Page 7 of 11
Re: Tesla Model 3 Battery Hacking
Posted: Sun Aug 09, 2020 8:02 pm
by muehlpower
I found a few other commands to test:
x0000 followed by x38DC followed by xF300 8 times!
Re: Tesla Model 3 Battery Hacking
Posted: Sun Aug 09, 2020 8:23 pm
by tom91
muehlpower wrote: ↑Sun Aug 09, 2020 8:02 pm
I found a few other commands to test:
x0000 followed by x38DC followed by xF300 8 times!
Were did you find that? you realise right that x0000 from the master is it just waiting on data back from the slave?
Re: Tesla Model 3 Battery Hacking
Posted: Sun Aug 09, 2020 8:37 pm
by muehlpower
cap4 from damien 5 days ago on time 0.050685291666667s
Re: Tesla Model 3 Battery Hacking
Posted: Sun Aug 09, 2020 8:56 pm
by tom91
muehlpower wrote: ↑Sun Aug 09, 2020 8:37 pm
cap4 from damien 5 days ago on time 0.050685291666667s
Ah yes, i did not see that alot in other captures, annoying bit is it appears not to do alot as there are no consistent responses.
Re: Tesla Model 3 Battery Hacking
Posted: Sun Aug 09, 2020 9:09 pm
by muehlpower
it repeats every 100ms , starting with 0x112F
Re: Tesla Model 3 Battery Hacking
Posted: Mon Aug 10, 2020 3:58 pm
by Jack Bauer
Code: Select all
IC 1 : | 3256mV| 3264mV| 3267mV| 3281mV| 3266mV| 3269mV| 3267mV| 3268mV| 3281mV| 3276mV| 3269mV| 3274mV| 3257mV| 0mV| 0mV
IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV
9F
659F
899F
C5E
10
A090
9F84
9F33
38FF
39A0
859F
A49F
179E
A2
9F80
9F95
9F22
5DFF
39
A0
85
9F
A4
9F
A2
9F
80
9F
95
9F
8A9F
9D9F
36A0
3978
88
9F81
9F8B
9F25
DFF
8A
9F
9D
9F
36
A0
88
9F
81
9F
8B
9F
FE9F
9F9F
E59F
37EC
4D
9F91
9F95
9F2E
8DFF
FE
9F
9F
9F
E5
9F
4D
9F
91
9F
95
9F
99F
0
200
32C8
0
2
2
24
A2FF
9
9F
0
0
2
0
0
0
2
0
2
0
200
7981
2CAE
2
90
7730
78FF
Sadly still no updating. Also worth noting that when we send the slave draws 4.5ma. When the m3 master sends the slave draws 6.5ma. I have observed that the more traffic the more current so we are for sure missing something. Will see what I can see in the logs.
Re: Tesla Model 3 Battery Hacking
Posted: Mon Aug 10, 2020 4:00 pm
by Jack Bauer
Re: Tesla Model 3 Battery Hacking
Posted: Thu Aug 13, 2020 7:16 am
by Jack Bauer
Any one? or is it still the Tom and Damien show? If I had a euro for every off forum contact I've had about this topic then both of us could retire to Lanzarote and hold ev drag races on the beach each morning.
Re: Tesla Model 3 Battery Hacking
Posted: Thu Aug 13, 2020 9:43 am
by muehlpower
have you tried x38DC followed by xF300 8 times! ?
Re: Tesla Model 3 Battery Hacking
Posted: Thu Aug 13, 2020 2:32 pm
by Jack Bauer
Sorry I didnt see that. Will try thanks.
