Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Successful data recovery of broken eMMC chip MCU1

This site may earn commission on affiliate links.
Hello, does someone has an mmc pinout from IC Tegra board? I have bricked IC after sw update... Thanks
1692094558861.png
 
  • Like
Reactions: Akikiki and chrisro
"
Yes exactly. Thanks
Here you go, if this is what you meant by mmc pinout:
 
Here you go, if this is what you meant by mmc pinout:
Instrument cluster is different than CID
 
They are not encrypted... you'd need the car.crt and car.key pair. If you have these two files, I can verify them for you.
They seems they are not in the p3, i think they are in the RAM and when the IC is powered up, they are placed in the p3 filesystem.
We have read the firmware with ISP, which seems to be mismatched it. If you know where are car.crt and car.key in the RAM, it will be helpful.
 
They seems they are not in the p3, i think they are in the RAM and when the IC is powered up, they are placed in the p3 filesystem.
We have read the firmware with ISP, which seems to be mismatched it. If you know where are car.crt and car.key in the RAM, it will be helpful.
How are you reading the ram?

They are on the CID not the IC.

They are in /var/etc/openvpn/car.crt and /var/etc/openvpn/car.key on the CID
where /var is p3
so...
<p3 mountpoint>/etc/openvpn/car.crt
<p3 mountpoint>/etc/openvpn/car.key

openvpn isn't used anymore but that's still the path.

that is unless you're running some super super old firmware... in which case the certs are sure to be expired.
 
Can someone help me to restore my certificates and keys from the IC firmware. I have already have the dump, but it seems that the keys and certs are 'encrypted' maybe?
The key you found is for RSA testing. This is not the key to your car. Below is the key you found and the matching certificate for your information. You can google parts of it and find this RSA pair used quite a bit.

Code:
-----BEGIN RSA TESTING KEY-----
MIICXgIBAAKBgQDuLnQAI3mDgey3VBzWnB2L39JUU4txjeVE6myuDqkM/uGlfjb9
SjY1bIw4iA5sBBZzHi3z0h1YV8QPuxEbi4nW91IJm2gsvvZhIrCHS3l6afab4pZB
l2+XsDulrKBxKKtD1rGxlG4LjncdabFn9gvLZad2bSysqz/qTAUStTvqJQIDAQAB
AoGAGRzwwir7XvBOAy5tM/uV6e+Zf6anZzus1s1Y1ClbjbE6HXbnWWF/wbZGOpet
3Zm4vD6MXc7jpTLryzTQIvVdfQbRc6+MUVeLKwZatTXtdZrhu+Jk7hx0nTPy8Jcb
uJqFk541aEw+mMogY/xEcfbWd6IOkp+4xqjlFLBEDytgbIECQQDvH/E6nk+hgN4H
qzzVtxxr397vWrjrIgPbJpQvBsafG7b0dA4AFjwVbFLmQcj2PprIMmPcQrooz8vp
jy4SHEg1AkEA/v13/5M47K9vCxmb8QeD/asydfsgS5TeuNi8DoUBEmiSJwma7FXY
fFUtxuvL7XvjwjN5B30pNEbc6Iuyt7y4MQJBAIt21su4b3sjXNueLKH85Q+phy2U
fQtuUE9txblTu14q3N7gHRZB4ZMhFYyDy8CKrN2cPg/Fvyt0Xlp/DoCzjA0CQQDU
y2ptGsuSmgUtWj3NM9xuwYPm+Z/F84K6+ARYiZ6PYj013sovGKUFfYAqVXVlxtIX
qyUBnu3X9ps8ZfjLZO7BAkEAlT4R5Yl6cGhaJQYZHOde3JEMhNRcVFMO8dJDaFeo
f9Oeos0UUothgiDktdQHxdNEwLjQf7lJJBzV+5OtwswCWA==
-----END RSA TESTING KEY-----

