Tesla Model 3 Battery Hacking
- muehlpower
- Posts: 585
- Joined: Fri Oct 11, 2019 10:51 am
- Location: Germany Fürstenfeldbruck
- Has thanked: 12 times
- Been thanked: 106 times
Re: Tesla Model 3 Battery Hacking
I found a few other commands to test:
x0000 followed by x38DC followed by xF300 8 times!
x0000 followed by x38DC followed by xF300 8 times!
-
- Posts: 1342
- Joined: Fri Mar 01, 2019 9:15 pm
- Location: Bristol
- Has thanked: 106 times
- Been thanked: 231 times
Re: Tesla Model 3 Battery Hacking
Were did you find that? you realise right that x0000 from the master is it just waiting on data back from the slave?muehlpower wrote: ↑Sun Aug 09, 2020 8:02 pm I found a few other commands to test:
x0000 followed by x38DC followed by xF300 8 times!
- muehlpower
- Posts: 585
- Joined: Fri Oct 11, 2019 10:51 am
- Location: Germany Fürstenfeldbruck
- Has thanked: 12 times
- Been thanked: 106 times
-
- Posts: 1342
- Joined: Fri Mar 01, 2019 9:15 pm
- Location: Bristol
- Has thanked: 106 times
- Been thanked: 231 times
Re: Tesla Model 3 Battery Hacking
Ah yes, i did not see that alot in other captures, annoying bit is it appears not to do alot as there are no consistent responses.
- muehlpower
- Posts: 585
- Joined: Fri Oct 11, 2019 10:51 am
- Location: Germany Fürstenfeldbruck
- Has thanked: 12 times
- Been thanked: 106 times
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Code: Select all
IC 1 : | 3256mV| 3264mV| 3267mV| 3281mV| 3266mV| 3269mV| 3267mV| 3268mV| 3281mV| 3276mV| 3269mV| 3274mV| 3257mV| 0mV| 0mV
IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV
9F
659F
899F
C5E
10
A090
9F84
9F33
38FF
39A0
859F
A49F
179E
A2
9F80
9F95
9F22
5DFF
39
A0
85
9F
A4
9F
A2
9F
80
9F
95
9F
8A9F
9D9F
36A0
3978
88
9F81
9F8B
9F25
DFF
8A
9F
9D
9F
36
A0
88
9F
81
9F
8B
9F
FE9F
9F9F
E59F
37EC
4D
9F91
9F95
9F2E
8DFF
FE
9F
9F
9F
E5
9F
4D
9F
91
9F
95
9F
99F
0
200
32C8
0
2
2
24
A2FF
9
9F
0
0
2
0
0
0
2
0
2
0
200
7981
2CAE
2
90
7730
78FF
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Capture on the repo :
https://github.com/damienmaguire/Tesla- ... nsy_Master
https://github.com/damienmaguire/Tesla- ... nsy_Master
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Any one? or is it still the Tom and Damien show? If I had a euro for every off forum contact I've had about this topic then both of us could retire to Lanzarote and hold ev drag races on the beach each morning.
I'm going to need a hacksaw
- muehlpower
- Posts: 585
- Joined: Fri Oct 11, 2019 10:51 am
- Location: Germany Fürstenfeldbruck
- Has thanked: 12 times
- Been thanked: 106 times
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Sorry I didnt see that. Will try thanks.
I'm going to need a hacksaw
-
- Posts: 1342
- Joined: Fri Mar 01, 2019 9:15 pm
- Location: Bristol
- Has thanked: 106 times
- Been thanked: 231 times
Re: Tesla Model 3 Battery Hacking
Nah, probally good to try my code first. modified it to actually send out 0x2bfb
https://github.com/tomdebree/Tesla-Mode ... _Test_1tdb
https://github.com/tomdebree/Tesla-Mode ... _Test_1tdb
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Progress :
So in this version I can now see tiny changes in the cell mv readings between each read. However, some voltages are reading 0 so I checked the pack with a meter. Only cell 14 is dead. All others around 3.2v. I am still unable to get the readings to update then affecting a cell voltage via a power supply which is strange.
