Bosch MED17 is the direct-injection-era successor to Bosch ME7 on Volkswagen Auto Group cars from roughly 2008 onward. It powers the Mk6 + Mk7 Golf GTI/R, B7/B8 A4, Q5, and every 2.0 TSI / 2.0T variant in between. From the IMMO-OFF perspective, MED17 is a mixed story: the early revisions (MED17.1, 1.1, 5, 5.5) accept byte-level patches similar to ME7, but Bosch progressively hardened the platform — by MED17.9 the firmware is RSA-signed and IMMO-OFF is no longer mathematically possible without the OEM's private key.
This guide walks through which MED17 variants are patchable in 2026, which aren't, how to identify which one you're looking at, and what the alternatives are when you land on a signed-flash variant.
The MED17 timeline — Bosch hardening, by year
Bosch shipped MED17 in roughly 4 generations across VAG's 2.0 TSI program:
- MED17.1 / 1.1 / 1.27 (~2008-2010) — early direct-injection platform. Mk6 Golf GTI, Mk5 Jetta TSI, B6 Passat 2.0T, B8 A4 early. Tricore-based, unsigned flash. IMMO-OFF works via standard byte patch.
- MED17.5 / MED17.5.5 (~2009-2018) — Mk6 Golf R, B7 Passat, B8 A4 / A5 / Q5 2.0T, late Mk7 Golf GTI. Still Tricore + still unsigned for most of the production run. Most-common variant we patch today.
- MED17.5.20 (~2017-2019) — Mk7.5 Golf GTI, B9 A4. Bosch + VAG started hardening here. Some calibrations are still patchable; others have partial RSA verification that breaks our standard flow.
- MED17.9 / Simos 18/19 (~2018+)— Mk8 Golf, B9 A4 facelift + B9 A5 + late Audi Q5. Fully RSA-signed firmware. The OEM's private key signs every legitimate calibration; without that key, we can't produce a valid signature. Marked Manual in our coverage matrix.
Per the long-running MQB community MED17 wiki — the de-facto reference for MED17 variant identification — the unsigned-vs-signed boundary moved progressively forward as VAG rolled out the MQB chassis. The earliest signed variants appeared in 2018 model year on premium platforms (Audi flagship cars first), and the hardening propagated to mainstream Golf / Passat by model year 2020.
How to identify your MED17 variant
Three sources of identification, in order of reliability:
- VCDS / OBD-Eleven scanreports the ECU's component name + software number + hardware number. Format: “0CF 906 026 BC SW: 0001 HW: H07” or similar. The hardware code (H07 in the example) is the most useful for variant identification.
- The Bosch internal part number on the case sticker (0 261 S07 XXX or 0 261 S18 XXX format). Matches against the MED17 catalog at the wiki above.
- The free identifier at /identify— upload the dump and we report the variant + whether it's in our patchable set OR marked Manual (RSA-signed). Instant, free, no signup.
For customers without a VCDS or OBD-Eleven on hand, the identifier is the simplest path — we can identify the variant from the dump alone.
What the MED17 IMMO-OFF patch actually changes
On the unsigned MED17 variants (1, 1.1, 1.27, 3.4, 5, 5.5), the IMMO-OFF patch is structurally similar to ME7 but operates on a Tricore 32-bit flash instead of a 16-bit microcontroller EEPROM. The patch:
- Locates the immobilizer-check routine in the Tricore flash. For MED17.5.5 this sits around 0x800XXXXX (depending on calibration variant). Different MED17 sub-revs put the routine at different addresses.
- Replaces the conditional jump after the check with an unconditional “OK to start” branch. Total byte modification: 8-16 bytes depending on variant.
- Recalculates the multi-sector flash checksum (MED17 has 8-12 checksum sectors compared to ME7's 2-3). Automated solver, sub-second.
- Verify against known-good post-patch checksum signature.
