start	end	text
1130	2030	Hi there.
2030	5010	Welcome to my talk where I go through and brick
5230	6430	a very expensive automobile,
6430	8470	then I eventually make it faster.
8490	9390	Hope you enjoy it.
9390	11350	It was certainly the most complicated
11350	13990	reverse engineering project I've ever worked on.
19820	21560	So a little bit about me.
21560	22920	My name is Patrick Kiley.
22920	26720	I'm a member of the Penetration Testing Team at Rapid7.
27160	31000	I've been working in the industry for about 17 years.
31000	33540	I've done previous research that I've released
33540	35240	on avionics security.
35240	37260	I've done quite a bit of research
37820	41520	specifically on internet-connected transportation platforms.
41520	43500	I have experience in hardware hacking,
43500	48260	internet of things, autonomous vehicles, and CAN bus.
51270	53870	So here's a overview of all the topics
53870	55330	that we're gonna cover.
56050	58630	First, we're gonna go over the architecture of the Model S
58630	61470	and specifically the battery management system.
61790	63250	You'll find all that needs to be relevant
63250	65550	when I explain some of the other stuff.
65990	69230	The timeline of when the Performance Model S
69230	71350	and Ludicrous were released.
71350	73510	The hardware changes that have to occur
74210	79130	in order to make a car move at Ludicrous speeds.
79130	82250	The data stored within the diagnostic program
82250	84950	that Tesla uses within its service center
84950	86630	is called Toolbox.
87330	89290	Some of the firmware changes,
89290	90610	in fact, all of the firmware changes
90610	92570	that have to occur to the battery management system
92570	94130	to make it work.
94130	98350	The process of modifying the high-current shunt.
98370	100650	For those of you who haven't heard the term before,
100650	104650	shunt is a method within electrical and electronics
105210	107850	of measuring current using a known resistance value.
107850	111430	And this is a device within the high-voltage battery
111430	114850	that has to be modified in order to allow it
114850	117390	to handle the power of Ludicrous.
117390	119210	And it turns out it was a very important part
119210	121450	of this whole process.
122010	124350	And then we'll actually go over the upgrade process,
124350	126450	how I failed and bricked the car,
126450	129350	what I learned and had to have it towed across state lines,
129350	131390	and some pretty cool things
131390	133850	on how I was able to dig a little bit deeper
133850	137710	on how the gateway works and some special files
137710	142030	that it stores that determine the configuration of the car.
142130	143230	And then next steps,
143230	145290	can we actually take Ludicrous speed further?
145290	145950	Should we?
146070	148610	And what we need to do to make that happen.
154560	156760	So a little bit about the architecture
157140	158780	of the Model S overall.
159640	161300	It has the central display.
161300	162620	So if you sit in a Model S,
162620	164380	there's a large screen to your right
164380	165880	or to your left if you're a passenger
165880	169420	or to your left if you're in a right-hand drive vehicle.
169500	171820	And then there's also instrument cluster.
171820	174500	Both of those actually run the NVIDIA Tegra
174500	177220	up until recently where the central display
177220	179340	switched over to Intel Atom.
179500	181200	All this is gonna be,
181200	183580	assuming it's an NVIDIA Tegra base
183580	186280	because that Tegra has to be rooted
186280	189060	for this research to work.
189340	191980	The next component that's really critical to this
191980	193600	is the gateway.
193920	198040	The gateway sits between the central display,
198040	200260	the instrument cluster and the rest of the vehicle.
200300	203580	It acts as a firewall between the various CAN buses
203580	207120	and between the CAN buses and the infotainment features
207120	208880	as well as the internet connectivity
208880	211120	and Wi-Fi connectivity, et cetera.
211820	214640	The next component that's critical to this
214640	216260	because that's where all the modifications in
216260	217680	are the Powertrain CAN bus.
217680	221320	This is a standard CAN bus running at 500 kilobits a second.
221320	224960	It contains the battery management system, the drive units,
224960	229640	all the charging and thermal controller set on that CAN bus.
230080	231920	Beyond that, it's a standard vehicle CAN bus.
231920	235020	It runs at, again, 500 kilobits a second,
235020	238000	uses 11-bit arbitration IDs.
238000	240340	And very importantly, it supports UDS.
240800	243840	Many of the routines that you actually have to modify
243840	246640	to do this require UDS to work.
246780	249720	And having some knowledge of UDS turned out to be critical
249720	251340	for me to do this research.
251340	253100	I managed to learn quite a bit about it.
254420	257940	So next we have the battery management system.
258040	259520	Battery management system is a board
259520	263640	that sits inside the battery pack at the rear.
264240	270580	Primary microprocessor on is a TI TMS320C2809.
270760	272380	There's a hardware backup for it.
272380	274400	So in case there's some type of hardware failure,
274400	277160	the hardware backup is an Altera CPLD.
277860	280360	It's critical for one step of the process
280680	282140	that we're going to do later.
282140	285800	And then there's a current shunt and pre-charge resistor.
286840	290040	The full reversing of these components is an ongoing project.
290040	292180	So if you want to help reach out to me,
292180	294140	because there's some of the skills like assembly
294140	297540	for the TMS320 that I'm not very good with.
298860	300820	So here's a skipped over some of the steps
300820	302680	because it's easier to show on the screen.
