Toolbox 3 Gateway Configuration Edit on Model 3 / Y?

[terranx]

Anyone out there know how to do this? As best as I can tell, the menu the tesla techs use (something to the effect of dashboard -> infotainment -> vehicle configuration change) isn't present in the version of toolbox us mere mortals get access to. However, under actions, PROC_ICE_X_SAFE-SET-VEHICLE-CONFIGS is available. The parameters it accepts are ConfigParams (type List) and Configs Require Ice Reboot (presumably yes/no, true/false, 0/1, etc -- can be left blank though I believe).

From what I can tell digging through the app.f5d3cbaebb2ad903a936.js file, this action is what's invoked when making the gateway config changes the official way. I just can't figure out how to format the input. For example I'm trying to change id 32 to 01, and I've tried sending {32, 01} and many variants (with quotes, different brackets, etc), to no avail. I mostly get an error about not being to cast the input as a List.

Anyone out there know what to do or can help with some hints? I can share any other relevant info

 

[kodenco]

Reading through this thread and trying to absorb as much info as possible. Is there any documentation in terms of what config Ids are locked down and what aren't? Trying to figure out if I can modify configID 67 for rearLightType [ {"configid":67,"data":"02"} ], which is heard is not a protected config...but not sure if that means I can modify it or not.

 

[WhiteM3P-]

Reading through this thread and trying to absorb as much info as possible. Is there any documentation in terms of what config Ids are locked down and what aren't? Trying to figure out if I can modify configID 67 for rearLightType [ {"configid":67,"data":"02"} ], which is heard is not a protected config...but not sure if that means I can modify it or not.

As far as I know. It's still not possible from the public toolbox.
Unprotected just means any level of tesla tech can change it.
There are a few people who use alternate methods to do this. Not sure what. Also if your car is 2020 or older that parameter is hard coded and won't do anything if you change it the last time I checked.

 

[kodenco]

As far as I know. It's still not possible from the public toolbox.
Unprotected just means any level of tesla tech can change it.
There are a few people who use alternate methods to do this. Not sure what. Also if your car is 2020 or older that parameter is hard coded and won't do anything if you change it the last time I checked.

Car is a 22 so I theoretically should be able to change the config. Was going to try and use one of the alternatives to toolbox to push the raw config, but the one I found so far supposedly wont to let me do it. -_- I’m tempted to buy day access to it just to try anyway.

 

[WhiteM3P-]

Car is a 22 so I theoretically should be able to change the config. Was going to try and use one of the alternatives to toolbox to push the raw config, but the one I found so far supposedly wont to let me do it. -_- I’m tempted to buy day access to it just to try anyway.

Keep us posted if you end up trying it. Curious to see if it works..

 

[WhiteM3P-]

Does anyone know the file and file path of where these configurations are stored? Is this something accessible through the tesla shell?

 

[terranx]

Car is a 22 so I theoretically should be able to change the config. Was going to try and use one of the alternatives to toolbox to push the raw config, but the one I found so far supposedly wont to let me do it. -_- I’m tempted to buy day access to it just to try anyway.

I wasn't successful and pushing the raw config - those seem to be protected at the same level as the GUI configuration. I haven't tried in a while, but no reason to suspect this has changed.

If I'm reading the javascript correctly, the allowed changes for public access are:

coolantpumptype","ecallenabled","forwardradarhw","packperformancedeviation","powerliftgatetype","steeringcolumnmotortype","supermanifoldtype","towpackage","tpmstype","twelvevbatterytype

One thing I'm curious about is if USS sensors can be retrofitted on the newer cars. Toying with the idea of getting myself a Plaid with the current prices, but don't want to be stuck with Tesla vision

 

[MobileClimate]

You can connect remotely to your car now if you you have legit business with insurance

 

[WhiteM3P-]

I wasn't successful and pushing the raw config - those seem to be protected at the same level as the GUI configuration. I haven't tried in a while, but no reason to suspect this has changed.

If I'm reading the javascript correctly, the allowed changes for public access are:

coolantpumptype","ecallenabled","forwardradarhw","packperformancedeviation","powerliftgatetype","steeringcolumnmotortype","supermanifoldtype","towpackage","tpmstype","twelvevbatterytype

One thing I'm curious about is if USS sensors can be retrofitted on the newer cars. Toying with the idea of getting myself a Plaid with the current prices, but don't want to be stuck with Tesla vision

I believe as of 2023.32.1 some of those setting are also customizable right from the car in service mode.

