Successful connection on the Model S internal Ethernet network

Chipper · Mar 2, 2014

Plug Me In said:
Wow, I would have about the same level of comprehension for this thread if it were in Finnish.

I don't think it's finished yet though.

jerry33 · Mar 2, 2014

nlc said:
Now I need to write a UDP client software to receive data frame and begin the content analyzing

Couldn't you just use snoop to capture the data?

nlc · Mar 2, 2014

I captured a lot of frame with tcpdump, but now I want to write my own receive program because it's easiest for me to try to understand the data format, convert it and print it in real time after program compilation.

Here are some frame data sent by the center console :

VehiclePowerStatus
VehicleVolatile2
Vehicle
VehicleStateBasics
RADIOText
VehicleConfig
HOMELINKData
RADIOData
RADIODiag
RADIOVersions
RADIOAMFM
RADIOEU
RADIOXM
RADIODAB
RADIOTrafic
ScheduleData
VehicleLowLatencyIndicator
RlsData
VehicleIndicators
AudioState
AudioBasicEqualizerGain
AudioLevels
NetStatus
CellStatus (it's not cell from pack but 3G cell, ie modem internet connection status)
CellStatusExtended (same)
CellDateTime
LinkStatus
GUIMapSessionTesting
GUIOptions
GUIData
GUIChargeSession
GUIShadowForIC
GUIScheduledCharging
GUIScheduledManager
GUIMedia
GUIRunState
CenterDisplayRadioStats
CenterDisplayNetStats
MediaServerInfo
MediaServerStatus
ParrotInfo
WifiStatusMessage
WifiLatchedStatusMessage
BluetoothState
PhoneInfo
EVRecentWHPM
EVTripData
BrowserNetStats
MediaSettings
MediaServerNetStats
NetStatus
PowerState
PowerRequests
ParrotPowerState
DVSM_VehicleVolatileBasics
CANSignalData

AnOutsider · Mar 2, 2014

looks like you can indeed get power state. We've seen before in the diagnostic screens that more information about battery state is available. As mentioned, would help in the various "capacity" discussions here.

nlc · Mar 2, 2014

I think the power state is the power data used by the dashboard to display the power value, the power limitation or regen limitation, etc...
I don't think there is the capacity left in the pack in this frame :/

lolachampcar · Mar 2, 2014

Very nice work.... Staying tuned

pgiralt · Mar 2, 2014

Can you post a Wireshark/tcpdump capture of the data for others to take a look? We could write a wireshark dissector to decode it instead of having to write an application to do it.

Chris Naps · Mar 2, 2014

This is very cool, but also scary. Does this void any warranty??? Lets say perhaps you created a new layout of the dashboard or touch screen - is that possible to upload it via the port?

tom66 · Mar 2, 2014

@chris that would require replacing the application currently running on the touchscreen/cluster with a custom designed one, which would be a challenge if the filesystem is static/readonly like I've been led to believe.

As for warranties, isn't their a clause in most of them which only voids the particular warranty, in this case, on the touchscreen/cluster, if you FUBAR them. Rather than the whole car, that is.

wk057 · Mar 2, 2014

Very nice. Do you have a pinout for the adapter you made? Wouldn't mind tinkering myself.

Jason S · Mar 2, 2014

pgiralt said:
Can you post a Wireshark/tcpdump capture of the data for others to take a look? We could write a wireshark dissector to decode it instead of having to write an application to do it.

This. ^^ Just reuse existing tech.
... Although I understand just wanting to use your own program; you then know you aren't missing anything and it is the first step on a custom diagnostic screen anyhow.

Pate · Mar 2, 2014

Plug Me In said:
Wow, I would have about the same level of comprehension for this thread if it were in Finnish.

Hey, me too! :wink:

nlc · Mar 3, 2014

wk057 said:
Very nice. Do you have a pinout for the adapter you made? Wouldn't mind tinkering myself.

Pinout :

it seems there is no auto MDX, if pair are inverted the ethernet link doesn't work.

- - - Updated - - -

pgiralt said:
Can you post a Wireshark/tcpdump capture of the data for others to take a look? We could write a wireshark dissector to decode it instead of having to write an application to do it.

