My adventures in gaining control of my car

[Jeff4155]

Though I know nothing about Hacking a vehicle I do think in time this will be the norm, sins Tesla is only the start of the "smart electric cars" I do think in time you will be able to download patches for upgrading the car for performance or getting that last bit of KW out of the battery pack (60 to 75kw for instance). 50 years ago who would have thought a 1 liter engine would be pushing out 100kw +, and that a car would be upgradable like a cellphone.

 

[apacheguy]

Can you still mount the navigation maps at 192.168.90.100:/opt/navigon?

 

[supratachophobia]

Factory mode. Sweet.

This is personal property. Folks should be able to di whatever they want with it.

There's risk for people screwing it up, of course. Just as people who work on their own brakes can screw that up too.

There's a ton of useful stuff that this may enable. I look forward to more.

I think it's a lot more serious than that. If you are making changes that could affect how the car reacts to the world around it when it's already expected to act a certain way, puts others at risk too. So far though, the most people have done is flash different firmware onto different hardware and roll back software updates. To my knowledge, no one has figured out how to remove the 5min nag (debatable if this is the actual time in all conditions). But if you remove that nag, how does that affect the rest of the system? We just don't know. Which begs the question, what exactly do you want to accomplish by hacking/rooting your car? If it's to control firmware, I sort of get it. If it's to modify battery output (above established limits) or autopilot function, I'd rather not have you on the same road as me.

Now, I've been in factory/diagnostic mode and what interested me the most was being able to pull up the diagnostic screens where you can see how your car is performing. I think releasing this "nerd mode" as an official app option (explicitly enabled of course) would scratch the itch of a lot of people. That and releasing the SDK for infotainment would essentially remove the need for 99% of people to hack their cars.

 

[ged]

Tesla didn't break it, Google did through a change in their API and how the maps work. Tesla, however, only will fix it through the firmware update.

Ok and what stopped Tesla from releasing a minor version update to the older firmware fixing the issue?

In fact, Tesla broke the features by being lazy and hacking together the software stack rather than designing it. What they should have done is set-up facades for services on their servers and that way backend changes would not require changes to the clients.

Anyway @green1 is right, I suspect he won't find anyone's comments helpful here. TMC has reached the point when it has transitioned from thoughtful/helpful/knowledgeable community of people who understand when they have nothing that adds to a conversation to a forum of rabid fanboys who believe Tesla is always right and infallible and must contribute uninformed opinions to every thread be they on-topic or not. The people who could help don't hang out here anymore because of that.

 

[green1]

Since gaining factory mode on my car I've had several people get in touch with me privately. It appears that the method I talk about here is not the only way in as others report using different methods to get to the same end result. As promised to those people, I will not give any more information about what those methods are, but I do find it to be an interesting design choice on Tesla's part.

If you are one of those people who have done this a different way and are thinking that just because I didn't do it your way I must be lying... well... I don't know that I'm going to convince you otherwise, and honestly I don't feel the need to either. But if you really can't get that feeling out of your head, there's enough information in my other posts in this thread to replicate what I did and how I did it, so you'll know it's possible.

 

[green1]

Can you still mount the navigation maps at 192.168.90.100:/opt/navigon?

I haven't had the time to try, nor has it been a priority for me as I doubt I'll gain anything by playing around in there. I'm assuming you mean by NFS right?

 

[tomas]

In fact, Tesla broke the features by being lazy and hacking together the software stack rather than designing it. What they should have done is set-up facades for services on their servers and that way backend changes would not require changes to the clients.

Anyway @green1 is right, I suspect he won't find anyone's comments helpful here. TMC has reached the point when it has transitioned from thoughtful/helpful/knowledgeable community of people who understand when they have nothing that adds to a conversation to a forum of rabid fanboys who believe Tesla is always right and infallible and must contribute uninformed opinions to every thread be they on-topic or not. The people who could help don't hang out here anymore because of that.