302680	304220	The high voltage contactors,
304220	306200	you can see in the middle of those round circles
306200	309220	with two large terminal posts on them.
309300	312240	The high current shunt that sits,
312240	314040	connects directly to the battery management system.
314040	316660	It sits between one of the bus bars
316660	319700	going from the battery to the contactors.
319880	321140	There's a pre-charge resistor.
321140	324380	So the way that the contactors are engaged are,
324820	329000	when the vehicle wants to enable battery power
329000	329860	to the rest of the vehicle,
329860	331600	one of the contactors closes.
331700	333920	And then the pre-charge resistor sits there
333920	337400	as a slow, relatively slow current path
338040	341000	for the rest of the high voltage system to come up
341000	343380	to match the voltage of the battery.
343380	345040	And it's only then that the BMS allows
345040	346760	the other contactors to close.
346760	348120	So you don't get inrush current
348120	349980	and you don't get damaged components
350720	354360	from the massive amount of power
354360	356560	that's in that battery system.
356800	361680	From there, we actually have 16 battery management boards.
361680	365700	These contain all the bleed resistors
365700	368920	so it can balance the voltage across all the packs.
368920	370620	There are 96 of them,
370620	374200	I believe six in each of the 16 modules.
374200	378340	And then the BMDs also manage the,
378340	379720	they monitor the temperature
379720	382700	and of course the voltage of the individual battery modules.
382900	384040	And then the last thing you see
384040	385780	on the far right, voltage sense.
386820	391620	Voltage sense is the component
391620	394000	that actually sits on the four contactors of the battery.
394000	395860	So not only can it actually detect
395860	397720	when the battery contactors are open or closed,
397720	400540	so if they're not in a state where the BMS expects them,
400540	401980	but they're also used to measure
401980	406260	the current voltage level coming from the battery.
410510	412590	So a little bit of history,
412590	415730	and this will be relevant in just a manual CY.
415730	419130	So in 2014 of October,
419130	423350	the performance dual motor Model S was announced.
423390	426750	This was ridiculously fast when it was released,
426750	429510	something like 3.4 seconds, zero to 60,
429510	433250	but it wasn't until July of the next year
433810	435710	that Ludicrous was announced.
435710	437850	So when Ludicrous was announced,
437850	440190	they announced it as a $10,000 option
440690	444330	on new models of the new versions of the Model S.
444670	446770	And it was $10,000 for a while.
446770	448770	I think eventually they gave it away for free,
448770	450350	but they keep going back and forth on it.
450350	451530	That's really up to them.
451530	454550	So it's always been kind of an optional item
454550	455930	to make the car a little bit faster
455930	458170	and have Ludicrous power on it.
458790	460830	So $10,000 for new buyers,
460830	466510	but as an offer for existing P85D owners,
466510	468830	they offered it as a $5,000 upgrade.
469610	471470	And the press release actually mentioned
471470	474530	that the upgrade involved putting in new contactors
474530	476030	and a pyrofuse.
476370	478590	But after a while,
478590	480270	of many of the performance battery packs,
480270	482370	so the battery packs that would go into the car
482370	484370	would already be capable of running Ludicrous mode
484370	486550	and they just wouldn't have the feature turned on.
487890	489850	And when I say Ludicrous capable,
489850	492790	what I mean is that all you have to do
492790	496690	is modify a single file on the gateway of the vehicle.
496690	498610	So you route the vehicle,
498610	499790	modify the single file,
499790	501610	and it has Ludicrous mode.
502910	506310	All the P100Ds, as far as I understand,
506310	508650	and all the newer Model S's
508650	511050	that are dual motor performance,
511590	515610	all you have to do is modify this single line on the gateway.
515610	518190	So I've got a little bit of information about that.
518190	523030	So the gateway has this file called internal.dat.
523030	525890	It stores the car's configuration.
526390	527590	It has like, you know, for example,
527590	528770	the type of wheels that are on it
528770	530970	so that the displays actually reflect correctly,
530970	532870	the color of the car,
532870	535670	the version of the thermal controller,
535670	538430	the version of the various drive units,
538430	540290	and the version of the battery pack.
540950	543930	Bunch of other configurations it also controls.
543930	546570	It's also the file that is modified
546570	549950	when I heard about how people had supercharging disabled.
549990	551350	That's where it's disabled.
551350	554150	It's actually disabled client side on the vehicle.
554730	557710	But for the purposes of this talk,
557710	561330	all you have to do is from a rooted vehicle,
561330	564270	request this internal.dat file,
564890	567130	make a quick file editor change
567130	569730	of which the, you know, VI and nano are both there.
569730	573230	So you go into internal.dat, add this line,
573230	576210	performance add-on, and add the value of one.
576890	579950	From there, you copy it back over to the gateway,
579950	582830	reboot the gateway, and then boom, the vehicle's ludicrous.
583030	584910	But that's not the case for the earlier models.
584910	586790	The earlier models where you actually had to do quite a bit
586790	587770	to the firmware.
587870	589390	I'm just talking about the later ones.
589390	591330	So the later ones that were ludicrous capable already,
591330	593250	in other words, the battery was already capable
593250	594570	of ludicrous speeds.
594650	596430	This is the only thing you have to change.
