Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Remote S: Tesla app for Apple Watch, iPhone, iPad, and iPod Touch

This site may earn commission on affiliate links.
Status
Not open for further replies.
Hey allen, for some reason my Summon doesnt work from your app anymore. It just says tesla servers overloaded. Any ideas?
It stopped working for me, too. It appears that Tesla changed their API so that the old API call for Summon stopped working. They implemented a version 2 of Summon a while ago that required continuous press. It doesn't appear that anyone has figured out yet what the command call for version 2 of Summon is. Times like these make me wish Tesla opened their API to developers so that they could warn us that they're going to change their API. Unfortunately, my iPhone is updated to the newest OS and can't be jailbroken. Without a jailbroken iPhone, I can't tell what the new API calls are, unless someone tells me how to read the calls without a jailbroken iPhone.

I check the Tesla API thread on here frequently, and nobody appears to be aware of the new commands for Summon. Every implementation of software that uses the Tesla API all use the same version 1 Summon command that I do.
 
I showed your app to someone else at a Tesla meetup yesterday who also had an Apple Watch. He bought it instantly and had it up and running minutes later. He loved that the iPhone app launches so much faster than Tesla's, and that he can run things from his watch. Great job Allen!
 
Without a jailbroken iPhone, I can't tell what the new API calls are, unless someone tells me how to read the calls without a jailbroken iPhone.
It's been a long time since I've done something like this, so it may not work anymore now that apps are more secure, but I used to setup my Mac as a WiFi hotspot and run an SSL proxy that does a man-in-the-middle attack with a fake SSL cert for whatever site you want. Then you can see the interactions in plain text.
 
It's been a long time since I've done something like this, so it may not work anymore now that apps are more secure, but I used to setup my Mac as a WiFi hotspot and run an SSL proxy that does a man-in-the-middle attack with a fake SSL cert for whatever site you want. Then you can see the interactions in plain text.

You can add any cert to the phone you want. That's how the phones get integrated into intranets.
 
It's been a long time since I've done something like this, so it may not work anymore now that apps are more secure, but I used to setup my Mac as a WiFi hotspot and run an SSL proxy that does a man-in-the-middle attack with a fake SSL cert for whatever site you want. Then you can see the interactions in plain text.

It's no longer possible to do this since the OS now does certificate pinning and the Tesla app properly verifies the server certificate. Installing a trusted root cert on the phone that "issued" the MITM certificate will not work anymore. To still be able to do a MITM on SSL iOS needs to be jailbroken and iOS SSL Kill Switch or similar needs to be installed to disable OS certificate verification.
 
  • Informative
Reactions: woof
Allen - I too have built an iOS app for Tesla and can confirm that autopark and trigger_homelink commands do not work. I have tried to use Charles as a proxy to intercept the Tesla api, but without a jailbroken device I need a valid SSL certificate for Tesla's servers, so if anyone can do that on a jailbroken device that would be appreciated.

The native Tesla app still functions, so originally I thought it had to do with the user_agent, but after spoofing mine to match Tesla's, that was not the case. Could they have changed the client key?
 
I also have an Android and have tried to proxy it but to no avail. Is there a method to do so? Any conventional proxy simply causes the Tesla app to not connect and does not reveal the endpoints.

I'm wondering how they do the continuous press. Is that simply a client side thing where it aborts if you let go, or is a socket connection actually created between the vehicle and the app?
 
The new summon/homelink commands use the streaming API (streaming.vn.teslamotors.com). For streaming, the Tesla app ignores any proxy settings that are set on the device, and talks directly to the server, so a proxy like Charles or Fiddler is useless for determining what the command syntax is. I did a quick setup with mitmproxy, on a jailbroken device that has cert pinning, validation, etc, disabled, and will consider any certificate "good", but the Tesla app still would not accept the certificate; resulting in a "could not connect to your vehicle" error on the summon page. I seem to recall that in an earlier version of the Tesla app they included the issuing certificate for their services as part of the app; if that's still the case I might be able to replace that with my mitm certificate and get a decoded stream after all. Didn't have much time to play, gotta get back to my day job for a bit :)
 
I also have an Android and have tried to proxy it but to no avail. Is there a method to do so? Any conventional proxy simply causes the Tesla app to not connect and does not reveal the endpoints.

I'm wondering how they do the continuous press. Is that simply a client side thing where it aborts if you let go, or is a socket connection actually created between the vehicle and the app?
It would have to be a real-time connection, because the theory was that if you drop your phone or your phone battery dies, the car will stop immediately, because you have no way of stopping the car - short of getting in the way of the car or pressing the door handles or using your keyfob. So the command wouldn't be a POST call anymore.
 
It would have to be a real-time connection, because the theory was that if you drop your phone or your phone battery dies, the car will stop immediately, because you have no way of stopping the car - short of getting in the way of the car or pressing the door handles or using your keyfob. So the command wouldn't be a POST call anymore.

That makes sense, because if the battery died then the phone wouldn't be able to send the abort POST request. Any luck on finding the streaming endpoints? Also it is curious why they switched the trigger_homelink to streaming since that is just a single button press.
 
image.jpeg
Everyone is okay. Got sideswiped by someone trying to pass me on a one lane street on my left while I was making a left turn. My Tesla barely got shifted. The Audi took most of the damage.
 

Attachments

  • image.jpeg
    image.jpeg
    433.8 KB · Views: 100
Status
Not open for further replies.