TMC is an independent, primarily volunteer organization that relies on ad revenue to cover its operating costs. Please consider whitelisting TMC on your ad blocker and becoming a Supporting Member. For more info: Support TMC

Let the hacking begin... (Model S parts on the bench)

Discussion in 'Model S' started by wk057, Dec 14, 2015.

Tags:
  1. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    I pulled the two EEPROM contents on the BCM someone any directions to share how to modify them so it will spit out the long saught code :). Else i will need a key programmed to it and i even have no clue how to manage that and if i send it that code if it then will spit out the code...
     
  2. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Well my findings upto now are that it isn't this. it's just one code 8 bytes which are indeed paired / teached.
    Offcourse this could be software version dependent.
    I know that my solution won't cut it for everyone and yes there are aftermarket controllers available but those controllers dont pass
    EMC certificate testing and that's mandatory.

    What you see is that the drive unit spits out :

    0x276 8 02 00 00 00 00 00 00 00 (request for IMMO)
    0x256 8 yy yy yy ay yy yy yy yy (a has IMMO state in it -- ((data[3] & 0x70) >> 4) --)
    0x5A8 8 xx xx xx xx xx xx xx xx (answer coming from somewhere i guess BCM through gateway) with the code.
    0x256 8 yy yy yy ay yy yy yy yy (a has IMMO state in it -- ((data[3] & 0x70) >> 4) --)

    The code repeats each 10/100ms (not sure yet).

    The 0x276 and 0x256 with immo locked are normally not / not always seen.

    If some people feel to contribute i fear/think the code is VIN related.
    But a nice start would be to compare 5A8's and atleast we learn if that one is unique.

    Uptil now i know that over the years it stays the same for the same vehicle.
    (but i only have one vehicle sample)
     
  3. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    5,599
    Location:
    Hickory, NC, USA
    They're generated based on the BCM's internal certificate (from the factory) and paired with the DU at install. So, unique to the car, but nothing to do with the VIN per se.

    I spent years developing hardware and software that allow the use of the Tesla drive units without any physical modifications to the drive unit. Also developed this process to work with any variation of Model S/X drive unit from day 1 to present, including the front versions.

    The controller replacement setups are pretty terrible. I've tried every one of the ones I'm aware of on my test bench... I mean heck, one of them uses a hobbyist WiFi module for primary control... like seriously.

    Anyway, getting full control over the units and refining that to the point where they can be used outside of a Tesla vehicle without hardware modifications has taken years to get perfect. Best of luck if that's the route you're going. Some hurdles are easier than others, but there's some doozies in there.
     
    • Informative x 6
    • Like x 1
  4. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Hi wk057,

    I'm up to the point of almost victory so the last hurdle is the IMMO code.
    With-out it won't engage gear, can you confirm that?

    Of Course then i need to ditch dozens of errors etc. so i can get out LIMB mode.
    I even don't know if that will be needed for just passing the MOT of the car.
    After i have the license plate and paperwork done i still could swap to something else.

    Since i have the BCM i will try to get it to the point to spit out my teached immo code.
    I was lucky that they still had it, and un-lucky that it came without the keyfob...

    Thank you, and everyone for the input, very much appreciated. :)
     
  5. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    5,599
    Location:
    Hickory, NC, USA
    Unfortunately on the latest firmwares it won't enable any "gear" without the immobilizer satisfied.

    The BCM won't unlock it without a key, either... and unfortunately it won't program a key without some other headaches (as in, getting other related modules in place for it to talk to), even if you can get someone who can do it.

    After you get it in gear you've got about ~100 signals across dozens of messages to properly emulate in order for it to work correctly with no faults or alerts.

    Best of luck.
     
    • Informative x 3
  6. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    #1746 EV_Builder, Oct 4, 2020
    Last edited: Oct 4, 2020
    Thank u wk057 for your info much appreciated if i could i would have bought an controller, but the point is they don't comply with EMC (certified); so either i make this work or i wont get my EV on the road...

    One question: on the SDU Board there is an EEPROM 24C32F have you read its contents?
     
  7. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Wouldn't it be possible to use the EEPROM contents to my advantage?

    Does anyone know if a BCM on the bench with no antenna's detects its keyfob? Will it work with just +VDC and GND?
    (at close distance)?
     
    • Like x 1
  8. DaveBC

    DaveBC Member

    Joined:
    Jul 23, 2019
    Messages:
    43
    Location:
    Lower Mainland, British Columbia
    Hi @EV_Builder, do you have a running and driving Tesla as well as your DU for transplant?

    What are you using to capture and analyze the CAN traffic? Do you know if it is possible to do with an OBDLink LX connected to PT CAN?
     
  9. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Nope else i already would have it fixed/running honestly :) its this difficult because i just bought a drive with matching BCM but no key and no car to grab known working recordings and with a working BCM you would have the password (or other replayable logs that should work). I hoped it would be enough to get this running but it looks/seems that the info i hoped to find is difficult to obtain.

    I think you should be able to make logs with the OBDLink LX what i do see is that the poorer the device the less accurate the capture is.
    So depending the quality of log you are looking for the more quality the CAN device needs to be :) (like often really).
     
  10. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Progress!!! obtained IMMO Code, so that's solved :)

    Now the next hurdle getting it to spin...someone has a model S D version canbus log and can share?
    I need a big chunk of 0x108...

    come on WK057 you know it...as a small present ...:) ;)
     
  11. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    You deserve some beers :) , thank u!
    If you PM me a Crypto account, i will donate some beers to you :)
     
    • Like x 1
  12. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    OK next hurdle. Can someone help with 0x396? The bit definition?

    I need to know: 1,6 and 12

    Hope someone can contribute.
     
  13. JWardell

    JWardell Member

    Joined:
    Apr 5, 2016
    Messages:
    233
    Location:
    Boston
    For S or 3?
     
    • Like x 1
  14. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Thank u! For a MODEL S :cool:
     
  15. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Ok i got it running!

    Very nice throttle response.

    Offcourse still some signals to figure out to get out of limb-mode :)

    Question: What is the max rpm / speed in limb-mode?

    (i would like to know, but i don't have cooling and oil in the unit right now so don't fancy maxing it out right now..)
     
    • Like x 6
    • Love x 1
  16. gwxfer

    gwxfer Member

    Joined:
    Oct 5, 2020
    Messages:
    30
    Location:
    Europe
    Why not use toolbox to pair immobilizer?
     
  17. EV_Builder

    EV_Builder Member

    Joined:
    May 6, 2020
    Messages:
    44
    Location:
    Holland
    Don't had access to it and couldn't get access to it only if paying big sums of money.
     

Share This Page

  • About Us

    Formed in 2006, Tesla Motors Club (TMC) was the first independent online Tesla community. Today it remains the largest and most dynamic community of Tesla enthusiasts. Learn more.
  • Do you value your experience at TMC? Consider becoming a Supporting Member of Tesla Motors Club. As a thank you for your contribution, you'll get nearly no ads in the Community and Groups sections. Additional perks are available depending on the level of contribution. Please visit the Account Upgrades page for more details.


    SUPPORT TMC