MEMS3 Tools

Download Link:

This is my free suite of tools for working with the Rover MEMS3 ECU. It includes MEMS3 Mapper, with full support for remapping (and now live mapping) the ECU, plus support for dual maps with live switching and a utility to reliably recover a bricked ECU. It also includes the simpler MEMS3 Flasher for reading, writing and cloning ECUs and MEMS3 Terminal for monitoring, decoding and logging OBDII communications with the ECU. These tools are all provided free of charge (you just need to purchase a cheap VAG COM KKL 409.1 cable or similar, details provided in the main article here) and run on Windows XP or later, 32-bit or 64-bit.

You can email me at

MEMS3 Mapper

These articles are about MEMS3 Mapper and how to use it.

Full Support Added for All Rover MEMS ECU Families

Support Added for the Lucas 5AS Immobiliser Including Key Fob Pairing

Remapping the Rover MEMS3 ECU

MEMS3 Seed Key Unlock Please read if you appear to be locked out of your ECU with Error setting general key, Negative response $7F

MEMS3 Live Mapping Remapping with Engine Running

MEMS3 Dual-Map Live Map Switching, Now on Rover K Series and Land Rover Td5.

MEMS3 Extended Firmware Memory Map Enables Map Switching on Freelander

MEMS3 Map Switching on Very Tight ECUs Enables Map Switching on MG ZT Turbo

MEMS3 MAP Sensor Scaling

MEMS3 Flywheel Trigger Pattern Changes

MEMS3 Downstream Lambda Delete Decat without DTCs or MIL light.

MEMS3 Firmware Immobiliser Delete Including Rover 75 / MG ZT / Freelander BMW EWS 3.D

Caterham Shift Light SuperSport Shift Light for All MEMS3 Caterhams (Now Adjustable)

Sharpening the VVC Response Making the VVC Mechanisms Respond More Quickly

TestBook T4 (Main Dealer) Level Support for MEMS3

High Speed Data Logging and Live Dashboard for MEMS3

Factory Wiping a MEMS3 ECU So a T4 will see it as a New Unit

Exploiting MEMS3 Vulnerabilities To Deploy & Execute Arbitrary Code Utilities in RAM

MEMS3 Td5 Emulation Emulating a Td5 ECU on Petrol ECU Hardware

Importing TunerPro XDF Definitions for Td5 e.g. from

Recovering a Bricked Rover MEMS3 ECU Without Opening the Case

MEMS3 Debugging Breakpoints with Stack, Register & Variable Tracing on a Running ECU

MEMS3 Seed to Key Algorithm Deriving the Pascal Seed to Key Algorithm from ECU Assembly Implementation

MEMS3 Checksum Calculations Documenting the Checksum Calculations and Routines in a MEMS3 Boot Loader

MEMS3 Firmware Correlation Identifying Tables & Scalars in All Firmware Versions

Support for Early Rover 75 / MG ZT / NNN100682 ECUs Please read if you have one of these earlier cars.

Support for Chinese / Continental EU4 NNN000830 ECUs / MG TF LE500 Please read if you have one of these later cars.

Other Projects

These articles describe the simpler MEMS3 Flasher tool and other things that have been developed along the way.

Reading/Writing/Flashing the Rover MEMS3 ECU (Download: MEMS3 Flasher)

MEMS3 Debug Code Injection

MEMS3 Reference Library

A library of reference material used during the development of MEMS3 Tools. These files may be of use to anyone else working with MEMS3.

MEMS3 Reference Library