 

[MobileClimate]

Does any one have a vsp I’d? You need to be a registered as a locksmith a believe ..I’m curious on what there allowing you to do with remote access

 

[kodenco]

Does anyone know the file and file path of where these configurations are stored? Is this something accessible through the tesla shell?

fetching ICE directory contents, I get this:

[
"cgdo",
"checkinternet",
"chromium",
"chromium-adapter",
"chromium-app",
"chromium-fullscreen",
"chromium-odin",
"cid-updater",
"connmetrics",
"dashcam",
"dashcam-viewer",
"ecallclient",
"firmwareinstall",
"godot",
"gpsmanager",
"gst-register",
"hermes-dynamic-triggers",
"hermes-eventlogs",
"ice-updater",
"infohealthd",
"inputmethod",
"lost+found",
"mediaserver",
"monitord",
"odin",
"on-boarding",
"on-boarding-adapter",
"owners-manual",
"owners-manual-adapter",
"qtaudiod",
"qtconnman",
"qtenergymonitor",
"qtpower",
"release-notes",
"release-notes-adapter",
"remote_configs",
"service-ui",
"spotify",
"tesla",
"tesla-cef",
"tmserver",
"tuner",
"tvideo",
"valhalla",
"vaultd",
"video-chat",
"videod",
"webcam",
"wireplumber"
]

 

[kodenco]

Keep us posted if you end up trying it. Curious to see if it works..

Didn't end up working. paid someone with access to a token to make the changes and that worked, but the methodology I posted above is sound. If you have a valid token that gives you access to unprotected/protected variables, you can push config changes using the string I posted in my OP.

I was able to mess with external stuff like ecall and towpackage, but ended up changing the config back to standard as it threw a multitude of errors...probably because ecall isn't supported in the US (probably wouldn't work even if it did enable), and towpackage threw a bunch of light controller missing errors.

I will also note that there appears to be more configurable options that what was outlined in this doc from a while back. Would be curious if anyone had a more updated and complete list.

 

[terranx]

Didn't end up working. paid someone with access to a token to make the changes and that worked, but the methodology I posted above is sound. If you have a valid token that gives you access to unprotected/protected variables, you can push config changes using the string I posted in my OP.

I was able to mess with external stuff like ecall and towpackage, but ended up changing the config back to standard as it threw a multitude of errors...probably because ecall isn't supported in the US (probably wouldn't work even if it did enable), and towpackage threw a bunch of light controller missing errors.

I will also note that there appears to be more configurable options that what was outlined in this doc from a while back. Would be curious if anyone had a more updated and complete list.

This is what's visible in the latest toolbox javascript

{ "gen3":[ { "accessId":7, "codeKey":"exteriorCol - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

Interesting tidbits in that dump is that it seems to confirm the cybertruck will be available in dual motor and 3 motor configs and have adaptive suspension. Also appears that the RGB lighting is limited to model 3, model y, and cybertruck for the time being. Interestingly it does look like it would be able to set the config for the RGB lighting to the pre-highland model 3 (probably because the Chinese model Y is getting those). Might mean a retrofit is feasible.

Curiously in all the versions I've looked at, I don't actually see a configuration setting for the ultrasonics, which makes me wonder if that's being detected live or something. That's one thing I'd be willing to pay good money to retrofit if feasible (my 3 has them, but have a plaid on order)

 

[EESP]

Had a look at this a while ago on a Model Y to try to enable the side marker lights (the amber ones) in the US type front fog lights after retrofitting them to an European Model Y. Looked through everything available and in the code, but did not find anything. The only option I know about is the old "Side markers installed: yes/no" from the old S/X Toolbox 2, which anyway does not apply to Toolbox 3/Model 3/Y. Anyone know if this setting can be entered/changed? It's definitely not a payable option or monitored anyhow, so I still have a small hope that they can be enabled without too much fuzz.

 

[terranx]

Had a look at this a while ago on a Model Y to try to enable the side marker lights (the amber ones) in the US type front fog lights after retrofitting them to an European Model Y. Looked through everything available and in the code, but did not find anything. The only option I know about is the old "Side markers installed: yes/no" from the old S/X Toolbox 2, which anyway does not apply to Toolbox 3/Model 3/Y. Anyone know if this setting can be entered/changed? It's definitely not a payable option or monitored anyhow, so I still have a small hope that they can be enabled without too much fuzz.

Probably need to change accessId 43 ("auxParkLamps") from 02 ("EU") to 01 ("NA_PREMIUM")

Do you have a method for actually editing the gateway configs?

