Tesla Model 3 Rear Drive Unit Closed Source CAN Hacking

[ScythianNite]

so this setup requires an originally-paired inverter and VCSEC and canspoofing for the rest of the messages? (not to be reductive, just trying to parse through the posts so far)

[P.S.Mangelsdorf]

Dude that is awesome! Great work!

[Bratitude]

great work AMP3R, just to recap:

-stock M3/MY drive unit
-matching VCSEC (from the same vehicle)
-stock pedal
-vehicle CAN
-HVIL terminated


key card is not required? or key card is required to enable keyless driving?

[AMP3R]

so this setup requires an originally-paired inverter and VCSEC and canspoofing for the rest of the messages? (not to be reductive, just trying to parse through the posts so far)

Yes

[AMP3R]

great work AMP3R, just to recap:

-stock M3/MY drive unit
-matching VCSEC (from the same vehicle)
-stock pedal
-vehicle CAN
-HVIL terminated


key card is not required? or key card is required to enable keyless driving?

Key card is not required. You can enable keyless driving via can and that's it.

[dimonlipko]

Great work AMP3R! I long time dont read this thread, you progress is cool!

I very slowly but work on this way to run M3 inverter. I make some research on MY and change rear drive inverter from 990 to 980 version. I make new IMMO pair with VCSEC and DIR with Tesla Toolbox. But then I change back stock inverter, VCSEC forgot it, so VCSEC can make pair only with one inverter.

I buy MCU with old software , display, motor, VCSEC, pedal and wiring for bench test. MCU help me rewrite software in inverter for more old version, when I start redeploy. And MCU help me make IMMO pair.

Next step emulate CAN frame to make motor spin)))

[AMP3R]

Does anybody have EEPROM dump of rear inverter?

[davefiddes]

Damien has some captures of the EEPROM access with the Tesla firmware running:

https://github.com/damienmaguire/Tesla- ... ter/EEPROM

You need Saleae Logic 1.x software to open these files.

I've attached a dump I made of my EEPROM before I started writing to it. It's mostly empty space.

The program I used to make the dump can be found here: https://github.com/davefiddes/c2000-inv ... dumpeeprom

If you are brave/careful/reckless (delete as applicable) it should be possible to run this on any Tesla M3/Y inverter without wiping the Tesla firmware.

[AMP3R]

Damien has some captures of the EEPROM access with the Tesla firmware running:

https://github.com/damienmaguire/Tesla- ... ter/EEPROM

You need Saleae Logic 1.x software to open these files.

I've attached a dump I made of my EEPROM before I started writing to it. It's mostly empty space.

The program I used to make the dump can be found here: https://github.com/davefiddes/c2000-inv ... dumpeeprom

If you are brave/careful/reckless (delete as applicable) it should be possible to run this on any Tesla M3/Y inverter without wiping the Tesla firmware.

Do you have .bin dump?

[davefiddes]

Do you have .bin dump?

No. You can run through a simple tool like xxd:

Code: Select all

xxd -r -p eeprom-dump-fast.txt eeprom-dump.bin

[AMP3R]

I have figured out the secret of how the immobilizer works and now it's possible to use drive units without VCSEC. Unfortunately, I can't reveal this information, otherwise a falcon 9 rocket will fall on my house, as Damien once joked.

[crasbe]

Congratulations.

[Bratitude]

I have figured out the secret of how the immobilizer works and now it's possible to use drive units without VCSEC. Unfortunately, I can't reveal this information, otherwise a falcon 9 rocket will fall on my house, as Damien once joked.

Where’s the fun in that? At least give us some clues!

[AMP3R]

Where’s the fun in that? At least give us some clues!

If I post this info, then what will be the point of the inverter board that Damien is making now? Also I don't want to take away the bread of Johannes, his openinverter shop and so on. Sorry.

[johu]

It's great that you are very thoughtful.
As for me (OI shop) I don't sell M3 boards and not planning either.

[Jack Bauer]

First off congratulations. I understand how it feels to see a motor turn after a long process of work. You are free to do with the information as you see fit. I know the broad strokes myself but i'm sure there are hundreds of details to work out along the way. The solution I'm pursuing is a different route with its own advantages and disadvantages. The biggest for me is the freedom to have it all open and accessible without fear or favor or concern about a booster "malfunction"

Sure its nice to make some money selling the boards but thats far from the only motivator. Depending on how things pan out i'm a week or two away from dragging my Volvo V50 M3 drive unit test mule into the barn and making it spin wheels with the prototype OI board in the inverter. I'll keep at it no matter what and all going well I'll try selling the board once I'm as happy as I can be that it works. I may decide to just make it fully opensource at that point also depending on circumstances. If there is no business case for selling the boards as various "better" solutions are available then that would make the most sense.

In any event , I owe it to myself and those who have supported me to keep going until I experience 500hp in a Volvo. Now I gotta wrestle a door latch back into the Red Arrow so I can make some room in the barn:)

[catphish]

If I post this info, then what will be the point of the inverter board that Damien is making now? Also I don't want to take away the bread of Johannes, his openinverter shop and so on. Sorry.

If this is your only motivation, then please send the data to Damien and Johannes and let them decide whether it's suitable to implement in the Zombieverter project!

[AMP3R]

If this is your only motivation, then please send the data to Damien and Johannes and let them decide whether it's suitable to implement in the Zombieverter project!

I prefer that this information not become open source.

[Bratitude]

I prefer that this information not become open source.

If your planing on releasing your own standalone controller then fair enough, but the open in openinverter dose stand for something….

[catphish]

If your planing on releasing your own standalone controller then fair enough, but the open in openinverter dose stand for something….

Congratulations on your 1000th post in this forum

[Alibro]

I prefer that this information not become open source.

Why on earth are you posting here then? Have you seen the name of this site?

[Jack Bauer]

I prefer that this information not become open source.

Ok. No problem. As I said before well done getting to where you need to be and I hope it works out and does what you need. The main focus of this thread is currently the replacement PCB project that I'm currently "leading" and the replacement software for the OEM board TI micro project of Dave's. While I personally don't like closed systems I've no problem with folks using them as at the end of the day it gets another conversion working and the owner driving down the road. It's probably worth you opening a new thread if you wish to discuss / document your solution on here.