Code: Select all
IC 1 : | 3251mV| 0mV| 3264mV| 3272mV| 3264mV| 3266mV| 3264mV| 3266mV| 3266mV| 3270mV| 3265mV| 3270mV| 3270mV| 0mV| 0mV
IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV
C59E
0
649F
310F
10
A090
9F84
9F33
38FF
CF9F
659F
819F
2285
A2
9F80
9F95
9F22
5DFF
CF
9F
65
9F
81
9F
A2
9F
80
9F
95
9F
699F
799F
799F
9F2
88
9F81
9F8B
9F25
DFF
69
9F
79
9F
79
9F
88
9F
81
9F
8B
9F
AB9F
789F
B29F
4B6
4D
9F91
9F95
9F2E
8DFF
AB
9F
78
9F
B2
9F
4D
9F
91
9F
95
9F
AE9F
0
100
B49
0
2
2
24
A2FF
AE
9F
0
0
1
0
0
0
2
0
2
0
100
777
1CE
2
90
7730
78FF
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Ok, tried something different. Put a 100w 230v light bulb across the pack and got :
IC 1 : | 3217mV| 0mV| 3208mV| 3236mV| 3204mV| 3233mV| 3225mV| 3231mV| 3208mV| 3237mV| 3229mV| 3235mV| 3226mV| 0mV| 0mV
IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV
Remove bulb :
IC 1 : | 3244mV| 0mV| 3257mV| 3265mV| 3257mV| 3259mV| 3257mV| 3258mV| 3259mV| 3262mV| 3258mV| 3263mV| 3252mV| 0mV| 0mV
IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV
edit: so looks like only ic1 is updating.
IC 1 : | 3217mV| 0mV| 3208mV| 3236mV| 3204mV| 3233mV| 3225mV| 3231mV| 3208mV| 3237mV| 3229mV| 3235mV| 3226mV| 0mV| 0mV
IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV
Remove bulb :
IC 1 : | 3244mV| 0mV| 3257mV| 3265mV| 3257mV| 3259mV| 3257mV| 3258mV| 3259mV| 3262mV| 3258mV| 3263mV| 3252mV| 0mV| 0mV
IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV
edit: so looks like only ic1 is updating.
I'm going to need a hacksaw
-
- Posts: 1342
- Joined: Fri Mar 01, 2019 9:15 pm
- Location: Bristol
- Has thanked: 106 times
- Been thanked: 231 times
Re: Tesla Model 3 Battery Hacking
Some progress, is this with my latest version with 0x2BFB being sent?
You got a capture of this?
You got a capture of this?
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Yes newest code.
Two captures on the github : https://github.com/damienmaguire/Tesla- ... nsy_Master
One with no load and the other with 100w 230v bulb applied approx 0.5sec into the capture and removed approx 0.5sec before capture end.
Two captures on the github : https://github.com/damienmaguire/Tesla- ... nsy_Master
One with no load and the other with 100w 230v bulb applied approx 0.5sec into the capture and removed approx 0.5sec before capture end.
I'm going to need a hacksaw
- muehlpower
- Posts: 585
- Joined: Fri Oct 11, 2019 10:51 am
- Location: Germany Fürstenfeldbruck
- Has thanked: 12 times
- Been thanked: 106 times
-
- Posts: 1342
- Joined: Fri Mar 01, 2019 9:15 pm
- Location: Bristol
- Has thanked: 106 times
- Been thanked: 231 times
Re: Tesla Model 3 Battery Hacking
Trying to just have it match a capture, we can add and remove various things to see what changes.
Best is to start with a baseline that matches a capture that works as close as possible before adding parts to it.
