My adventures in gaining control of my car

[Pdub2015]

Some people are pretty selfish when it comes to weighing what they think is their personal liberty versus the safety of those around them on the road. If you want to take risks fine just stay off public roads.

Change a few of these words, and you have one of the popular arguments for gun control... Or lack thereof. Freedom to own weaponry vs public safety.

Ideologically, I'm on the side of "I own it, I can do what I want with it." In practice, though, this level of "freedom" poses certain difficulties for, you know, civilization. "I own this 500 hp car, I should be able to remove the catalytic converter and related smog equipment and tune it for top performance." Fortunately for the rest of us air breathers, current laws mostly restrict this type of modication. Still, tuners will tune... and hackers will hack.

Apologies to the Op.

 

[skrenes]

so far all they're showing me is the last 7.1

Interesting. They were quite aggressive with the latest v7.1 build (2.36.31). I wonder if there's some prerequisite install procedure it needs to get to Firmware 8. Although I think someone said they upgraded directly from v6 to v8. The v8 firmware (2.40.21) was pushed to what seems like every Canadian Tesla on Friday/Saturday. I would imagine yours would pick it up if you upgraded to 2.36.31.

Is it possible for you to post a list of variables that you are able to set? You mentioned that you had a list of REST commands. I'd be interested to see what these are. Also, while snooping on the network, have you found you can see traffic from the remote API? It would be really interesting to be able to expand the remote API by adding specific payloads to existing remote API commands, and then snooping the traffic (with say an Arduino or Raspberry Pi) to grab this payload and use it to invoke commands on the local network that are not supported by the remote API. Examples include, folding mirrors, turning on rear defroster, raising/lowering suspension, setting charge rate, changing scheduled charging, etc (assuming these things are simple unencrypted commands that can be invoked on the local network).

Is the rear facing camera an analog connection or does that make use of the packet network too?

 

[green1]

There's no prerequisite in the last 7.1 to get 8.0, however most of the extra lockdown is actually in the last 7.1 and not in 8.0 itself. That's why the rollout was so aggressive.

The remote API doesn't leak on to the network, however the same things and more can be triggered by setting local variables (eg heating/AC control, locks, sunroof, keyless driving, charging control, honking the horn, flashing the lights, homelink, etc) along with more (eg window control, pack pre heating, frunk and trunk controls, and lots more) you can also change almost any car setting, from radio station to whether the fog lights will come on while driving, to even if the submarine Easter egg will show on the air suspension screen in controls.
There are hundreds of variables, some giving you information about the state of the vehicle, others allowing you to control aspects of it. Without trying each one is hard to tell what is what there.

I haven't had time yet to see if the variables in the car give any hints for the remote API, however as the naming conventions are rather inconsistent, I feel like it may not be a lot of help that way.

For me, I now have a raspberry pi under the dash and can set or view any variable while on my home network, or within direct wifi range of my car. (I've even put together a nice little webpage with the common ones I want and easy access to manually setting others) However without shelling out for a cellular data plan for the pi, or getting even more access, it doesn't give me full remote access beyond wifi range.

 

[MP3Mike]

Interesting. They were quite aggressive with the latest v7.1 build (2.36.31). I wonder if there's some prerequisite install procedure it needs to get to Firmware 8.

The latest 7.1 build was pushed aggressively because it was a major security update that prevents at least one vector for a remote attack on a Tesla.

 

[diamond.g]

There's no prerequisite in the last 7.1 to get 8.0, however most of the extra lockdown is actually in the last 7.1 and not in 8.0 itself. That's why the rollout was so aggressive.

The remote API doesn't leak on to the network, however the same things and more can be triggered by setting local variables (eg heating/AC control, locks, sunroof, keyless driving, charging control, honking the horn, flashing the lights, homelink, etc) along with more (eg window control, pack pre heating, frunk and trunk controls, and lots more) you can also change almost any car setting, from radio station to whether the fog lights will come on while driving, to even if the submarine Easter egg will show on the air suspension screen in controls.
There are hundreds of variables, some giving you information about the state of the vehicle, others allowing you to control aspects of it. Without trying each one is hard to tell what is what there.

I haven't had time yet to see if the variables in the car give any hints for the remote API, however as the naming conventions are rather inconsistent, I feel like it may not be a lot of help that way.

For me, I now have a raspberry pi under the dash and can set or view any variable while on my home network, or within direct wifi range of my car. (I've even put together a nice little webpage with the common ones I want and easy access to manually setting others) However without shelling out for a cellular data plan for the pi, or getting even more access, it doesn't give me full remote access beyond wifi range.

