DQ500 0DL Flash Support

[flamingtoast123]

Hello, is it possible Bosch DQ500 DSGs will be supported in the future, as I believe they're very similar to the DQ381?

Massive respect for making this software open source, successfully flashed my Mk2 Tiguan in Australia.

[threepotMR2]

Yes please, DQ500 would be very helpful, I would love this too :)

These gearboxes are used in all sorts of conversions, DQ500 from diesel Tiguan and Q3 especially.

[TheFlashBold]

I reverse engineered the CBOOT firmware in Ghidra and fixed the 2-phase block erase issue that previously limited DQ381 to CAL-only flashing.
As DQ381 and DQ500 0DL are basically the same in terms of internal structure.
DQ500 0DL flashing should work now too.

Implemented in my fork: https://github.com/TheFlashBold/VW_Flash

Would appreciate testers.
If you run into issues, grab the flash.log, flash_details.log, and udsoncan.log and open an issue on my fork.

[evo77t]

flash.log
flash_details.log
udsoncan.log

I reverse engineered the CBOOT firmware in Ghidra and fixed the 2-phase block erase issue that previously limited DQ381 to CAL-only flashing. As DQ381 and DQ500 0DL are basically the same in terms of internal structure. DQ500 0DL flashing should work now too.

Implemented in my fork: https://github.com/TheFlashBold/VW_Flash

Would appreciate testers. If you run into issues, grab the flash.log, flash_details.log, and udsoncan.log and open an issue on my fork.

I compiled your version on windows, but can't flash dq500, cal and full flash tested. It's a problem with encryption before flashing, so no brick.

2026-03-10 12:53:22 [INFO] FlashUtils: Preparing \FD_03DATA.CAL_modd1a.bin for flashing as block 3
2026-03-10 12:53:22 [DEBUG] Checksum: Checksum = 0xb8b80ff6
2026-03-10 12:53:22 [WARNING] Checksum: File is invalid! File's embedded checksum: 0xffffffff does not match calculated: 0xb8b80ff6
2026-03-10 12:53:22 [INFO] Checksum: Fixed checksum in binary -> 0xb8b80ff6
2026-03-10 12:53:22 [INFO] FlashUtils: File CRC32 checksum is valid.
2026-03-10 12:53:22 [INFO] FlashUtils: Compressing \FD_03DATA.CAL_modd1a.bin input size :261632
2026-03-10 12:53:23 [INFO] FlashUtils: Encrypting \FD_03DATA.CAL_modd1a.bin compressed size :56788
2026-03-10 12:53:23 [ERROR] VWFlash: Uncaught exception
Traceback (most recent call last):
File "threading.py", line 1041, in _bootstrap_inner
File "threading.py", line 992, in run
File "lib\dsg_flash_utils.py", line 219, in flash_bin
File "lib\dsg_flash_utils.py", line 127, in prepare_blocks
File "lib\crypto\aes.py", line 18, in encrypt
File "Crypto\Cipher_mode_cbc.py", line 183, in encrypt
ValueError: Data must be padded to 16 byte boundary in CBC mode

[TheFlashBold]

I fixed that the AES CBC input is 16 byte aligned. pull and try again

[evo77t]

I have no logs, but now flashing starts and brick tcu.
"FLASHING - Erasing Block 3 - 0
FLASHING - Requesting Download for Block 3 - 0"
Bring to life by flashing backup with kt200.

[TheFlashBold]

yeah it stops after erasing and requesting the download?
You need to supply logs, then we can move forward.

[kernelson]

Any updates?

[flamingtoast123]

If it’s possible to recover a tcu via ODIS then I can attempt to flash a DQ500 0DL and supply logs.

…

On Wed, 1 Apr 2026 at 1:51 am, Kernelson ***@***.***> wrote: *kernelson* left a comment (bri3d/VW_Flash#161) <#161 (comment)> Any updates? — Reply to this email directly, view it on GitHub <#161?email_source=notifications&email_token=BK4O57BX4JHEAFZDDTMLEZ34TQATLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIMJWGQZTOMRXGAZKM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4164372702>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BK4O57FU7EJS5MKAOL5K4DT4TQATLAVCNFSM6AAAAACWHZR2WKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DCNRUGM3TENZQGI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[kernelson]

ODIS E is 50/50, it doesn't always work to recover bricked modules, and the most recommended method is to use a tool like Flex via Bench. If you have TCU tune in your car, you can use the cable that companies sell to customers and you will be able to revert the brick via OBD.