Well even if it's useless I would appreciate any hints regarding the syntax. That's about what I was able to come up with digging through the javascript and looking at examples of other tasks. I understand if you're unwilling to share.
-
Want to remove ads? Register an account and login to see fewer ads, and become a Supporting Member to remove almost all ads.
2022 Tesla Model 3 LR Projector to Matrix headlight retrofit
- Thread starter GoPowerup
- Start date
the syntax is just a regular python array of dicts. To enable tow package:
I don't know for sure, but I think it's tbx-external as well. May be with some very few exceptions. tbx-internal is basically ranger access
Nintendo80
Member
can we turn on the ambient light? I found the original Ambient Light but of course they Don’t work!!!
Nintendo80
Member
I meant the door ambient light insert for refresh I’m sorry
Attachments
Thanks for valuable information in this thread, it’s so interesting to learn about internals of the Tesla software on the cars. How to unlock the gateway though as the other thread quoted earlier in a comment mentions about “Vehicle gateway unlock procedure” and article 5582900. I couldn’t find this article, is it hidden from Tesla service portal?
This was a roller coaster of a read! I thought someone had it figured out, then we didn't, then someone had something...lol! We just got a set of these Matrix beauties in inventory and I want to put them in an Older Model 3!
There’s been a couple sporadic cases. But more often than not the Tesla centers will say they can’t do it
Did anyone manage to change the gateway Paramus using toolbox with external privilege?
I tried to intercept the messages between toolbox and the car, all command are limited by the JWT token principle that is fetched from odin_token endpoint and then sent to Odin in the MCU which verifies the intermediate cert against the stored root cert, then the verifies the token against the intermediate cert provided in the command, based on that principle everything is limited.
If I could put my hands on firmware image I might be able to inspect odin_bundle and try to exploit it.
I managed to exploit toolbox.Tesla.com and get toolbox subscription for free, I know their code is not invincible and they don’t really try hard to close exploits as much as they just wait for them to be discovered then they close them.
So if anyone has access to some private repo that has firmware images that would be really helpful. The firmware image I have is really old and I’m sure the code is changed a lot.
I tried to intercept the messages between toolbox and the car, all command are limited by the JWT token principle that is fetched from odin_token endpoint and then sent to Odin in the MCU which verifies the intermediate cert against the stored root cert, then the verifies the token against the intermediate cert provided in the command, based on that principle everything is limited.
If I could put my hands on firmware image I might be able to inspect odin_bundle and try to exploit it.
I managed to exploit toolbox.Tesla.com and get toolbox subscription for free, I know their code is not invincible and they don’t really try hard to close exploits as much as they just wait for them to be discovered then they close them.
So if anyone has access to some private repo that has firmware images that would be really helpful. The firmware image I have is really old and I’m sure the code is changed a lot.
What level of access does your exploited toolbox have? Did you try to run the commands using set vehicle configs odin task?
I don have an exploited toolbox, I managed to find a way to get annual subscription for free, that’s all for now, I got Intel MCU and trying to exploit Odin on it without doing any hardware changes, but as I mentioned before, without firmware image I can’t really do anything, so if I couldn’t find firmware image to inspect the odin bundle I might have to get eMMC reader and get into the messy level.
vehicle config is still filtered and you can’t change much when you are tbx-external level.
have you managed to change anything?
vehicle config is still filtered and you can’t change much when you are tbx-external level.
have you managed to change anything?
Could you send me a PM on how you found a way to get it for free, because paying the amount jsut for testing is not worth it.
Thanks
Sorry guys but the vulnerable endpoint was patched as I was checking today 
it is not enough to have tbx-mothership token, for secured configs, like headlamps/autopilot/taillights you need to specify not only a value, but a signature, that contains vin & timestamp. such signature will only be valid for 5 minutes
Similar threads
