Korhex Boot Glitch and MCU Access Tool

Korhex Boot Glitch and MCU Access Tool

Korhex is a hardware add-on MagicMotorsport built for its Flex programmer. Its job in one sentence: open protected engine control units without soldering on the board and without wiring boot pins by hand. It does this with a Boot Glitch procedure applied at a defined contact point on the microcontroller, using EMFI — Electromagnetic Fault Injection. Korhex does not work on its own; it is part of the Flex ecosystem and is used together with Flex.

What Korhex Is and Why It Exists

Recent engine control units are closed over OBD, protected on the bench and hardened against the classic boot method. The Bosch MDG1 family is the example most workshops meet. On these units the classic boot procedure usually required:

• Opening the housing and the protective coating on the board
• Removing one or more resistors
• Wiring the boot pins by hand, usually with solder
• Undoing all of it once the job is finished

Every step costs time and every soldered joint is a risk — a lifted pad turns the job into a repair. Korhex was designed to remove those steps: the tool is positioned with its own mask on the defined contact point of the unit's microcontroller and provides access without physical intervention.

What Is a Boot Glitch, and How Does EMFI Work?

A glitch is a very short, controlled disturbance introduced while a microcontroller is running, timed to catch the instant the processor skips a security check. A Boot Glitch applies that during start-up: the disturbance created as the unit passes its security check lets the processor enter protected boot mode.

How the disturbance is produced defines the method. Korhex uses EMFI — an electromagnetic pulse delivered through an antenna positioned over the microcontroller. The board is not touched, nothing is removed, no trace is left. That is the difference from voltage-based methods (VFI), which require intervention on the supply rail.

What Korhex Can Do

Korhex is not a read/write tool but an access tool: it opens the door, Flex does the work. Once access is established the supported operations are:

• Internal flash read, write and checksum correction
• Internal EEPROM read and write
• Full backup — the entire contents of the unit before any operation
• Boot unlock

Supported ECUs and Processors

Korhex support is defined unit by unit and grows with Flex software updates. The main applications announced by the manufacturer:

On the Mercedes side, models running Bosch MD1CP001 and MG1CP002 include the A-Class (W177), GLA (H247), Vito (W447) and CLE (C236). The list grows with updates, so confirm support for your specific unit before buying — send us the number printed on it.

Operation Times

Compared with the strip-down, solder and reassembly time a classic boot on the same unit demands, this is where the tool pays for itself: not in minutes saved but in labour per job and in risk not taken.

How Korhex Is Used

1. Connect. Set the unit up on the bench with Flex and Flexbox, and connect Korhex to the system.
2. Position. Fit the Korhex mask for that unit family and seat the antenna on the defined contact point of the microcontroller.
3. Unlock. Start the access and Boot Glitch procedure from the Flex software; the workflow is guided.
4. Program. With access established, reading, writing, backup and checksum run through Flex as usual.

What Is in the Box

• Korhex main device (KRX01.001)
• External Korhex connector board (KRX02.002)
• USB cable (KRX03.001)
• Power supply and 3-pin power cord (FLX4.9.1)
• 2 × Antenna A
• 5 × Korhex Mask A — microcontroller contact masks
• Carrying case and international plug heads

Technical Specifications

Which Licence Do You Need?

You can add the Boot Glitch licence alongside the device from the selector on this page. The Master / Slave distinction applies here too and must match your Flex side — a Slave Flex takes a Slave Boot Glitch licence.

Who It Is For

• Chip tuning workshops working on new-generation protected units from Mercedes, DAF and similar
• Electronics shops doing repair, cloning and software recovery on MDG1 and SPC58 based units
• Fleet workshops dealing with heavy duty units such as CPC5
• Existing Flex owners extending coverage to protected new-generation units