599140	601700	So, okay, kind of alluded to earlier,
601700	605400	the earlier vehicles, you know, so some of the 90s,
606380	610800	all of the 85s released up to that point required hardware.
610800	612680	They required modification of the current shunt.
612680	613900	You had to reflash the firmware
613900	615700	in the battery management system.
615900	617980	You had to recalibrate the current shunt.
618220	620860	Only then could you actually add that value
620860	624900	to the gateway file, internal.dat,
624900	628320	and actually reconfigure it to support ludicrous speed.
628320	630720	If you did it before that, it wouldn't show,
630720	631660	actually give you the speed.
631660	633740	It would show you the setting,
633740	635380	but it wouldn't go any faster.
637160	638360	So we did this.
638440	640540	I actually upgraded an owner vehicle.
641100	644820	We have a contact in Southern California.
644820	645740	For those who don't know,
645740	647160	I'm actually located in Las Vegas.
647400	651560	So I threw some online forums of someone else
651560	653480	who was actually hacking on their Tesla.
654540	655760	Guy owned a body shop.
655760	657580	He was willing to let me loan his lift.
657580	659380	So a lift isn't something you can just kind of go to a guy
659380	661880	and say, hey, can I borrow your lift for a couple of days?
662480	663820	Because they'd be like, no, I have this thing
663820	664780	called insurance.
664780	666720	And no, just go away.
666920	668980	So he let me do this, very gracious.
668980	670020	Thank you, Bitbuster.
670120	672060	Call you out here at the end.
672680	675580	But another little quick anecdote,
675580	677480	this guy who loaned me this garage,
677480	679780	he was actually hacking on a Model S.
679780	684960	He took the car and actually enabled autopilot version two
685500	687120	on an autopilot one car.
687120	689440	So he added all eight of the cameras,
690030	691280	put in the newer computer,
691280	693720	replaced the steering rack and a bunch of other stuff
694380	699480	and actually got retrofitted autopilot two.
699580	701160	So all the full self-driving stuff
701600	703780	to an older model vehicle.
704020	705020	Pretty cool stuff.
705020	706200	I was pretty impressed with that.
706200	707620	And I believe he's the first person in the world
707620	708700	to ever do that.
710300	712520	So here's a picture of the pack dropped.
712820	715720	It was fairly complicated, but not too hard.
715720	718560	You know, you remove the central bolts
718560	720680	and then lower it down onto this big heavy rack
720680	722680	that can support the weight of the entire vehicle.
722680	724140	And then you remove the ones along the edges
724140	725760	and then raise the car back up.
725880	727580	Battery pack drops out.
727580	730080	All the electrical connections are quick disconnects.
730080	731940	The coolant is a quick disconnect.
731980	734160	I believe this is because originally Tesla
734160	735860	was toying around with this idea
735860	739100	of having swappable battery packs for people on the road.
739100	741420	I believe they had a pilot program at one point.
741700	743620	It just never really seemed to go anywhere.
743620	746820	So they make it really easy to drop the pack
747380	749500	as long as you have access to the appropriate equipment.
751780	753760	So here in this next picture,
753760	755420	we have a picture of the fuse bay,
755420	756620	which is up at the front of the vehicle
756620	761240	on the opposite side of where the coolant tubes enter the pack.
761300	763860	Here, the cover over the fuse is removed
763860	765340	and the old fuse is visible,
765340	767360	the fuse that actually has to come out.
769200	771880	And then on the right, we have the contactor bay
771880	775540	with it opened up, the cover plate removed
775540	777820	and the old contactors removed.
778920	781860	All right, here we have a close-up of the current shunt.
781860	783860	You can see it sits right next to the BMS.
785800	788580	And then the new contactors are installed at this point.
791300	793940	Here's a close-up of the BMS.
794440	796920	You can see that it just sits at the very bottom of the bay
796920	799620	and it's just kind of on the right side or left
799620	801160	if you're staring at the car from the front.
801160	802880	But from my perspective, it's on the right.
804120	807060	And you can see the TMS 320 right there,
807060	809140	kind of in the middle, CPLD off to the right
809140	812440	and what is that between the two?
812580	813780	Enhance.
814020	815740	Oh, that's interesting.
815740	817780	That label says JTAG.
818260	820160	Get into that later.
820720	822440	Yeah, it actually has JTAG.
822440	825900	The BMSs that I messed with on my bench,
825900	828000	none of them actually had that connector.
828000	830380	It was all covered over with conformal coating
830380	832980	but the one in the car that I modified
832980	837760	actually had these headers on here that say JTAG.
837760	839160	Kind of interesting.
841180	842580	Another thing that you have to do
843120	846560	is you actually have to replace a second fuse.
846560	848760	So there's older vehicles.
848760	851140	This is underneath the rear seat.
851320	853520	There's a fuse between the center thing
853520	855060	called the high voltage junction box
855410	856960	and the front drive unit.
857240	859800	So one of the things that I kind of found
859800	861720	by digging around in Toolbox that we'll get into later
861720	865340	is you actually have to replace this fuse with a bus bar.
865340	866160	Yeah, that's right.
866160	870480	The instructions say you replace the fuse with a bus bar.
870480	871560	So we did that.
872160	874100	Here's the front fuse.
