1
00:00:01,130 --> 00:00:02,030
Hi there.

2
00:00:02,030 --> 00:00:08,470
Welcome to my talk where I go through and brick a very expensive automobile, then I eventually make it faster.

3
00:00:08,490 --> 00:00:09,390
Hope you enjoy it.

4
00:00:09,390 --> 00:00:13,990
It was certainly the most complicated reverse engineering project I've ever worked on.

5
00:00:19,820 --> 00:00:21,560
So a little bit about me.

6
00:00:21,560 --> 00:00:22,920
My name is Patrick Kiley.

7
00:00:22,920 --> 00:00:26,720
I'm a member of the Penetration Testing Team at Rapid7.

8
00:00:27,160 --> 00:00:31,000
I've been working in the industry for about 17 years.

9
00:00:31,000 --> 00:00:35,240
I've done previous research that I've released on avionics security.

10
00:00:35,240 --> 00:00:41,520
I've done quite a bit of research specifically on internet-connected transportation platforms.

11
00:00:41,520 --> 00:00:48,260
I have experience in hardware hacking, internet of things, autonomous vehicles, and CAN bus.

12
00:00:51,270 --> 00:00:55,330
So here's a overview of all the topics that we're gonna cover.

13
00:00:56,050 --> 00:01:01,470
First, we're gonna go over the architecture of the Model S and specifically the battery management system.

14
00:01:01,790 --> 00:01:05,550
You'll find all that needs to be relevant when I explain some of the other stuff.

15
00:01:05,990 --> 00:01:11,350
The timeline of when the Performance Model S and Ludicrous were released.

16
00:01:11,350 --> 00:01:19,130
The hardware changes that have to occur in order to make a car move at Ludicrous speeds.

17
00:01:19,130 --> 00:01:26,630
The data stored within the diagnostic program that Tesla uses within its service center is called Toolbox.

18
00:01:27,330 --> 00:01:34,130
Some of the firmware changes, in fact, all of the firmware changes that have to occur to the battery management system to make it work.

19
00:01:34,130 --> 00:01:38,350
The process of modifying the high-current shunt.

20
00:01:38,370 --> 00:01:47,850
For those of you who haven't heard the term before, shunt is a method within electrical and electronics of measuring current using a known resistance value.

21
00:01:47,850 --> 00:01:57,390
And this is a device within the high-voltage battery that has to be modified in order to allow it to handle the power of Ludicrous.

22
00:01:57,390 --> 00:02:01,450
And it turns out it was a very important part of this whole process.

23
00:02:02,010 --> 00:02:22,030
And then we'll actually go over the upgrade process, how I failed and bricked the car, what I learned and had to have it towed across state lines, and some pretty cool things on how I was able to dig a little bit deeper on how the gateway works and some special files that it stores that determine the configuration of the car.

24
00:02:22,130 --> 00:02:25,290
And then next steps, can we actually take Ludicrous speed further?

25
00:02:25,290 --> 00:02:25,950
Should we?

26
00:02:26,070 --> 00:02:28,610
And what we need to do to make that happen.

27
00:02:34,560 --> 00:02:38,780
So a little bit about the architecture of the Model S overall.

28
00:02:39,640 --> 00:02:41,300
It has the central display.

29
00:02:41,300 --> 00:02:49,420
So if you sit in a Model S, there's a large screen to your right or to your left if you're a passenger or to your left if you're in a right-hand drive vehicle.

30
00:02:49,500 --> 00:02:51,820
And then there's also instrument cluster.

31
00:02:51,820 --> 00:02:59,340
Both of those actually run the NVIDIA Tegra up until recently where the central display switched over to Intel Atom.

32
00:02:59,500 --> 00:03:09,060
All this is gonna be, assuming it's an NVIDIA Tegra base because that Tegra has to be rooted for this research to work.

33
00:03:09,340 --> 00:03:13,600
The next component that's really critical to this is the gateway.

34
00:03:13,920 --> 00:03:20,260
The gateway sits between the central display, the instrument cluster and the rest of the vehicle.

35
00:03:20,300 --> 00:03:31,120
It acts as a firewall between the various CAN buses and between the CAN buses and the infotainment features as well as the internet connectivity and Wi-Fi connectivity, et cetera.

36
00:03:31,820 --> 00:03:37,680
The next component that's critical to this because that's where all the modifications in are the Powertrain CAN bus.

37
00:03:37,680 --> 00:03:41,320
This is a standard CAN bus running at 500 kilobits a second.

38
00:03:41,320 --> 00:03:49,640
It contains the battery management system, the drive units, all the charging and thermal controller set on that CAN bus.

39
00:03:50,080 --> 00:03:51,920
Beyond that, it's a standard vehicle CAN bus.

40
00:03:51,920 --> 00:03:58,000
It runs at, again, 500 kilobits a second, uses 11-bit arbitration IDs.

41
00:03:58,000 --> 00:04:00,340
And very importantly, it supports UDS.

42
00:04:00,800 --> 00:04:06,640
Many of the routines that you actually have to modify to do this require UDS to work.

43
00:04:06,780 --> 00:04:11,340
And having some knowledge of UDS turned out to be critical for me to do this research.

44
00:04:11,340 --> 00:04:13,100
I managed to learn quite a bit about it.

45
00:04:14,420 --> 00:04:17,940
So next we have the battery management system.

46
00:04:18,040 --> 00:04:23,640
Battery management system is a board that sits inside the battery pack at the rear.

47
00:04:24,240 --> 00:04:30,580
Primary microprocessor on is a TI TMS320C2809.

48
00:04:30,760 --> 00:04:32,380
There's a hardware backup for it.

49
00:04:32,380 --> 00:04:37,160
So in case there's some type of hardware failure, the hardware backup is an Altera CPLD.

50
00:04:37,860 --> 00:04:42,140
It's critical for one step of the process that we're going to do later.

51
00:04:42,140 --> 00:04:45,800
And then there's a current shunt and pre-charge resistor.

