Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Search results

  1. TheBlackKnight

    Model S Parts for Sale

    Yes, black carpet. I'll look on Monday to try to find the trunk carpet and padding. All of that was in good shape. The collision was basically in the front end. The trunk didn't latch properly anymore because there was some damage to the top of the car too. I don't know if it hit a deer or what...
  2. TheBlackKnight

    Model S Parts for Sale

    The trunk light I should have in good shape. The center console I broke.
  3. TheBlackKnight

    Model S Parts for Sale

    Do you need just the steering wheel itself or also the parts on top of it (air bag, controls)?
  4. TheBlackKnight

    Model S Parts for Sale

    Sorry, I should have posted more details. 2015 Tesla, white body, beige/black interior, black carpet. I broke the center console being an idiot while removing it.
  5. TheBlackKnight

    Model S Parts for Sale

    I've got a salvaged Tesla Model S that I've used for parts I need for a conversion. I've taken the batteries, chargers, drivetrain, brake booster. But, the body is not totally smashed - some doors are OK, most all the door glass, the CID, IC, all ECUs, anti-lock brake distribution system...
  6. TheBlackKnight

    In-development: Inexpensive Custom BMS for Tesla Battery Modules

    Fast forward a year and that's no longer true: GitHub - collin80/TeslaBMS It works with any number of modules from 1 to 62 with one master board.
  7. TheBlackKnight

    The Use by Other EVs of Tesla Supercharges?

    There's virtually no chance Tesla is ever going to validate the SC connection with a VIN number - they aren't that stupid. The VIN number on a Tesla is nearly the least unique thing ever. Out of 17 digits there are what, like 5-6 unique digits at the end that are a manufacturing serial number...
  8. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Yeah, it seems to have come back. We might have been a bit hasty in predicting its demise.
  9. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Yes, I didn't mean to imply that they were locking out body shops, just the rest of us. But, it still could just be a momentary glitch. Well, this is a dangerous thing to say. If anyone did do that I'd imagine they wouldn't broadcast any details or ever admit it.
  10. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    When I try to go to toolbox.teslamotors.com it tells me that the connection has been reset. There is no webpage served any longer. Also, previously it allowed me to use my login for Toolbox even after my paid access to the service site expired. Now it tells me the access token has expired and to...
  11. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Well, not easily. The current format of the manuals makes it difficult to save them for later at any sort of speed. You have to grab them page by page. You might not be able to get all of the pages you're interested in in a single hour. Then again, maybe you've got the fastest fingers in the...
  12. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Yes but there is a difference between being able to duplicate a known SHA256 hash output and it being tough to make duplicate values. A 256 bit hash *will* have collisions guaranteed so long as the data you are hashing is over 256 bits. It has to because there are more possibilities in the input...
  13. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Yeah, I'm pretty sure that I mentioned the CANTact / CANard stuff before. Eric Evenchick got a very large amount of publicity for that stuff but really I'm not aware of too much coming of it. I don't know of any really good open source tools that are written for it. However, it does support...
  14. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Not a typo. At least in older firmwares for US cars this frame has three bytes. It is possible that they changed it in later firmwares or for a different market or something.
  15. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Yes, it seems to be a 5 minute heartbeat message that is sent any time the car's computer systems are operating. I've seen it on driving captures (but only captures that are minutes long, otherwise you're likely to never see it). I can't really be sure as to *why* it sends its own VIN number...
  16. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    I'm pretty sure that the rate is actually every 5 minutes - no joke. The interval is so long that I've got a whole lot of captures that never got any 0x508 messages. Apparently the car doesn't expect the VIN to change that often. :wink:
  17. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Just a quick correction: the fastest frames are sent every 10ms not every 1ms. Still, that is 100 times per second. Receiving a frame that indicates a problem then sending a reply can be done in about 11ms - that is probably the lower bound for response time. If my math is correct that would...
  18. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    The time stamp you see normally is microseconds since the capture hardware started. That gives you a *very* precise timestamp but it is somewhat cumbersome to work with. It tends to be easier to read if you go to File->Preferences->Display time in seconds. Then the next time you start the...
  19. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    The power train bus has about 2200 frames per second as far as I remember. That's somewhere in the neighborhood of 40% bus utilization. The CANTact firmware doesn't use interrupt driven reception but does seem to use the hardware FIFO. I believe that should be at least 3 deep but I don't know...
  20. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Well, any active node has no choice. ACK is part of the message acceptance algorithm. If you receive a frame and accept it then you will set ACK. Listen only mode just disconnects the TX line so that your ACK goes nowhere. Thus, your choices are to be in listen only mode and only receive traffic...
  21. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    That's the best reason, in my opinion. If you are in listen only mode then an incorrect speed setting does nothing to anything else on the bus. Your end just throws a bus error and drops out. Then you change the speed and try again until you find the right one. Otherwise it isn't that dangerous...
  22. TheBlackKnight