874100	875400	Here's the front fuse removed
875400	878120	and here's the front fuse replaced with the bus bar.
878120	880820	Put it all back together, put the seat back in,
880820	883240	connect all the high voltage interlocks,
883240	886900	back up and that part is done.
887460	888800	So what about front bar?
888800	892420	This is really where the majority of my time went.
892760	896040	The physical work was actually pretty easy to figure out.
896040	897700	Tesla actually publicly talked about
897700	899740	the components that were involved.
902050	904370	The firmware was the hard part.
904850	907230	And to do this, we need to dig into some Python.
907730	911330	Tesla uses a diagnostic tool called Toolbox.
911330	916130	It's a Python Windows executable.
916130	916850	That's right.
916850	919510	It's an executable written in Python,
919510	920890	but it runs in Windows.
920890	923990	So it's been compiled and then encrypted.
923990	927410	It uses these plugins that are compiled and encrypted,
927410	929870	it's designed to work without a connection to the internet.
929870	932250	So all the information that you need to decrypt
932250	934770	these indual files called scrambled,
934770	936790	as you can kind of see in this image,
936790	940370	are actually on the executable.
940370	942050	So if you were able to get an image
942050	944350	or grab the correct files,
944890	946470	you're able to decrypt these modules.
946470	948190	To be completely honest,
948190	949950	this wasn't my work to figure this out.
949950	952430	This was other people that actually figured this out.
953150	955890	They had done some of the decompiling as well.
955890	959390	So you can use uncompile six to actually run
959390	963770	the PYC compiled files and get Python source code.
963970	965270	I did a lot of that.
965270	967570	I wrote a really, really ugly Python script
967570	970910	to iterate through every single one of the scramble files,
970910	972750	because the scramble files are also all kind of
972750	973590	zipped up together.
973590	975550	There's a bunch of separate source code files
975550	978330	underneath each one in separate directories.
978330	979970	So I iterated through them all,
981570	982970	ran uncompile against them,
982970	984510	and then did some additional work
984510	986170	that I'll talk about in the next slides.
986270	989090	But they also left all the source code comments in place.
989090	989910	So thank you.
989910	992910	That actually helped me figure this out.
993650	997130	So this is an example of just the header of a file.
997430	998990	This is the UDS one.
999430	1002810	You can see it actually has all of the comments
1002810	1004130	here in place.
1004330	1006930	Here's the headers added by uncompile,
1006930	1009110	but it actually shows when it was compiled,
1009110	1011050	who compiled it, who's the author,
1011050	1012630	gives me his email address too.
1013090	1015630	And then the copyright information on it.
1018270	1021050	So here's the kind of thing that I was able to actually see
1021050	1022570	by digging through all these.
1023050	1028390	This is one of the specific files used
1028390	1029510	to configure for Ludicrous.
1029510	1031110	So this is the performance add-on config.
1031110	1032550	This is the one that modifies the gateway
1032550	1034770	if you don't do it manually like I did.
1034910	1039850	And it tells you that you first have to verify
1039850	1041350	the vehicle can be configured.
1042630	1043550	For Ludicrous mode,
1043550	1045230	the vehicle needs to be all wheel drive
1045230	1046990	and have a battery pack config
1046990	1049510	that supports the 1500 amp current discharge.
1049510	1050790	So this is assuming the battery pack
1050790	1052230	has already been modified.
1052790	1055390	There are other routines in Toolbox
1055390	1057210	that actually go through this.
1057950	1061130	One of the most important things in these Toolbox files
1061130	1062450	were these data structures.
1062450	1064750	So you can see these two variable names,
1064750	1067190	three variable names, qt-resource-data,
1067190	1069970	qt-resource-name, qt-resource-struct.
1070170	1072390	My really, really ugly Python script
1072390	1073410	went through those
1073410	1076130	and actually converted those back into binary.
1076670	1077890	And then from there,
1077890	1080070	I ran binwalk against those binary files
1080070	1083170	and I got a ton of useful information.
1085980	1087780	Things like this,
1087780	1090860	this is the pointer that tells me exactly how to do it.
1090860	1092490	It says that,
1093800	1095440	so we already know that the donor vehicle
1095440	1097200	has a pack ID of 57.
1097200	1098060	I didn't say that previously,
1098060	1100960	but the donor vehicle had a pack ID of 57.
1100960	1101580	It says, okay,
1101580	1104480	so if you're gonna change pack ID,
1104480	1106720	battery pack ID 57 to 70,
1106720	1109720	here are the three firmware files that you need.
1109760	1112040	Okay, well, where do I get those firmware files?
1112160	1113020	Turns out they were stored
1113020	1114700	within those Python data structures.
1114700	1116840	When I ran binwalk against it,
1117400	1119520	I actually got a tar file of firmware.
1119520	1120700	And when you untar that file,
1120700	1124160	you get every single one of these hex files of firmware.
1124160	1127260	It was all stored within the Python executable,
1127260	1128380	all right there,
1129340	1131060	ready to be used.
1131060	1135140	So for this upgrade, pack 57 becomes pack 70.
1135140	1138840	Pack 57 is a 1300 amp battery pack,
1138840	1141180	pack 70 is a 1500 amp.