52
00:04:46,840 --> 00:04:50,040
The full reversing of these components is an ongoing project.

53
00:04:50,040 --> 00:04:57,540
So if you want to help reach out to me, because there's some of the skills like assembly for the TMS320 that I'm not very good with.

54
00:04:58,860 --> 00:05:02,680
So here's a skipped over some of the steps because it's easier to show on the screen.

55
00:05:02,680 --> 00:05:09,220
The high voltage contactors, you can see in the middle of those round circles with two large terminal posts on them.

56
00:05:09,300 --> 00:05:14,040
The high current shunt that sits, connects directly to the battery management system.

57
00:05:14,040 --> 00:05:19,700
It sits between one of the bus bars going from the battery to the contactors.

58
00:05:19,880 --> 00:05:21,140
There's a pre-charge resistor.

59
00:05:21,140 --> 00:05:31,600
So the way that the contactors are engaged are, when the vehicle wants to enable battery power to the rest of the vehicle, one of the contactors closes.

60
00:05:31,700 --> 00:05:43,380
And then the pre-charge resistor sits there as a slow, relatively slow current path for the rest of the high voltage system to come up to match the voltage of the battery.

61
00:05:43,380 --> 00:05:46,760
And it's only then that the BMS allows the other contactors to close.

62
00:05:46,760 --> 00:05:56,560
So you don't get inrush current and you don't get damaged components from the massive amount of power that's in that battery system.

63
00:05:56,800 --> 00:06:01,680
From there, we actually have 16 battery management boards.

64
00:06:01,680 --> 00:06:08,920
These contain all the bleed resistors so it can balance the voltage across all the packs.

65
00:06:08,920 --> 00:06:14,200
There are 96 of them, I believe six in each of the 16 modules.

66
00:06:14,200 --> 00:06:22,700
And then the BMDs also manage the, they monitor the temperature and of course the voltage of the individual battery modules.

67
00:06:22,900 --> 00:06:25,780
And then the last thing you see on the far right, voltage sense.

68
00:06:26,820 --> 00:06:34,000
Voltage sense is the component that actually sits on the four contactors of the battery.

69
00:06:34,000 --> 00:06:46,260
So not only can it actually detect when the battery contactors are open or closed, so if they're not in a state where the BMS expects them, but they're also used to measure the current voltage level coming from the battery.

70
00:06:50,510 --> 00:06:55,730
So a little bit of history, and this will be relevant in just a manual CY.

71
00:06:55,730 --> 00:07:03,350
So in 2014 of October, the performance dual motor Model S was announced.

72
00:07:03,390 --> 00:07:15,710
This was ridiculously fast when it was released, something like 3.4 seconds, zero to 60, but it wasn't until July of the next year that Ludicrous was announced.

73
00:07:15,710 --> 00:07:24,330
So when Ludicrous was announced, they announced it as a $10,000 option on new models of the new versions of the Model S.

74
00:07:24,670 --> 00:07:26,770
And it was $10,000 for a while.

75
00:07:26,770 --> 00:07:30,350
I think eventually they gave it away for free, but they keep going back and forth on it.

76
00:07:30,350 --> 00:07:31,530
That's really up to them.

77
00:07:31,530 --> 00:07:38,170
So it's always been kind of an optional item to make the car a little bit faster and have Ludicrous power on it.

78
00:07:38,790 --> 00:07:48,830
So $10,000 for new buyers, but as an offer for existing P85D owners, they offered it as a $5,000 upgrade.

79
00:07:49,610 --> 00:07:56,030
And the press release actually mentioned that the upgrade involved putting in new contactors and a pyrofuse.

80
00:07:56,370 --> 00:08:06,550
But after a while, of many of the performance battery packs, so the battery packs that would go into the car would already be capable of running Ludicrous mode and they just wouldn't have the feature turned on.

81
00:08:07,890 --> 00:08:16,690
And when I say Ludicrous capable, what I mean is that all you have to do is modify a single file on the gateway of the vehicle.

82
00:08:16,690 --> 00:08:21,610
So you route the vehicle, modify the single file, and it has Ludicrous mode.

83
00:08:22,910 --> 00:08:35,610
All the P100Ds, as far as I understand, and all the newer Model S's that are dual motor performance, all you have to do is modify this single line on the gateway.

84
00:08:35,610 --> 00:08:38,190
So I've got a little bit of information about that.

85
00:08:38,190 --> 00:08:43,030
So the gateway has this file called internal.dat.

86
00:08:43,030 --> 00:08:45,890
It stores the car's configuration.

87
00:08:46,390 --> 00:09:00,290
It has like, you know, for example, the type of wheels that are on it so that the displays actually reflect correctly, the color of the car, the version of the thermal controller, the version of the various drive units, and the version of the battery pack.

88
00:09:00,950 --> 00:09:03,930
Bunch of other configurations it also controls.

89
00:09:03,930 --> 00:09:09,950
It's also the file that is modified when I heard about how people had supercharging disabled.

90
00:09:09,990 --> 00:09:11,350
That's where it's disabled.

91
00:09:11,350 --> 00:09:14,150
It's actually disabled client side on the vehicle.

92
00:09:14,730 --> 00:09:29,730
But for the purposes of this talk, all you have to do is from a rooted vehicle, request this internal.dat file, make a quick file editor change of which the, you know, VI and nano are both there.

93
00:09:29,730 --> 00:09:36,210
So you go into internal.dat, add this line, performance add-on, and add the value of one.

94
00:09:36,890 --> 00:09:42,830
From there, you copy it back over to the gateway, reboot the gateway, and then boom, the vehicle's ludicrous.

95
00:09:43,030 --> 00:09:44,910
But that's not the case for the earlier models.

96
00:09:44,910 --> 00:09:47,770
The earlier models where you actually had to do quite a bit to the firmware.

97
00:09:47,870 --> 00:09:49,390
I'm just talking about the later ones.

