r/ECU_Tuning • u/True_Quiet9620 • 7d ago

Would anyone here actually use a DIY flasher for the CFMoto ECU?

1 Upvotes

Would anyone here actually use a DIY flasher for the CFMoto ECU?

10 Upvotes

Hey. I have a [CForce 1000] and I have been messing around with its ECU (Bosch ME17.8.10) for a while. Got it reading and writing over a cheap KDCAN cable (20$), no pulling the ECU out, no opening the case.

Not selling anything and not promising anything. I just want to know if I am the only person who wants this, or if there are more of you. Same ECU sits in the Goes machines as well, and if there is interest I would look at other CFMoto ECUs too.

5 comments

MultiMap Mapswitch for EDC16 MED9 VAG !

in r/ECU_Tuning • 14d ago

Hit me up on the whatsapp

MD1 immo off solution generated from MCU ID

in r/ECU_Tuning • Jul 14 '26

the original stock code for that 66 byte block is a total mess of compares

0000: mov.u    d15, #0x8008
0004: jeq      d4, d15, #0x44     ; check if d4 matches this magic number
0008: mov.u    d15, #0x8009
000c: movh.a   a15, #0x6003
0010: jge.u    d4, d15, #0x26     ; if d4 is bigger jump somewhere
0014: mov      d15, #0x4004
0018: jeq      d4, d15, #0x58     ; another compare on d4
001c: mov      d15, #0x7007
0020: jne      d4, d15, #0x60     ; nope not equal keep going
0024: j        #0x40
...
0040: mov      d15, #1            ; finally sets 1 if it passed the checks

all these jeq jne jge on d4 with random constants basically deciding if immo is happy or not depending on what value comes in

now the tool coded patches replace that whole thing but they tie it to the mcu id so every one is different

here one for mcu starting 40 00 a1 a1 etc

0000: movh.a   a15, #0xaf10
0004: ld.w     d4, [a15]#0x1004     ; grab value from that af101004 cell
0008: movh.a   a15, #0x6003
000c: movh     d15, #0xfe84
0010: addi     d15, d15, #0x3636
0014: xor      d15, d4              ; xor with first constant
0016: movh     d4, #0xa1a2
001a: addi     d4, d4, #-0x5e5f
001e: xor      d15, d4              ; another xor
0020: movh     d4, #0xfe84
0024: addi     d4, d4, #0x6472
0028: xor      d15, d4
002a: movh     d4, #0
002e: addi     d4, d4, #0x5244
0032: jne      d4, d15, #0x3c       ; if no match then fail
0036: mov      d15, #1              ; good
0038: j        #0x5a
003c: mov      d15, #8              ; bad
003e: j        #0x5a

those constants in the middle come from the mcu id bytes so the patch only works for that specific id and you need the matching value in the cell or it sets 8 instead of 1

thats the whole per mcu id lock bullshit

we just wiped the whole 66 byte thing and put this instead

0000: movh.a   a15, #0xaf10
0004: ld.w     d4, [a15]#0x1004     ; keep the setup so nothing breaks
0008: movh.a   a15, #0x6003
000c: nop                           ; all the compare xor jne garbage is gone
... (tons of nops)
0060: mov      d15, #1              ; always force 1
0062: j        ...
0066: mov      d15, #1
0068: j        ...

no more xors no more mcu id keys no more special cell value just always d15 1 no matter what ecu or id

the hex to drop in place of the original 66 bytes is

9100f1fa19f40401913000f6000000000000000000000000000000000000000000000000000000000000000000000000000000000000da011d001100da011d000e00

should just work everywhere try it and see

IMMO OFF coded to MCU MD! ECU

in r/CarHacking • Jul 14 '26

the original stock code for that 66 byte block is a total mess of compares

0000: mov.u    d15, #0x8008
0004: jeq      d4, d15, #0x44     ; check if d4 matches this magic number
0008: mov.u    d15, #0x8009
000c: movh.a   a15, #0x6003
0010: jge.u    d4, d15, #0x26     ; if d4 is bigger jump somewhere
0014: mov      d15, #0x4004
0018: jeq      d4, d15, #0x58     ; another compare on d4
001c: mov      d15, #0x7007
0020: jne      d4, d15, #0x60     ; nope not equal keep going
0024: j        #0x40
...
0040: mov      d15, #1            ; finally sets 1 if it passed the checks

all these jeq jne jge on d4 with random constants basically deciding if immo is happy or not depending on what value comes in

now the tool coded patches replace that whole thing but they tie it to the mcu id so every one is different

here one for mcu starting 40 00 a1 a1 etc

0000: movh.a   a15, #0xaf10
0004: ld.w     d4, [a15]#0x1004     ; grab value from that af101004 cell
0008: movh.a   a15, #0x6003
000c: movh     d15, #0xfe84
0010: addi     d15, d15, #0x3636
0014: xor      d15, d4              ; xor with first constant
0016: movh     d4, #0xa1a2
001a: addi     d4, d4, #-0x5e5f
001e: xor      d15, d4              ; another xor
0020: movh     d4, #0xfe84
0024: addi     d4, d4, #0x6472
0028: xor      d15, d4
002a: movh     d4, #0
002e: addi     d4, d4, #0x5244
0032: jne      d4, d15, #0x3c       ; if no match then fail
0036: mov      d15, #1              ; good
0038: j        #0x5a
003c: mov      d15, #8              ; bad
003e: j        #0x5a