1142240	1143740	One of the things that I kind of did
1143740	1145180	that I thought was interesting,
1145740	1148140	since we're still talking about the firmware,
1148140	1151400	is I did some differential analysis of the bootloaders.
1151400	1153580	So I have the two different bootloaders here,
1153580	1154540	57 and 70.
1154540	1157240	You can see that there really weren't that many changes.
1157260	1160100	On one line, it's a single bit that changes.
1161060	1162500	The other one that, you know,
1162500	1164640	537 and 730 that you see here
1165100	1170220	are just the R and then the actual number.
1170220	1171800	One is 57, one is 70.
1171800	1175160	And then we have this short little string of,
1175160	1176540	you know, group of hex characters.
1176540	1177260	And that was the only change
1177260	1180320	between the different versions of the bootloader.
1182920	1184520	But it's not the application file.
1184520	1186900	Application file had a few, a bunch of different changes.
1186900	1188080	It's just the bootloaders themselves
1188080	1189500	were all very, very similar.
1189500	1192600	So to do this upgrade,
1192600	1195220	all the instructions and files that you need for this
1195220	1197240	were stored in these toolbox files.
1199300	1202960	There also were a bunch of other really helpful files.
1202960	1204380	DBC files, for those of you
1204380	1206980	who've hacked on a vehicle before,
1206980	1209900	DBC is the instruction file
1209900	1212340	that stores all of the various CAN bus signals
1212940	1214980	so that you can interpret them.
1214980	1217360	And these individual DBC files
1217360	1219140	for all the various CAN buses of the vehicle
1219140	1221400	were stored within toolbox.
1221600	1225380	The ODX files, ODX is a XML style format
1225380	1228620	that defines how to do diagnostics,
1228620	1230360	how to do firmware upgrades,
1230360	1232520	how to get security access.
1233080	1234840	A bunch of other stuff are stored
1234840	1236340	in kind of the ODX file format.
1236340	1238460	So the diagnostic routines are ODX,
1238460	1241020	the CAN bus interpretation routines are DBC.
1241880	1243780	And then there were also files
1243780	1246640	that stored the calibration data for the shunt.
1246640	1248780	Those are stored also in a Python pickle.
1249280	1251920	Turns out that every single vehicle
1251920	1255540	that was eligible for ludicrous upgrades
1255540	1257060	by upgrading the battery
1257560	1260620	had the shunt calibration values stored
1260620	1264220	as an array within this Python pickle file.
1264220	1266400	So you have to actually look up the shunt
1266400	1268940	on the vehicle that you're upgrading,
1268940	1271080	compare it to this pickle file
1271080	1272960	and get these shunt calibration values
1272960	1274620	that I'm gonna show you in a little bit.
1275320	1277280	And then of course, there are all these text comments
1277280	1278420	and other data structures
1278420	1280480	that kind of eventually allowed me
1280480	1282420	to piece together the process.
1283620	1286700	So kind of talk a little bit more about UDS.
1286700	1288360	Here's what a UDS file looks like.
1288360	1290560	This is the one for actually shunt calibration.
1290560	1293100	It shows that there are all these parameters,
1293100	1297360	HWID, CGI1, CAU1, there's also a CRC value
1300420	1303220	and a serial number, a serial number.
1303220	1306680	And again, CAN networks use a DVC file,
1306680	1309120	UDS use ODX or GMD.
1309880	1312180	So I use the commercial tool Vehicle Spy
1312180	1317020	to actually do the next steps of this research.
1317020	1320060	I took these DVC files and these ODX files
1320060	1322180	and imported them to Vehicle Spy,
1322180	1323400	plugged it into the bench,
1323400	1325000	plugged it into an actual vehicle
1325000	1326560	and just sat there and listened to traffic
1326560	1328520	so I could try and figure it out.
1328540	1332520	So it turns out that the ID's 232,
1332520	1335680	the arbitration ID is 232 for the BMS,
1335680	1339840	266 and 2E5 for the two drive inverters,
1339840	1342420	they identify max power, those are variables.
1342420	1344340	They vary based on state of charge,
1344340	1346360	temperature and power recently used.
1346480	1349620	On Sunday, I'm actually gonna have an in-depth,
1349880	1352740	a deep dive into these DVC files
1352740	1353960	and some of the information
1353960	1356500	because I wanna actually map out the entire power curve
1356500	1359080	to see if I can put that back
1359080	1360500	and actually figure out where the power curve
1360500	1362640	is stored in the BMS firmware.
1363100	1365500	But check that out if you wanna actually see
1365960	1368320	a little bit further into the talk
1368320	1370500	than what I'm able to cover on this.
1370740	1373760	So what a DVC does,
1373760	1376760	this is what raw CAN bus traffic looks like.
1376820	1378000	You can see all the IDs,
1378000	1380760	you know, 102 through 302 down here,
1380760	1382700	and you just see a bunch of data.
1382700	1385380	But once you put in a DVC file,
1385380	1387000	you can actually translate it all.
1387000	1392040	So you can actually see that all the values for BMS
1392040	1393480	basically means that this is the BMS
1393480	1395160	who's actually sending this.
1395860	1397420	You can see the power available.
1397420	1400520	This is power available before the drive units are engaged.
