Search results

In the very same article it was mentioned that the fire started inside the car. This wasn't a high voltage fault, nothing was wrong with the battery, and by amount of damage done to the car it's clear that the battery never even caught fire. This kind of failure could happen to any car on the...

How low did you downgrade? You need 2020.36 to root easily.

Instrument cluster is different than CID

They mean a diagram of points on the board to read/write the eMMC without removal. Not a generic pinout of the chip.

Depends on firmware version. Below 2019.4 you just grab saccess keys (SSH passwords) and get persistent root with something like lunars or freedomEV. After 2019.4 the easiest way to do it is with squashfs patches, but you have to patch boot for that.

They’re *very* similar. To which files are you referring?

This is the one important one. PSPTool just helps you extract data and build payloads. https://github.com/PSPReverse/amd-sp-glitch

All their code has been available for a year now :) they’re just showing it being used on MCUZ

Depending on the firmware version, it won’t be encrypted.

You can pry open the port quite easily with a plastic tool or a flathead screwdriver covered in tape so as to not scratch the housing. It's held closed magnetically, so you won't damage anything by popping it open this way. Fair warning though- it will not charge or let you plug anything in if...

JTAG is much more difficult. Your best bet to safely read/write Spansion is to modify the U-boot defconfig for a similar device. You could start with Cardhu for instance. Use Tesla's Linux device tree source as a reference to add Spansion to your new device tree and pinmux. You can reference the...

Technically there are other ways for sure, but those two are the easiest. JTAG will do it as well.

that's eMMC, not Spansion flash. It can only be read via the kernel or U-boot.

A drive motor failure isn't going to just kill you out of the blue. You're going to pull off to the side like any reasonable driver as soon as you lose power. Even in aircraft, you're not going to die just because you lost power.

This doesn't apply to OP's issue. These releases are only for the rear doors, the front doors have the manual release in the handle mechanism, you just pull it further than normal. Without the exterior handle switches connected, and no pull cable connected to the interior handle, there is no way...

Is this installed in the car? What do you have unplugged?

if you've already paid for the safety inspection you might as well ask Tesla what you need to do to get your DCFC back. Otherwise good luck trying to find someone who knows their way around MCU2 and can root it.

I don't have one of these boards on-hand to check the contents of this, but I imagine it replaces one of the two SD cards that MCU1 boards have. If this MCU1.5 board doesn't have one, that confirms it. Probably maps, if I had to guess. Not written to very often, shouldn't be a huge failure risk.

If it fails, they would likely hand you a quote for repairs to get it in spec, at which point you decide whether to have it fixed, fix it yourself, or just take the car and leave it as is.

Via JTAG? I’ve been working periodically on getting access to it with U-boot.

The car already has demonstrated its capability to detect a dangerous situation, if it continues to fail isolation checks it just won't start. If you get it apart with the guides others in this thread have linked and see corrosion, isopropanol, nylon brushes, and some rags are going to be a big...

Does someone have 2019.12 or 2019.15 they could send me?

What sort of hardware are most people using for hardware access to Spansion?

Oh wow, just two wire runs? That’s great to hear. Thank you! I’ll have to report back after I give this a try.

the "mystery button" is just a reset button, thankfully, so you're good on that front. You must be pretty close to a tower to be getting LTE on a bare MCU. If you're worried about it, you could disconnect the LTE board while you're tinkering. (probably already too late though, its likely it has...

Oh awesome, that's not too bad. Any chance you could tell me which lines are needed for the new headlights? I've pulled up the wiring diagrams for the two, but I'm not entirely certain what I'm looking for.

No resistor required. Bench · Lunars/tesla Wiki

Pyro is only supposed to blow during a collision.

Is this separate from CID-updater’s CID recovery you get when a rootfs is corrupt?

Don’t know why, these don’t have secure boot enabled, bootloader patches will always work.

Doesn't matter what their script does, it wouldn't work on any remotely recent firmware version anyway. Root method varies for recent stuff, the main divide is between 2020.36 and older, and 2020.48 and newer. 2020.48 and newer will require a patched bootloader and kernel for persistent root (or...

I'm looking to flash my gateway on my bench mcu with older firmware. I don't have an older release.tgz I can use, so I'm trying to craft one from files in /deploy, but I can't figure out exactly how it's calculating the crc for the files or how to just patch out crc checks from boot.img, so gw...

Nope, powered right up and drives. Mine is a 2014 single rear drive unit, not sure if newer cars have a paired motor controller and BCM, as I think I read the same thing someplace. I used some wire in place of the pyro to get it moving before I had a replacement fuse, but the 12 volt systems...

Bought a BCM with a paired key off eBay.

They jumped it to get the odometer reading or took the photos before it died, but mine was indeed keyless with a blown pyro.

I think the 12v died rather quickly after the crash, and it sat unpowered at the salvage yard. Never let it connect to Tesla, immediately disconnected LTE so I could have it powered when I needed to while working on it.

It's possible it was never disabled, like on my Model S.

He probably removed the LTE module or disconnected the antennas, which would achieve the same thing but the car will not have internet access. You'd need to have a rooter disable the Tesla access if you want it online without SC being disabled, then reconnect LTE.

The only way to be sure it won't be deactivated is if it's already rooted and had Tesla access disabled, or if you have that done after buying. Once it's rooted you can just enable SC.

Anyone know if the LED lights are plug and play with the original S, assuming you change internal.dat? Or is an HID emulator absolutely needed?

If I'm missing anything from a crash damaged MS, what's the best way to make sure a part I buy is compatible? Some of the damaged components obviously have part numbers, but others are entirely missing, lost in the crash and didn't make it to the salvage yard. In some cases, I know I'm missing...

Well, before I do any more soldering, I’m gonna poke around with Fusee and see what I can find out. I did a lot of ****ery with the Nintendo Switch way back, maybe that’ll be of some use with this Tegra.

Anyone have a diagram for flashing CID's Spansion in circuit?

Anyone have a diagram for flashing CID's Spansion in circuit?

I'm getting an error when trying to install firmware on MCU1 from cid-updater recovery. Anyone know how to fix this? cid-updater:40122: pending_command for retry: install http://192.168.90.101:80/2020.36.16-5-3e9e4e8dd2.mcu1 -o 0 cid-updater:40145: download status=complete cid-updater:36361...

Anyone have 2021.24.28-40 they could DM me?

No idea what's wrong with this MCU, but it's no longer booting. Black screen. Was working, dumped the eMMC in-circuit, now no boot. Not sure if it's hardware or firmware that's the issue.

Yeah I eventually went through and saw that, thanks 😁 If anyone has info on downgrading or otherwise installing a firmware image without root, but with rw to the eMMC, please PM me. I'm on 2021.24.28-40 and need to get down to something rootable.

as in, shorting across the oscillator, or something else?

Anyone know if the passenger knee airbag and driver knee airbag are interchangeable? 2014 Model S. I'm having a hell of a time trying to find a driver side knee airbag, P# 1005259 with the passenger side being P# 1005260. They look entirely identical, with the connector on the same side and...