    Chassis CAN Logging To ASCII Text Plus Graphing

    Lots of people like Eric Evenchick's CANtact hardware along with possibly the CANard software. The CANtact is open source as is CANard. CANard is a set of python scripts and so is very cross platform. CANtact supports socketcan via the lawicel protocol so you can use pretty much any linux canbus...
  23. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    The way to make it happen: Have someone do a capture of the chassis canbus (seems to be bus 6 which is pins 4 and 11 on the diag connector I believe). First capture a bunch of traffic without doing anything. Then do a capture with triggering the brakes on/off. Then do on with turn signals...
  24. TheBlackKnight

    CHAdeMO Adapter Tear Down

    Well, I have it on good authority that somebody has published an open source implementation of CHAdeMO on the car side: collin80/JLD505 at debug · GitHub So, figuring out CHAdeMO won't be a problem. There is already the above open source car side and soon I'll be making an open source charger...
  25. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    @garygid Alright, I wrote all the code to support your file format (CANDO) but I have a couple of questions: 1. All files seem to start with a frame that has the third and forth byte set to FF. That would ordinarily be illegal. What is that frame for? 2. It seems like your timestamp and ID...
  26. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    It defaults to CRTD format. Mark from OVMS created that format for his tools. I then used it to help everyone be on the same page. But, now SavvyCAN supports all kinds of formats and I probably should really default it to the native GVRET format now. Here is a sample line from CRTD...
  27. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Currently there is only support for the EVTVDue or CANDue boards. But, I plan on supporting socketcan on linux. IXXAT almost certainly has socketcan compatible drivers. That doesn't help OSX or Windows users. I had thought to maybe support Kvaser tools on WIndows. I've got a kvaser leaf light...
  28. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    I will attempt to keep this as far from commercial as I can as well. SavvyCAN itself is free. You are free to go download it and use it so there is no commercial aspect to the software. SavvyCAN is just a program you can run on Windows, OSX, and Linux. It uses hardware that is, in fact, a...
  29. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    And now for something completely different... though still on topic. Has anyone got a capture from the powertrain bus where they're charging the car on a car with the gen2 charger/s? I'm wondering what the difference is between the gen1 and gen2 chargers.
  30. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Interesting! I guess Arthur's initial guess that the 14th bit was a signal type just colored my perception. I suppose that makes sense but it makes creating a DBC file a lot harder. Well, it's good that we know the proper scaling factor now.
  31. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Thank you for the updated data. This data suggests that the equation would be more accurately: CellVoltage = (Reading / 3274) + 2.49 So, that's my next guess. Is it the truth? Well, it seems like a bias of 2.5 would make more sense. That would bring the divisor to 3311. But, that seems a...
  32. TheBlackKnight

