Let the hacking begin... (Model S parts on the bench)

[redevries]

Thanks for sharing this with us, wk057! I wonder if Tesla will be in touch as they have supposedly done with some of the previous hacking attempts. The difference is of course that there is no car attached

But, I am also planning some time to follow this show. Mightily entertaining, thanks!

 

[wk057]

Check this link : Premium Audio System for Tesla Model S by Light Harmonic - Page 5

When you have premium audio, the amp actually drives the front doors, the rear lift gate speakers and the sub. The rest of the audio is driven by the MCU's amp.

That makes a lot of sense then, thanks. I'm still wondering what, if any, difference the MCU itself has that would require a different part number for the premium audio version then.

Thanks for sharing this with us, wk057! I wonder if Tesla will be in touch as they have supposedly done with some of the previous hacking attempts. The difference is of course that there is no car attached

But, I am also planning some time to follow this show. Mightily entertaining, thanks!

I'm half expecting a caravan of black Model X to descend upon my house any minute now... lol. Well, really, there isn't much they can say about it. I'm not violating any laws or contracts by doing things with these parts and hardware that I legally own. So, ideally, Tesla will just leave me alone, but I wouldn't be surprised if they say something.

 

[Cobbler]

Do you already have the CAN-bus connected? Any listing of the telegrams picked up? (SDO or PDO?) Is the CANbus also used to communicate with the servo controller or is there a faster communication bus used?

 

[wonko]

Adding an external HDMI port would be absolutely fantastic. I could hook my smart phone to it, and whenever a message comes in, z quick tap on the camera button will let me see what's on the phone display without actually touching the phone. Yay!

 

[AB4EJ]

Gain access to the system software[/COLOR]

• It's been done, and this unit is on 6.1 still. So, should be possible but I'm not sure. I'm pretty capable. If there is a way in, I'll find it.
• From here, any number of things is possible, and that list is pretty long.

Excellent work. BTW If you find a way in, I think you are obligated by the White Hat Hacker Code of Ethics to notify Tesla so that they can block it... I'm just sayin' ...

 

[wk057]

Do you already have the CAN-bus connected? Any listing of the telegrams picked up? (SDO or PDO?) Is the CANbus also used to communicate with the servo controller or is there a faster communication bus used?

I only have the CAN bus connected between the MCU and the IC currently. I'm working on getting some CAN sniffers/injectors setup now for that bus and the other *four* (five total) CAN buses on this car. Probably will be a few days before I actually have time to tinker with all of the CAN stuff.

Not sure what you mean by "the servo controller." There appear to be five CAN bus connections and some LIN connections on the MCU. The LIN stuff looks to work for homelink, the seat heaters, the electrochromatic mirror dimmers, and some 12V battery monitoring system I'm unsure about.

- - - Updated - - -

Excellent work. BTW If you find a way in, I think you are obligated by the White Hat Hacker Code of Ethics to notify Tesla so that they can block it... I'm just sayin' ...

*shrugs*

I don't feel like I'm obligated to notify Tesla of anything at all, honestly. If they provided me with the hardware and such to tinker with, and maybe even some additional info and insight to make the job easier, then sure, they would be the first to know of anything I come up with. But I purchased the hardware I'm working with myself and I'm doing so basically blind to the inner workings. Also, considering pretty much anything I do here is going to involve some form of hardware hack and not something that some random person is going to be able to do to some random Model S to cause any issues... honestly, I'll probably just post my findings here and be done with it. If Tesla wants to follow along, they're more than welcome to just like anyone else. I'll gladly entertain their questions/comments/concerns.

- - - Updated - - -

Adding an external HDMI port would be absolutely fantastic. I could hook my smart phone to it, and whenever a message comes in, z quick tap on the camera button will let me see what's on the phone display without actually touching the phone. Yay!

Yeah, I was honestly thinking the same thing when I came up with the initial idea. Would require a switch of some kind to toggle between the rearview cam and the connected HDMI device, though, which would likely have three settings: Rear, Aux, Auto... where auto would default to the rear cam when nothing was connected to the aux HDMI.

Honestly, this will probably be the easiest part once I get a hold of a rear cam to play with...