Not sure what forum you have been reading. Having participated since 2011, I recall a pretty good intellectual mix with some lively debates. I would say that in 2011/12/13 there was a pretty strong "enthusiast" leaning, and a ton of people helping people learn about a new product that was quickly evolving. By that, I mean people who were enthusiastic about what Tesla was trying to do, and excited to be early participants. Around 2014, posts moved decidedly more towards criticism of and anger towards Tesla over perceived flaws, perceived broken marketing promises, etc. So, if anything, over the last 5 years I've seen TMC become less "rabid defenders" and more "critical cynics". Regardless, when one opens a thread with a bunch of polarizing comments, one reaps what one sows!

Back to the regularly scheduled program: rooting the car, I guess.

 

[jaguar36]

there's enough information in my other posts in this thread to replicate what I did and how I did it, so you'll know it's possible.

What information? The only part that is anything besides "Google the pinout and watch the Defcon talk" is the part where someone else told you how to do it.

I'm very curious to see where Tesla goes with this. They can go full anti-consumer and lock everything down hard, engaging in a perpetual fight with hackers, they could just leave the exploits available and allow folks who want to have their way with it, or they could actually encourage development, releasing a devkit and such. Would be great to see the last part, particularly as in doing so they could wall off the safety critical parts of the system (such as the AP stuff that everyone is so up in arms about) while allowing folks to create and improve the rest of the car.

 

[green1]

I stated specifically that this would NOT be a how-to, but if you have enough knowledge to have gotten in to factory mode on your own, then the information I shared would certainly be enough to find the same points I did to know what to do to replicate my work. I mentioned more than the defcon talk and googling the pinout, I also mentioned what exactly to look for while packet sniffing the network.

Again, this is not a how-to, this is me describing where I found the information so that someone else with my level of expertise can do the same. My biggest hurdle to getting where I am now was not knowing where to look, I have helped others in my position resolve that specific hurdle.

And nobody else told me how to do it, I figured that out all on my own from the resources I posted. The other person helped with a bit of minor command formatting after I had already written the command. They had no previous knowledge of how to get in to factory mode either, though after working together to learn the exact command they say they'll try it soon on their own car. Without their help it would have taken me a few more working hours to figure this out (which likely translates to a day or two longer) but I definitely would have gotten there.

As for where Tesla will go with it, they've shown in the past that they will lock it down hard. That has been their MO since day 1. It is unfortunate as they are the only car company on the planet that fights this hard against their own owners and third party repair shops.

 

[bkp_duke]

@green1 - rooting for you (pun intended).

 

[scaesare]

I think it's a lot more serious than that. If you are making changes that could affect how the car reacts to the world around it when it's already expected to act a certain way, puts others at risk too...

That's pretty much the same case with modifications for cars for decades:

- ECU flashes/tunes
- Modifications to braking systems
- Transmission changes
- Engine/crankshaft/cam/head changes
- Suspension modifications
- Electrical upgrades/mods
- Steering modifications
- Body modifications

Any of the above can have a potentially fatal detrimental impact on a vehicle. Stalls, loss of stability, braking failure, steering failure, unintended acceleration, etc...

In this case it's software rather than hardware. But that was already the case when engines went from being governed by mechanical means such as distributors and carburetors to ECU's and electronic injection.

 

[msnow]

That's pretty much the same case with modifications for cars for decades:

- ECU flashes/tunes
- Modifications to braking systems
- Transmission changes
- Engine/crankshaft/cam/head changes
- Suspension modifications
- Electrical upgrades/mods
- Steering modifications
- Body modifications

Any of the above can have a potentially fatal detrimental impact on a vehicle. Stalls, loss of stability, braking failure, steering failure, unintended acceleration, etc...

In this case it's software rather than hardware. But that was already the case when engines went from being governed by mechanical means such as distributors and carburetors to ECU's and electronic injection.

The dfference is there are tons of documentation and knowledge on those things.

 

[scaesare]

The dfference is there are tons of documentation and knowledge on those things.

That didn't exist day 1 until people reverse engineered much of it, as the OP is doing in this thread.

 

[msnow]

That didn't exist day 1 until people reverse engineered much of it, as the OP is doing in this thread.

"Day 1" was a hundred years ago. The landscape (people, cars, regulations) was much different then.

 

[bkp_duke]

"Day 1" was a hundred years ago. The landscape (people, cars, regulations) was much different then.