There are personal data in some frame, in doubt I prefer to not post a capture here. Or just this frame, I think there is nothing personal :

PHP:

17:40:57.937350 IP 192.168.90.100.36639 > 192.168.90.255.4031: UDP, length 1202
    0x0000:  4500 04ce 0000 4000 4011 ff6a c0a8 5a64  [email protected]@..j..Zd
    0x0010:  c0a8 5aff 8f1f 0fbf 04ba 47b7 0000 0000  ..Z.......G.....
    0x0020:  0000 0090 0000 000a 0000 0000 2200 5600  ............".V.
    0x0030:  6500 6800 6900 6300 6c00 6500 4900 6e00  e.h.i.c.l.e.I.n.
    0x0040:  6400 6900 6300 6100 7400 6f00 7200 7300  d.i.c.a.t.o.r.s.
    0x0050:  0000 0a00 0000 0010 0036 0032 0037 0064  .........6.3.7.e
    0x0060:  0038 0063 0032 0065 0000 0002 0000 0000  .5.c.2.e........
    0x0070:  0000 0000 0100 0000 0000 0200 0000 0000  ................
    0x0080:  0000 0001 0000 0000 0002 0000 0000 0000  ................
    0x0090:  0000 0100 0100 0000 0100 0100 0000 0600  ................
    0x00a0:  402a 0000 0000 0000 0000 0006 0040 2b7b  @*[email protected]+{
    0x00b0:  7b80 0000 0000 0000 0100 0000 0000 0001  {...............
    0x00c0:  ffff ffff 0000 0000 01ff ffff ff00 0000  ................
    0x00d0:  0001 ffff ffff 0000 0000 01ff ffff ff00  ................
    0x00e0:  0000 0001 ffff ffff 0000 0000 01ff ffff  ................
    0x00f0:  ff00 0000 0001 ffff ffff 0000 0000 01ff  ................
    0x0100:  ffff ff00 0000 0001 ffff ffff 0000 0000  ................
    0x0110:  01ff ffff ff00 0000 0001 ffff ffff 0000  ................
    0x0120:  0000 01ff ffff ff00 0000 0001 ffff ffff  ................
    0x0130:  0000 0000 01ff ffff ff00 0000 0001 ffff  ................
    0x0140:  ffff 0000 0001 0000 0000 0002 0000 0000  ................
    0x0150:  0000 0000 0200 0000 0002 0000 0002 0000  ................
    0x0160:  0000 0300 0000 0100 0000 0000 0100 0000  ................
    0x0170:  0000 0100 0000 0000 0100 0000 0000 0100  ................
    0x0180:  0000 0000 0100 0000 0000 0100 0000 0000  ................
    0x0190:  0100 0000 0000 0100 0000 0000 0100 0000  ................
    0x01a0:  0000 0200 0000 0000 0000 0001 0000 0000  ................
    0x01b0:  0001 0000 0000 0002 0000 0000 0000 0000  ................
    0x01c0:  0200 0000 0000 0000 0002 0000 0000 0000  ................
    0x01d0:  0000 0100 0000 0000 0100 0000 0000 0001  ................
    0x01e0:  ffff ffff 0000 0000 01ff ffff ff00 0000  ................
    0x01f0:  0100 0000 0000 0100 0000 0000 0100 0000  ................
    0x0200:  0000 0100 0000 0000 0100 0000 0000 0100  ................
    0x0210:  0000 0000 0100 0000 0000 0200 0000 0000  ................
    0x0220:  0000 0000 01ff ffff ff00 0000 0001 ffff  ................
    0x0230:  ffff 0000 0001 0000 0000 0001 0000 0000  ................
    0x0240:  0002 0000 0000 0000 0000 0200 0000 0000  ................
    0x0250:  0000 0002 0000 0000 0000 0000 0200 0000  ................
    0x0260:  0000 0000 0002 0000 0000 0100 0000 0200  ................
    0x0270:  0000 0001 0000 0002 0000 0000 0000 0000  ................
    0x0280:  0200 0000 0000 0000 0002 0000 0000 0000  ................
    0x0290:  0000 0200 0000 0000 0000 0002 0000 0000  ................
    0x02a0:  0000 0000 0200 0000 0000 0000 0002 0000  ................
    0x02b0:  0000 0000 0000 0200 0000 0000 0000 0002  ................
    0x02c0:  0000 0000 0000 0000 0200 0000 0000 0000  ................
    0x02d0:  0002 0000 0000 0000 0000 0200 0000 0000  ................
    0x02e0:  0000 0002 0000 0000 0000 0000 0200 0000  ................
    0x02f0:  0000 0000 0002 0000 0000 0000 0000 0200  ................
    0x0300:  0000 0000 0000 0002 0000 0000 0000 0000  ................
    0x0310:  0200 0000 0000 0000 0002 0000 0000 0000  ................
    0x0320:  0000 0200 0000 0000 0000 0001 0001 0000  ................
    0x0330:  0002 0000 0000 0000 0000 0200 0000 0000  ................
    0x0340:  0000 0001 0000 0000 0001 0000 0000 0001  ................
    0x0350:  0000 0000 0001 0000 0000 0001 0000 0000  ................
    0x0360:  0002 0000 0000 0000 0000 0100 0000 0000  ................
    0x0370:  0100 0000 0000 0100 0000 0000 0200 0000  ................
    0x0380:  0000 0000 0001 0000 0000 0000 01ff ffff  ................
    0x0390:  ff00 0000 0001 ffff ffff 0000 0000 01ff  ................
    0x03a0:  ffff ff00 0000 0001 ffff ffff 0000 0000  ................
    0x03b0:  01ff ffff ff00 0000 0001 ffff ffff 0000  ................
    0x03c0:  0000 01ff ffff ff00 0000 0001            ......