 

[pimp-boy]

- - - Updated - - -



Yeah, I was honestly thinking the same thing when I came up with the initial idea. Would require a switch of some kind to toggle between the rearview cam and the connected HDMI device, though, which would likely have three settings: Rear, Aux, Auto... where auto would default to the rear cam when nothing was connected to the aux HDMI.

Honestly, this will probably be the easiest part once I get a hold of a rear cam to play with...[/QUOTE]



Maybe you can turn the rear cam into a recording camera too???? Since wiring a rear camera is much harder to do with a hatchback w/o drilling or something! That would be great!

 

[wk057]

Maybe you can turn the rear cam into a recording camera too???? Since wiring a rear camera is much harder to do with a hatchback w/o drilling or something! That would be great!

That's probably possible too. Once I nail down the rear cam communication that would be a logical next step. Anyone have a spare rear cam?

 

[KirkDavis]

I haven't let the unit connect via the cell network or wifi. I only have it connected to my phone via bluetooth for tinkering with the audio outputs. I actually don't think I'm going to let it connect out to the internet at all.

Yeah no doubt the mothership is just itching to do a remote wipe.

 

[3mp_kwh]

Wow. You have the old center-KW display! I'm stuck with a permanent Autopilot cartoon, whether using it, or not .

Yeah, there is an external amplifier (somewhere to the left of the steering column IIRC) that the line level outputs feed with the premium audio package...

What format are the line-outs in? RCA, or just shielded wire? Is Sirius XM coming from its own hardware, or is it integral to the MCU?

One future problem with these cars is the MCU's part price, of $5,000. I worry multiple T-shoot paths in the future will lead to "Replace MCU".

 

[wk057]

Wow. You have the old center-KW display! I'm stuck with a permanent Autopilot cartoon, whether using it, or not .

What format are the line-outs in? RCA, or just shielded wire? Is Sirius XM coming from its own hardware, or is it integral to the MCU?

One future problem with these cars is the MCU's part price, of $5,000. I worry multiple T-shoot paths in the future will lead to "Replace MCU".

Yeah, this is from a pre-autopilot car (not too far behind really) that is still on v6.1.

The Line outs are in shielded wire in their own 20 pin connector on the back of the MCU. No RCAs, although that would've been nice.

XM/AM/FM appear to come from a separate radio module. There are left and right line inputs (in another harness) that come from that module (I don't have it) along with line inputs from driver and passenger microphones.

 

[maximus16]

OP, did you watch this? They tell all the technical details of the workings of the car.
DEF CON 23 - Marc Rogers and Kevin Mahaffey - How to Hack a Tesla Model S - YouTube

 

[3mp_kwh]

Yeah, I think the Sirius XM module might look like this. I wasn't sure for how many MS's it was an actual separate piece of hardware, or if wiring it in makes the MCU recognize it.
Tesla 1004787 00 C XM Satellite Radio Tuner Receiver Module Panasonic CRFX51E0GD | eBay -since gone off Ebay
Tesla moved the XM Antenna to the sunroof area some time ago. I'd guess its wiring first goes to this unit, then the MCU. One thing I haven't had the time to figure out is if the non-XM Sound cars were nonetheless bestowed with satellite antennas? If so, some open lines may be in your dash, with no place to go.

 

[lolachampcar]

subscribed

 

[green1]

Thanks for documenting all this work on here! I really look forward to what you come up with. I'm always willing to mod my stuff, though I do like some idea that someone else has taken the major risks on my $100,000 toy

 

[Kandiru]

"Car needs service", ha

No worries, just take it to a service center, Tesla will rebuild the car around it.

 

[wk057]

So, I'm toying with CAN data on the powertrain bus. Funny enough if I play back CAN logs to the bench setup I get speed readout, a broken power meter (it seems offset by something like -300 kW and stays pegged on beyond full regen), and my energy usage graph updates, rated miles show, etc.

Up to 13 errors on the display though... lol.

I think the most interesting part is that the odometer on the IC and the trip meters are incrementing as I play the drive data...

 

[fluxemag]

I'm curious if you could just swap screens/MCUs with a salvage part if yours were to die out of warranty. Would you have to find one with the same options like sunroof/suspension etc?

 

[Muzzman1]

@wk057
I really wish you lived in LA. I'd be standing over your shoulder and learning/helping in every way possible. Great work!

 

[Cyclone]

Something tells me you will soon be able to adjust your wife's performance driver's seat