Yeah I intend to post whatever I figure out publicly.
Digging through the javascript files, "PROC_ICE_X_SAFE-SET-VEHICLE-CONFIGS" does seem to be the action the service/dealer level toolbox interface calls when using the gateway change interface. So while we don't get the pretty gui, we do seem to have access to the actual command.
The input is where I'm stuck. When digging through the vehicle configuration function in the javascript (even though we don't have front end access to the interface, the code that generates it seems to be present in the js files), I can find this relevant excerpt: (my best attempt at making it semi-readable - everything is on a single line by default)
Code:
onSaveChanges: function () {
return e(function (e, t) {
var r = t(), n = r.odin, o = r.user, a = n.connection.params, i = a.host, s = a.platform, c = o.username, l = Object.values(n.config.changes), u = Object(sl.p)(s), d = lG(u), p = "gen3" === Object(mC.d)(u).gen, f = l.map(function (e) {
var t = e.accessId, r = e.value;
return p ? {configid: t, data: r.toString(16).padStart(2, "0")} : [t.toLowerCase(), r, c];
The code is somewhat obfuscated, but from what I can gather, if the car is a model3/y, the parameter passed to the function is {configid: t, data: r.toString(16).padStart(2, "0")}. While if it's a (presumed legacy) s/x, the parameter passed is [t.toLowerCase(), r, c] which translates to accessId, value, username. This actually does correspond to the method described in the script on the
model S jailbreak page
I tried {32, 01} and every possible iteration with and without quotation, spaces, different bracket types etc. And I largely get an error about the input not being able to be cast as a List.
Now where I can see a potential issue is that it's not t(accessId) and r(value) being passed to the model 3 function, it's configid: t, and data: r -- which to me suggests the actual parameters are being retrieved from a dictionary and then passed, But so far I have not had luck tracking that down.