1400520	1402980	So this is just the car sitting in an off mode
1403640	1405240	before you press the brake pedal
1405240	1408020	and engage the drive units
1408020	1409820	and wake the car up all the way.
1410940	1415080	So again, ODX routines for shunt calibration.
1415080	1418220	Here's the actually ODX routine imported into Vehicle Spy
1418220	1423320	for actually doing the shunt calibration.
1423320	1428660	So what you do is you actually connect to the car,
1428660	1429480	read the value of the shunt.
1429480	1430660	You actually have to do some firmware stuff,
1430660	1431860	but I'll go over that in a minute.
1431920	1433700	And then modify these values.
1433700	1436280	So these are values that are already modified.
1436580	1439100	The reason thing I thought was interesting
1439100	1442300	is the CGI1 and CAE1 values are all identical
1442300	1445000	for a ludicrous vehicle where they weren't before.
1445320	1447840	And then we have a serial number and a CRC.
1447840	1449380	And then of course the hardware ID.
1449880	1452260	This is actually, it shows write success with that.
1452260	1454800	This is actually a read function.
1455100	1458000	So the 23 is a read function.
1458920	1461280	There's a separate function for actually writing the shunt.
1461280	1463440	And again, I actually demonstrate the process
1463440	1465360	on Sunday in the deep dive.
1466460	1468120	So one of the things I found out
1468120	1469860	by building this all on a bench
1470440	1472600	and doing this work is the shunt
1472600	1475000	also needed a hardware modification.
1477280	1480340	After I did the upgrade on a bench,
1480840	1482600	I kept getting this error message
1482600	1487020	that would pop up on the central display.
1487020	1489380	And also, you know, within the DVCs of a CAN bus,
1489380	1492400	it gives you arrays of all the various error messages.
1492400	1495740	And it talks about overcurrent sense.
1495740	1498080	There's a particular error message that just popped up
1498080	1503960	showing overcurrent sense after I modified the firmware.
1503960	1506440	But the error was not there before.
1507540	1509280	So digging into this,
1509280	1511340	what I did is I actually made a breakout board
1512580	1514660	and used a logic analyzer
1514660	1517020	and analyzed all the signals coming off of this shunt.
1517020	1518740	Actually, it turns out it's a very simple
1519340	1521440	communications protocol that it used.
1521440	1524740	But this one wire, as it turns out,
1524740	1526720	eventually connects to the CPLD.
1526720	1531340	So it looks like that there's a sensor within this shunt
1533500	1535800	that for ludicrous power, they want disconnected.
1535800	1536840	They don't want it to be able to communicate
1536840	1538240	to the CPU DLD.
1538240	1540240	And since the CPLD didn't change,
1541420	1542800	assuming it has something to do with it,
1542800	1546000	you know, the current values going through the CPLD,
1546000	1547680	they didn't want to modify.
1547680	1549080	Tesla didn't want them modified.
1549480	1552480	So when this wire was disconnected,
1552480	1553620	that error message went away.
1553620	1556920	So that basically tells me that there's a wire
1556920	1559400	that has to be disconnected during the process
1560340	1563620	of actually doing this upgrade.
1564380	1569680	So again, go to California, drop the battery pack,
1571280	1573460	drain the battery as much as possible,
1574260	1577720	do all the hardware stuff, modify the shunt,
1577720	1580440	disconnect that wire, very scary stuff.
1580940	1583000	And then there's actually these special gloves
1583000	1586060	that I purchased, special gloves and special socket wrenches
1586060	1588600	that are used when you're dealing with high voltage.
1588600	1592640	They're a rubber glove with a leather over lining.
1592640	1593920	And then you're just careful about, you know,
1593920	1596860	where you're standing and proximity to the other components.
1596860	1600380	And even though the fuse isolates you,
1600380	1602540	there's still enough of a charge
1602540	1605100	and something where you can shock yourself.
1605100	1607740	And again, if you're touching the wrong things,
1607740	1609340	you can actually hurt yourself.
1609340	1612140	So there's quite a few precautions you actually have to do.
1612140	1613960	I talked to a few Tesla techs and they told me
1613960	1616400	what the gloves were that they were.
1616400	1617380	So I ordered a set of those
1617380	1620540	and used all possible precautions for doing that.
1620760	1623600	So we dropped the pack, do all the hardware stuff,
1624500	1625320	reinstall the pack.
1625320	1626880	So the reinstalling the pack was probably
1626880	1631180	the most pucker factor part of the whole install
1631720	1632980	because I was really nervous
1632980	1634520	about having a rich rebuilds moment
1634520	1637120	and actually damaging one of the leads
1637120	1639060	because then I'd have to leave the vehicle there
1639060	1641680	for a long time and have the customer angry at me.
1641680	1645680	So I used a bore scope, both back here at the battery pack,
1645680	1649260	these are the main battery pack contacts,
1649260	1650780	going back into the battery
1650780	1653780	and then up front where the coolant lines were,
1653780	1656820	I scoped those and then just very slowly
1656820	1658500	lowered the vehicle onto them all.
1658500	1660100	Everything went flawlessly.
1661060	1663020	Reinstalled all the hardware,
1663020	1665620	lifted the car back up, verified everything,
1665620	1667220	dropped it completely off the lift
1667740	1669420	and then had to do all the firmware stuff.
