Toolbox 3 Gateway Configuration Edit on Model 3 / Y?

[terranx]

Anyone out there know how to do this? As best as I can tell, the menu the tesla techs use (something to the effect of dashboard -> infotainment -> vehicle configuration change) isn't present in the version of toolbox us mere mortals get access to. However, under actions, PROC_ICE_X_SAFE-SET-VEHICLE-CONFIGS is available. The parameters it accepts are ConfigParams (type List) and Configs Require Ice Reboot (presumably yes/no, true/false, 0/1, etc -- can be left blank though I believe).

From what I can tell digging through the app.f5d3cbaebb2ad903a936.js file, this action is what's invoked when making the gateway config changes the official way. I just can't figure out how to format the input. For example I'm trying to change id 32 to 01, and I've tried sending {32, 01} and many variants (with quotes, different brackets, etc), to no avail. I mostly get an error about not being to cast the input as a List.

Anyone out there know what to do or can help with some hints? I can share any other relevant info

 

[WhiteM3P-]

Look into the way python 3 does lists. Odin is a python 3 service. Wish I had access to toolbox to help you with the testing. May look into buying it if you get it to do anything.

 

[WhiteM3P-]

Have you tried:
root[32] = 01?

 

[terranx]

No dice. ValueError('Could not typecast root[32]=01 to List')

What I've been able to determine so far:

If I enter [] or {}, the function runs, but ultimately errors out saying it couldn't update the vehicle configuration (presumably because I'm passing a blank list).

Any of the below it doesn't even get as far as trying to execute anything and I get the noted errors

{32}
description:"AttributeError("'int' object has no attribute 'get'")"
{'32'}
Error: AttributeError("'str' object has no attribute 'get'")
{32,01}
Error: ValueError('Could not typecast {32,01} to List')
{'32','01'}
Error: ValueError("Could not typecast {'32',01} to List")
{32},{01}
Error: ValueError('Could not typecast {32},{01} to List')
{32:01}
Error: ValueError('Could not typecast {32:01} to List')
[{32}]
"ValueError("ScriptTest inputs and outputs must be (<class 'str'>, <class 'int'>, <class 'float'>, <class 'bool'>, <class 'dict'>, <class 'list'>, <enum 'Enum'>)")"

Errors are essentially the same if I used [ ] instead of { }

Not really sure what else I should be trying. A part of me wonders if the browser isn't passing parameters properly and I need to figure out how to invoke the command via console.

 

[WhiteM3P-]

I looked all over the tesla documentation and no mention of this safe-set config procedure anywhere.

 

[terranx]

Yeah I think it's a relatively low level thing. The interface the techs use calls it at the backend.

Digging through the javascript, I think the console command is supposed to look something like

send_network_request({"command":"execute","args":{"name":"Model3/tasks/PROC_ICE_X_SAFE-SET-VEHICLE-CONFIGS","kw":{"configParams":{"configid":32,"data":"01"},configs_require_ice_reboot":null,"ignore_display_state":true,"skip_gtw_state_checks":false}}})

Sending that from the web console on 192.168.90.100:8080 fails due to a token error, even when connected

Attempting to send the command from the actual toolbox tab doesn't work since the whole thing is obfuscated (though could maybe figure out how to do it with some debugging). Attempting to pass the commands through the actions interface doesn't work, but I'm starting to think that the text parser is semi broken for more complex commands

 

[terranx]

Just to close the loop, the correct syntax is

[ {"configid":32,"data":"01"} ]

. Credit to green for the info.

Unfortunately Tesla has this sufficiently locked down that we can’t edit the options that actually interest us. Service center might be able to if you can convince them to try.

It does appear there are methods to get access at a lower level, but none are publicized.

 

[Fahrly]

Recently there was a mobile technician he was using a version of toolbox which we dont have access to. He was able to change the gateway config and set everything he wants.

 

[Fahrly]

does someone know what configid is what for?