    Reading Battery Voltages and Temperatures via CAN on Model S

    In theory, yes. But, the big problem with the MCP2515/MCP2551 combo is that it is external to the processor. Any time a CAN frame comes in the 2515 has to signal the microprocessor to have it go fetch the frame. This tends to happen over SPI. SPI is fast but there is some latency involved in...
  33. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Yeah, that does sound like a reasonable plan. I suppose it wouldn't actually be confusing, anything connecting to it would just have to also know the options. Maybe first search for a known SSID that the device generates if it couldn't connect to an AP or use the connected AP to find it via some...
  34. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Since a wifi chipset can only be in one of those two modes at a time (either connecting to an AP or being an AP) I would suggest that you really don't want to muddy the waters too much by switching that often. Ideally a device should be in only one of those two modes 99% of the time. Mostly...
  35. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Yes and no. Yes, he started that thread long before I posted. But, the details changed. At that point we believed that the voltage was a simple question of dividing by something to get the proper cell voltage. It isn't. You'll see as you go through various states of charge that it isn't a simple...
  36. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    It seems that EVTV is releasing the full source for a program that reads this message so I see no harm in fully explaining that message here. There are 32 messages in a constant loop. They transmit 96 voltages and 32 temperatures in series. The format is: Byte 0 = The sequence # (0-31)...
  37. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    That's awesome! Looking through the document I can confirm that I've found it to ring true. There were some areas I wasn't entirely sure of. For instance, I knew that 0x102 had a 15 bit signed value in bytes 2 and 3 but never could quite convince myself whether it was pack current or not. It...
  38. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Personally I'm a fan of the CANDue 2.0 boards because they've got more features than most anything. Yes, they are expensive. You can most certainly find cheaper canbus adapters than $150. But, my hope is that it still seems worth it to some people for the following reasons: it has two CAN buses...
  39. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    I suppose at this point I should mention two things: I don't have a whole Tesla and my only interest is in hacking as many of the Tesla parts as possible and using them in other vehicles. So, no, it probably isn't a good idea to do this in your Tesla but there might not be any reason I couldn't...
  40. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Is there any reason one could not figure out which message the BMS sends for this and modify it? Then the limit could be whatever you want. It is true, EVTV knows the proper things to send to cause the regen to be anything from 0 to 100% regen (up to the limit set) so, yeah. its there on the canbus.
  41. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Yup, I've got pass-through capable hardware too. In fact, I actually even published a canbus example program that works on Arduino Due compatible boards like the EVTV canbus hardware: due_can/examples at master · collin80/due_can · GitHub So, the capability is there. But, it could also be...
  42. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    I haven't done any X development but I *have* done plenty of Qt development. And, the Tesla display applications seem to all link to Qt4.7.2. So, it seems like the easiest approach would be to use Qt like Tesla did. I know that Qt5 supports touch screen interfaces, I don't know how that works in...
  43. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    Absolutely. They're terrified of bad PR and pretty much every stupid sounding decision they make comes back to this. Can't access data that would be useful? Well, someone might misinterpret the data and do something dumb or complain. Can't fix the car yourself? Well, you might do it wrong and...
  44. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    It is always their option to change things at any point in time. In fact, it seems like they do tweak the communications protocols every so often. I've seen cars that send different IDs than other cars, data that has different offset or scaling factor, etc. But, it is isn't in their best...
  45. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    I'm the person who wrote SavvyCAN. The whole reason it exists is to reverse engineer canbus protocols. So, it has lots of features that I wanted while doing reverse engineering. I also wrote the GVRET firmware that runs on EVTVDue and CANDue boards. It is my opinion and hope that these tools are...
  46. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    I have figured out the checksum byte. I don't think it was anything standard. It is possible to capture many packets and build up a table but that always feels lame to me. It's better if you can figure out a suitable algorithm to calculate it. The bonus there is that programmers are lazy and...
  47. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    I've thought about writing up an accessible guide for how to do this. I know that opengarages is coming out with a new version of their manual soon: http://opengarages.org/handbook/ There is a lot that goes into this whole thing. It goes in layers. First you need the proper hardware. Then you...
  48. TheBlackKnight

    Let the hacking begin... (Model S parts on the bench)

    I think it's worth noting that EVTV does already sell a device that works with the Tesla Model S diag connector and also has free firmware and PC based software to go along with it: EVTV Motor Verks Store: SavvyCAN for Tesla Model S, CAN Tools, TeslaCANKit It is, perhaps, a bit more expensive...