TMC is an independent, primarily volunteer organization that relies on ad revenue to cover its operating costs. Please consider whitelisting TMC on your ad blocker and becoming a Supporting Member. For more info: Support TMC

Let the hacking begin... (Model S parts on the bench)

Discussion in 'Model S' started by wk057, Dec 14, 2015.

Tags:
  1. redevries

    redevries René de Vries

    Joined:
    May 22, 2013
    Messages:
    2,443
    Location:
    Oosterhout, Netherlands
    Thanks for sharing this with us, wk057! I wonder if Tesla will be in touch as they have supposedly done with some of the previous hacking attempts. The difference is of course that there is no car attached :)

    But, I am also planning some time to follow this show. Mightily entertaining, thanks!
     
  2. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    5,599
    Location:
    Hickory, NC, USA
    That makes a lot of sense then, thanks. I'm still wondering what, if any, difference the MCU itself has that would require a different part number for the premium audio version then.

    I'm half expecting a caravan of black Model X to descend upon my house any minute now... lol. Well, really, there isn't much they can say about it. I'm not violating any laws or contracts by doing things with these parts and hardware that I legally own. So, ideally, Tesla will just leave me alone, but I wouldn't be surprised if they say something.
     
  3. Cobbler

    Cobbler Paranoid T.E.S.L.A Bull

    Joined:
    Sep 22, 2015
    Messages:
    435
    Location:
    België
    Do you already have the CAN-bus connected? Any listing of the telegrams picked up? (SDO or PDO?) Is the CANbus also used to communicate with the servo controller or is there a faster communication bus used?
     
  4. wonko

    wonko Member

    Joined:
    Mar 14, 2014
    Messages:
    58
    Location:
    Germany
    Adding an external HDMI port would be absolutely fantastic. I could hook my smart phone to it, and whenever a message comes in, z quick tap on the camera button will let me see what's on the phone display without actually touching the phone. Yay!
     
  5. AB4EJ

    AB4EJ Member

    Joined:
    Feb 25, 2015
    Messages:
    771
    Location:
    Tuscaloosa, AL
    Excellent work. BTW If you find a way in, I think you are obligated by the White Hat Hacker Code of Ethics to notify Tesla so that they can block it... I'm just sayin' ...
     
  6. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    5,599
    Location:
    Hickory, NC, USA
    I only have the CAN bus connected between the MCU and the IC currently. I'm working on getting some CAN sniffers/injectors setup now for that bus and the other *four* (five total) CAN buses on this car. Probably will be a few days before I actually have time to tinker with all of the CAN stuff.

    Not sure what you mean by "the servo controller." There appear to be five CAN bus connections and some LIN connections on the MCU. The LIN stuff looks to work for homelink, the seat heaters, the electrochromatic mirror dimmers, and some 12V battery monitoring system I'm unsure about.

    - - - Updated - - -

    *shrugs*

    I don't feel like I'm obligated to notify Tesla of anything at all, honestly. If they provided me with the hardware and such to tinker with, and maybe even some additional info and insight to make the job easier, then sure, they would be the first to know of anything I come up with. But I purchased the hardware I'm working with myself and I'm doing so basically blind to the inner workings. Also, considering pretty much anything I do here is going to involve some form of hardware hack and not something that some random person is going to be able to do to some random Model S to cause any issues... honestly, I'll probably just post my findings here and be done with it. If Tesla wants to follow along, they're more than welcome to just like anyone else. I'll gladly entertain their questions/comments/concerns.

    - - - Updated - - -

    Yeah, I was honestly thinking the same thing when I came up with the initial idea. Would require a switch of some kind to toggle between the rearview cam and the connected HDMI device, though, which would likely have three settings: Rear, Aux, Auto... where auto would default to the rear cam when nothing was connected to the aux HDMI.

    Honestly, this will probably be the easiest part once I get a hold of a rear cam to play with...
     
  7. pimp-boy

    pimp-boy Member

    Joined:
    Feb 5, 2013
    Messages:
    173
    Location:
    Los Gatos
    - - - Updated - - -



    Yeah, I was honestly thinking the same thing when I came up with the initial idea. Would require a switch of some kind to toggle between the rearview cam and the connected HDMI device, though, which would likely have three settings: Rear, Aux, Auto... where auto would default to the rear cam when nothing was connected to the aux HDMI.

    Honestly, this will probably be the easiest part once I get a hold of a rear cam to play with...[/QUOTE]



    Maybe you can turn the rear cam into a recording camera too???? Since wiring a rear camera is much harder to do with a hatchback w/o drilling or something! That would be great!
     
