-
Want to remove ads? Register an account and login to see fewer ads, and become a Supporting Member to remove almost all ads.
That makes a lot of sense then, thanks. I'm still wondering what, if any, difference the MCU itself has that would require a different part number for the premium audio version then.
Thanks for sharing this with us, wk057! I wonder if Tesla will be in touch as they have supposedly done with some of the previous hacking attempts. The difference is of course that there is no car attached
But, I am also planning some time to follow this show. Mightily entertaining, thanks!
I'm half expecting a caravan of black Model X to descend upon my house any minute now... lol. Well, really, there isn't much they can say about it. I'm not violating any laws or contracts by doing things with these parts and hardware that I legally own. So, ideally, Tesla will just leave me alone, but I wouldn't be surprised if they say something.
wk057; [COLOR=#333333 said:
Excellent work. BTW If you find a way in, I think you are obligated by the White Hat Hacker Code of Ethics to notify Tesla so that they can block it... I'm just sayin' ...
I only have the CAN bus connected between the MCU and the IC currently. I'm working on getting some CAN sniffers/injectors setup now for that bus and the other *four* (five total) CAN buses on this car. Probably will be a few days before I actually have time to tinker with all of the CAN stuff.
Not sure what you mean by "the servo controller." There appear to be five CAN bus connections and some LIN connections on the MCU. The LIN stuff looks to work for homelink, the seat heaters, the electrochromatic mirror dimmers, and some 12V battery monitoring system I'm unsure about.
- - - Updated - - -
*shrugs*
I don't feel like I'm obligated to notify Tesla of anything at all, honestly. If they provided me with the hardware and such to tinker with, and maybe even some additional info and insight to make the job easier, then sure, they would be the first to know of anything I come up with. But I purchased the hardware I'm working with myself and I'm doing so basically blind to the inner workings. Also, considering pretty much anything I do here is going to involve some form of hardware hack and not something that some random person is going to be able to do to some random Model S to cause any issues... honestly, I'll probably just post my findings here and be done with it. If Tesla wants to follow along, they're more than welcome to just like anyone else. I'll gladly entertain their questions/comments/concerns.
- - - Updated - - -
Yeah, I was honestly thinking the same thing when I came up with the initial idea. Would require a switch of some kind to toggle between the rearview cam and the connected HDMI device, though, which would likely have three settings: Rear, Aux, Auto... where auto would default to the rear cam when nothing was connected to the aux HDMI.
Honestly, this will probably be the easiest part once I get a hold of a rear cam to play with...
- - - Updated - - -
Yeah, I was honestly thinking the same thing when I came up with the initial idea. Would require a switch of some kind to toggle between the rearview cam and the connected HDMI device, though, which would likely have three settings: Rear, Aux, Auto... where auto would default to the rear cam when nothing was connected to the aux HDMI.
Honestly, this will probably be the easiest part once I get a hold of a rear cam to play with...[/QUOTE]
Maybe you can turn the rear cam into a recording camera too???? Since wiring a rear camera is much harder to do with a hatchback w/o drilling or something! That would be great!
Yeah, I was honestly thinking the same thing when I came up with the initial idea. Would require a switch of some kind to toggle between the rearview cam and the connected HDMI device, though, which would likely have three settings: Rear, Aux, Auto... where auto would default to the rear cam when nothing was connected to the aux HDMI.
Honestly, this will probably be the easiest part once I get a hold of a rear cam to play with...[/QUOTE]
Maybe you can turn the rear cam into a recording camera too???? Since wiring a rear camera is much harder to do with a hatchback w/o drilling or something! That would be great!
That's probably possible too. Once I nail down the rear cam communication that would be a logical next step. Anyone have a spare rear cam?
Wow. You have the old center-KW display! I'm stuck with a permanent Autopilot cartoon, whether using it, or not .
What format are the line-outs in? RCA, or just shielded wire? Is Sirius XM coming from its own hardware, or is it integral to the MCU?
One future problem with these cars is the MCU's part price, of $5,000. I worry multiple T-shoot paths in the future will lead to "Replace MCU".
.What format are the line-outs in? RCA, or just shielded wire? Is Sirius XM coming from its own hardware, or is it integral to the MCU?
One future problem with these cars is the MCU's part price, of $5,000. I worry multiple T-shoot paths in the future will lead to "Replace MCU".
Wow. You have the old center-KW display! I'm stuck with a permanent Autopilot cartoon, whether using it, or not
What format are the line-outs in? RCA, or just shielded wire? Is Sirius XM coming from its own hardware, or is it integral to the MCU?
One future problem with these cars is the MCU's part price, of $5,000. I worry multiple T-shoot paths in the future will lead to "Replace MCU".
Yeah, this is from a pre-autopilot car (not too far behind really) that is still on v6.1.
The Line outs are in shielded wire in their own 20 pin connector on the back of the MCU. No RCAs, although that would've been nice.
XM/AM/FM appear to come from a separate radio module. There are left and right line inputs (in another harness) that come from that module (I don't have it) along with line inputs from driver and passenger microphones.
OP, did you watch this? They tell all the technical details of the workings of the car.
DEF CON 23 - Marc Rogers and Kevin Mahaffey - How to Hack a Tesla Model S - YouTube
DEF CON 23 - Marc Rogers and Kevin Mahaffey - How to Hack a Tesla Model S - YouTube
Yeah, I think the Sirius XM module might look like this. I wasn't sure for how many MS's it was an actual separate piece of hardware, or if wiring it in makes the MCU recognize it.
Tesla 1004787 00 C XM Satellite Radio Tuner Receiver Module Panasonic CRFX51E0GD | eBay -since gone off Ebay
Tesla moved the XM Antenna to the sunroof area some time ago. I'd guess its wiring first goes to this unit, then the MCU. One thing I haven't had the time to figure out is if the non-XM Sound cars were nonetheless bestowed with satellite antennas? If so, some open lines may be in your dash, with no place to go.
Tesla 1004787 00 C XM Satellite Radio Tuner Receiver Module Panasonic CRFX51E0GD | eBay -since gone off Ebay
Tesla moved the XM Antenna to the sunroof area some time ago. I'd guess its wiring first goes to this unit, then the MCU. One thing I haven't had the time to figure out is if the non-XM Sound cars were nonetheless bestowed with satellite antennas? If so, some open lines may be in your dash, with no place to go.
lolachampcar
Well-Known Member
green1
Active Member
So, I'm toying with CAN data on the powertrain bus. Funny enough if I play back CAN logs to the bench setup I get speed readout, a broken power meter (it seems offset by something like -300 kW and stays pegged on beyond full regen), and my energy usage graph updates, rated miles show, etc.
Up to 13 errors on the display though... lol.
I think the most interesting part is that the odometer on the IC and the trip meters are incrementing as I play the drive data...
Up to 13 errors on the display though... lol.
I think the most interesting part is that the odometer on the IC and the trip meters are incrementing as I play the drive data...