98
00:09:49,390 --> 00:09:54,570
So the later ones that were ludicrous capable already, in other words, the battery was already capable of ludicrous speeds.

99
00:09:54,650 --> 00:09:56,430
This is the only thing you have to change.

100
00:09:59,140 --> 00:10:10,800
So, okay, kind of alluded to earlier, the earlier vehicles, you know, so some of the 90s, all of the 85s released up to that point required hardware.

101
00:10:10,800 --> 00:10:12,680
They required modification of the current shunt.

102
00:10:12,680 --> 00:10:15,700
You had to reflash the firmware in the battery management system.

103
00:10:15,900 --> 00:10:17,980
You had to recalibrate the current shunt.

104
00:10:18,220 --> 00:10:28,320
Only then could you actually add that value to the gateway file, internal.dat, and actually reconfigure it to support ludicrous speed.

105
00:10:28,320 --> 00:10:31,660
If you did it before that, it wouldn't show, actually give you the speed.

106
00:10:31,660 --> 00:10:35,380
It would show you the setting, but it wouldn't go any faster.

107
00:10:37,160 --> 00:10:38,360
So we did this.

108
00:10:38,440 --> 00:10:40,540
I actually upgraded an owner vehicle.

109
00:10:41,100 --> 00:10:44,820
We have a contact in Southern California.

110
00:10:44,820 --> 00:10:47,160
For those who don't know, I'm actually located in Las Vegas.

111
00:10:47,400 --> 00:10:53,480
So I threw some online forums of someone else who was actually hacking on their Tesla.

112
00:10:54,540 --> 00:10:55,760
Guy owned a body shop.

113
00:10:55,760 --> 00:10:57,580
He was willing to let me loan his lift.

114
00:10:57,580 --> 00:11:01,880
So a lift isn't something you can just kind of go to a guy and say, hey, can I borrow your lift for a couple of days?

115
00:11:02,480 --> 00:11:04,780
Because they'd be like, no, I have this thing called insurance.

116
00:11:04,780 --> 00:11:06,720
And no, just go away.

117
00:11:06,920 --> 00:11:08,980
So he let me do this, very gracious.

118
00:11:08,980 --> 00:11:10,020
Thank you, Bitbuster.

119
00:11:10,120 --> 00:11:12,060
Call you out here at the end.

120
00:11:12,680 --> 00:11:19,780
But another little quick anecdote, this guy who loaned me this garage, he was actually hacking on a Model S.

121
00:11:19,780 --> 00:11:27,120
He took the car and actually enabled autopilot version two on an autopilot one car.

122
00:11:27,120 --> 00:11:39,480
So he added all eight of the cameras, put in the newer computer, replaced the steering rack and a bunch of other stuff and actually got retrofitted autopilot two.

123
00:11:39,580 --> 00:11:43,780
So all the full self-driving stuff to an older model vehicle.

124
00:11:44,020 --> 00:11:45,020
Pretty cool stuff.

125
00:11:45,020 --> 00:11:46,200
I was pretty impressed with that.

126
00:11:46,200 --> 00:11:48,700
And I believe he's the first person in the world to ever do that.

127
00:11:50,300 --> 00:11:52,520
So here's a picture of the pack dropped.

128
00:11:52,820 --> 00:11:55,720
It was fairly complicated, but not too hard.

129
00:11:55,720 --> 00:12:02,680
You know, you remove the central bolts and then lower it down onto this big heavy rack that can support the weight of the entire vehicle.

130
00:12:02,680 --> 00:12:05,760
And then you remove the ones along the edges and then raise the car back up.

131
00:12:05,880 --> 00:12:07,580
Battery pack drops out.

132
00:12:07,580 --> 00:12:10,080
All the electrical connections are quick disconnects.

133
00:12:10,080 --> 00:12:11,940
The coolant is a quick disconnect.

134
00:12:11,980 --> 00:12:19,100
I believe this is because originally Tesla was toying around with this idea of having swappable battery packs for people on the road.

135
00:12:19,100 --> 00:12:21,420
I believe they had a pilot program at one point.

136
00:12:21,700 --> 00:12:23,620
It just never really seemed to go anywhere.

137
00:12:23,620 --> 00:12:29,500
So they make it really easy to drop the pack as long as you have access to the appropriate equipment.

138
00:12:31,780 --> 00:12:41,240
So here in this next picture, we have a picture of the fuse bay, which is up at the front of the vehicle on the opposite side of where the coolant tubes enter the pack.

139
00:12:41,300 --> 00:12:47,360
Here, the cover over the fuse is removed and the old fuse is visible, the fuse that actually has to come out.

140
00:12:49,200 --> 00:12:57,820
And then on the right, we have the contactor bay with it opened up, the cover plate removed and the old contactors removed.

141
00:12:58,920 --> 00:13:01,860
All right, here we have a close-up of the current shunt.

142
00:13:01,860 --> 00:13:03,860
You can see it sits right next to the BMS.

143
00:13:05,800 --> 00:13:08,580
And then the new contactors are installed at this point.

144
00:13:11,300 --> 00:13:13,940
Here's a close-up of the BMS.

145
00:13:14,440 --> 00:13:21,160
You can see that it just sits at the very bottom of the bay and it's just kind of on the right side or left if you're staring at the car from the front.

146
00:13:21,160 --> 00:13:22,880
But from my perspective, it's on the right.

147
00:13:24,120 --> 00:13:32,440
And you can see the TMS 320 right there, kind of in the middle, CPLD off to the right and what is that between the two?

148
00:13:32,580 --> 00:13:33,780
Enhance.

149
00:13:34,020 --> 00:13:35,740
Oh, that's interesting.

150
00:13:35,740 --> 00:13:37,780
That label says JTAG.

151
00:13:38,260 --> 00:13:40,160
Get into that later.

152
00:13:40,720 --> 00:13:42,440
Yeah, it actually has JTAG.

