How to find maps inside a VAG ECU binary

VAG (Audi/VW/Seat/Skoda) — CROSS-PLATFORM map-location & tuning methodology. Covers Bosch Motronic petrol (ME7.x, MED9.1, MED17.x), Continental/Siemens Simos (Simos18), and Bosch diesel EDC (EDC15/EDC16/EDC17). Written as a "how to find and validate maps in a stock file when no definition exists" playbook that applies across those families, with per-platform specifics called out.

Reference - updated 4 August 2026

The ECU hardware

Petrol Motronic: ME7.1/ME7.1.1/ME7.5 = 16-bit C166-core MCU (Infineon/Siemens C167CR/CS or, on later boxes, ST10F275) with EXTERNAL AMD/Spansion 29Fxxx NOR flash. Image size is per-box — VERIFY from the dump, do not assume: 1.8T ME7.5 is typically 512KB (29F400-class); the 2.7T ME7.1 8D0907551 is C167CR-based and has been read as both 512KB and a full 1MB (29F800) dump depending on rev/read method; 4.2 V8 ME7.1.1 = 1MB. MED9.1 = Infineon TriCore TC1766. MED17.1 = TC1766/TC1767; MED17.5 = TC1791/TC1797-class. Simos18 (Continental/Siemens) = TriCore TC1791. Diesel: EDC15 = C167 (16-bit); EDC16 = TC1766; EDC17 = TC1767/TC1791/TC1793. Newest EA888 evo/EA839 petrol move to Bosch MG1 and diesel to MD1 (TC3xx Aurix) with secure boot — out of scope for OBD tuning, bench/BSL only. Rule of thumb: C166/ST10 = older 16-bit segmented (DPP-paged) architecture with external NOR; everything TC17xx = 32-bit TriCore with on-die PMU program flash + DFlash.

Fuelling and load sensing

Both — petrol (Motronic ME/MED) and diesel (EDC common-rail and older PD)

How this ECU is read and flashed

ME7 (C167/ST10): OBD over K-line KWP2000/ISO14230 — header type is PER-ECU (some answer no-address, some physical, so PROBE both). Read via ReadMemoryByAddress (23); WRITE via session 10 85 (immo-gated on some, e.g. 4Z), SecurityAccess 27, RequestDownload 34, TransferData 36 37. Immo boundary is real: dev session (10 86 14) + read (23) reaches EEPROM/RAM immo-free but NOT flash — flash is immo-gated (needs 10 85 / matched car / SKC), so use BENCH BOOT MODE (C167/ST10 BSL over K-line, immo-immune) which requires grounding ONE internal boot pin (e.g. flash pin24->P0L.4; can't be done cable-only). MED9.1 (TC1766): CAN TP2.0/UDS — flash READ must NOT enter session 0x86 (reboots to BSL, needs a power-pull); 0x27 alone enables reads; cal-write arms via 33C4->73 with a 31C5 re-arm before each 33C5 poll; full recovery = bench BDM/BSL; immo via M95160 EEPROM on CH341A. EDC16 (TC1766)/MED17/EDC17 (TC1767/1791/1793): OBD UDS with SecurityAccess seed/key + boot-mode bootloader upload, or BENCH BOOT via TC1791_CAN_BSL (boot pins/BDM). Simos18 & later signed MED17.x/EDC17: OBD flash of the ASW needs the SBOOT seed/key path (bri3d/Simos18_SBOOT); a CAL-only tune on Simos18.1 just needs a valid CRC32 (CAL unsigned), while Simos18.10/newer signed CAL needs SBOOT/bench; the OBD transfer uses AES-128 'Encryption A' + LZSS 'Compression A'. General: bench/boot tools (KESS/KTAG/CMD/Autotuner/bFlash and open-source TC1791_CAN_BSL) bypass immo & signature gates that OBD can't. Newest MG1/MD1 (TC3xx) add secure boot/ECDSA — treat as bench-only. Always correct/replace checksums (and re-sign or route around a signature where present) before writing.

Engine codes in this family

• 1.8T 20v ME7.5 — AWP/AWM/AMK
• 2.7T biturbo ME7.1 — APB/AGB/AZB
• 4.2 V8 ME7.1.1 — BBK/BAS
• 2.0 TFSI EA113 MED9.1 — BWA/BPY/CDLA
• 3.0T supercharged MED17.1 (NOT MED9.1) — CAKA/CGWD
• 2.0 TFSI EA888 Gen3 Simos18 (later boxes Bosch MG1) — CJXC/DAZA/CZPB
• 1.9/2.0 TDI PD EDC16 — BXE/BKD/BMN
• 2.0 TDI CR EDC17 — CBAB/CFFB/CLLA
• 3.0 V6 TDI EDC17 — CASA/CDUC

