TMC is an independent, primarily volunteer organization that relies on ad revenue to cover its operating costs. Please consider whitelisting TMC on your ad blocker and becoming a Supporting Member. For more info: Support TMC
  1. TMC is currently READ ONLY.
    Click here for more info.

Let the hacking begin... (Model S parts on the bench)

Discussion in 'Model S' started by wk057, Dec 14, 2015.

Tags:
  1. Slexs

    Slexs Member

    Joined:
    Jan 27, 2020
    Messages:
    35
    Location:
    Kristiansand Norway
    Alright, so power was the reason it didnt turn on. I got ahold of a more powerful supply, and now it boots into "idle" i think. I see lots of activity on the LEDS on the motherboard, but so far i havent been able to get the screen to turn on. Is this because of abovementioned lacking ethernet signal, wakeup signal, or am i just too impatient and it needs a bit more time with power before anything shows on the screen?
     
  2. rooter

    rooter Member

    Joined:
    May 13, 2018
    Messages:
    673
    Location:
    Edmonds, WA
    Assuming you mean the MCU screen, this is a classic symptom of the CID failing to boot.

    Have you changed the CID? What is the history here?
     
  3. Slexs

    Slexs Member

    Joined:
    Jan 27, 2020
    Messages:
    35
    Location:
    Kristiansand Norway
    Its a used MCU which had Black screen. Owner took it to SC and they managed to boot it. Owner decided to swap because of symptom even if it booted. So i bought it off him to experiment on. Maybe the memory tipped over the last point and failed?

    Im planning swap out the memory any ways so its no biggies i dont need the data on it from previous owner, i plan to use it as verification that memory swap was succsessfull before putting it back in car.

    Would it boot on power if the memory was intact?
     
  4. rooter

    rooter Member

    Joined:
    May 13, 2018
    Messages:
    673
    Location:
    Edmonds, WA
    #1704 rooter, Feb 15, 2020
    Last edited: Feb 15, 2020
    Ok, sounds like the CID matches the MCU. ('Curtains match the Drapes'?) You must not have differing software versions in them due to code-signing, else yet another reason why it will not boot.

    I'll bet it would boot if you sprayed some liquid cold on the eMMC, as I recommend in my article. I am very suspicious at this point of the eMMC support circuitry being at fault, rather than the memory cells themselves. (yaay Hynix...)

    But code-signing also means that you must lay down the exact version of firmware that you are running in the car now, else black screen. (Don't ask me how I know...) Check which of your partitions is active (1 or 2) and build the image as I recommend. Both parts can have the same version as long as it is the current version you are running.

    Ya, the most important thing is having your own files. (parts 3 & 4)

    PS - It's not 'memory' (RAM), it's flash.
     
  5. Slexs

    Slexs Member

    Joined:
    Jan 27, 2020
    Messages:
    35
    Location:
    Kristiansand Norway
    Sorry, i have a bad habit of calling storage space (flash etc.) for memory.

    By CID do you mean Instrument cluster, or the daughterboard on the tegra motherboard containing CPU/ flash?
    Let's say i put my own cars daughterboard into this donor MCU, will there be code-signing when i dont have the instrument cluster connected to the MCU? Im not sure what version this donor MCU ran before it was detached from the car, but im pretty sure its not the same version i have in my car now (2020.4.1)
     
  6. rooter

    rooter Member

    Joined:
    May 13, 2018
    Messages:
    673
    Location:
    Edmonds, WA
    IC=Instrument Cluster, MCU=Media Control Unit, CID=T3 daughtercard

    Yep, that would do it.

    When the MCU initializes it starts a boot coprocessor in the Tegra3, which looks to the first address in the Spansion flash (on obverse of the CID) to boot. Early in its boot process (equivalent to its BIOS) the coprocessor turns on code-signing, which thereafter checks that every ECU (Electronic Control Unit) in the car is running the same version of firmware.

    If you put your own car's daughtercard into the bench MCU, or the bench MCU's daughtercard into your car, black screen due to firmware version mismatch. (as confirmed by code-signing) Don't ask me how I know...

    I have permission from Sid to publish his custom Fusee Gelee hack for Tesla to turn off code-signing, but have no code nor further info.

    And rats, I muffed that amusing metaphor; it should have been 'Carpet match the drapes?'. (referring to a woman's hair color)
     
    • Like x 2
  7. JustADude

    JustADude Closed

    Joined:
    Jun 18, 2019
    Messages:
    71
    Location:
    Canada
    How easy is it to downgrade to before 2019.16?
     
