Tesla Model 3 Battery Hacking

Topics concerning the Tesla front and rear drive unit drop-in board
Post Reply
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

I found a few other commands to test:

x0000 followed by x38DC followed by xF300 8 times!
tom91
Posts: 1272
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

muehlpower wrote: Sun Aug 09, 2020 8:02 pm I found a few other commands to test:

x0000 followed by x38DC followed by xF300 8 times!
Were did you find that? you realise right that x0000 from the master is it just waiting on data back from the slave?
Founder Volt Influx https://www.voltinflux.com/
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

cap4 from damien 5 days ago on time 0.050685291666667s
tom91
Posts: 1272
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

muehlpower wrote: Sun Aug 09, 2020 8:37 pm cap4 from damien 5 days ago on time 0.050685291666667s
Ah yes, i did not see that alot in other captures, annoying bit is it appears not to do alot as there are no consistent responses.
Founder Volt Influx https://www.voltinflux.com/
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

it repeats every 100ms , starting with 0x112F
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Code: Select all

IC 1 : | 3256mV| 3264mV| 3267mV| 3281mV| 3266mV| 3269mV| 3267mV| 3268mV| 3281mV| 3276mV| 3269mV| 3274mV| 3257mV| 0mV| 0mV

IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV

9F

659F

899F

C5E

10

A090

9F84

9F33

38FF

39A0

859F

A49F

179E

A2

9F80

9F95

9F22

5DFF

39

A0

85

9F

A4

9F

A2

9F

80

9F

95

9F

8A9F

9D9F

36A0

3978

88

9F81

9F8B

9F25

DFF

8A

9F

9D

9F

36

A0

88

9F

81

9F

8B

9F

FE9F

9F9F

E59F

37EC

4D

9F91

9F95

9F2E

8DFF

FE

9F

9F

9F

E5

9F

4D

9F

91

9F

95

9F

99F

0

200

32C8

0

2

2

24

A2FF

9

9F

0

0

2

0

0

0

2

0

2

0

200

7981

2CAE

2

90

7730

78FF



Sadly still no updating. Also worth noting that when we send the slave draws 4.5ma. When the m3 master sends the slave draws 6.5ma. I have observed that the more traffic the more current so we are for sure missing something. Will see what I can see in the logs.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Any one? or is it still the Tom and Damien show? If I had a euro for every off forum contact I've had about this topic then both of us could retire to Lanzarote and hold ev drag races on the beach each morning.
I'm going to need a hacksaw
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

have you tried x38DC followed by xF300 8 times! ?
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Sorry I didnt see that. Will try thanks.
I'm going to need a hacksaw
tom91
Posts: 1272
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

Nah, probally good to try my code first. modified it to actually send out 0x2bfb :P

https://github.com/tomdebree/Tesla-Mode ... _Test_1tdb
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Progress :

Code: Select all

IC 1 : | 3251mV| 0mV| 3264mV| 3272mV| 3264mV| 3266mV| 3264mV| 3266mV| 3266mV| 3270mV| 3265mV| 3270mV| 3270mV| 0mV| 0mV

IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV

C59E

0

649F

310F

10

A090

9F84

9F33

38FF

CF9F

659F

819F

2285

A2

9F80

9F95

9F22

5DFF

CF

9F

65

9F

81

9F

A2

9F

80

9F

95

9F

699F

799F

799F

9F2

88

9F81

9F8B

9F25

DFF

69

9F

79

9F

79

9F

88

9F

81

9F

8B

9F

AB9F

789F

B29F

4B6

4D

9F91

9F95

9F2E

8DFF

AB

9F

78

9F

B2

9F

4D

9F

91

9F

95

9F

AE9F

0

100

B49

0

2

2

24

A2FF

AE

9F

0

0

1

0

0

0

2

0

2

0

100

777

1CE

2

90

7730

78FF



So in this version I can now see tiny changes in the cell mv readings between each read. However, some voltages are reading 0 so I checked the pack with a meter. Only cell 14 is dead. All others around 3.2v. I am still unable to get the readings to update then affecting a cell voltage via a power supply which is strange.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Ok, tried something different. Put a 100w 230v light bulb across the pack and got :
IC 1 : | 3217mV| 0mV| 3208mV| 3236mV| 3204mV| 3233mV| 3225mV| 3231mV| 3208mV| 3237mV| 3229mV| 3235mV| 3226mV| 0mV| 0mV

IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV

Remove bulb :
IC 1 : | 3244mV| 0mV| 3257mV| 3265mV| 3257mV| 3259mV| 3257mV| 3258mV| 3259mV| 3262mV| 3258mV| 3263mV| 3252mV| 0mV| 0mV

IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV

edit: so looks like only ic1 is updating.
I'm going to need a hacksaw
tom91
Posts: 1272
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

Some progress, is this with my latest version with 0x2BFB being sent?