7:"06"
8:"01"
9:"00"
10:"03"
11:""
12:"01"
13:"01"
14:"01"
15:"02"
16:"7A"
17:"09"
18:"00"
19:"00"
20:"01"
21:"01"
23:""
24:"01"
25:"01"
26:"01"
27:"01"
28:"02"
29:"04"
30:"02"
31:"01"
32:"02"
33:"00"
34:"01"
35:"03"
36:"04"
41:"16"
42:""
43:"02"
44:"01"
45:"01"
46:"01"
47:"01"
48:"00"
49:"00"
50:"00"
51:"01"
52:"01"
53:"01"
54:"00 00 00 00"
55:"00"
56:"01"
58:"01"
59:"04"
62:"02"
63:"01"
64:"00"
66:"01"
67:"02"
72:"00"
73:"02"
75:"01"
76:"01"

 

[terranx]

does someone know what configid is what for?

7:"06"
8:"01"
9:"00"
10:"03"
11:""
12:"01"
13:"01"
14:"01"
15:"02"
16:"7A"
17:"09"
18:"00"
19:"00"
20:"01"
21:"01"
23:""
24:"01"
25:"01"
26:"01"
27:"01"
28:"02"
29:"04"
30:"02"
31:"01"
32:"02"
33:"00"
34:"01"
35:"03"
36:"04"
41:"16"
42:""
43:"02"
44:"01"
45:"01"
46:"01"
47:"01"
48:"00"
49:"00"
50:"00"
51:"01"
52:"01"
53:"01"
54:"00 00 00 00"
55:"00"
56:"01"
58:"01"
59:"04"
62:"02"
63:"01"
64:"00"
66:"01"
67:"02"
72:"00"
73:"02"
75:"01"
76:"01"

Most of them are in here { "gen3": [ { "accessId": 7, "codeKey": "exteriorColor", - Pastebin.com

 

[Nintendo80]

no update right guys?

 

[Igor7777]

I read somewhere that you can change the configuration not only in the toolbox, but also with the help of a script. I just don't know where to get it and how to use it.

 

[krzakx]

Look into the way python 3 does lists. Odin is a python 3 service.

and this ODIN command needs grant access to different levels, which does works on Tokens mechanism singed by Tesla CA.
Otherwise very likekly root access needed in order to evoke commands.
Goging to watch this thread, maybe somebody of us can share more.

 

[MobileClimate]

Forgot to take screen shot but with 2022.45.15 internal.dat config has been added to toolbox 3

 

[sovereignbat]

anything more on this. Id like to change my gateway config to premium sound and activate footwell lights.

 

[Cyberpower678]

anything more on this. Id like to change my gateway config to premium sound and activate footwell lights.

Did you install additional speakers in your car?

 

[sovereignbat]

I haven't yet. It's a side project that I have not had time for. The thought was to modify one of the cheap speaker activation harnesses and wire the car exactly like the LR with all front speakers coming off the front amp, run the two wires for the a2b protocol to the trunk for the rear amp for the rear speakers. Then edit the config file on the MCU to tell it it's the premium version.

 

[WhiteM3P-]

Has anyone with toolbox gave this another try yet?

 

[terranx]

Has anyone with toolbox gave this another try yet?

I haven't bought toolbox in a while, but I've been keeping an eye on the javascript source, which seems to show which roles can edit which functions. So far tbx-external is showing the following for the 3/Y/Refresh S/X

"coolantpumptype","ecallenabled","forwardradarhw","packperformancedeviation","powerliftgatetype","steeringcolumnmotortype","supermanifoldtype","towpackage","tpmstype","twelvevbatterytype"

Does seem like a team managed to get root access via an unpatchable vulnerability on ryzen cars Unpatchable AMD Chip Flaw Unlocks Paid Tesla Feature Upgrades

But taking the computer out and executing a glitching attack isn't trivial for most of us. But perhaps smarter folks having unpatchable root access will make it easier for them to find software vulnerabilities.

 

[sovereignbat]

Yes, It is a similar process for MCU2 cars we have to take the CPU out and find the CMD, CLK, VSS, and at least a D0 pin and connect it via an SD card reader to a laptop to access the onboard memory. While, jumping the intel cpu to reset.