Can you tether your car and your pi to your cell phone?

 

[green1]

Can you tether your car and your pi to your cell phone?

Yes. As long as I'm within wifi range of the car, or it and I are both on my home wifi, I can connect that way. Otherwise I have to use the remote API like everyone else.

 

[skrenes]

There's no prerequisite in the last 7.1 to get 8.0, however most of the extra lockdown is actually in the last 7.1 and not in 8.0 itself. That's why the rollout was so aggressive.

The remote API doesn't leak on to the network, however the same things and more can be triggered by setting local variables (eg heating/AC control, locks, sunroof, keyless driving, charging control, honking the horn, flashing the lights, homelink, etc) along with more (eg window control, pack pre heating, frunk and trunk controls, and lots more) you can also change almost any car setting, from radio station to whether the fog lights will come on while driving, to even if the submarine Easter egg will show on the air suspension screen in controls.
There are hundreds of variables, some giving you information about the state of the vehicle, others allowing you to control aspects of it. Without trying each one is hard to tell what is what there.

I haven't had time yet to see if the variables in the car give any hints for the remote API, however as the naming conventions are rather inconsistent, I feel like it may not be a lot of help that way.

For me, I now have a raspberry pi under the dash and can set or view any variable while on my home network, or within direct wifi range of my car. (I've even put together a nice little webpage with the common ones I want and easy access to manually setting others) However without shelling out for a cellular data plan for the pi, or getting even more access, it doesn't give me full remote access beyond wifi range.

Cool. Thanks for answering most of the questions and more. I know with the remote API, you can set the Valet pin. You could probably create your own valet encoding pin (briefly and then reset so that valid use of the pin isn't interrupted) that the RPi can read and know to invoke something on the local network. That way you can do everything you want via the 3G/LTE connection.

 

[green1]

Cool. Thanks for answering most of the questions and more. I know with the remote API, you can set the Valet pin. You could probably create your own valet encoding pin (briefly and then reset so that valid use of the pin isn't interrupted) that the RPi can read and know to invoke something on the local network. That way you can do everything you want via the 3G/LTE connection.

Now that's an interesting idea. I like it. And yes, the pi can read what the current valet mode pin is, so that's probably worth looking in to. That said, it would be tough for time critical functions, as the pi has to pull the data, it doesn't get a push notification of a change, currently I have limited my interactions to every minute for recurring tasks, though I suppose I could probably ramp that up if I wanted (though I don't want to interfere with other traffic on the internal network, or drive load on the CID)

 

[spottyq]

If you only need one way communication (you -> car) you could use a prepaid SIM card and send SMS to your RPi. That would set you back 10$ for the card + a SIM card shield for the RPi. As it is a prepaid card, you don't have to top it up so you don't have monthly fees.

 

[green1]

If you only need one way communication (you -> car) you could use a prepaid SIM card and send SMS to your RPi. That would set you back 10$ for the card + a SIM card shield for the RPi. As it is a prepaid card, you don't have to top it up so you don't have monthly fees.

It appears obvious you are in a country with sane wireless services. I assure you, I am not.
"pre-paid" plans here expire after 30 days. The absolute cheapest plan in existence where I live is $15 for those 30 days, that does not include taxes, the hardware, or any data usage.

It would be neat to do, but I'm not spending over $200/year + hardware costs on a way to have one way transmission to the car to get only marginally more than the existing free app.

 

[spottyq]

It appears obvious you are in a country with sane wireless services. I assure you, I am not.
"pre-paid" plans here expire after 30 days. The absolute cheapest plan in existence where I live is $15 for those 30 days, that does not include taxes, the hardware, or any data usage.

It would be neat to do, but I'm not spending over $200/year + hardware costs on a way to have one way transmission to the car to get only marginally more than the existing free app.

Funny, I thought about that and assumed that Canada had a better wireless service than I have. Guess I was wrong !

Anyways, this discussion (and a side project of mine) got me thinking about cell services for the Internet of Things and I found some interesting things while searching for global SIM providers of low monthly allowance SIM cards.

Could this maybe work out for you ? Pricing
$0,40/month + 0,60$/MB in Canada (0,85$ in the US).
And a one-time fee of 5$ + 15$ shipping to Alberta, Canada.

For your usage, you'll only be using kB's per month (with a little optimisation) so monthly fees should be very low.

I haven't tested their service, nor do I no anyone who has, so I can't tell you if they are any good. But maybe they are worth a try ?