You got a capture of this?
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Yes newest code.
Two captures on the github : https://github.com/damienmaguire/Tesla- ... nsy_Master

One with no load and the other with 100w 230v bulb applied approx 0.5sec into the capture and removed approx 0.5sec before capture end.
I'm going to need a hacksaw
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

why don't you send Com (0x21f2, 0x4d00), only Com2?
tom91
Posts: 1272
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

muehlpower wrote: Fri Aug 14, 2020 9:33 am why don't you send Com (0x21f2, 0x4d00), only Com2?
Trying to just have it match a capture, we can add and remove various things to see what changes.

Best is to start with a baseline that matches a capture that works as close as possible before adding parts to it.
Founder Volt Influx https://www.voltinflux.com/
tom91
Posts: 1272
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

Cleaned up some more of the coding, would be good to get a couple of captures so we can get an idea of how we can check which modules are listening.

Give it a go Damien, please also take some captures. we are getting there slowly, seems like the modules do not require us to actually have a counter that counts up in the messages.
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Latest code. No load :


IC 1 : | 3251mV| 0mV| 3265mV| 3272mV| 3264mV| 3267mV| 3265mV| 3266mV| 3267mV| 3269mV| 3266mV| 3271mV| 3252mV| 0mV| 0mV

IC 2 : | 3285mV| 3278mV| 3277mV| 3279mV| 3279mV| 3266mV| 3265mV| 3264mV| 3265mV| 3263mV| 3265mV| 3265mV| 0mV| 0mV| 0mV


100w bulb load:


IC 1 : | 3227mV| 0mV| 3217mV| 3245mV| 3210mV| 3243mV| 3235mV| 3240mV| 3215mV| 3245mV| 3238mV| 3244mV| 3227mV| 0mV| 0mV

IC 2 : | 3260mV| 3252mV| 3250mV| 3255mV| 3251mV| 3240mV| 3216mV| 3219mV| 3221mV| 3209mV| 3242mV| 3228mV| 0mV| 0mV| 0mV
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Two new captures on the repo :
https://github.com/damienmaguire/Tesla- ... nsy_Master

same conditions as yesterday. Now looks like both ics are updating. Nice on Tom.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

PSU set at 2 amps on first 5 cells in the pack :
IC 1 : | 3249mV| 0mV| 3263mV| 3269mV| 3262mV| 3264mV| 3262mV| 3264mV| 3264mV| 3267mV| 3264mV| 3268mV| 3249mV| 0mV| 0mV

IC 2 : | 3665mV| 3666mV| 3673mV| 3631mV| 3681mV| 3263mV| 3262mV| 3261mV| 3263mV| 3260mV| 3263mV| 3263mV| 0mV| 0mV| 0mV

Can clearly see voltages at 3.6v:)
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Cells 5 through 10 on charge at 2 amps :
IC 1 : | 3248mV| 0mV| 3262mV| 3268mV| 3261mV| 3264mV| 3262mV| 3263mV| 3264mV| 3266mV| 3263mV| 3268mV| 3249mV| 0mV| 0mV

IC 2 : | 3310mV| 3305mV| 3304mV| 3305mV| 3305mV| 3605mV| 3674mV| 3701mV| 3884mV| 3645mV| 3262mV| 3262mV| 0mV| 0mV| 0mV
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Cell s 11-15 on charge :
IC 1 : | 3609mV| 2802mV| 3664mV| 3268mV| 3261mV| 3263mV| 3261mV| 3263mV| 3263mV| 3266mV| 3263mV| 3267mV| 3248mV| 0mV| 0mV

IC 2 : | 3306mV| 3302mV| 3301mV| 3302mV| 3302mV| 3297mV| 3296mV| 3296mV| 3288mV| 3296mV| 3605mV| 3675mV| 0mV| 0mV| 0mV
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Cells 16-20 on charge :
IC 1 : | 3278mV| 483mV| 3291mV| 3644mV| 3743mV| 3546mV| 3625mV| 3620mV| 3263mV| 3265mV| 3262mV| 3267mV| 3248mV| 0mV| 0mV

IC 2 : | 3304mV| 3299mV| 3299mV| 3300mV| 3300mV| 3289mV| 3288mV| 3288mV| 3280mV| 3287mV| 3290mV| 3291mV| 0mV| 0mV| 0mV
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

and finally cells 21-25 on charge :
IC 1 : | 3275mV| 415mV| 3289mV| 3302mV| 3258mV| 3260mV| 3259mV| 3294mV| 4074mV| 3597mV| 3645mV| 3627mV| 3591mV| 0mV| 0mV

IC 2 : | 3303mV| 3298mV| 3298mV| 3299mV| 3299mV| 3287mV| 3287mV| 3286mV| 3279mV| 3285mV| 3288mV| 3288mV| 0mV| 0mV| 0mV
I'm going to need a hacksaw
Post Reply