153
00:13:42,440 --> 00:13:48,000
The BMSs that I messed with on my bench, none of them actually had that connector.

154
00:13:48,000 --> 00:13:57,760
It was all covered over with conformal coating but the one in the car that I modified actually had these headers on here that say JTAG.

155
00:13:57,760 --> 00:13:59,160
Kind of interesting.

156
00:14:01,180 --> 00:14:06,560
Another thing that you have to do is you actually have to replace a second fuse.

157
00:14:06,560 --> 00:14:08,760
So there's older vehicles.

158
00:14:08,760 --> 00:14:11,140
This is underneath the rear seat.

159
00:14:11,320 --> 00:14:16,960
There's a fuse between the center thing called the high voltage junction box and the front drive unit.

160
00:14:17,240 --> 00:14:25,340
So one of the things that I kind of found by digging around in Toolbox that we'll get into later is you actually have to replace this fuse with a bus bar.

161
00:14:25,340 --> 00:14:26,160
Yeah, that's right.

162
00:14:26,160 --> 00:14:30,480
The instructions say you replace the fuse with a bus bar.

163
00:14:30,480 --> 00:14:31,560
So we did that.

164
00:14:32,160 --> 00:14:34,100
Here's the front fuse.

165
00:14:34,100 --> 00:14:38,120
Here's the front fuse removed and here's the front fuse replaced with the bus bar.

166
00:14:38,120 --> 00:14:46,900
Put it all back together, put the seat back in, connect all the high voltage interlocks, back up and that part is done.

167
00:14:47,460 --> 00:14:48,800
So what about front bar?

168
00:14:48,800 --> 00:14:52,420
This is really where the majority of my time went.

169
00:14:52,760 --> 00:14:56,040
The physical work was actually pretty easy to figure out.

170
00:14:56,040 --> 00:14:59,740
Tesla actually publicly talked about the components that were involved.

171
00:15:02,050 --> 00:15:04,370
The firmware was the hard part.

172
00:15:04,850 --> 00:15:07,230
And to do this, we need to dig into some Python.

173
00:15:07,730 --> 00:15:11,330
Tesla uses a diagnostic tool called Toolbox.

174
00:15:11,330 --> 00:15:16,130
It's a Python Windows executable.

175
00:15:16,130 --> 00:15:16,850
That's right.

176
00:15:16,850 --> 00:15:20,890
It's an executable written in Python, but it runs in Windows.

177
00:15:20,890 --> 00:15:23,990
So it's been compiled and then encrypted.

178
00:15:23,990 --> 00:15:29,870
It uses these plugins that are compiled and encrypted, it's designed to work without a connection to the internet.

179
00:15:29,870 --> 00:15:40,370
So all the information that you need to decrypt these indual files called scrambled, as you can kind of see in this image, are actually on the executable.

180
00:15:40,370 --> 00:15:46,470
So if you were able to get an image or grab the correct files, you're able to decrypt these modules.

181
00:15:46,470 --> 00:15:49,950
To be completely honest, this wasn't my work to figure this out.

182
00:15:49,950 --> 00:15:52,430
This was other people that actually figured this out.

183
00:15:53,150 --> 00:15:55,890
They had done some of the decompiling as well.

184
00:15:55,890 --> 00:16:03,770
So you can use uncompile six to actually run the PYC compiled files and get Python source code.

185
00:16:03,970 --> 00:16:05,270
I did a lot of that.

186
00:16:05,270 --> 00:16:13,590
I wrote a really, really ugly Python script to iterate through every single one of the scramble files, because the scramble files are also all kind of zipped up together.

187
00:16:13,590 --> 00:16:18,330
There's a bunch of separate source code files underneath each one in separate directories.

188
00:16:18,330 --> 00:16:26,170
So I iterated through them all, ran uncompile against them, and then did some additional work that I'll talk about in the next slides.

189
00:16:26,270 --> 00:16:29,090
But they also left all the source code comments in place.

190
00:16:29,090 --> 00:16:29,910
So thank you.

191
00:16:29,910 --> 00:16:32,910
That actually helped me figure this out.

192
00:16:33,650 --> 00:16:37,130
So this is an example of just the header of a file.

193
00:16:37,430 --> 00:16:38,990
This is the UDS one.

194
00:16:39,430 --> 00:16:44,130
You can see it actually has all of the comments here in place.

195
00:16:44,330 --> 00:16:52,630
Here's the headers added by uncompile, but it actually shows when it was compiled, who compiled it, who's the author, gives me his email address too.

196
00:16:53,090 --> 00:16:55,630
And then the copyright information on it.

197
00:16:58,270 --> 00:17:02,570
So here's the kind of thing that I was able to actually see by digging through all these.

198
00:17:03,050 --> 00:17:09,510
This is one of the specific files used to configure for Ludicrous.

199
00:17:09,510 --> 00:17:11,110
So this is the performance add-on config.

200
00:17:11,110 --> 00:17:14,770
This is the one that modifies the gateway if you don't do it manually like I did.

201
00:17:14,910 --> 00:17:21,350
And it tells you that you first have to verify the vehicle can be configured.

202
00:17:22,630 --> 00:17:29,510
For Ludicrous mode, the vehicle needs to be all wheel drive and have a battery pack config that supports the 1500 amp current discharge.

203
00:17:29,510 --> 00:17:32,230
So this is assuming the battery pack has already been modified.

204
00:17:32,790 --> 00:17:37,210
There are other routines in Toolbox that actually go through this.

205
00:17:37,950 --> 00:17:42,450
One of the most important things in these Toolbox files were these data structures.

206
00:17:42,450 --> 00:17:49,970
So you can see these two variable names, three variable names, qt-resource-data, qt-resource-name, qt-resource-struct.

207
00:17:50,170 --> 00:17:56,130
My really, really ugly Python script went through those and actually converted those back into binary.

208
00:17:56,670 --> 00:18:03,170
And then from there, I ran binwalk against those binary files and I got a ton of useful information.

