Anyone succeed to use OVMS get the Security PIN?

[xiaoteshushu]

Last year , I bought this Roadster 2.5, but the last owner didn't remember the PIN code. Before I know the OVMS can crack the PIN code by force .

Very appreciated markwj making OVMS for us, Just got it this week ! Now I can monitor my roadster on the App even without PIN .

Thing about the Details Here. Vulnerability Announcement: Tesla Roadster vulnerable to sniffing of security PIN code via CAN bus | Open Vehicles

So I tried to make it on my Roadster.

Since I did't know much about CANbus Stuff, so I used a python script and web API to crack it .

curl 'http://192.168.4.1/api/execute' -H 'Cookie: ovms_session=4138f86b1bxxxxxx' --data 'command=unlock+0000'

First, I locked the car by key, and I can see a red lock on IC;
Then, I run the script to unlock the car , from 0000 to 9999;
But, nothing happened, the car didn't unlock.

Because I don't have right PIN , so I don't know what happens if the PIN is right by execute " unlock <pin>"

Did anyone succeed to get the PIN by OVMS?

 

[GJVR]

My experience is that I can lock the car with OVMS and then unlock with OVMS.

If I lock with the key I can only unlock by key.

My code was reset by the SC much earlier and does not seem to be related to this issue.

 

[slcasner]

I believe the PIN can be more than 4 digits.

 

[im4uttx]

My pin is 8 characters, so

I believe the PIN can be more than 4 digits.

This is true. Mine is 8.

 

[xiaoteshushu]

My experience is that I can lock the car with OVMS and then unlock with OVMS.

If I lock with the key I can only unlock by key.

My code was reset by the SC much earlier and does not seem to be related to this issue.

OK, if the SC can do this job , I'll contact with them. Thank you

 

[markwj]

My experience is that I can lock the car with OVMS and then unlock with OVMS.
If I lock with the key I can only unlock by key.

OVMS can always (with the correct PIN) lock/unlock the doors. On cars fitted with an immobiliser (ie; those sold outside north america) OVMS won't disable/enable that at all. So on an EU car if you lock with the button on the keyfob, then unlock with the PIN on OVMS, you will be able to open the door but the alarm will sound.

 

[GJVR]

Thanks Mark

that sounds right

and also if you lock with OVMS the immobiliser is not activated apparently, no alarm when opening then.

 

[markwj]

and also if you lock with OVMS the immobiliser is not activated apparently, no alarm when opening then.

Correct. Essentially, the PIN lock/unlock feature only affects the door locks, not the immobiliser. US cars don't have an immobiliser, others do/may.

 

[pd_australia]

So the previous owner of my 2.5 (non-US) forgot the "Security Code" and 1234, 0000, didn't do the trick.

I installed OVMSv3, ssh'd in and ran the following commands to test reactions of the car on commands

OVMS# lock 1111
Error: vehicle could not be locked
OVMS# lock 1234
Error: vehicle could not be locked
OVMS# metrics list v.e.locked
v.e.locked                               no
OVMS# unlock 1111
Vehicle unlocked
OVMS# unlock 1234
Vehicle unlocked
OVMS# metrics list v.e.locked
v.e.locked                               no

So now I manually locked it with the keyfob and then did this

OVMS# metrics list v.e.locked
v.e.locked                               yes
OVMS# lock 1111
Error: vehicle could not be locked
OVMS# lock 1234
Error: vehicle could not be locked
OVMS# unlock 1111
Vehicle unlocked

OVMS# metrics list v.e.locked
v.e.locked                               yes
OVMS# unlock 1234
Vehicle unlocked
OVMS# metrics list v.e.locked
v.e.locked                               yes

Anyone has experienced this before? Would I be able to use the "lock" command to script a bruteforce as the unlock always returns success ...

 

[markwj]

Message me, and I'll send you the brute force script for this.

Note that the 'Vehicle unlocked' really means 'Command to unlock vehicle sent', not necessarily that it was unlocked. The brute force script monitors the lock status to determine success.,