Tesla Model 3 Rear Drive Unit Closed Source CAN Hacking

[AMP3R]

Great job!

So are you saying that if i record these 65536 challenge responses for a paired motor/VCSEC, then i could dump the motor firmware and flash it into another motor and the new motor should authenticate?

A small update for you. It's impossible to dump the inverter flash via CAN, because Tesla disabled UDS service 0×35 Request data upload.

[Refasol123]

Hi everyone,
First of all congratulations for the amazing work that you've done here.

I am an electronics student and I want to use the inverter of a m3 front du just to measure some parameters (efficiency, temperature...) as part of a project. I would greatly appreciate it if someone could guide me a bit on how to get started with the purpose of enabling the inverter and controlling some parameters.

[AMP3R]

A few days ago I had an idea to take another close look what the inverter sends to the vehicle CAN and after poking around found something interesting. It turns out that there are many more ids with alerts and errors than I thought. By simple calculations edited the dbc file and when turned on the drive unit I was stunned.

Of course, nothing will work, because the DI_a174_notOkToStartDrive alert is active. The logic lacks 12 volts, which I supply from a regular ATX power supply. If this turns out to be the cause, it will be very funny. But it is too early to rejoice.
Screenshot from 2025-02-02 21-54-41.png

The new power supply didn't help, which means the problem is somewhere in the can messages.

[AMP3R]

It works. Switches to D and R, but for some reason immediately returns to P. Also, a new alert DI_a125_noBatteryPower appeared.

[RadioKot]

Congratulations on your success! You’ve done a great job, and the results speak for themselves. It’s clear that you know what you’re doing and are moving in the right direction. Keep it up!

[AMP3R]

[ScythianNite]

so this setup requires an originally-paired inverter and VCSEC and canspoofing for the rest of the messages? (not to be reductive, just trying to parse through the posts so far)

[P.S.Mangelsdorf]

Dude that is awesome! Great work!

[Bratitude]

great work AMP3R, just to recap:

-stock M3/MY drive unit
-matching VCSEC (from the same vehicle)
-stock pedal
-vehicle CAN
-HVIL terminated


key card is not required? or key card is required to enable keyless driving?

[AMP3R]

so this setup requires an originally-paired inverter and VCSEC and canspoofing for the rest of the messages? (not to be reductive, just trying to parse through the posts so far)

Yes

[AMP3R]

great work AMP3R, just to recap:

-stock M3/MY drive unit
-matching VCSEC (from the same vehicle)
-stock pedal
-vehicle CAN
-HVIL terminated


key card is not required? or key card is required to enable keyless driving?

Key card is not required. You can enable keyless driving via can and that's it.

[dimonlipko]

Great work AMP3R! I long time dont read this thread, you progress is cool!

I very slowly but work on this way to run M3 inverter. I make some research on MY and change rear drive inverter from 990 to 980 version. I make new IMMO pair with VCSEC and DIR with Tesla Toolbox. But then I change back stock inverter, VCSEC forgot it, so VCSEC can make pair only with one inverter.

I buy MCU with old software , display, motor, VCSEC, pedal and wiring for bench test. MCU help me rewrite software in inverter for more old version, when I start redeploy. And MCU help me make IMMO pair.

Next step emulate CAN frame to make motor spin)))

[AMP3R]

Does anybody have EEPROM dump of rear inverter?

[davefiddes]

Damien has some captures of the EEPROM access with the Tesla firmware running:

https://github.com/damienmaguire/Tesla- ... ter/EEPROM

You need Saleae Logic 1.x software to open these files.

I've attached a dump I made of my EEPROM before I started writing to it. It's mostly empty space.

The program I used to make the dump can be found here: https://github.com/davefiddes/c2000-inv ... dumpeeprom

If you are brave/careful/reckless (delete as applicable) it should be possible to run this on any Tesla M3/Y inverter without wiping the Tesla firmware.

[AMP3R]

Damien has some captures of the EEPROM access with the Tesla firmware running:

https://github.com/damienmaguire/Tesla- ... ter/EEPROM

You need Saleae Logic 1.x software to open these files.

I've attached a dump I made of my EEPROM before I started writing to it. It's mostly empty space.

The program I used to make the dump can be found here: https://github.com/davefiddes/c2000-inv ... dumpeeprom

If you are brave/careful/reckless (delete as applicable) it should be possible to run this on any Tesla M3/Y inverter without wiping the Tesla firmware.

Do you have .bin dump?

[davefiddes]

Do you have .bin dump?

No. You can run through a simple tool like xxd:

Code: Select all

xxd -r -p eeprom-dump-fast.txt eeprom-dump.bin

[AMP3R]

I have figured out the secret of how the immobilizer works and now it's possible to use drive units without VCSEC. Unfortunately, I can't reveal this information, otherwise a falcon 9 rocket will fall on my house, as Damien once joked.

[crasbe]

Congratulations.

[Bratitude]

I have figured out the secret of how the immobilizer works and now it's possible to use drive units without VCSEC. Unfortunately, I can't reveal this information, otherwise a falcon 9 rocket will fall on my house, as Damien once joked.

Where’s the fun in that? At least give us some clues!

[AMP3R]

Where’s the fun in that? At least give us some clues!

If I post this info, then what will be the point of the inverter board that Damien is making now? Also I don't want to take away the bread of Johannes, his openinverter shop and so on. Sorry.

[johu]

It's great that you are very thoughtful.
As for me (OI shop) I don't sell M3 boards and not planning either.

[Jack Bauer]

First off congratulations. I understand how it feels to see a motor turn after a long process of work. You are free to do with the information as you see fit. I know the broad strokes myself but i'm sure there are hundreds of details to work out along the way. The solution I'm pursuing is a different route with its own advantages and disadvantages. The biggest for me is the freedom to have it all open and accessible without fear or favor or concern about a booster "malfunction"

Sure its nice to make some money selling the boards but thats far from the only motivator. Depending on how things pan out i'm a week or two away from dragging my Volvo V50 M3 drive unit test mule into the barn and making it spin wheels with the prototype OI board in the inverter. I'll keep at it no matter what and all going well I'll try selling the board once I'm as happy as I can be that it works. I may decide to just make it fully opensource at that point also depending on circumstances. If there is no business case for selling the boards as various "better" solutions are available then that would make the most sense.

In any event , I owe it to myself and those who have supported me to keep going until I experience 500hp in a Volvo. Now I gotta wrestle a door latch back into the Red Arrow so I can make some room in the barn:)

[catphish]

If I post this info, then what will be the point of the inverter board that Damien is making now? Also I don't want to take away the bread of Johannes, his openinverter shop and so on. Sorry.

If this is your only motivation, then please send the data to Damien and Johannes and let them decide whether it's suitable to implement in the Zombieverter project!

[AMP3R]

If this is your only motivation, then please send the data to Damien and Johannes and let them decide whether it's suitable to implement in the Zombieverter project!

I prefer that this information not become open source.

[Bratitude]

I prefer that this information not become open source.

If your planing on releasing your own standalone controller then fair enough, but the open in openinverter dose stand for something….