Gotta start somewhere, so that really makes this a poor argument.

Also, people are assuming the OP and others with root access can just go in and "change anything they want". That is not entirely correct, since most of the code for AP or any other subsystem is compiled into machine code. I seriously doubt he will go through the arduous process of decompiling it and trudging through that to attempt changes.

 

[supratachophobia]

Gotta start somewhere, so that really makes this a poor argument.

Also, people are assuming the OP and others with root access can just go in and "change anything they want". That is not entirely correct, since most of the code for AP or any other subsystem is compiled into machine code. I seriously doubt he will go through the arduous process of decompiling it and trudging through that to attempt changes.

Then again, what does anyone hope to accomplish with root access?

 

[scaesare]

"Day 1" was a hundred years ago. The landscape (people, cars, regulations) was much different then.

Screwing up mechanical brakes the so you plow in to a gaggle pedestrians was just as much a bummer 100 years ago as it is today.

Screwing up the hydraulic brakes was only 60 yrs ago.

Screwing up the power steering was only 40 yrs ago.

Breaking the ECU was only 20 yrs ago.

Cratering the firmware is only the most recent danger.


To pretend that there wasn't been a spectrum of technological progression over that span of time that all required initial discovery and exploration along the way is ignoring the facts, IMO.

(time references not exact and for illustrative purposes only)

 

[scaesare]

Then again, what does anyone hope to accomplish with root access?

I'd love, for instance, to be able to get access to the service modes that engage the pumps to purge the coolant lines, so I could change that myself, for example.

I recently had a charger failure. I had to pay the service center to reconfigure the car to go from a dual- to single charger configuration. I know for a fact that can be done with the correct access outside of a service center. I'd love to be able to do that myself.

Not to mention there's a crapload of diagnostic info available that the car collects..

 

[supratachophobia]

That's pretty much the same case with modifications for cars for decades:

- ECU flashes/tunes
- Modifications to braking systems
- Transmission changes
- Engine/crankshaft/cam/head changes
- Suspension modifications
- Electrical upgrades/mods
- Steering modifications
- Body modifications

Any of the above can have a potentially fatal detrimental impact on a vehicle. Stalls, loss of stability, braking failure, steering failure, unintended acceleration, etc...

In this case it's software rather than hardware. But that was already the case when engines went from being governed by mechanical means such as distributors and carburetors to ECU's and electronic injection.

I think you are oversimplifying with the exception of ECU. The other items on the list are all hardware modifications with very real A + B = C results. Unless, of course, the installation is botched in some way. Are you saying that a modification done incorrectly is part of your risk assessment? Because I would argue that if a modification above is done right, then the risk of failure (for that reason) is avoided. Now, your risk is limited to environment, ie. drag slicks on snow, or lean running air-fuel at high altitude. These are incompatibilities we know beforehand.

With software, I think the complexities and the dependencies are still a big unknown (and a reason to not attempt as a "lone wolf project"). And without a complete grasp over how all the cars modules interact (there could be upwards 2 dozen of them depending on car config), I don't think most of us are capable. Wk057 had an interesting tidbit when he did that AP conversion for his wife's P85. He had all the hardware lined up and ready, but suffered a firmware failure on one of his early attempts to flash. It turned out the interior temperature sensor wasn't compatible with the AP firmware and needed swapped out. Now, I have no idea what that sensor has to do with autopilot, but some verification check somewhere, thought it was important enough to throw an error. I can't even imagine was a seemingly simple change in software could affect in some seemingly unrelated module or algorithm elsewhere.

 

[supratachophobia]

I'd love, for instance, to be able to get access to the service modes that engage the pumps to purge the coolant lines, so I could change that myself, for example.

I recently had a charger failure. I had to pay the service center to reconfigure the car to go from a dual- to single charger configuration. I know for a fact that can be done with the correct access outside of a service center. I'd love to be able to do that myself.

Not to mention there's a crapload of diagnostic info available that the car collects..

So you bring up very good points. And if you had access to ToolBox, you would have been able to perform those functions.

Would it be fair to suggest that what you specifically are requesting is an interface/avenue to perform general maintenance?