 

[green1]

*sigh* I love how Canada is lumped in with all the third world countries for the pricing on that site...

It's definitely an interesting prospect. I'll certainly keep it in reserve for future. Right at this instant the extra functionality it would provide me isn't worth the hassle, but with a bit more development it might be.

 

[hiroshiy]

OT, in Japan we have free subscription SIM card up to 500MB every month.

 

[Gizmotoy]

It would be neat to do, but I'm not spending over $200/year + hardware costs on a way to have one way transmission to the car to get only marginally more than the existing free app.

I've been itching for a reason to try one of these guys: Electron

As cheap as $50 hardware costs, plus $2.99 monthly (just 1MB though, you're not going to want to stream GPS through it).

 

[jaguar36]

OT, in Japan we have free subscription SIM card up to 500MB every month.

Freedom pop has free data sim card subscriptions for 200MB per month in the US. Dunno if they work in Canada.

 

[green1]

Freedom pop has free data sim card subscriptions for 200MB per month in the US. Dunno if they work in Canada.

Everything I can find says it doesn't work in Canada.

 

[Nietschy]

also OT: strange pricing you got there... for about every supplier you pay 10€ per GB per month. If you just use 100MB, you just pay 1€ every month (or you recharge the sim only every 10 months). The sim is 2,99€. And all of this is just austria and is very expensive compared to norway where you get it for 25% of that money.

 

[demundus]

sooooooo hows it goinnnnnn?

 

[green1]

sooooooo hows it goinnnnnn?

no real update as lack of time, however I do have access to the internal network, and can set all sorts of variables at will (I have a Raspberry Pi computer and a 3 port switch under the dash).

Currently this allows me to disable all AP nags and speed limitations, enable the AP diagnostic mode on the IC, and enable the summon features that Tesla decided not to release anywhere outside of the USA (summon from the keyfob being the big one, but also summon without having to continually hold the app button. Still haven't figured out the double tap park button one, but that seems like one I don't care much about anyway.)
It has also allowed me to disable the firmware update pop-up while I stay on 7.1, and I have an automated script which re-enables remote access every minute in case some valet/service tech/thief knows how to turn it off, (because Tesla was too stupid to require authentication on that one!)
Additionally I can now use homelink from my cell phone while the car is plugged in at home, meaning I don't need to carry my keys to get in to my garage any more.

I'm starting to play with some of the more advanced variables as well to see what they do, things like allowing AP to trigger based on Botts-Dots, there's also one talking about stop signs and red lights, and some others I want to try as well.

Overall I'm pretty happy with where I am at this point.

Root would be nice, but it's not nearly as important right now as I have the car operating the way it should. That said, I fully expect Tesla to break more features of the pre-8.0 software at some point in the not too distant future, and my current setup would not survive an update to 8.0 without gaining root, so I may have to address that one yet. Unfortunately I don't currently have a good path to get me there.

 

[demundus]

no real update as lack of time, however I do have access to the internal network, and can set all sorts of variables at will (I have a Raspberry Pi computer and a 3 port switch under the dash).

Currently this allows me to disable all AP nags and speed limitations, enable the AP diagnostic mode on the IC, and enable the summon features that Tesla decided not to release anywhere outside of the USA (summon from the keyfob being the big one, but also summon without having to continually hold the app button. Still haven't figured out the double tap park button one, but that seems like one I don't care much about anyway.)
It has also allowed me to disable the firmware update pop-up while I stay on 7.1, and I have an automated script which re-enables remote access every minute in case some valet/service tech/thief knows how to turn it off, (because Tesla was too stupid to require authentication on that one!)
Additionally I can now use homelink from my cell phone while the car is plugged in at home, meaning I don't need to carry my keys to get in to my garage any more.

I'm starting to play with some of the more advanced variables as well to see what they do, things like allowing AP to trigger based on Botts-Dots, there's also one talking about stop signs and red lights, and some others I want to try as well.

Overall I'm pretty happy with where I am at this point.

Root would be nice, but it's not nearly as important right now as I have the car operating the way it should. That said, I fully expect Tesla to break more features of the pre-8.0 software at some point in the not too distant future, and my current setup would not survive an update to 8.0 without gaining root, so I may have to address that one yet. Unfortunately I don't currently have a good path to get me there.

So you've used Raspberry Pi as a traffic filter, blocking certain signals and allowing others through? By enabling AP diagnostic mode, are you bypassing the nags? So you're driving around in diagnostic mode?

Are those bad assumptions ^^^