1669420	1673320	So it turns out you have to actually flash the BMS
1673320	1674620	with special firmware.
1674620	1676380	There was those three files that actually says
1676380	1678760	that to do the shunt calibration,
1678760	1680900	you load this file onto the BMS.
1680900	1682260	So there's a special application file
1682260	1683980	just for doing the shunt calibration.
1684220	1686560	Look up the shunt value, recalibrate the shunt
1686560	1688640	with the value based on the serial number.
1688840	1690360	I had already extracted that serial number
1690360	1692560	and validated that it was in the table.
1692560	1694020	So I knew I was okay there.
1694020	1696340	That all went without a hitch.
1696940	1699220	Flash the BMS with its new bootloader,
1699220	1702300	flash the BMS with its new application firmware,
1702300	1705960	updated internal.dat, changed the pack ID,
1705960	1708400	and then tried to do a firmware redeploy,
1708400	1709800	which is the thing that you have to do
1709800	1711680	after you change any component on the vehicle
1712260	1713700	and then drive away, right?
1713800	1715580	No, no.
1715580	1717280	This is where the fun begins.
1718200	1722140	I used every known technique that I've used before.
1722140	1723540	I've tried putting on new firmware.
1723540	1725440	I messed with this for a day and a half.
1725760	1728800	I think I aged myself quite a bit,
1728800	1730440	but I didn't want to stress myself out.
1731080	1732240	It failed.
1732240	1734900	It would not redeploy.
1734980	1736460	It would not reinstall.
1736460	1738800	I was getting an error every single time.
1739040	1743480	So I started logging a lot of data,
1744360	1747360	tried to troubleshoot, couldn't figure it out,
1747360	1748780	was stressed out.
1748840	1751900	Finally just said, screw it,
1751900	1754940	towed the car from Manchurian-Cucamonga back to Vegas
1754940	1757340	so I can continue to work on it.
1757340	1761600	But it only cost $360 or $3,600.
1762020	1764820	So not great, not terrible, right?
1765240	1767020	But I learned something cool.
1767800	1769440	I was able to figure something else out.
1769440	1772980	So flew home, started messing with my bench,
1772980	1775140	trying to replicate this condition,
1775140	1778800	dug through my error logs that I copiously captured
1778800	1779920	and I was noticing an error
1779920	1782660	mentioning something called firmware.rc.
1782660	1785180	The file was generating some type of error.
1785920	1788360	It turns out the gateway uses this as a validation check
1789200	1790780	and the values in it are calculated
1790780	1792300	during the upgrade and redeploy.
1795140	1799180	So in this file stores all these CRC values.
1799180	1801800	So I had seen one other reference to it.
1801980	1804000	The Tencent guys had done a previous
1804000	1805480	Tesla hacking presentation
1805880	1808220	where they talked about how the gateway used this file.
1808480	1810800	So I went to the gateway and said,
1810800	1813240	instead of gwtransferinternal.dat,
1814000	1815000	gwtransferfirmware.rc
1815000	1816700	and boom, it gave me the file.
1816780	1818920	I saw it and it had all these CRC values.
1818920	1822840	So all I had to do was look up from the,
1823960	1827500	there's a map of files for this specific BMS firmware
1827500	1829600	that it's supposed to be running for that pack ID
1829600	1831800	and that version of software,
1831800	1834280	made sure that version of software or firmware
1834280	1839340	was running on the BMS and then grabbed its CRC value.
1839560	1841640	Replaced the CRC value in firmware.rc
1841640	1844240	with the value for the new pack ID.
1845540	1846880	And then if you look here at the end,
1846880	1849880	you can see there's a separate one for file CRC.
1850920	1853420	There's even little values for the door handles,
1853420	1855900	this drfp and drrp,
1855900	1858460	those are values for the various door handles.
1858720	1860220	So if you upgrade the door handle,
1860220	1863000	the new firmware, firmware.rc has to be changed.
1864280	1865860	It turns out I had a new door handle
1865860	1867620	that I actually had to change to,
1867620	1868960	but it wasn't causing an error
1868960	1871300	that wasn't causing the vehicle to be able to operate.
1871300	1875040	So what you do is you strip off the CRC line,
1875040	1876660	calculate the new CRC.
1876660	1878960	It turns out it's a jammed CRC 32.
1878960	1881380	Someone else figured that out while they're helping me.
1881380	1882840	I didn't figure that out myself.
1884440	1886300	And then put the file back on the gateway.
1886300	1887720	And after I did that, the car woke up,
1887720	1891780	the errors cleared, and that was the problem.
1891780	1893320	And I eventually figured out the reason
1893320	1894500	for the other failure.
1895000	1897540	I'm not gonna talk about that, it's really embarrassing.
1897840	1899380	It was something I added to the car
1899380	1901340	that it didn't have, that it didn't need.
1901960	1905240	But yeah, hit me up with a beer sometime
1905240	1906460	and I'll talk about it.
1908720	1911760	So here is the power before and after the upgrade.
1911760	1914600	I grabbed the CAN bus data before.
1914860	1918180	Before the upgrade, it had 1305 amps available.
1918440	1919660	These are static values again.
1919660	1920800	These aren't the ones that are available
1920800	1921840	based on state of charge.