209
00:18:05,980 --> 00:18:10,860
Things like this, this is the pointer that tells me exactly how to do it.

210
00:18:10,860 --> 00:18:17,200
It says that, so we already know that the donor vehicle has a pack ID of 57.

211
00:18:17,200 --> 00:18:20,960
I didn't say that previously, but the donor vehicle had a pack ID of 57.

212
00:18:20,960 --> 00:18:29,720
It says, okay, so if you're gonna change pack ID, battery pack ID 57 to 70, here are the three firmware files that you need.

213
00:18:29,760 --> 00:18:32,040
Okay, well, where do I get those firmware files?

214
00:18:32,160 --> 00:18:34,700
Turns out they were stored within those Python data structures.

215
00:18:34,700 --> 00:18:39,520
When I ran binwalk against it, I actually got a tar file of firmware.

216
00:18:39,520 --> 00:18:44,160
And when you untar that file, you get every single one of these hex files of firmware.

217
00:18:44,160 --> 00:18:51,060
It was all stored within the Python executable, all right there, ready to be used.

218
00:18:51,060 --> 00:18:55,140
So for this upgrade, pack 57 becomes pack 70.

219
00:18:55,140 --> 00:19:01,180
Pack 57 is a 1300 amp battery pack, pack 70 is a 1500 amp.

220
00:19:02,240 --> 00:19:11,400
One of the things that I kind of did that I thought was interesting, since we're still talking about the firmware, is I did some differential analysis of the bootloaders.

221
00:19:11,400 --> 00:19:14,540
So I have the two different bootloaders here, 57 and 70.

222
00:19:14,540 --> 00:19:17,240
You can see that there really weren't that many changes.

223
00:19:17,260 --> 00:19:20,100
On one line, it's a single bit that changes.

224
00:19:21,060 --> 00:19:30,220
The other one that, you know, 537 and 730 that you see here are just the R and then the actual number.

225
00:19:30,220 --> 00:19:31,800
One is 57, one is 70.

226
00:19:31,800 --> 00:19:36,540
And then we have this short little string of, you know, group of hex characters.

227
00:19:36,540 --> 00:19:40,320
And that was the only change between the different versions of the bootloader.

228
00:19:42,920 --> 00:19:44,520
But it's not the application file.

229
00:19:44,520 --> 00:19:46,900
Application file had a few, a bunch of different changes.

230
00:19:46,900 --> 00:19:49,500
It's just the bootloaders themselves were all very, very similar.

231
00:19:49,500 --> 00:19:57,240
So to do this upgrade, all the instructions and files that you need for this were stored in these toolbox files.

232
00:19:59,300 --> 00:20:02,960
There also were a bunch of other really helpful files.

233
00:20:02,960 --> 00:20:14,980
DBC files, for those of you who've hacked on a vehicle before, DBC is the instruction file that stores all of the various CAN bus signals so that you can interpret them.

234
00:20:14,980 --> 00:20:21,400
And these individual DBC files for all the various CAN buses of the vehicle were stored within toolbox.

235
00:20:21,600 --> 00:20:32,520
The ODX files, ODX is a XML style format that defines how to do diagnostics, how to do firmware upgrades, how to get security access.

236
00:20:33,080 --> 00:20:36,340
A bunch of other stuff are stored in kind of the ODX file format.

237
00:20:36,340 --> 00:20:41,020
So the diagnostic routines are ODX, the CAN bus interpretation routines are DBC.

238
00:20:41,880 --> 00:20:46,640
And then there were also files that stored the calibration data for the shunt.

239
00:20:46,640 --> 00:20:48,780
Those are stored also in a Python pickle.

240
00:20:49,280 --> 00:21:04,220
Turns out that every single vehicle that was eligible for ludicrous upgrades by upgrading the battery had the shunt calibration values stored as an array within this Python pickle file.

241
00:21:04,220 --> 00:21:14,620
So you have to actually look up the shunt on the vehicle that you're upgrading, compare it to this pickle file and get these shunt calibration values that I'm gonna show you in a little bit.

242
00:21:15,320 --> 00:21:22,420
And then of course, there are all these text comments and other data structures that kind of eventually allowed me to piece together the process.

243
00:21:23,620 --> 00:21:26,700
So kind of talk a little bit more about UDS.

244
00:21:26,700 --> 00:21:28,360
Here's what a UDS file looks like.

245
00:21:28,360 --> 00:21:30,560
This is the one for actually shunt calibration.

246
00:21:30,560 --> 00:21:37,360
It shows that there are all these parameters, HWID, CGI1, CAU1, there's also a CRC value

247
00:21:40,420 --> 00:21:43,220
and a serial number, a serial number.

248
00:21:43,220 --> 00:21:49,120
And again, CAN networks use a DVC file, UDS use ODX or GMD.

249
00:21:49,880 --> 00:21:57,020
So I use the commercial tool Vehicle Spy to actually do the next steps of this research.

250
00:21:57,020 --> 00:22:08,520
I took these DVC files and these ODX files and imported them to Vehicle Spy, plugged it into the bench, plugged it into an actual vehicle and just sat there and listened to traffic so I could try and figure it out.

251
00:22:08,540 --> 00:22:22,420
So it turns out that the ID's 232, the arbitration ID is 232 for the BMS, 266 and 2E5 for the two drive inverters, they identify max power, those are variables.

252
00:22:22,420 --> 00:22:26,360
They vary based on state of charge, temperature and power recently used.

253
00:22:26,480 --> 00:22:42,640
On Sunday, I'm actually gonna have an in-depth, a deep dive into these DVC files and some of the information because I wanna actually map out the entire power curve to see if I can put that back and actually figure out where the power curve is stored in the BMS firmware.

254
00:22:43,100 --> 00:22:50,500
But check that out if you wanna actually see a little bit further into the talk than what I'm able to cover on this.

255
00:22:50,740 --> 00:22:56,760
So what a DVC does, this is what raw CAN bus traffic looks like.