-
- Posts: 1342
- Joined: Fri Mar 01, 2019 9:15 pm
- Location: Bristol
- Has thanked: 106 times
- Been thanked: 231 times
Re: Tesla Model 3 Battery Hacking
Cleaned up some more of the coding, would be good to get a couple of captures so we can get an idea of how we can check which modules are listening.
Give it a go Damien, please also take some captures. we are getting there slowly, seems like the modules do not require us to actually have a counter that counts up in the messages.
Give it a go Damien, please also take some captures. we are getting there slowly, seems like the modules do not require us to actually have a counter that counts up in the messages.
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Latest code. No load :
IC 1 : | 3251mV| 0mV| 3265mV| 3272mV| 3264mV| 3267mV| 3265mV| 3266mV| 3267mV| 3269mV| 3266mV| 3271mV| 3252mV| 0mV| 0mV
IC 2 : | 3285mV| 3278mV| 3277mV| 3279mV| 3279mV| 3266mV| 3265mV| 3264mV| 3265mV| 3263mV| 3265mV| 3265mV| 0mV| 0mV| 0mV
100w bulb load:
IC 1 : | 3227mV| 0mV| 3217mV| 3245mV| 3210mV| 3243mV| 3235mV| 3240mV| 3215mV| 3245mV| 3238mV| 3244mV| 3227mV| 0mV| 0mV
IC 2 : | 3260mV| 3252mV| 3250mV| 3255mV| 3251mV| 3240mV| 3216mV| 3219mV| 3221mV| 3209mV| 3242mV| 3228mV| 0mV| 0mV| 0mV
IC 1 : | 3251mV| 0mV| 3265mV| 3272mV| 3264mV| 3267mV| 3265mV| 3266mV| 3267mV| 3269mV| 3266mV| 3271mV| 3252mV| 0mV| 0mV
IC 2 : | 3285mV| 3278mV| 3277mV| 3279mV| 3279mV| 3266mV| 3265mV| 3264mV| 3265mV| 3263mV| 3265mV| 3265mV| 0mV| 0mV| 0mV
100w bulb load:
IC 1 : | 3227mV| 0mV| 3217mV| 3245mV| 3210mV| 3243mV| 3235mV| 3240mV| 3215mV| 3245mV| 3238mV| 3244mV| 3227mV| 0mV| 0mV
IC 2 : | 3260mV| 3252mV| 3250mV| 3255mV| 3251mV| 3240mV| 3216mV| 3219mV| 3221mV| 3209mV| 3242mV| 3228mV| 0mV| 0mV| 0mV
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Two new captures on the repo :
https://github.com/damienmaguire/Tesla- ... nsy_Master
same conditions as yesterday. Now looks like both ics are updating. Nice on Tom.
https://github.com/damienmaguire/Tesla- ... nsy_Master
same conditions as yesterday. Now looks like both ics are updating. Nice on Tom.
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
PSU set at 2 amps on first 5 cells in the pack :
IC 1 : | 3249mV| 0mV| 3263mV| 3269mV| 3262mV| 3264mV| 3262mV| 3264mV| 3264mV| 3267mV| 3264mV| 3268mV| 3249mV| 0mV| 0mV
IC 2 : | 3665mV| 3666mV| 3673mV| 3631mV| 3681mV| 3263mV| 3262mV| 3261mV| 3263mV| 3260mV| 3263mV| 3263mV| 0mV| 0mV| 0mV
Can clearly see voltages at 3.6v:)