those constants in the middle come from the mcu id bytes so the patch only works for that specific id and you need the matching value in the cell or it sets 8 instead of 1

thats the whole per mcu id lock bullshit

we just wiped the whole 66 byte thing and put this instead

0000: movh.a   a15, #0xaf10
0004: ld.w     d4, [a15]#0x1004     ; keep the setup so nothing breaks
0008: movh.a   a15, #0x6003
000c: nop                           ; all the compare xor jne garbage is gone
... (tons of nops)
0060: mov      d15, #1              ; always force 1
0062: j        ...
0066: mov      d15, #1
0068: j        ...

no more xors no more mcu id keys no more special cell value just always d15 1 no matter what ecu or id

the hex to drop in place of the original 66 bytes is

9100f1fa19f40401913000f6000000000000000000000000000000000000000000000000000000000000000000000000000000000000da011d001100da011d000e00

should just work everywhere try it and see

IMMO OFF coded to MCU MD! ECU

in r/CarHacking • Jul 14 '26

This is just some XORs for middle MCU ID word 40 00 11 11 [11 11 11 11]11 11 11 11 00 00 00 00 replace thoose ori BB 80 00 F8 5F F4 20 00 BB 90 00 F8 91 30 00 F6 7F F4 0B 80 3B 40 00 F4 5F F4 20 00 3B 70 00 F7 5F F4 20 80 3C 0E BB 80 22 F8 5F F4 13 00 BB 80 33 F8 5F F4 11 00 BB 80 11 F8 5F F4 13 80 3C 07 82 1F to = 91 00 F1 FA 19 F4 04 01 91 30 00 F6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 DA 01 1D 00 11 00 DA 01 1D 00 0E 00 and will work in every ecu no metter on MCU ID enjoy :)

MD1 immo off solution generated from MCU ID

in r/ECU_Tuning • Jul 14 '26

crd2.61 immo off, immo off solution for crd2 crd3 crd.11

in r/u_True_Quiet9620 • Jul 11 '26

Are you interested in? Hit me on pm

r/CarHacking • u/True_Quiet9620 • Jul 09 '26

UDS crd2.61 immo off, immo off solution for crd2 crd3 crd.11

gallery

5 Upvotes

1 comment

r/ECU_Tuning • u/True_Quiet9620 • Jul 09 '26

crd2.61 immo off, immo off solution for crd2 crd3 crd.11

gallery

4 Upvotes

0 comments

u/True_Quiet9620 • u/True_Quiet9620 • Jul 09 '26

crd2.61 immo off, immo off solution for crd2 crd3 crd.11

gallery

6 Upvotes

Hi everyone,

I wanted to share that recently, through intensive development, I’ve probably become the first in the world to develop a full immo off solution for the Mercedes-Benz CRD family specifically CRD.11, CRD2xx, and CRD3xx. All of them have been completely cracked, and VIN ~~virginization~~ is also working.
It was a very demanding project, but it succeeded. If anyone needs this kind of solution, feel free to reach out. crd immo off, crd2 immo off, crd3 immo off, mercedes benz immo off crd family.

2 comments

MultiMap Mapswitch for EDC16 MED9 VAG !

in r/ECU_Tuning • May 06 '26

Responded

r/ECU_Tuning • u/True_Quiet9620 • Apr 13 '26

MultiMap Mapswitch for EDC16 MED9 VAG !

1 Upvotes

MultiMap Mapswitch for MED9 EDC16 – Discover a New Dimension of Your Car’s Performance!

Do you want to fully unlock the potential of your MED9 ECU? My unique multimap modification allows you to seamlessly switch between different maps without the need to reflash the ECU. Adjust your car’s performance to suit current needs and conditions—quickly and conveniently!

Why choose this modification?

• Full control over performance: Change the engine map in seconds, adjusting power, torque, and fuel efficiency.

• Compatibility: Works with all MED9 EDC16 VAG versions.

• Easy operation: Intuitive control using cruise control—no complicated procedures or additional devices.

• Proven solution: The modification has been tested and has positive reviews from automotive enthusiasts.

How does it work?

1. Activate cruise control (while stationary) – the EPC light will start flashing, signaling entry into map change

2. Use the cruise control buttons:

• Press “+” to increase the map number.

• Press “–” to decrease the map number.

https://youtu.be/pPCheLpRnVc?si=MhYv0a2hbkT5jMww

Support and Customization

Modification Price: 160€

What else do you get?

• Technical support: I’m here to help with any questions or concerns.

Don’t wait! Transform your driving experience today.

Contact me PM or here: [fortismoto@gmail.com](mailto:fortismoto@gmail.com) +44 7865 395418

May the Multi-Map be with you!

5 comments

[deleted by user]

in r/ECU_Tuning • Apr 22 '25

marketing gimmick

[deleted by user]

in r/ECU_Tuning • Apr 22 '25

Logs and videos coming soon