On RSA-signed variants (MED17.9 and signed MED17.5.20 calibs), none of this works because the boot loader cryptographically validates the firmware signature against an embedded public key before allowing the modified flash to run. Without VAG's private signing key (and yes, this is the same problem the right-to-repair fight is currently navigating in Brussels + Washington), there is no byte-level path forward.
What to do if you land on a signed variant
For MED17.9 + signed MED17.5.20, the path is live OE-software programming via the VAG dealer toolchain (ODIS / SVM). Our /flash booking flowcovers VAG ODIS sessions — we remote-program your replacement ECU via ODIS (the VAG dealer tool) connected through your J2534 to our workstation. We can VIN-pair a virgin or matching donor ECU to your vehicle's key system, which is the OE-supported equivalent of what IMMO-OFF would do byte-level.
Cost: $250 per VAG ODIS session vs $25 byte-level IMMO-OFF on unsigned variants. The cost gap is real but the dealer alternative is $800-1,500+, so the remote-session path still wins by a wide margin.
Pricing — confirmed-coverage variants
For Live status MED17 variants in our /coverage matrix:
- $25 per file for MED17.1, 1.1, 1.27, 3.4, 5, 5.5 — confirmed byte-level patch with automated checksum recovery.
- $15 per file effective with credit packs (volume locksmiths + tuners).
- $50-100 per file for less-common MED17.5.20 calibrations where the patch is donor-pair- derived per job (and only on the unsigned subset of 5.20).
For Manual status variants (MED17.9, signed 5.20): byte-level IMMO-OFF is not available. The path is the $250 ODIS remote-programming session at /flash.
VAG cars by MED17 variant
Quick reference mapping cars to MED17 generation:
- Mk6 Golf GTI 2.0 TSI (2010-2013) — MED17.5
- Mk6 Golf R 2.0 TSI (2012-2013) — MED17.5 EA113
- Mk7 Golf GTI 2.0 TSI (2015-2017) — MED17.5.5
- Mk7 Golf R 2.0 TSI (2015-2017) — MED17.5.5
- Mk7.5 Golf GTI / R (2018+) — MED17.9 (signed, dealer-only)
- B8 Audi A4 / A5 / Q5 2.0T (2009-2016) — MED17.5 / MED17.5.5
- B9 Audi A4 / A5 (2017+) — Simos 18 + MED17.9 (signed, dealer-only)
- B7 / B8 VW Passat 2.0T (2012-2018) — MED17.5 / MED17.5.5
As one veteran VAG community contributor put it on the MQB wiki:
“MED17.5.5 is the last reliable IMMO-OFF target on modern VAG cars. Anything 2018+ on the MQB platform is increasingly signed, and we've had to retire byte-level flows on most of it. For Mk7.5 + B9 + later, the right workflow is remote ODIS, not IMMO-OFF.” — MQB community ECU contributor, MED17 wiki maintainer
Boot-mode vs OBD2 access — which to use
Two ways to read and write a MED17 ECU:
- OBD2 / K-line— read + write via the vehicle's OBD-II port using a generic Tricore tool. Works on unsigned MED17 variants. Doesn't require pulling the ECU.
- Boot-mode / BDM— bench-mode access by opening the ECU case + attaching to the Tricore boot pads with a Magic Motorsport Trasdata, AlexFlasher HW4, or equivalent. Works regardless of OBD2 protection (but doesn't help against RSA signing — the boot loader still validates).
For most customers, OBD2 access is the simpler path. Boot-mode is the workflow when the ECU is pulled anyway (rebuild, engine swap) or when OBD2 access is blocked.
Companion reading
- Bosch ME7 IMMO-OFF guide — the predecessor platform on VAG 1.8T cars
- What is IMMO-OFF — when do you need it — the broader IMMO-OFF service this MED17 patch is a special case of
- Remote ECU programming guide — the live-session alternative for signed-flash variants
- Live coverage matrix — every MED17 variant we cover with honest Live/Manual status flags