Trying to run Tesla M3/Y Rear Drive Unit via CAN

[catphish]

If your planing on releasing your own standalone controller then fair enough, but the open in openinverter dose stand for something….

Congratulations on your 1000th post in this forum

[Alibro]

I prefer that this information not become open source.

Why on earth are you posting here then? Have you seen the name of this site?

[Jack Bauer]

I prefer that this information not become open source.

Ok. No problem. As I said before well done getting to where you need to be and I hope it works out and does what you need. The main focus of this thread is currently the replacement PCB project that I'm currently "leading" and the replacement software for the OEM board TI micro project of Dave's. While I personally don't like closed systems I've no problem with folks using them as at the end of the day it gets another conversion working and the owner driving down the road. It's probably worth you opening a new thread if you wish to discuss / document your solution on here.

[AMP3R]

If your planing on releasing your own standalone controller then fair enough, but the open in openinverter dose stand for something….

Yes in plans to release turnkey controller with mobile app.

[Slimjimmy]

Yes in plans to release turnkey controller with mobile app.

Very cool, where can we get more information on this?

[AMP3R]

Very cool, where can we get more information on this?

In progress. Now it's possible to flash any version of Tesla firmware via CAN, change the motor config, etc.

[Bratitude]

are you exploiting the vulnerability in the VCSEC throughout the certificate authentication process, causing an integer overflow in the VCSEC’s memory? It appears that memory is readable, writable, and executable! This seems to be the way to bypass the VCSEC and enable keyless driving.
But Looks like Tesla has patched this recently with firmware 2024.14

Some good details here:
https://nvd.nist.gov/vuln/detail/CVE-2025-2082

https://www.cvedetails.com/cve/CVE-2025-2082/

[AMP3R]

are you exploiting the vulnerability in the VCSEC throughout the certificate authentication process, causing an integer overflow in the VCSEC’s memory? It appears that memory is readable, writable, and executable! This seems to be the way to bypass the VCSEC and enable keyless driving.
But Looks like Tesla has patched this recently with firmware 2024.14

Some good details here:
https://nvd.nist.gov/vuln/detail/CVE-2025-2082

https://www.cvedetails.com/cve/CVE-2025-2082/

No, I didn't do that.

[AMP3R]

Working on a new CAN architecture of M3/Y and it's quiet interesting. They removed party can bus, hvil and firmware files became lighter. Also there is no physical connection with gas pedal and its state is transmitting via can. What about immobilizer? It's still there, but VCSEC module is now integrated with one of the body controllers. So what can I say? I liked work they've done. Drive unit can be controlled just with 4 wires (+12V, ground, CAN) and everything looks now more elegant and minimalistic.

Made a script that is searching matching firmware and after flashing it into the drive unit.

[Jack Bauer]

Do they still run a hardware brake pedal signal to the inverter? Guess I'm old fashioned insofar as I'd still like to see that being done.

[AMP3R]

Do they still run a hardware brake pedal signal to the inverter?

No. Brake pedal switch status is via CAN.

[Bratitude]

Is this a result of a newer firmware you updated on your existing drive unit? Or did you pick up another drive unit?

[AMP3R]

Is this a result of a newer firmware you updated on your existing drive unit? Or did you pick up another drive unit?

This is a result of a newer firmware I updated on my existing drive unit.

[AMP3R]

So, it took three working days to get the drive unit running on the M3 Highland firmware version from 2025. As you can see, it works. There are still a few details to tweak.

[Jack Bauer]

You have a WAY more tidy workspace than me I notice your drive unit has no temp sensor on the resolver side. O the 3 I have only one has a temp sensor. More reduction I guess.

[AMP3R]

It's turned out that new architecture is a bit more complex than expected, but that only made it more interesting. I'm still trying to figure out how to enable R. However, everything is perfect in CAN, and the drive unit has zero errors.

[AMP3R]

Managed to find R. Also thanks to the new architecture turned out that it's possible to spin the motor in reverse at the same speed as in drive (approximately 260 km/h).

Of course all tesla's protections works automatically (overheat protection and much more).

I'm still need to do some work. Have to write a script for adjusting regen force, cruise, speed limit etc.