Re: Tesla Model 3 Battery Hacking
Posted: Thu Aug 13, 2020 6:34 pm
by tom91
Nah, probally good to try my code first. modified it to actually send out 0x2bfb
https://github.com/tomdebree/Tesla-Mode ... _Test_1tdb
Re: Tesla Model 3 Battery Hacking
Posted: Fri Aug 14, 2020 7:49 am
by Jack Bauer
Progress :
Code: Select all
IC 1 : | 3251mV| 0mV| 3264mV| 3272mV| 3264mV| 3266mV| 3264mV| 3266mV| 3266mV| 3270mV| 3265mV| 3270mV| 3270mV| 0mV| 0mV
IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV
C59E
0
649F
310F
10
A090
9F84
9F33
38FF
CF9F
659F
819F
2285
A2
9F80
9F95
9F22
5DFF
CF
9F
65
9F
81
9F
A2
9F
80
9F
95
9F
699F
799F
799F
9F2
88
9F81
9F8B
9F25
DFF
69
9F
79
9F
79
9F
88
9F
81
9F
8B
9F
AB9F
789F
B29F
4B6
4D
9F91
9F95
9F2E
8DFF
AB
9F
78
9F
B2
9F
4D
9F
91
9F
95
9F
AE9F
0
100
B49
0
2
2
24
A2FF
AE
9F
0
0
1
0
0
0
2
0
2
0
100
777
1CE
2
90
7730
78FF
So in this version I can now see tiny changes in the cell mv readings between each read. However, some voltages are reading 0 so I checked the pack with a meter. Only cell 14 is dead. All others around 3.2v. I am still unable to get the readings to update then affecting a cell voltage via a power supply which is strange.
Re: Tesla Model 3 Battery Hacking
Posted: Fri Aug 14, 2020 7:55 am
by Jack Bauer
Ok, tried something different. Put a 100w 230v light bulb across the pack and got :
IC 1 : | 3217mV| 0mV| 3208mV| 3236mV| 3204mV| 3233mV| 3225mV| 3231mV| 3208mV| 3237mV| 3229mV| 3235mV| 3226mV| 0mV| 0mV
IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV
Remove bulb :
IC 1 : | 3244mV| 0mV| 3257mV| 3265mV| 3257mV| 3259mV| 3257mV| 3258mV| 3259mV| 3262mV| 3258mV| 3263mV| 3252mV| 0mV| 0mV
IC 2 : | 3278mV| 3267mV| 3266mV| 3269mV| 3266mV| 3268mV| 3267mV| 3266mV| 3267mV| 3262mV| 3267mV| 3268mV| 0mV| 0mV| 0mV
edit: so looks like only ic1 is updating.
Re: Tesla Model 3 Battery Hacking
Posted: Fri Aug 14, 2020 8:12 am
by tom91
Some progress, is this with my latest version with 0x2BFB being sent?
You got a capture of this?
Re: Tesla Model 3 Battery Hacking
Posted: Fri Aug 14, 2020 8:43 am
by Jack Bauer
Yes newest code.
Two captures on the github :
https://github.com/damienmaguire/Tesla- ... nsy_Master
One with no load and the other with 100w 230v bulb applied approx 0.5sec into the capture and removed approx 0.5sec before capture end.
Re: Tesla Model 3 Battery Hacking
Posted: Fri Aug 14, 2020 9:33 am
by muehlpower
why don't you send Com (0x21f2, 0x4d00), only Com2?
Re: Tesla Model 3 Battery Hacking
Posted: Fri Aug 14, 2020 12:58 pm
by tom91
muehlpower wrote: ↑Fri Aug 14, 2020 9:33 am
why don't you send Com (0x21f2, 0x4d00), only Com2?
Trying to just have it match a capture, we can add and remove various things to see what changes.
Best is to start with a baseline that matches a capture that works as close as possible before adding parts to it.
Re: Tesla Model 3 Battery Hacking
Posted: Fri Aug 14, 2020 5:25 pm
by tom91
Cleaned up some more of the coding, would be good to get a couple of captures so we can get an idea of how we can check which modules are listening.
Give it a go Damien, please also take some captures. we are getting there slowly, seems like the modules do not require us to actually have a counter that counts up in the messages.
