Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Time to crack her open and get inside the network for AP2

This site may earn commission on affiliate links.
Good work :)

I dug up some photos, and I’ll try to highlight some differences between AP1 and AP2:

The Ethernet DIAG jack – easily accessible below CID – is a Rosenberger D4Z001-000-B (White). AKA the “easy” port or “Toolbox” port. It seems to be identical on AP1 and AP2. Which makes sense, considering that the service centers / rangers frequently have to deal with both configs…

View attachment 248488

The DIAG cable terminates differently on AP1 vs. AP2 cars, however.

On AP1 cars, it feeds directly into the back of CID. The connector on the CID side seems to have changed color at some point, because I’ve seen pictures where it’s white and pictures where it’s blue. Here’s the white one:

View attachment 248489

On AP2 however, the Toolbox cable terminates into the Autopilot 2 ECU (“PX2”). The connector on the ECU side is a Rosenberger D4K20A-1D5A5-D (Bordeaux, or Purple).

View attachment 248490

As you can see from the picture above, the AP2ECU also has a white Rosenberger D4Z001-000-B. This is, according to the wiring diagrams, “Ethernet Gateway”, and connects to the CID.

On the CID side, the socket should be Bordeaux / Purple color

Hey that's my hand in those images! I'm a hand model
 
So, with a heavy heart, I can say the approach I was planning on taking to gain CID access was apparently closed by Tesla with the 8.0 release..... So, a bit of set back their, but we'll find another way in....

Could you maybe tell us more about what you wanted to do ?

That will certainly help others (by showing them what not to do) and it can't help Tesla to annoy us (since they have already closed that particular hole).

It will be an interesting read, at the very least…
 
Could you maybe tell us more about what you wanted to do ?

That will certainly help others (by showing them what not to do) and it can't help Tesla to annoy us (since they have already closed that particular hole).

It will be an interesting read, at the very least…

I will once, I confirm what I believe to be true from my sources. However, at this point I have not confirmed my suspicions myself. However I do very much trust my sources, but just in case since they aren't on the .34 version, I'm going to wait until I recieve my cable and test they closed it off before reporting either way.

But yes, if in fact Tesla did close it off and close the hole, I'll gladly post the method I intended based on my research. I will say this, what I was planning to do is very readable / understandable with a bit of googling, image searching and reading @green1 trail blazing thread.
 
Well...

still-waiting.jpg



For the cable.... :(
 
I won’t likely have much time to work on this until tomorrow... but first things first... let’s make some Ethernet cables!

I bought a Male to Female Z cable from Superbat and chopped it in half. Used punchdown RJ45 connectors as those were what I had on hand (and are a lot easier than crimping on connectors ;-))

Pinout, if my testing is correct is:
Ethernet -> RF cable
Orange -> Brown
O/W -> Blue
Green -> Green
G/W -> Orange

Now I have a cable of each gender to work with :)

06124B68-94FA-46C1-AB0F-0BC53CD78A70.jpeg

I also bought a small managed switch and configured port mirroring so I can (hopefully) MITM some useful traffic now!
 
Glovebox came out pretty easily (this is good experience for replacing the cabin air filter on this car too!)

Connected to the internal network (run going to CID) without much trouble, and see lots of broadcast traffic coming from the CID on the wire now.

Next we try and get in....
 
  • Love
Reactions: lunitiks