openinverter forum

I bought a broken TC-1 to teardown and show whats going on inside.

The design is super weird - using high-side drivers to drive relays but not just driving 12v outputs with them directly. Also, everything is hand soldered and there were even solder balls running around inside!

They are using a Mikro 7inch smart display dev board: https://www.mikroe.com/mikromedia-7-stm32f7

They are using a balling F7 mcu

I connected my stlinkv3 and it locked through byte options RIPPP

The firmware is RDP so I'm looking into making a glitcher for it. If anyone has info on STM32F7 glitching to bypass RDP please let me know.

I have a friend with IDA pro so that could be interesting. If I can disassemble the code I will post it here.

Hopefully, this helps someone at least a little

Thanks for posting:)

Does anybody sell broken T-2C controller?

I bought a new display and the touch is restored! Looks like the guy basically gave me a TC-1 for free since the replacement resistive touch panel was less than 20bucks from buydisplay.com

Unfortunately, there is nothing in settings or options for firmware updating. I think the fuse they set might be permanent (aka hardware Efuse RDP).

This is extremely impressive as the people who wrote the software for this thing left a ridiculous amount of horsepower untouched. The code runs extremely slow and I'm surprised the developers actually enabled RDP.

Called up EV controls. They state that without the logic board I'm straight out of luck as they do not reflash more than one control board per unit sold. Man, I really wish someone would post the CAN firmware update sequence for updating the drive unit. I've been looking into doing this for a while now and it seems like you can with Tesla Toolbox. It would be so nice if people could simply replay the flashing sequence via the CAN bootloader and then everyone can benefit from open-source CAN emulation!