256
00:22:56,820 --> 00:23:02,700
You can see all the IDs, you know, 102 through 302 down here, and you just see a bunch of data.

257
00:23:02,700 --> 00:23:07,000
But once you put in a DVC file, you can actually translate it all.

258
00:23:07,000 --> 00:23:15,160
So you can actually see that all the values for BMS basically means that this is the BMS who's actually sending this.

259
00:23:15,860 --> 00:23:17,420
You can see the power available.

260
00:23:17,420 --> 00:23:20,520
This is power available before the drive units are engaged.

261
00:23:20,520 --> 00:23:29,820
So this is just the car sitting in an off mode before you press the brake pedal and engage the drive units and wake the car up all the way.

262
00:23:30,940 --> 00:23:35,080
So again, ODX routines for shunt calibration.

263
00:23:35,080 --> 00:23:43,320
Here's the actually ODX routine imported into Vehicle Spy for actually doing the shunt calibration.

264
00:23:43,320 --> 00:23:49,480
So what you do is you actually connect to the car, read the value of the shunt.

265
00:23:49,480 --> 00:23:51,860
You actually have to do some firmware stuff, but I'll go over that in a minute.

266
00:23:51,920 --> 00:23:53,700
And then modify these values.

267
00:23:53,700 --> 00:23:56,280
So these are values that are already modified.

268
00:23:56,580 --> 00:24:05,000
The reason thing I thought was interesting is the CGI1 and CAE1 values are all identical for a ludicrous vehicle where they weren't before.

269
00:24:05,320 --> 00:24:07,840
And then we have a serial number and a CRC.

270
00:24:07,840 --> 00:24:09,380
And then of course the hardware ID.

271
00:24:09,880 --> 00:24:12,260
This is actually, it shows write success with that.

272
00:24:12,260 --> 00:24:14,800
This is actually a read function.

273
00:24:15,100 --> 00:24:18,000
So the 23 is a read function.

274
00:24:18,920 --> 00:24:21,280
There's a separate function for actually writing the shunt.

275
00:24:21,280 --> 00:24:25,360
And again, I actually demonstrate the process on Sunday in the deep dive.

276
00:24:26,460 --> 00:24:35,000
So one of the things I found out by building this all on a bench and doing this work is the shunt also needed a hardware modification.

277
00:24:37,280 --> 00:24:47,020
After I did the upgrade on a bench, I kept getting this error message that would pop up on the central display.

278
00:24:47,020 --> 00:24:52,400
And also, you know, within the DVCs of a CAN bus, it gives you arrays of all the various error messages.

279
00:24:52,400 --> 00:24:55,740
And it talks about overcurrent sense.

280
00:24:55,740 --> 00:25:03,960
There's a particular error message that just popped up showing overcurrent sense after I modified the firmware.

281
00:25:03,960 --> 00:25:06,440
But the error was not there before.

282
00:25:07,540 --> 00:25:17,020
So digging into this, what I did is I actually made a breakout board and used a logic analyzer and analyzed all the signals coming off of this shunt.

283
00:25:17,020 --> 00:25:21,440
Actually, it turns out it's a very simple communications protocol that it used.

284
00:25:21,440 --> 00:25:26,720
But this one wire, as it turns out, eventually connects to the CPLD.

285
00:25:26,720 --> 00:25:35,800
So it looks like that there's a sensor within this shunt that for ludicrous power, they want disconnected.

286
00:25:35,800 --> 00:25:38,240
They don't want it to be able to communicate to the CPU DLD.

287
00:25:38,240 --> 00:25:47,680
And since the CPLD didn't change, assuming it has something to do with it, you know, the current values going through the CPLD, they didn't want to modify.

288
00:25:47,680 --> 00:25:49,080
Tesla didn't want them modified.

289
00:25:49,480 --> 00:25:53,620
So when this wire was disconnected, that error message went away.

290
00:25:53,620 --> 00:26:03,620
So that basically tells me that there's a wire that has to be disconnected during the process of actually doing this upgrade.

291
00:26:04,380 --> 00:26:20,440
So again, go to California, drop the battery pack, drain the battery as much as possible, do all the hardware stuff, modify the shunt, disconnect that wire, very scary stuff.

292
00:26:20,940 --> 00:26:28,600
And then there's actually these special gloves that I purchased, special gloves and special socket wrenches that are used when you're dealing with high voltage.

293
00:26:28,600 --> 00:26:32,640
They're a rubber glove with a leather over lining.

294
00:26:32,640 --> 00:26:36,860
And then you're just careful about, you know, where you're standing and proximity to the other components.

295
00:26:36,860 --> 00:26:45,100
And even though the fuse isolates you, there's still enough of a charge and something where you can shock yourself.

296
00:26:45,100 --> 00:26:49,340
And again, if you're touching the wrong things, you can actually hurt yourself.

297
00:26:49,340 --> 00:26:52,140
So there's quite a few precautions you actually have to do.

298
00:26:52,140 --> 00:26:56,400
I talked to a few Tesla techs and they told me what the gloves were that they were.

299
00:26:56,400 --> 00:27:00,540
So I ordered a set of those and used all possible precautions for doing that.

300
00:27:00,760 --> 00:27:05,320
So we dropped the pack, do all the hardware stuff, reinstall the pack.

301
00:27:05,320 --> 00:27:21,680
So the reinstalling the pack was probably the most pucker factor part of the whole install because I was really nervous about having a rich rebuilds moment and actually damaging one of the leads because then I'd have to leave the vehicle there for a long time and have the customer angry at me.

302
00:27:21,680 --> 00:27:38,500
So I used a bore scope, both back here at the battery pack, these are the main battery pack contacts, going back into the battery and then up front where the coolant lines were, I scoped those and then just very slowly lowered the vehicle onto them all.

303
00:27:38,500 --> 00:27:40,100
Everything went flawlessly.