  8. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    5,599
    Location:
    Hickory, NC, USA
    That's probably possible too. Once I nail down the rear cam communication that would be a logical next step. Anyone have a spare rear cam? :)
     
  9. KirkDavis

    KirkDavis Member

    Joined:
    Nov 4, 2015
    Messages:
    20
    Location:
    Sunnyvale
    Yeah no doubt the mothership is just itching to do a remote wipe.
     
  10. 3mp_kwh

    3mp_kwh Active Member

    Joined:
    Feb 13, 2013
    Messages:
    1,112
    Location:
    Boston
    Wow. You have the old center-KW display! I'm stuck with a permanent Autopilot cartoon, whether using it, or not :mad:.

    What format are the line-outs in? RCA, or just shielded wire? Is Sirius XM coming from its own hardware, or is it integral to the MCU?

    One future problem with these cars is the MCU's part price, of $5,000. I worry multiple T-shoot paths in the future will lead to "Replace MCU".
     
    • Like x 1
  11. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    5,599
    Location:
    Hickory, NC, USA
    Yeah, this is from a pre-autopilot car (not too far behind really) that is still on v6.1.

    The Line outs are in shielded wire in their own 20 pin connector on the back of the MCU. No RCAs, although that would've been nice.

    XM/AM/FM appear to come from a separate radio module. There are left and right line inputs (in another harness) that come from that module (I don't have it) along with line inputs from driver and passenger microphones.
     
  12. maximus16

    maximus16 Member

    Joined:
    Nov 5, 2015
    Messages:
    75
    Location:
    Houston, TX
  13. 3mp_kwh

    3mp_kwh Active Member

    Joined:
    Feb 13, 2013
    Messages:
    1,112
    Location:
    Boston
    Yeah, I think the Sirius XM module might look like this. I wasn't sure for how many MS's it was an actual separate piece of hardware, or if wiring it in makes the MCU recognize it.
    Tesla 1004787 00 C XM Satellite Radio Tuner Receiver Module Panasonic CRFX51E0GD | eBay -since gone off Ebay
    Tesla moved the XM Antenna to the sunroof area some time ago. I'd guess its wiring first goes to this unit, then the MCU. One thing I haven't had the time to figure out is if the non-XM Sound cars were nonetheless bestowed with satellite antennas? If so, some open lines may be in your dash, with no place to go.
     
  14. lolachampcar

    lolachampcar Well-Known Member

    Joined:
    Nov 26, 2012
    Messages:
    5,147
    Location:
    WPB Florida
  15. green1

    green1 Active Member

    Joined:
    Mar 25, 2014
    Messages:
    4,548
    Location:
    Calgary, Alberta, Canada
    Thanks for documenting all this work on here! I really look forward to what you come up with. I'm always willing to mod my stuff, though I do like some idea that someone else has taken the major risks on my $100,000 toy :)
     
  16. Kandiru

    Kandiru Active Member

    Joined:
    Oct 20, 2014
    Messages:
    1,072
    Location:
    USA
    No worries, just take it to a service center, Tesla will rebuild the car around it.
     
    • Funny x 2
  17. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    5,599
    Location:
    Hickory, NC, USA
    So, I'm toying with CAN data on the powertrain bus. Funny enough if I play back CAN logs to the bench setup I get speed readout, a broken power meter (it seems offset by something like -300 kW and stays pegged on beyond full regen), and my energy usage graph updates, rated miles show, etc.

    Up to 13 errors on the display though... lol.

    I think the most interesting part is that the odometer on the IC and the trip meters are incrementing as I play the drive data...
     
  18. fluxemag

    fluxemag Member

    Joined:
    Jan 10, 2013
    Messages:
    476
    Location:
    Portland, OR
    I'm curious if you could just swap screens/MCUs with a salvage part if yours were to die out of warranty. Would you have to find one with the same options like sunroof/suspension etc?
     
  19. Muzzman1

    Muzzman1 Member

    Joined:
    Feb 8, 2014
    Messages:
    540
    Location:
    Los Angeles
    @wk057
    I really wish you lived in LA. I'd be standing over your shoulder and learning/helping in every way possible. Great work!
     
  20. Cyclone

    Cyclone Cyclonic Member ((.oO))

    Joined:
    Jan 12, 2015
    Messages:
    5,056
    Location:
    Charlotte, NC
    Something tells me you will soon be able to adjust your wife's performance driver's seat :)
     

Share This Page

  • About Us

    Formed in 2006, Tesla Motors Club (TMC) was the first independent online Tesla community. Today it remains the largest and most dynamic community of Tesla enthusiasts. Learn more.
  • Do you value your experience at TMC? Consider becoming a Supporting Member of Tesla Motors Club. As a thank you for your contribution, you'll get nearly no ads in the Community and Groups sections. Additional perks are available depending on the level of contribution. Please visit the Account Upgrades page for more details.


    SUPPORT TMC