- - - Updated - - -

Chris Naps said:
This is very cool, but also scary. Does this void any warranty???

Just reading data will not because there is no modification of the car to do

Chris Naps said:
Lets say perhaps you created a new layout of the dashboard or touch screen - is that possible to upload it via the port?

Cannot answer, don't know what we can do through the ethernet port. Without SSH login/password it is impossible to get a console and enter the system.

widodh · Mar 3, 2014

This is nice! Hooking in here

Have you tried to list the nfs mounts on the server? Maybe there is some data in there?

Maarten · Mar 3, 2014

widodh said:
This is nice! Hooking in here Have you tried to list the nfs mounts on the server? Maybe there is some data in there?

Yeah people! This is great. Hack into the car and spread the news!
Can't wait till someone will use that data to break into my car, attach a little electronic box, disable all tracking abilities and drive away!.... Great work! Thanks in advance.

nlc · Mar 3, 2014

widodh said:
This is nice! Hooking in here Have you tried to list the nfs mounts on the server? Maybe there is some data in there?

I know they can do a firmware upgrade through ethernet, thus I tnink they send the file by mounting the NFS. I tried to mount the disk but it doesn't work, need a valid login/password...

widodh · Mar 3, 2014

Maarten said:
Yeah people! This is great. Hack into the car and spread the news!
Can't wait till someone will use that data to break into my car, attach a little electronic box, disable all tracking abilities and drive away!.... Great work! Thanks in advance.

You don't get the point. We do this in public to gather data, somebody else will do this in private to try to steal the car.

If I find a serious security issue I'll report it to Tesla. I'm not trying to break the car, just trying to learn what we can find and report back to Tesla if something serious is found.

nlc said:
I know they can do a firmware upgrade through ethernet, thus I tnink they send the file by mounting the NFS. I tried to mount the disk but it doesn't work, need a valid login/password...

So it was NFSv4 with Kerberos? Have you tried NFSv3?

What was the mountpoint on which server?

nlc · Mar 3, 2014

widodh said:
So it was NFSv4 with Kerberos? Have you tried NFSv3?

What was the mountpoint on which server?

Don't know, I just tried these command line :

mount -t nfs 192.168.90.100:/ /home/nlc/partage/
mount -t nfs 192.168.90.100:/home /home/nlc/partage/

We also probably need to know the path of the NFS directory on the device

nlc · Mar 3, 2014

nlc said:
We also probably need to know the path of the NFS directory on the device

Just discovered the showmount command, will try to see which directory are shared on the central console !

brianstorms · Mar 3, 2014

This is a great thread. Glad to see folks are exploring the car's systems. Can't wait to learn everything we can about the systems' capabilities.

Successful connection on the Model S internal Ethernet network

Active Member

(S85-3/2/13 traded in) X LR: F2611##-3/27/20

Member

S532 # XS27

Member

Well-Known Member

Supporting Member

Member

Member

Senior Tinkerer

Model S Sig Perf (P85)

Member

Member

Model S 85 and 100D

Active Member

Member

Model S 85 and 100D

Member

Member

Member

Similar threads