      {
         "accessId":43,
         "codeKey":"auxParkLamps",
         "content":{
            "enums":[
               {
                  "codeKey":"NA_BASE",
                  "description":"Side markers only",
                  "value":0,
                  "products":[
                     "Model3",
                     "ModelY",
                     "Poppyseed"
                  ]
               },
               {
                  "codeKey":"NA_PREMIUM",
                  "description":"Side markers with light pipe as auxiliary park lamps",
                  "value":1,
                  "products":[
                     "Lychee",
                     "Model3",
                     "ModelY",
                     "Poppyseed",
                     "Tamarind"
                  ]
               },
               {
                  "codeKey":"EU",
                  "description":"Light pipe as fog light guide, no side markers",
                  "value":2,
                  "products":[
                     "Lychee",
                     "Model3",
                     "ModelY",
                     "Poppyseed",
                     "Tamarind"
                  ]
               },
               {
                  "codeKey":"NONE",
                  "description":"Plastic inserts instead of lights",
                  "value":3,
                  "products":[
                     "Model3",
                     "ModelY",
                     "Poppyseed"
                  ]
               }
            ]
         },
         "description":"Region-correlated combination of fascia lighting element options",
         "products":[
            "Model3",
            "ModelY",
            "Tamarind",
            "Lychee",
            "Poppyseed"
         ]
      },

 

[EESP]

Probably need to change accessId 43 ("auxParkLamps") from 02 ("EU") to 01 ("NA_PREMIUM")

Do you have a method for actually editing the gateway configs?

      {
         "accessId":43,
         "codeKey":"auxParkLamps",
         "content":{
            "enums":[
               {
                  "codeKey":"NA_BASE",
                  "description":"Side markers only",
                  "value":0,
                  "products":[
                     "Model3",
                     "ModelY",
                     "Poppyseed"
                  ]
               },
               {
                  "codeKey":"NA_PREMIUM",
                  "description":"Side markers with light pipe as auxiliary park lamps",
                  "value":1,
                  "products":[
                     "Lychee",
                     "Model3",
                     "ModelY",
                     "Poppyseed",
                     "Tamarind"
                  ]
               },
               {
                  "codeKey":"EU",
                  "description":"Light pipe as fog light guide, no side markers",
                  "value":2,
                  "products":[
                     "Lychee",
                     "Model3",
                     "ModelY",
                     "Poppyseed",
                     "Tamarind"
                  ]
               },
               {
                  "codeKey":"NONE",
                  "description":"Plastic inserts instead of lights",
                  "value":3,
                  "products":[
                     "Model3",
                     "ModelY",
                     "Poppyseed"
                  ]
               }
            ]
         },
         "description":"Region-correlated combination of fascia lighting element options",
         "products":[
            "Model3",
            "ModelY",
            "Tamarind",
            "Lychee",
            "Poppyseed"
         ]
      },

Thank you so much!

This is a good help.

Now the biggest challenge here - how to actually change this. I used to work for a certain company where I could use my own work computer to do this in a whiff, but I don't do that anymore.

Is there any way to actually do those changes without a whole lot of fuzz?

 

[terranx]

Yeah that's a good question. A few of us got a guy (user Nomisal over here) to do it remotely for a fee - not exactly cheap. There do seem to be some shops scattered around that have the capability to do it, not 100% sure what method they're using.

And I suppose working for a certain company and using your own work computer would also do the trick. If you still have any friends at said company, that might be the way to go.

For Ryzen cars there is apparently a hardware vulnerability that can grant full access to the system, some details of that here https://i.blackhat.com/BH-US-23/Presentations/US-23-Werling-Jailbreaking-Teslas.pdf

 

[ph0ton]

Yeah that's a good question. A few of us got a guy (user Nomisal over here) to do it remotely for a fee - not exactly cheap. There do seem to be some shops scattered around that have the capability to do it, not 100% sure what method they're using.

And I suppose working for a certain company and using your own work computer would also do the trick. If you still have any friends at said company, that might be the way to go.

For Ryzen cars there is apparently a hardware vulnerability that can grant full access to the system, some details of that here https://i.blackhat.com/BH-US-23/Presentations/US-23-Werling-Jailbreaking-Teslas.pdf

Realistically, that's $10k of work, which might even be patched eventually. Voltage glitching internal hardware and loading custom firmware will never be commercially viable.

 

[terranx]

Realistically, that's $10k of work, which might even be patched eventually. Voltage glitching internal hardware and loading custom firmware will never be commercially viable.

I wouldn't say it's $10k worth of work. Initial discovery might have been (or more really), but that's already done. Implementation would not be that different from the xbox360 RGH mod or the current Nintendo switch glitching attacks, both of which can be done with < $100 in hardware. Looks like their own implementation used a Teensy to execute the attack.

The limiting factor is more the commercial interest. Just not that many Tesla owners who are into tinkering, and fewer still are willing to void their warranties.

 

[brainhouston]

I'd be down
Point me in the right direction
Will most likely be picking up salvage 3 as my next project...

 

[EESP]

The limiting factor is more the commercial interest. Just not that many Tesla owners who are into tinkering, and fewer still are willing to void their warranties.

That's a point. I would not have big problems trying something "creative" with a middle aged gaming console still with some warranty remaining, but I would be hesitant to doing stuff that will void the warranty of a $60k car.

I will try to see if some old acquaintances still working at said company would be willing to do this. I don't know how hard said company monitor what they are doing with the diagnostic software as long as it's not about changing the monitored parameters (payable options) on cars.