IC 1 : | 3249mV| 0mV| 3263mV| 3269mV| 3262mV| 3264mV| 3262mV| 3264mV| 3264mV| 3267mV| 3264mV| 3268mV| 3249mV| 0mV| 0mV
IC 2 : | 3665mV| 3666mV| 3673mV| 3631mV| 3681mV| 3263mV| 3262mV| 3261mV| 3263mV| 3260mV| 3263mV| 3263mV| 0mV| 0mV| 0mV
Can clearly see voltages at 3.6v:)
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Cells 5 through 10 on charge at 2 amps :
IC 1 : | 3248mV| 0mV| 3262mV| 3268mV| 3261mV| 3264mV| 3262mV| 3263mV| 3264mV| 3266mV| 3263mV| 3268mV| 3249mV| 0mV| 0mV
IC 2 : | 3310mV| 3305mV| 3304mV| 3305mV| 3305mV| 3605mV| 3674mV| 3701mV| 3884mV| 3645mV| 3262mV| 3262mV| 0mV| 0mV| 0mV
IC 1 : | 3248mV| 0mV| 3262mV| 3268mV| 3261mV| 3264mV| 3262mV| 3263mV| 3264mV| 3266mV| 3263mV| 3268mV| 3249mV| 0mV| 0mV
IC 2 : | 3310mV| 3305mV| 3304mV| 3305mV| 3305mV| 3605mV| 3674mV| 3701mV| 3884mV| 3645mV| 3262mV| 3262mV| 0mV| 0mV| 0mV
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Cell s 11-15 on charge :
IC 1 : | 3609mV| 2802mV| 3664mV| 3268mV| 3261mV| 3263mV| 3261mV| 3263mV| 3263mV| 3266mV| 3263mV| 3267mV| 3248mV| 0mV| 0mV
IC 2 : | 3306mV| 3302mV| 3301mV| 3302mV| 3302mV| 3297mV| 3296mV| 3296mV| 3288mV| 3296mV| 3605mV| 3675mV| 0mV| 0mV| 0mV
IC 1 : | 3609mV| 2802mV| 3664mV| 3268mV| 3261mV| 3263mV| 3261mV| 3263mV| 3263mV| 3266mV| 3263mV| 3267mV| 3248mV| 0mV| 0mV
IC 2 : | 3306mV| 3302mV| 3301mV| 3302mV| 3302mV| 3297mV| 3296mV| 3296mV| 3288mV| 3296mV| 3605mV| 3675mV| 0mV| 0mV| 0mV
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
Cells 16-20 on charge :
IC 1 : | 3278mV| 483mV| 3291mV| 3644mV| 3743mV| 3546mV| 3625mV| 3620mV| 3263mV| 3265mV| 3262mV| 3267mV| 3248mV| 0mV| 0mV
IC 2 : | 3304mV| 3299mV| 3299mV| 3300mV| 3300mV| 3289mV| 3288mV| 3288mV| 3280mV| 3287mV| 3290mV| 3291mV| 0mV| 0mV| 0mV
IC 1 : | 3278mV| 483mV| 3291mV| 3644mV| 3743mV| 3546mV| 3625mV| 3620mV| 3263mV| 3265mV| 3262mV| 3267mV| 3248mV| 0mV| 0mV
IC 2 : | 3304mV| 3299mV| 3299mV| 3300mV| 3300mV| 3289mV| 3288mV| 3288mV| 3280mV| 3287mV| 3290mV| 3291mV| 0mV| 0mV| 0mV
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Battery Hacking
and finally cells 21-25 on charge :
IC 1 : | 3275mV| 415mV| 3289mV| 3302mV| 3258mV| 3260mV| 3259mV| 3294mV| 4074mV| 3597mV| 3645mV| 3627mV| 3591mV| 0mV| 0mV
IC 2 : | 3303mV| 3298mV| 3298mV| 3299mV| 3299mV| 3287mV| 3287mV| 3286mV| 3279mV| 3285mV| 3288mV| 3288mV| 0mV| 0mV| 0mV
IC 1 : | 3275mV| 415mV| 3289mV| 3302mV| 3258mV| 3260mV| 3259mV| 3294mV| 4074mV| 3597mV| 3645mV| 3627mV| 3591mV| 0mV| 0mV
IC 2 : | 3303mV| 3298mV| 3298mV| 3299mV| 3299mV| 3287mV| 3287mV| 3286mV| 3279mV| 3285mV| 3288mV| 3288mV| 0mV| 0mV| 0mV
I'm going to need a hacksaw