1921840	1923120	These are a hard limit.
1923480	1926480	After the upgrade, it had 1516 amps.
1926480	1929520	But it actually has a separate CAN bus line 202
1929520	1931860	instead of 702, the debug one,
1933100	1935720	that actually has a slightly lower value.
1935720	1937040	And I have no idea why.
1937040	1939300	So if someone from Tesla wants to tell me,
1939300	1940500	I'll keep it to myself.
1940500	1944260	I'm just really curious why the vehicle has that extra
1945540	1949940	16 plus eight, 24 amps of power missing.
1950280	1954960	Actually 23.6 amps of power missing.
1954960	1958680	So if you can tell me, I'm really curious about that.
1958680	1960860	It doesn't look like there's any derating going on
1960860	1963220	because that value right above it is there.
1963220	1964540	It says derating active zero.
1964540	1967820	So I'm assuming that means no, but I'm curious.
1969500	1972420	Okay, so here's where we can take this project
1972420	1973680	from here if you want to help.
1973920	1977260	The TMS320 is supported in IDA Pro.
1977260	1978820	I've actually got some stuff on that
1978820	1981360	in the Car Hacking Village Deep Dive.
1982180	1986260	Again, arbitrations AD72 and 202 defined max current.
1986260	1989000	There's one more for the other drive inverter.
1989000	1990000	I can't remember what it is.
1990000	1992700	So it seems possible to increase speed behind ludicrous
1992700	1993960	and actually do it safely.
1993960	1995480	It has been done by others.
1995860	1997960	There's a guy back East who actually has
1998380	2003640	a rear wheel drive P85 that he faked the unit out
2003640	2006960	and basically created a CAN bus emulator
2006960	2008220	for the front drive unit
2008220	2014020	and bumped the VMS beyond the limits that it can handle.
2014040	2016460	So it seems that all you have to do is go into that firmware
2016460	2018200	and bump the values up a bit.
2018360	2021560	You can probably even recalculate the CRC value.
2021560	2026100	And it looks like, since we know how to change the gateway,
2026100	2027720	we can just change that as well.
2027860	2029820	But it can be dangerous if you take this too far,
2029820	2031140	you're gonna burn up the car.
2031140	2034180	You're gonna start blowing the individual cell fuses.
2034760	2039100	But there is some room in there, it looks like.
2039100	2042440	The current amp drain for the Model S batteries,
2042440	2045260	it's only like 6.6 C, 20 amps per cell.
2045540	2047420	For those of you who worked in RC before,
2047420	2049500	you know that you can actually go beyond that
2049500	2051260	for short periods of time.
2051700	2054140	But who knows what the IGPTs
2054140	2055860	within the drive unit can handle.
2055860	2058960	You blow those, you're looking at a really expensive upgrade.
2059460	2062260	But again, I just wanna reverse engineer this
2062260	2064720	for the personal point of reverse engineering.
2064720	2067220	I wanna understand where these values are stored
2067860	2070660	so that others more brave than I can actually
2071260	2073900	turn their cars into true drag monsters.
2074760	2078200	Put in better batteries,
2078200	2079640	maybe double up on the number of batteries
2079640	2084000	and just turn their Model S's into just things
2084000	2086260	that annihilate everything else on the track.
2086540	2088600	I'd also like to understand the shunt parameters,
2088600	2090580	CAU1, CGI1, I don't know what those are,
2090580	2091680	I just know they had to change.
2091680	2095000	So again, come check out the Car Hacking Village Deep Dive
2096700	2100420	and we'll do some more analysis of the firmware,
2100420	2102540	we'll actually show where you can take a project from here.
2103500	2106940	So reference materials, I had to remove the first link
2106940	2109940	so we don't have a copyright, that was the first thing.
2111180	2113340	But again, thank you to the Space Vessels Moving
2113340	2115040	for inspiring Ludicrous Mode.
2115260	2117340	And then the P85D announcement,
2117340	2118900	the Ludicrous announcement.
2119620	2121760	ElectroBoom, if you haven't checked out his YouTube page,
2121760	2123700	pretty funny guy, he actually describes
2123820	2125740	a current shunt better than I ever could.
2126200	2129680	The data sheet for the TMS320 on TI's site,
2129680	2133120	very helpful for the AIDA stuff that I was working on.
2133120	2135720	I'd like to thank Intrepid Control Systems,
2135720	2138100	they made the Vehicle Spy software.
2138880	2140780	Bitbuster, thank you for letting me use your lift
2140780	2144540	in your garage, it was invaluable in this work.
2144660	2147220	The guys who helped me with the toolbox reversing,
2147220	2149340	I know you are, thank you all,
2149340	2151300	you're invaluable for all this work.
2151600	2153380	And then the Tesla Security Team,
2153380	2155060	thank you for actually letting me do this talk
2155060	2157300	and being so supportive of this research.
2157640	2162520	And then of course, all these names, the Model S, P85D,
2162520	2164780	those are all registered trademarks of Tesla.
2164860	2168580	We are not sponsored by or associated with Tesla in any way.
2170000	2171880	And thank you for listening.
2171880	2174360	We're gonna have a Q&A at some point later today,
2174360	2176400	so bring your questions there,
2176400	2177900	I'd be happy to answer them.