  8. Restrected

    Restrected Member

    Joined:
    Jun 4, 2017
    Messages:
    64
    Location:
    10305
    Your emmc is dying. You need a backup of that before it’s completely gone.

    pm me.
     
  9. Banjo

    Banjo Member

    Joined:
    Mar 18, 2018
    Messages:
    45
    Location:
    USA
    Does anybody know the answer to this? How long can the car be completely disconnected before it will be unable to update the certificates?
     
  10. appleguru

    appleguru Member

    Joined:
    Mar 15, 2017
    Messages:
    952
    Location:
    US
    you’d have to check the cert expiry dates, but generally they are good for 3-5 years.
     
  11. MP3Mike

    MP3Mike Well-Known Member

    Joined:
    Feb 1, 2016
    Messages:
    14,925
    Location:
    Oregon
    But you could be at the start of the certificate life, or the end. No way to know without actually investigating the certificate.
     
  12. verygreen

    verygreen Curious member

    Joined:
    Jan 16, 2017
    Messages:
    2,897
    Location:
    TN
    mcu2, model3 and autopilot certs are only good for 2 years
     
    • Informative x 4
  13. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Hi Everyone a bit late to the party i guess but trying to get upto speed...

    My part on the bench is a 2015 Rear drive unit (85D series).
    I was looking for some canbus logs. Has anyone one which he can share?
    (or knows a link?).

    I need one with the drivetrain data in it.

    I'm also looking for a sheet with all the ID's (could only find one for Model 3?!?) .

    Hope you guys can help me. The sheet from wk057 is already in my archive :)
     
  14. hungyip84

    hungyip84 Member

    Joined:
    Dec 25, 2014
    Messages:
    123
    Location:
    Hong Kong
    I am trying to mess around map data. I backed up my current partition and want to download map of other region. In case I want to revert back the old map, I assume I just need to copy my backup back to the map partition.

    Not sure if I missed anything.
     
  15. Luxeelectrical

    Luxeelectrical New Member

    Joined:
    Apr 15, 2018
    Messages:
    4
    Location:
    San Diego
    Hello, does anybody know how to make the screen turn on on CID, when I connect it, it does not light up, even tho MCU debug leds blink and I can get in root before the CID goes to sleep. Is there any command that I can use to make it turn on?
    Thank you!
     
  16. StarLog

    StarLog Supporting Member

    Joined:
    Mar 11, 2019
    Messages:
    416
    Location:
    MCO
  17. Luxeelectrical

    Luxeelectrical New Member

    Joined:
    Apr 15, 2018
    Messages:
    4
    Location:
    San Diego
    Thank you, will try.
     
  18. Luxeelectrical

    Luxeelectrical New Member

    Joined:
    Apr 15, 2018
    Messages:
    4
    Location:
    San Diego
    Does anybody have CID soft version 2019.40.2.3 ?
    trying to recover from dead emmc.
     
  19. Luxeelectrical

    Luxeelectrical New Member

    Joined:
    Apr 15, 2018
    Messages:
    4
    Location:
    San Diego
    Got it figured out.
     
  20. JWardell

    JWardell Member

    Joined:
    Apr 5, 2016
    Messages:
    256
    Location:
    Boston
    For folks that are interested, I've started shipping out my CANServer and MicroDisplay boards, as I have the hardware ready but the Arduino-programmable software has a long way to go.
    It's an ESP32 that sits on any can bus...and direct plug and play to the chassis bus under the seat... and can not only transmit data to the hud-like displays, but in the future can provide a high bandwidth interface to phone apps, and connect with home nas or Pi servers and offload an entire drive's worth of data.
    I am waiting to announce til software is more publicly consumable, but if you are interesting in helping or hacking around I set up a wait list and shipped a few with venmo for costs.
    CANserver
     
    • Like x 2

Share This Page

  • About Us

    Formed in 2006, Tesla Motors Club (TMC) was the first independent online Tesla community. Today it remains the largest and most dynamic community of Tesla enthusiasts. Learn more.
  • Do you value your experience at TMC? Consider becoming a Supporting Member of Tesla Motors Club. As a thank you for your contribution, you'll get nearly no ads in the Community and Groups sections. Additional perks are available depending on the level of contribution. Please visit the Account Upgrades page for more details.


    SUPPORT TMC