304
00:27:41,060 --> 00:27:49,420
Reinstalled all the hardware, lifted the car back up, verified everything, dropped it completely off the lift and then had to do all the firmware stuff.

305
00:27:49,420 --> 00:27:54,620
So it turns out you have to actually flash the BMS with special firmware.

306
00:27:54,620 --> 00:28:00,900
There was those three files that actually says that to do the shunt calibration, you load this file onto the BMS.

307
00:28:00,900 --> 00:28:03,980
So there's a special application file just for doing the shunt calibration.

308
00:28:04,220 --> 00:28:08,640
Look up the shunt value, recalibrate the shunt with the value based on the serial number.

309
00:28:08,840 --> 00:28:12,560
I had already extracted that serial number and validated that it was in the table.

310
00:28:12,560 --> 00:28:14,020
So I knew I was okay there.

311
00:28:14,020 --> 00:28:16,340
That all went without a hitch.

312
00:28:16,940 --> 00:28:33,100
Flash the BMS with its new bootloader, flash the BMS with its new application firmware, updated internal.dat, changed the pack ID, and then tried to do a firmware redeploy, which is the thing that you have to do after you change any component on the vehicle and then drive away,

313
00:28:33,100 --> 00:28:33,700
right?

314
00:28:33,800 --> 00:28:35,580
No, no.

315
00:28:35,580 --> 00:28:37,280
This is where the fun begins.

316
00:28:38,200 --> 00:28:42,140
I used every known technique that I've used before.

317
00:28:42,140 --> 00:28:43,540
I've tried putting on new firmware.

318
00:28:43,540 --> 00:28:45,440
I messed with this for a day and a half.

319
00:28:45,760 --> 00:28:50,440
I think I aged myself quite a bit, but I didn't want to stress myself out.

320
00:28:51,080 --> 00:28:52,240
It failed.

321
00:28:52,240 --> 00:28:54,900
It would not redeploy.

322
00:28:54,980 --> 00:28:56,460
It would not reinstall.

323
00:28:56,460 --> 00:28:58,800
I was getting an error every single time.

324
00:28:59,040 --> 00:29:08,780
So I started logging a lot of data, tried to troubleshoot, couldn't figure it out, was stressed out.

325
00:29:08,840 --> 00:29:17,340
Finally just said, screw it, towed the car from Manchurian-Cucamonga back to Vegas so I can continue to work on it.

326
00:29:17,340 --> 00:29:21,600
But it only cost $360 or $3,600.

327
00:29:22,020 --> 00:29:24,820
So not great, not terrible, right?

328
00:29:25,240 --> 00:29:27,020
But I learned something cool.

329
00:29:27,800 --> 00:29:29,440
I was able to figure something else out.

330
00:29:29,440 --> 00:29:42,660
So flew home, started messing with my bench, trying to replicate this condition, dug through my error logs that I copiously captured and I was noticing an error mentioning something called firmware.rc.

331
00:29:42,660 --> 00:29:45,180
The file was generating some type of error.

332
00:29:45,920 --> 00:29:52,300
It turns out the gateway uses this as a validation check and the values in it are calculated during the upgrade and redeploy.

333
00:29:55,140 --> 00:29:59,180
So in this file stores all these CRC values.

334
00:29:59,180 --> 00:30:01,800
So I had seen one other reference to it.

335
00:30:01,980 --> 00:30:08,220
The Tencent guys had done a previous Tesla hacking presentation where they talked about how the gateway used this file.

336
00:30:08,480 --> 00:30:16,700
So I went to the gateway and said, instead of gwtransferinternal.dat, gwtransferfirmware.rc and boom, it gave me the file.

337
00:30:16,780 --> 00:30:18,920
I saw it and it had all these CRC values.

338
00:30:18,920 --> 00:30:39,340
So all I had to do was look up from the, there's a map of files for this specific BMS firmware that it's supposed to be running for that pack ID and that version of software, made sure that version of software or firmware was running on the BMS and then grabbed its CRC value.

339
00:30:39,560 --> 00:30:44,240
Replaced the CRC value in firmware.rc with the value for the new pack ID.

340
00:30:45,540 --> 00:30:49,880
And then if you look here at the end, you can see there's a separate one for file CRC.

341
00:30:50,920 --> 00:30:58,460
There's even little values for the door handles, this drfp and drrp, those are values for the various door handles.

342
00:30:58,720 --> 00:31:03,000
So if you upgrade the door handle, the new firmware, firmware.rc has to be changed.

343
00:31:04,280 --> 00:31:11,300
It turns out I had a new door handle that I actually had to change to, but it wasn't causing an error that wasn't causing the vehicle to be able to operate.

344
00:31:11,300 --> 00:31:16,660
So what you do is you strip off the CRC line, calculate the new CRC.

345
00:31:16,660 --> 00:31:18,960
It turns out it's a jammed CRC 32.

346
00:31:18,960 --> 00:31:21,380
Someone else figured that out while they're helping me.

347
00:31:21,380 --> 00:31:22,840
I didn't figure that out myself.

348
00:31:24,440 --> 00:31:26,300
And then put the file back on the gateway.

349
00:31:26,300 --> 00:31:31,780
And after I did that, the car woke up, the errors cleared, and that was the problem.

350
00:31:31,780 --> 00:31:34,500
And I eventually figured out the reason for the other failure.

351
00:31:35,000 --> 00:31:37,540
I'm not gonna talk about that, it's really embarrassing.

352
00:31:37,840 --> 00:31:41,340
It was something I added to the car that it didn't have, that it didn't need.

353
00:31:41,960 --> 00:31:46,460
But yeah, hit me up with a beer sometime and I'll talk about it.

354
00:31:48,720 --> 00:31:51,760
So here is the power before and after the upgrade.

355
00:31:51,760 --> 00:31:54,600
I grabbed the CAN bus data before.

356
00:31:54,860 --> 00:31:58,180
Before the upgrade, it had 1305 amps available.

357
00:31:58,440 --> 00:31:59,660
These are static values again.

