDC17, boot passwords, TSW modes etc — but once the newer SBOOT updates started showing up after around mid-2020, the old tricks over diag lines were basically finished.
Has anyone here actually mapped out JTAG / DAP points on these Bosch boards, or spent time working on glitch timing for these MCUs without just kicking them straight into reset? I’m mainly interested in hearing from people who’ve genuinely put time into auditing this generation properly rather than just using commercial black-box tools.
If anyone has already got a real educational proof of concept working for this generation, I’d be interested in talking and would be willing to pay for your time or research.