Re: Tesla Model 3 Battery Hacking
Posted: Sat Aug 15, 2020 1:10 pm
by Jack Bauer
Latest code. No load :
IC 1 : | 3251mV| 0mV| 3265mV| 3272mV| 3264mV| 3267mV| 3265mV| 3266mV| 3267mV| 3269mV| 3266mV| 3271mV| 3252mV| 0mV| 0mV
IC 2 : | 3285mV| 3278mV| 3277mV| 3279mV| 3279mV| 3266mV| 3265mV| 3264mV| 3265mV| 3263mV| 3265mV| 3265mV| 0mV| 0mV| 0mV
100w bulb load:
IC 1 : | 3227mV| 0mV| 3217mV| 3245mV| 3210mV| 3243mV| 3235mV| 3240mV| 3215mV| 3245mV| 3238mV| 3244mV| 3227mV| 0mV| 0mV
IC 2 : | 3260mV| 3252mV| 3250mV| 3255mV| 3251mV| 3240mV| 3216mV| 3219mV| 3221mV| 3209mV| 3242mV| 3228mV| 0mV| 0mV| 0mV
Re: Tesla Model 3 Battery Hacking
Posted: Sat Aug 15, 2020 1:12 pm
by Jack Bauer
Two new captures on the repo :
https://github.com/damienmaguire/Tesla- ... nsy_Master
same conditions as yesterday. Now looks like both ics are updating. Nice on Tom.
Re: Tesla Model 3 Battery Hacking
Posted: Sat Aug 15, 2020 1:14 pm
by Jack Bauer
PSU set at 2 amps on first 5 cells in the pack :
IC 1 : | 3249mV| 0mV| 3263mV| 3269mV| 3262mV| 3264mV| 3262mV| 3264mV| 3264mV| 3267mV| 3264mV| 3268mV| 3249mV| 0mV| 0mV
IC 2 : | 3665mV| 3666mV| 3673mV| 3631mV| 3681mV| 3263mV| 3262mV| 3261mV| 3263mV| 3260mV| 3263mV| 3263mV| 0mV| 0mV| 0mV
Can clearly see voltages at 3.6v:)
Re: Tesla Model 3 Battery Hacking
Posted: Sat Aug 15, 2020 1:18 pm
by Jack Bauer
Cells 5 through 10 on charge at 2 amps :
IC 1 : | 3248mV| 0mV| 3262mV| 3268mV| 3261mV| 3264mV| 3262mV| 3263mV| 3264mV| 3266mV| 3263mV| 3268mV| 3249mV| 0mV| 0mV
IC 2 : | 3310mV| 3305mV| 3304mV| 3305mV| 3305mV| 3605mV| 3674mV| 3701mV| 3884mV| 3645mV| 3262mV| 3262mV| 0mV| 0mV| 0mV
Re: Tesla Model 3 Battery Hacking
Posted: Sat Aug 15, 2020 1:21 pm
by Jack Bauer
Cell s 11-15 on charge :
IC 1 : | 3609mV| 2802mV| 3664mV| 3268mV| 3261mV| 3263mV| 3261mV| 3263mV| 3263mV| 3266mV| 3263mV| 3267mV| 3248mV| 0mV| 0mV
IC 2 : | 3306mV| 3302mV| 3301mV| 3302mV| 3302mV| 3297mV| 3296mV| 3296mV| 3288mV| 3296mV| 3605mV| 3675mV| 0mV| 0mV| 0mV
Re: Tesla Model 3 Battery Hacking
Posted: Sat Aug 15, 2020 1:25 pm
by Jack Bauer
Cells 16-20 on charge :
IC 1 : | 3278mV| 483mV| 3291mV| 3644mV| 3743mV| 3546mV| 3625mV| 3620mV| 3263mV| 3265mV| 3262mV| 3267mV| 3248mV| 0mV| 0mV
IC 2 : | 3304mV| 3299mV| 3299mV| 3300mV| 3300mV| 3289mV| 3288mV| 3288mV| 3280mV| 3287mV| 3290mV| 3291mV| 0mV| 0mV| 0mV
Re: Tesla Model 3 Battery Hacking
Posted: Sat Aug 15, 2020 1:28 pm
by Jack Bauer
and finally cells 21-25 on charge :
IC 1 : | 3275mV| 415mV| 3289mV| 3302mV| 3258mV| 3260mV| 3259mV| 3294mV| 4074mV| 3597mV| 3645mV| 3627mV| 3591mV| 0mV| 0mV
IC 2 : | 3303mV| 3298mV| 3298mV| 3299mV| 3299mV| 3287mV| 3287mV| 3286mV| 3279mV| 3285mV| 3288mV| 3288mV| 0mV| 0mV| 0mV