358
00:31:59,660 --> 00:32:01,840
These aren't the ones that are available based on state of charge.

359
00:32:01,840 --> 00:32:03,120
These are a hard limit.

360
00:32:03,480 --> 00:32:06,480
After the upgrade, it had 1516 amps.

361
00:32:06,480 --> 00:32:15,720
But it actually has a separate CAN bus line 202 instead of 702, the debug one, that actually has a slightly lower value.

362
00:32:15,720 --> 00:32:17,040
And I have no idea why.

363
00:32:17,040 --> 00:32:20,500
So if someone from Tesla wants to tell me, I'll keep it to myself.

364
00:32:20,500 --> 00:32:29,940
I'm just really curious why the vehicle has that extra 16 plus eight, 24 amps of power missing.

365
00:32:30,280 --> 00:32:34,960
Actually 23.6 amps of power missing.

366
00:32:34,960 --> 00:32:38,680
So if you can tell me, I'm really curious about that.

367
00:32:38,680 --> 00:32:43,220
It doesn't look like there's any derating going on because that value right above it is there.

368
00:32:43,220 --> 00:32:44,540
It says derating active zero.

369
00:32:44,540 --> 00:32:47,820
So I'm assuming that means no, but I'm curious.

370
00:32:49,500 --> 00:32:53,680
Okay, so here's where we can take this project from here if you want to help.

371
00:32:53,920 --> 00:32:57,260
The TMS320 is supported in IDA Pro.

372
00:32:57,260 --> 00:33:01,360
I've actually got some stuff on that in the Car Hacking Village Deep Dive.

373
00:33:02,180 --> 00:33:06,260
Again, arbitrations AD72 and 202 defined max current.

374
00:33:06,260 --> 00:33:09,000
There's one more for the other drive inverter.

375
00:33:09,000 --> 00:33:10,000
I can't remember what it is.

376
00:33:10,000 --> 00:33:13,960
So it seems possible to increase speed behind ludicrous and actually do it safely.

377
00:33:13,960 --> 00:33:15,480
It has been done by others.

378
00:33:15,860 --> 00:33:34,020
There's a guy back East who actually has a rear wheel drive P85 that he faked the unit out and basically created a CAN bus emulator for the front drive unit and bumped the VMS beyond the limits that it can handle.

379
00:33:34,040 --> 00:33:38,200
So it seems that all you have to do is go into that firmware and bump the values up a bit.

380
00:33:38,360 --> 00:33:41,560
You can probably even recalculate the CRC value.

381
00:33:41,560 --> 00:33:47,720
And it looks like, since we know how to change the gateway, we can just change that as well.

382
00:33:47,860 --> 00:33:51,140
But it can be dangerous if you take this too far, you're gonna burn up the car.

383
00:33:51,140 --> 00:33:54,180
You're gonna start blowing the individual cell fuses.

384
00:33:54,760 --> 00:33:59,100
But there is some room in there, it looks like.

385
00:33:59,100 --> 00:34:05,260
The current amp drain for the Model S batteries, it's only like 6.6 C, 20 amps per cell.

386
00:34:05,540 --> 00:34:11,260
For those of you who worked in RC before, you know that you can actually go beyond that for short periods of time.

387
00:34:11,700 --> 00:34:15,860
But who knows what the IGPTs within the drive unit can handle.

388
00:34:15,860 --> 00:34:18,960
You blow those, you're looking at a really expensive upgrade.

389
00:34:19,460 --> 00:34:24,720
But again, I just wanna reverse engineer this for the personal point of reverse engineering.

390
00:34:24,720 --> 00:34:33,900
I wanna understand where these values are stored so that others more brave than I can actually turn their cars into true drag monsters.

391
00:34:34,760 --> 00:34:46,260
Put in better batteries, maybe double up on the number of batteries and just turn their Model S's into just things that annihilate everything else on the track.

392
00:34:46,540 --> 00:34:51,680
I'd also like to understand the shunt parameters, CAU1, CGI1, I don't know what those are, I just know they had to change.

393
00:34:51,680 --> 00:35:02,540
So again, come check out the Car Hacking Village Deep Dive and we'll do some more analysis of the firmware, we'll actually show where you can take a project from here.

394
00:35:03,500 --> 00:35:09,940
So reference materials, I had to remove the first link so we don't have a copyright, that was the first thing.

395
00:35:11,180 --> 00:35:15,040
But again, thank you to the Space Vessels Moving for inspiring Ludicrous Mode.

396
00:35:15,260 --> 00:35:18,900
And then the P85D announcement, the Ludicrous announcement.

397
00:35:19,620 --> 00:35:25,740
ElectroBoom, if you haven't checked out his YouTube page, pretty funny guy, he actually describes a current shunt better than I ever could.

398
00:35:26,200 --> 00:35:33,120
The data sheet for the TMS320 on TI's site, very helpful for the AIDA stuff that I was working on.

399
00:35:33,120 --> 00:35:38,100
I'd like to thank Intrepid Control Systems, they made the Vehicle Spy software.

400
00:35:38,880 --> 00:35:44,540
Bitbuster, thank you for letting me use your lift in your garage, it was invaluable in this work.

401
00:35:44,660 --> 00:35:51,300
The guys who helped me with the toolbox reversing, I know you are, thank you all, you're invaluable for all this work.

402
00:35:51,600 --> 00:35:57,300
And then the Tesla Security Team, thank you for actually letting me do this talk and being so supportive of this research.

403
00:35:57,640 --> 00:36:04,780
And then of course, all these names, the Model S, P85D, those are all registered trademarks of Tesla.

404
00:36:04,860 --> 00:36:08,580
We are not sponsored by or associated with Tesla in any way.

405
00:36:10,000 --> 00:36:11,880
And thank you for listening.

406
00:36:11,880 --> 00:36:17,900
We're gonna have a Q&A at some point later today, so bring your questions there, I'd be happy to answer them.