-----BEGIN CERTIFICATE-----
MIICEzCCAXygAwIBAgIQMIMChMLGrR+QvmQvpwAU6zANBgkqhkiG9w0BAQsFADAS
MRAwDgYDVQQKEwdBY21lIENvMCAXDTcwMDEwMTAwMDAwMFoYDzIwODQwMTI5MTYw
MDAwWjASMRAwDgYDVQQKEwdBY21lIENvMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
iQKBgQDuLnQAI3mDgey3VBzWnB2L39JUU4txjeVE6myuDqkM/uGlfjb9SjY1bIw4
iA5sBBZzHi3z0h1YV8QPuxEbi4nW91IJm2gsvvZhIrCHS3l6afab4pZBl2+XsDul
rKBxKKtD1rGxlG4LjncdabFn9gvLZad2bSysqz/qTAUStTvqJQIDAQABo2gwZjAO
BgNVHQ8BAf8EBAMCAqQwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUw
AwEB/zAuBgNVHREEJzAlggtleGFtcGxlLmNvbYcEfwAAAYcQAAAAAAAAAAAAAAAA
AAAAATANBgkqhkiG9w0BAQsFAAOBgQCEcetwO59EWk7WiJsG4x8SY+UIAA+flUI9
tyC4lNhbcF2Idq9greZwbYCqTTTr2XiRNSMLCOjKyI7ukPoPjo16ocHj+P3vZGfs
h1fIw3cSS2OolhloGw/XM6RWPWtPAlGykKLciQrBru5NAPvCMsb/I1DAceTiotQM
fblo6RBxUQ==
-----END CERTIFICATE-----
 
Last edited:
In my case the eMMC from the CID is dead and i`m unable to restore the keys from it. The only option is to find them in the IC dump, as someone in the thread mention that they are also there. Is it possible to fin them in IC dump?
you won't find them in the IC dump... at least not on firmware recent enough where the keys would still be valid. The certs expire after 2years if not renewed and firmware old enough to keep keys on the IC would be too old to be renewing. They don't exist on the IC at all.

You can mail me the dead eMMC from the CID or the Tegra board if the eMMC is still mounted. I've been reasonably successful at recovering them.

I'd only charge anything if I was successful in recovering the certs.
 
you won't find them in the IC dump... at least not on firmware recent enough where the keys would still be valid. The certs expire after 2years if not renewed and firmware old enough to keep keys on the IC would be too old to be renewing. They don't exist on the IC at all.

You can mail me the dead eMMC from the CID or the Tegra board if the eMMC is still mounted. I've been reasonably successful at recovering them.

I'd only charge anything if I was successful in recovering the certs.
At the end the eMMC chip was physically damaged (don ask me why :( ) . So is there any other option to restore the keys?
 
At the end the eMMC chip was physically damaged (don ask me why :( ) . So is there any other option to restore the keys?
None that I'm aware of.

I've been working on a 3rd-party web-based app replacement for CIDs running older firmware (2020.36 and earlier) for vehicles that for whatever reason no longer have valid keys.

What firmware are you running? or is the vehicle even running at this point?

Alternative would be to somehow get Tesla to generate and install a new set of keys. I'm very interested in knowing what the process is to make this happen. There must be a procedure to have a new SSL cert/key installed by Tesla. They would need to do this when performing the eMMC 8gb to 64gb tegra replacement. I'm sure it would require physically bringing the vehicle into a service center, but if I brought my car in asking for new SSL keys, I have the feeling they'd just look at me funny and say "what???"

In the event you've never had the 8gb recall done... just bring it in for that and your missing key issue should be resolved in the process.
 
None that I'm aware of.

I've been working on a 3rd-party web-based app replacement for CIDs running older firmware (2020.36 and earlier) for vehicles that for whatever reason no longer have valid keys.

What firmware are you running? or is the vehicle even running at this point?

Alternative would be to somehow get Tesla to generate and install a new set of keys. I'm very interested in knowing what the process is to make this happen. There must be a procedure to have a new SSL cert/key installed by Tesla. They would need to do this when performing the eMMC 8gb to 64gb tegra replacement. I'm sure it would require physically bringing the vehicle into a service center, but if I brought my car in asking for new SSL keys, I have the feeling they'd just look at me funny and say "what???"

In the event you've never had the 8gb recall done... just bring it in for that and your missing key issue should be resolved in the process.
The car is not running at the moment, as the eMMC of CID MCU needs to be replaced, once we have solution for the keys. In the dump of the IC we found only mismatched certs/keys and we are not sure how to proceed with the dump. Currently the only option is to load latest firmware and hope that the car is running, at least. Than maybe we will try to contact Tesla service center in Romania, as here in Bulgaria we don't have one :( . Any ideas will be greatly appreciated.