Staging - what each stage really gives

• stage1 - SOFTWARE-ONLY reflash on 100% stock hardware (OBD or bench). Petrol ME7/MED/Simos: raise LDRXN/KFMIRL boost & load request, add WGDC (KFLDRL/KFLDIMX) to hit it, add timing (KFZW) within knock headroom, set safe WOT lambda (LAMFA), keep the torque monitor (KFMIOP/miszul/mimax) satisfied, correct checksum. Diesel EDC: raise IQ within the smoke limiter, lift rail pressure & boost. Typical gains: 1.8T ~+30-50 hp; 2.0 TFSI ~+40-70 hp; 2.7T ~+60-80 hp; 2.0 TDI ~+25-35% torque. No leaning-out, no monitor-disable, no smoke-limiter removal.
• stage2 - BOLT-ONS + recalibration: downpipe/decat, front-mount intercooler, high-flow intake/exhaust (diesel: intercooler, exhaust, sometimes hybrid VNT). Rescale for the extra airflow and reduced backpressure — more boost/timing headroom, often a larger MAF housing so MLHFM/KRKTE/KFKHFM are re-scaled. Petrol typically +10-20% over Stage 1; diesel gains grow but start stressing the clutch — plan clutch/DSG capacity.
• stage3 - HARDWARE: bigger/hybrid turbo, larger injectors + upgraded HPFP/LPFP, upgraded clutch and DSG/mechatronic tune, uprated fuelling. Full fuelling remap (KRKTE/injector constant, MLHFM often rescaled or moved toward speed-density when the MAF is maxed), boost control re-authored for the new turbo, torque model & clutch-torque limits raised IN LOCKSTEP. Diesel: larger VNT/injectors, DPF & EGT management, clutch. Gains are build-specific — e.g. 2.7T 500+ hp, 2.0 TFSI EA888 350-400+ hp; requires supporting fuel, cooling, and transmission.

Safety limits

• PETROL knock: no sustained knock — log knock counts/retard and back off timing (KFZW) until zero sustained knock; leave knock control/enrichment protective.
• PETROL AFR: boosted WOT lambda ~0.80-0.85 (approx 11.5-12.5:1); never leaner than ~0.90 under boost. Set via LAMFA and verify with a real wideband.
• PETROL EGT: keep modeled/real pre-turbo EGT under ~950degC; do not disable KFLBTS/TABGBTS enrichment to chase leaner AFR.
• PETROL torque monitor: must always hold modeled actual torque < miszul and driver request (mrfa) < mimax — raise limits in lockstep, NEVER blindly zero the monitor (it is the last-line lean/overboost protection).
• BOOST transient/overshoot: tune the WGDC feed-forward + I-clamp so target is met WITHOUT spikes — overshoot trips the overboost fuel cut (limp) and overstresses pistons/turbo. Avoid integrator wind-up.
• BOOST/turbo (petrol): stay inside the compressor map (off surge and overspeed); no MAF signal clipping/maxing — rescale the housing instead.
• FUEL SUPPLY (DI petrol): keep HPFP/LPFP and rail-pressure headroom on TFSI/TSI — running the HPFP to its limit causes rail-pressure droop and lean spots at high RPM; upgrade the pump before adding fuel demand (Stage 3). Keep injector duty under ~85-90%.
• DIESEL rail pressure: never exceed the pump/injector system ceiling (~1600-2000 bar depending on generation).
• DIESEL EGT: keep sustained EGT under ~750-800degC (sensor-dependent) to protect turbo/manifold/DPF.
• DIESEL smoke limiter: never inject more fuel than the air-mass (MAF) smoke map permits — raising IQ without air = black smoke, soot, DPF overload.
• DIESEL turbo overspeed/VNT surge: don't chase boost past the VNT/variable-vane turbo's overspeed or into surge — a small stock VNT overspeeds and fails; back the boost target off the compressor/turbine limit.
• DIESEL DPF/emissions: don't drive soot past regen capacity; keep within thermal/NOx limits.
• DSG/clutch: never command engine torque above the transmission's clutch torque-limit map (e.g. DQ250 stock clutch ~350 Nm; DQ381/DQ500 higher) without raising the clutch torque-limit + clamp-pressure maps in lockstep (separate TCU/mechatronic flash).
• INTEGRITY: always correct the checksum (and re-sign or route around a signature where present) — an uncorrected/mis-signed file is rejected/limps or, on signed boxes, can brick without bench recovery.

How confident is this?

SOLID: ME7 map roles, torque-monitor math, and the checksum toolchain (grounded in S4wiki, ME7Sum/ME7Check/ME7Logger, and live K-line/bench work); the LOCATION methodology (identity-string->def, axis-signature scan with an EXACT-close requirement, stock-vs-tune diff, interpolation-kernel pointer tracing, decode-to-sane validation with the uniform-map/zero-cell dtype+endianness gate); Simos18/TriCore flash architecture, CRC vs signature layering, and access paths (grounded in bri3d/VW_Flash, Simos18_SBOOT, TC1791_CAN_BSL); WinOLS/DAMOS/A2L as the pro definition standard. Corrected IN THIS PASS: RSA/signature enforcement is NOT universal — it is Simos18.x, later MQB EDC17/Simos12, and MG1/MD1; ordinary MED9.1/MED17.1/17.5/EDC16/early-EDC17 are multi-region CRC only (no signature). The 3.0T supercharged is MED17.1, NOT MED9.1. ME7 image size (512KB vs 1MB) varies per box — verify from the dump, don't assume a chip. THIN / MUST-VALIDATE (do NOT treat as fixed): exact per-file FLASH ADDRESSES for any map (come only from a matching def or from signature+diff+validate on the specific box, never invented); precise checksum ranges/polynomials and the exact set of signed blocks vary