TMC is an independent, primarily volunteer organization that relies on ad revenue to cover its operating costs. Please consider whitelisting TMC on your ad blocker and becoming a Supporting Member. For more info: Support TMC
  1. TMC is currently READ ONLY.
    Click here for more info.

Let the hacking begin... (Model S parts on the bench)

Discussion in 'Model S' started by wk057, Dec 14, 2015.

Tags:
  1. JabbahTheHutt

    JabbahTheHutt Member

    Joined:
    Jul 4, 2020
    Messages:
    8
    Location:
    A Galaxy Far Far Away
    Hey all,

    I have been reading for some time and learned a lot from this board. So thank you everybody who is contributing!

    I have been tinkering with a spare MCU for a few weeks already and I understand more and more each day, but one thing I still couldn't figure out is how to get specific clean firmware images. I mean, I read that some have them and I somewhere read about a mysterious archive that some people have access to.

    Can we trick the MCU into downloading whichever firmware we need (to service other cars) from the tesla server? Can somebody shed some light on this?

    Greetings!
    Jabbah
     
  2. DaveBC

    DaveBC Member

    Joined:
    Jul 23, 2019
    Messages:
    43
    Location:
    Lower Mainland, British Columbia
    AFAIK, no. The cid sends a handshake to mothership and is given a current firmware download for that vehicle in diff or in full. Those who have had root for some time have been able to assemble an archive over time.
    If you have a firmware on hand you can tell cid-updater to download and install it.
    Public info on installing firmware images can be found here Lunars/tesla
    and at @rooter ’s wiki here Upgrading the Firmware - Unofficial Tesla Tech.
     
  3. nem3

    nem3 Member

    Joined:
    Apr 16, 2019
    Messages:
    25
    Location:
    Illinois
    Shot in the dark here, but any chance anyone has an updated PID for the brake pedal? Seems like 0x168 no longer comes across. Will be looking into other PID's in the next few days to see if I can find it, just hoping to save some time.
     
  4. JabbahTheHutt

    JabbahTheHutt Member

    Joined:
    Jul 4, 2020
    Messages:
    8
    Location:
    A Galaxy Far Far Away
    Hey Dave. Thanks for the answer. So what do I do if I have a Unit with a damaged firmware partition on the bench?

    For example, I now have a unit that had 2020.16.2.1 e99c70fff409 last active according to the app. The emmc is dead and I need to rebuild the two firmware partitions.

    is there any way i can download this particular firmware from the server to flash it to the new emmc?

    or is there any source where I can get this firmware?
     
  5. StarLog

    StarLog Supporting Member

    Joined:
    Mar 11, 2019
    Messages:
    416
    Location:
    MCO
  6. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Ok, i'm makeing quite some progress with the drive-unit controls, but guess what: The driveunit (DI) has an IMMOBILIZER.
    If i'm correct USA models didn't have it / not activated. What i observe is that the IMMO state is sensitive for some messages so i'm poking in the right direction. Now the big question is which bytes does it need to get? How are they calculated?
    I bought the DI with official bill at quality yard. I have VIN of the donor car to.

    Who can help me out with some info on european Drive Units? I feel that with a last bit of info i get it running.
    Right now the situation is that it 'pops' out of gearrequest! But i think its that IMMO state which needs to be disarmed.
    Is that the correct state you all guys read in the DI?
     
  7. StarLog

    StarLog Supporting Member

    Joined:
    Mar 11, 2019
    Messages:
    416
    Location:
    MCO
  8. StarLog

    StarLog Supporting Member

    Joined:
    Mar 11, 2019
    Messages:
    416
    Location:
    MCO
    Anyone have a set of the mcu1 screen legs for sale. Maybe you have a dead or cracked screen. I need the 6 legs and the 12 screws. Will pay.
     

    Attached Files:

  9. Krash

    Krash Data Technician

    Joined:
    Apr 18, 2017
    Messages:
    1,811
    Location:
    Intermountain US
    You can't buy those from the service center?
     
