Successful connection on the Model S internal Ethernet network

[lolachampcar]

I'm all for looking at the Enet side of things. I think there should be more end user support for understanding the car, its systems and diagnostics.

Getting into the CAN side of things will take a bit more care. You can do a lot of harm in a very short period of time there. If they have used FlexRay, you'll likely not have the templates and will be unable to participate on the bus.

The above said, Wifi'd CAN is a neat idea.

 

[Earthdog]

I'd just like a hack for Video on that awesome screen.

 

[nlc]

Getting into the CAN side of things will take a bit more care. You can do a lot of harm in a very short period of time there.

Just sniffing data and try to understand them it not dangerous, but yes, it's more same to not send anything !!
But the car probably have multiple CAN bus !!

 

[wonko]

Um, where exactly is that plug located and how does one get to it?

 

[NigelM]

Mod Note: a number of posts went here - Hacking-the-Model-S-for-evil

 

[widodh]

Um, where exactly is that plug located and how does one get to it?

Open the driver's door and remove the small panel from the dashboard.

There is a white connector.

 

[wonko]

OK, that plug would be a Rosenberger HSD.

 

[araxara]

OK, that plug would be a Rosenberger HSD.

Looks like the Rosenberger HSD e: http://www.rosenberger.com/documents/headquarters_de_en/ba_automotive/AUTO_HSDe_Flyer_2012.pdf

Now to find a source for them....

 

[W.Petefish]

I'll save you the time and trouble. There are several. But they won't release them w/o a corporate agreement and a MOQ.

 

[wk057]

Anyone have a 3D printer and some header pins?

 

[disharmony]

Firefox over X11 op beide schermen. (En ja, je kan dus alles daarover heen trappen, video, etc.)
Ook luisterd het scherm naar een port waar zoals het lijkt audio over heen gaat. Als ik meer tijd heb zal ik kijken of we daar iets zinnigs mee kunnen.

devices: ic, cid, en gw: vermoedelijk center console (cid/100), scherm achter het stuur (ic/101) en ik vermoed een canbus gateway (gw/102).

Voor de genen die het opmerken, het display achter het stuur is 180 graden gedraaid en het center display 90 graden.

Gr,

Disharmony.

 

[LuckyLuke]

Nice progress, maybe that audio listen port is for voice commands?

 

[wonko]

Awesome! As this is X11, the touch interface should at least return clicks and drags to the app as well. Perfect. X11 has some nice features such as shaped windows that remain on top. This would allow us to draw new interface elements onto the existing Tesla screen. Depending on the implementation, X11 may allow even screen grabs.

 

[lolachampcar]

rut ro

 

[matbl]

Firefox over X11 op beide schermen. (En ja, je kan dus alles daarover heen trappen, video, etc.)
Ook luisterd het scherm naar een port waar zoals het lijkt audio over heen gaat. Als ik meer tijd heb zal ik kijken of we daar iets zinnigs mee kunnen.

devices: ic, cid, en gw: vermoedelijk center console (cid/100), scherm achter het stuur (ic/101) en ik vermoed een canbus gateway (gw/102).


Voor de genen die het opmerken, het display achter het stuur is 180 graden gedraaid en het center display 90 graden.

Gr,

Disharmony.

And in English?

 

[doctorwho]

And in English?

from Google translate:
Firefox about x 11 on both screens. (And Yes, you can so all over stairs, video, etc.)
Also located the screen to a port where as it seems audio about go. When I have more time I'll see if we can something sensible.

devices: ic, cid, and gw: presumably center console (cid/100), screen behind the wheel (ic/101) and I suspect a canbus gateway (gw/102).

 

[disharmony]

Sorry for the fact that my post was in Dutch, I was still half a sleep.

Anyway, for anyone interested Ill share some additional information.

xlsclients output for both "display" devices:

IC (.101)
ic /usr/tesla/UI/bin/QtCarNavServer --gw 192.168.90.102 --isic --ic --rotate 180 --audio 192.168.90.100:4102 --nkconf /var/navigon/NaviKernelConf.ini
ic /usr/tesla/UI/bin/QtCarNavServer --gw 192.168.90.102 --isic --ic --rotate 180 --audio 192.168.90.100:4102 --nkconf /var/navigon/NaviKernelConf.ini
ic /usr/tesla/UI/bin/QtCarCluster --isic --ic --abs-speed --cid 192.168.90.100 --gw 192.168.90.102 --udp :20101 --ip 192.168.90.101 --rate 60 --rotate 180 --car ModelS --fps

CID (.100)

cid /usr/tesla/UI/bin/QtCarBrowser --gw 192.168.90.102 --udp :20101 --ip 192.168.90.100
cid /usr/tesla/UI/bin/QtCar --cid --abs-speed --ic 192.168.90.101 --gw 192.168.90.102 --udp :20101 --ip 192.168.90.100 cid --rotate -90 --rate 55 --fps --touch usb --car ModelS

