Star3 SECoC coding

The newest Mercedes chassis don't let you code anything without an online certificate from ZenZefi. On W206, W223, X254, EQE, and EQS, every variant write, module swap, and teach-in has to be signed by Mercedes' servers in real time. Xentry Pass-Thru with a local license isn't enough on its own.

Workshops and partners who can't get past that certificate check can run the job through us. We run Star3 with SECoC commissioning and ZenZefi certificates live on the wire, so you can code a W223 the same afternoon the owner drops it off.

What SECoC is

SECoC is Secure On-board Communication. Mercedes introduced it on MBUX Gen 2, also called Gen20x, to stop unsigned writes landing on the CAN and DoIP buses. Every coding transaction carries a rolling cryptographic signature, and the ECU checks that signature against a fresh key before it commits anything to flash.

ZenZefi is the certificate manager that distributes those keys. It fetches the right certificate for the job and hands it to the diagnostic tool. Without a working ZenZefi pipeline you can see the modules but you can't write to them.

Which Mercedes chassis need SECoC

SECoC applies to the chassis in this table.

Any Gen20x refresh of the GLE, GLS, and G-Class on the new electrical platform needs it too. If your car has Zero-Layer MBUX and a Gen20x head unit, assume SECoC is in the way.

What we run for partners

We keep a working Star3 instance on our side, with:

• Live SECoC commissioning on every ECU that asks for it, including the central gateway, body modules, driver assistance (ADAS) stack, drivetrain, head unit, and charging hardware on EQ cars.
• ZenZefi certificates for 2026 coding (Aftersales Enhanced).
• Programming certificates for variant coding (Development Enhanced).
• Timeback, which unlocks the car so it accepts coding writes.
• Full SAS variant coding, SCN (Software Calibration Number), teach-in, and component protection handling where the VIN and SA codes allow it.
• Read-back verification after the write, plus a cold-start sanity check so you don't close a ticket on a module that fails to come up after ignition off.

Typical jobs we cover

• AMG menu unlocks, Digital Light activation, ambient tier upgrades on W223 and W206.
• Module replacement after a crash or a theft recovery, covering the gateway, FSCM, body control module (BCM), and instrument cluster.
• Region conversion on Gen20x imports where the destination market allows it.
• Post-repair SCN and teach-in on EQE and EQS, including charging module re-signs.
• Retrofit coding on factory-wired but disabled options (head-up display, rear-axle steering, Burmester tiers).

What you need on your side

• An ENET yellow cable with the MB pinout. If you aren't sure which one you have, the VCI guide walks through it.
• A Windows 10 or 11 laptop with a wired internet connection for the duration of the session.
• The car at 13.5 V or better.
• Ignition on, and no active diagnostic trouble codes (DTCs) on the gateway before we start.

How a partner session runs

We don't publish the session procedure. Email us and we'll send it to you.

What makes a SECoC job fail

• A bad certificate. Wrong key, expired key, drifted clock. The ECU drops the frame and the job fails halfway.
• A laptop going to sleep mid-signing. This is the single most common reason a job has to be restarted.
• A weak 12 V battery. On a W223 it will drop the gateway mid-coding.

Pricing and partner terms

Pricing is per-job for one-off tickets and volume-based for shops running SECoC work every week. We invoice monthly. Partner accounts also get priority scheduling and a direct line into the team, and high-volume workflows can run through our API.

We don't publish the partner rate card openly. Email with your shop name, country, and the chassis mix you see most and we'll send it back the same working day.

Contact

• Email contact@mbretrofit.it with subject line Star3 SECoC partner access.
• Include your shop name, country, rough monthly volume of Gen20x coding jobs, and whether you already run Xentry locally.
• If you'd rather have a call first, say so in the email and we'll book one.

If you're a single-car owner rather than a workshop, the standard remote-coding flow on the vehicle coding overview covers one-off W206 and W223 jobs without the partner contract.