  10. Trebek1762

    Trebek1762 Let's play jeopardy

    Joined:
    Feb 6, 2018
    Messages:
    336
    Location:
    Wisconsin
  11. StarLog

    StarLog Supporting Member

    Joined:
    Mar 11, 2019
    Messages:
    416
    Location:
    MCO
    @Krash
    Yes you can probably buy a refurbished one, at about $1800, I never tried.
    Just know that the unit is supposedly working, and I am guessing the SC, could make it work in your car for a fee.
    Or if your a tinkerer then on the work bench. Just saying.

    @Trebek1762
    Yes, I did not notice the vesion but if you could keep it at that, or root it to force it to stay pre batterygate, :)
     
  12. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Anyone of you can comment?
    Just looking for some model S , D version log files. Willing to compensate? If that would help?
     
  13. Krash

    Krash Data Technician

    Joined:
    Apr 18, 2017
    Messages:
    1,811
    Location:
    Intermountain US
    No I mean the 6 legs and the 12 screws, can't you buy just those parts from the service center without buying the entire MCU?
     
  14. StarLog

    StarLog Supporting Member

    Joined:
    Mar 11, 2019
    Messages:
    416
    Location:
    MCO
    @Krash
    yes I can, I found the kit of brackets and screws for $45 shipped to my house.
     
    • Like x 1
  15. DaveBC

    DaveBC Member

    Joined:
    Jul 23, 2019
    Messages:
    43
    Location:
    Lower Mainland, British Columbia
    I think the drive unit is crypto paired to the body control module. Can you get the BCM from the same donor car?
     
    • Like x 1
  16. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Nope thats impossible.
    What i do have the version of the DU firmware. (when it boots its the first thing it resports).
    It matches with the UDS's version memory location.

    When the drive unit receives an 5A8 message it check it. I have been told they are more firmware tight then anything else.
    Would be cool if someone could look up the 8bytes missing for this tesla fan :)
     
  17. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Yes i can! Its not a cheap test though (+/- 300 bucks..)..
    Can you provide me with a bit more info?
     
  18. DaveBC

    DaveBC Member

    Joined:
    Jul 23, 2019
    Messages:
    43
    Location:
    Lower Mainland, British Columbia
    Hello EV builder. I don’t have firsthand experience with this. I’ve heard it referenced I think on this forum and in Jack Rickard and Rich Benoit’s YouTube videos.


    Jason Hughes (https://twitter.com/wk057, http://skie.net, https://hsrmotors.com)
    developed a motor controller but afaik he only sells it bundled with drive units he has tested and paired to the controller.

    Damien Maguire (http://www.evbmw.com, https://www.youtube.com/c/Evbmw) designed and built open source LDU and SDU controllers. They are now available through the openinverter project. John Volk (https://instagram.com/tesla_bimmer, https://www.youtube.com/c/TeslaBimmer) used Damien’s motor controller in his conversion project.

    I believe Damien went the route of a replacement logic board to bypass any current or future firmware restrictions Tesla put in place. Theory being that even if you figured out what was needed to get the drive unit in front of you going, Tesla could change the entire game with a firmware update down the line and all your hard work would not benefit anyone else.

    If it is a cryptographic challenge and response, you'd theoretically need the BCM on the CAN bus every time you engage the DU. If you were to reverse engineer what the BCM is doing and share the details with the readers here, you would have an audience of grateful TMC members.
     
    • Helpful x 1
  19. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Ok. The issue with most of the solutions is that they aren't EMC proof certified. So I can't use them.

    So yes i'm in need of log files to find out if there is any relationship somewhere.
     
  20. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    I'm in possession now of the original body controller. Sadly they coudn't find the matching key anymore...
     

Share This Page

  • About Us

    Formed in 2006, Tesla Motors Club (TMC) was the first independent online Tesla community. Today it remains the largest and most dynamic community of Tesla enthusiasts. Learn more.
  • Do you value your experience at TMC? Consider becoming a Supporting Member of Tesla Motors Club. As a thank you for your contribution, you'll get nearly no ads in the Community and Groups sections. Additional perks are available depending on the level of contribution. Please visit the Account Upgrades page for more details.


    SUPPORT TMC