Xdpyinfo for CID + IC

IC: (display behind steering wheel)
name of display: 192.168.90.101:0
version number: 11.0
vendor string: The X.Org Foundation
vendor release number: 10900000
X.Org version: 1.9.0
maximum request size: 16777212 bytes
motion buffer size: 256
bitmap unit, bit order, padding: 32, LSBFirst, 32
image byte order: LSBFirst
number of supported pixmap formats: 7
supported pixmap formats:
depth 1, bits_per_pixel 1, scanline_pad 32
depth 4, bits_per_pixel 8, scanline_pad 32
depth 8, bits_per_pixel 8, scanline_pad 32
depth 15, bits_per_pixel 16, scanline_pad 32
depth 16, bits_per_pixel 16, scanline_pad 32
depth 24, bits_per_pixel 32, scanline_pad 32
depth 32, bits_per_pixel 32, scanline_pad 32
keycode range: minimum 8, maximum 255
focus: window 0x20000f, revert to Parent
number of extensions: 26
BIG-REQUESTS
Composite
DAMAGE
DOUBLE-BUFFER
DPMS
Generic Event Extension
GestureExtension
MIT-SCREEN-SAVER
MIT-SHM
RANDR
RECORD
RENDER
SECURITY
SHAPE
SYNC
TEGRA-EGL
X-Resource
XC-MISC
XFIXES
XFree86-VidModeExtension
XINERAMA
XInputExtension
XKEYBOARD
XTEST
XVideo
XVideo-MotionCompensation
default screen number: 0
number of screens: 1


screen #0:
dimensions: 1280x480 pixels (338x127 millimeters)
resolution: 96x96 dots per inch
depths (7): 24, 1, 4, 8, 15, 16, 32
root window id: 0x47
depth of root window: 24 planes
number of colormaps: minimum 1, maximum 1
default colormap: 0x20
default number of colormap cells: 256
preallocated pixels: black 0, white 16777215
options: backing-store NO, save-unders NO
largest cursor: 64x64
current input event mask: 0x404030
EnterWindowMask LeaveWindowMask KeymapStateMask
PropertyChangeMask
number of visuals: 2
default visual id: 0x21
visual:
visual id: 0x21
class: TrueColor
depth: 24 planes
available colormap entries: 256 per subfield
red, green, blue masks: 0xff0000, 0xff00, 0xff
significant bits in color specification: 8 bits
visual:
visual id: 0x45
class: TrueColor
depth: 32 planes
available colormap entries: 256 per subfield
red, green, blue masks: 0xff0000, 0xff00, 0xff
significant bits in color specification: 8 bits


CID (.100) (big 17" display)
name of display: 192.168.90.100:0
version number: 11.0
vendor string: The X.Org Foundation
vendor release number: 10900000
X.Org version: 1.9.0
maximum request size: 16777212 bytes
motion buffer size: 256
bitmap unit, bit order, padding: 32, LSBFirst, 32
image byte order: LSBFirst
number of supported pixmap formats: 7
supported pixmap formats:
depth 1, bits_per_pixel 1, scanline_pad 32
depth 4, bits_per_pixel 8, scanline_pad 32
depth 8, bits_per_pixel 8, scanline_pad 32
depth 15, bits_per_pixel 16, scanline_pad 32
depth 16, bits_per_pixel 16, scanline_pad 32
depth 24, bits_per_pixel 32, scanline_pad 32
depth 32, bits_per_pixel 32, scanline_pad 32
keycode range: minimum 8, maximum 255
focus: window 0x20000f, revert to Parent
number of extensions: 26
BIG-REQUESTS
Composite
DAMAGE
DOUBLE-BUFFER
DPMS
Generic Event Extension
GestureExtension
MIT-SCREEN-SAVER
MIT-SHM
RANDR
RECORD
RENDER
SECURITY
SHAPE
SYNC
TEGRA-EGL
X-Resource
XC-MISC
XFIXES
XFree86-VidModeExtension
XINERAMA
XInputExtension
XKEYBOARD
XTEST
XVideo
XVideo-MotionCompensation
default screen number: 0
number of screens: 1


screen #0:
dimensions: 1920x1200 pixels (369x230 millimeters)
resolution: 132x133 dots per inch
depths (7): 24, 1, 4, 8, 15, 16, 32
root window id: 0x68
depth of root window: 24 planes
number of colormaps: minimum 1, maximum 1
default colormap: 0x20
default number of colormap cells: 256
preallocated pixels: black 0, white 16777215
options: backing-store NO, save-unders NO
largest cursor: 64x64
current input event mask: 0x404030
EnterWindowMask LeaveWindowMask KeymapStateMask
PropertyChangeMask
number of visuals: 2
default visual id: 0x21
visual:
visual id: 0x21
class: TrueColor
depth: 24 planes
available colormap entries: 256 per subfield
red, green, blue masks: 0xff0000, 0xff00, 0xff
significant bits in color specification: 8 bits
visual:
visual id: 0x66
class: TrueColor
depth: 32 planes
available colormap entries: 256 per subfield
red, green, blue masks: 0xff0000, 0xff00, 0xff
significant bits in color specification: 8 bits



So there is some interesting information here perhaps (like versions, display info, tegra, etc).

Furthermore as already mentioned by others, there is a lot of UDP broadcasting which I think includes CANbus messages.

When I have more time Ill poison the arp tables of the devices, reroute and sniff all the traffic to see if there is more interesting stuff that we can find out or do.

 

[Martini]

Some interesting stuff here on LIN bus hacking from TMC member Otmar: Parts, Seat and LIN Hacking, Video Update #3 | Stretchla Blog At about the 7 minute mark in the video, or you could just read the text below.

 

[MrDude_1]

This is all pretty cool, but I thought I would throw in there one thought...
The hardware updates can come over the air. This is probably via Ethernet, with some part of the car converting from Ethernet to CAN.
Techs may need to update the hardware on site. This is probably via THAT Ethernet port. As far as I know there is no CAN port.

So it really is likely you COULD force an actual firmware update via this port.

 

[lolachampcar]

yes and I suspect there is a CAN gateway attached to the OBDii plug that would allow CAN access as well. Given that Tesla is more computer than car company, I suspect they prefer to work in Enet and not in CAN.