Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Successful data recovery of broken eMMC chip MCU1

This site may earn commission on affiliate links.
Imagine Tesla engineers are cringing when they read what creative independent individuals and companies are trying to do on these cars.

It's a fact that Tesla offers the worst possible service to independent repairers/operators in the whole automotive world.
I don't know any other company that refuses the access to diagnostic software, tools and parts in that way.
 
If you still have the old EMMC a recovery might be possible via direct NAND access by someone who does flash data recovery.
I learned in TFF forum that one austrian guy managed to force tesla into providing the VPN and Certificate data by pointing towards EU anti-trust regulations related to 3rd-party car repair shops (point 15 in this document https://ec.europa.eu/competition/sectors/motor_vehicles/legislation/mv_faq_en.pdf ). But in the US that will unfortunately not help you...
I shipped my old eMMC to Poland to see if they could do NAND direct recovery. If I'm recovering all 0s, I'll be surprised if they find anything different. But here's hoping.
 
  • Like
Reactions: Word42
Here's Tesla's response to my request to get my keys put back on through them:
 

Attachments

  • TeslaService.JPG
    TeslaService.JPG
    44.2 KB · Views: 214
Tried the MCU with p1 and p2 restored and p3 and p4 empty save for apn-file and folders. MCU did not start up, tried the steering wheel reboot methods a couple of times. Desoldered the new emmc again today to verify i didn't damage it while soldering it. It was fine. Read the syslog file created on p3 which contained over a million lines of squashfs read errors. Turns out that p1/p2 wasn't ok after all. Unsquashfs confirms that they are toast (i should have tried this before..).
Any ideas on getting MCU operational without intact p1/p2?
 
The way I understand it, older Instrument Clusters have p1/p2 on their eMMC as well. Speaking of, anybody willing to remove an eMMC from a daughterboard for me? I pulled apart an IC that I replaced a long time back, curious what's on the chip, but I haven't ever tried pulling off a chip and I'd rather not f' it up. I'm located near El Paso, willing to ship and also willing to pay.
 
Hi folks,

finally I am able to report that my recovery (albeit delayed somewhat) was successful. I accessed the eMMC again last week (this time using 1-Bit mode - because I was lazy and thought 3 wires + supply are enough soldering this time) and installed the openvpn credentials and mcu_commands_key (recovered within 1 weeks time by multi-com.eu).
My car now reports back to mothership, is accessible via the app for the first time since february, my spotify songlist was restored (most important ;) ) and the update for the current version is pending.

I wish to express my gratitude to everyone around who supported me in this quest.
 
I shipped my old eMMC to Poland to see if they could do NAND direct recovery. If I'm recovering all 0s, I'll be surprised if they find anything different. But here's hoping.

Any updates on this? I was just about to contact them to get my keys from the chip.

I have the same issue: only zeros. The new chip is already changed with default sw without the keys.
 
My mail got stuck in Chicago for about 12 days. Looks like it just got to Germany, hopefully Poland in the next day or so.

Note: For EU members, you may have better luck fighting Tesla for your certificates, since you can claim that they're making it impossible for third party repairs.