WEBVTT 00:01.130 --> 00:02.030 Hi there. 00:02.030 --> 00:08.470 Welcome to my talk where I go through and brick a very expensive automobile, then I eventually make it faster. 00:08.490 --> 00:09.390 Hope you enjoy it. 00:09.390 --> 00:13.990 It was certainly the most complicated reverse engineering project I've ever worked on. 00:19.820 --> 00:21.560 So a little bit about me. 00:21.560 --> 00:22.920 My name is Patrick Kiley. 00:22.920 --> 00:26.720 I'm a member of the Penetration Testing Team at Rapid7. 00:27.160 --> 00:31.000 I've been working in the industry for about 17 years. 00:31.000 --> 00:35.240 I've done previous research that I've released on avionics security. 00:35.240 --> 00:41.520 I've done quite a bit of research specifically on internet-connected transportation platforms. 00:41.520 --> 00:48.260 I have experience in hardware hacking, internet of things, autonomous vehicles, and CAN bus. 00:51.270 --> 00:55.330 So here's a overview of all the topics that we're gonna cover. 00:56.050 --> 01:01.470 First, we're gonna go over the architecture of the Model S and specifically the battery management system. 01:01.790 --> 01:05.550 You'll find all that needs to be relevant when I explain some of the other stuff. 01:05.990 --> 01:11.350 The timeline of when the Performance Model S and Ludicrous were released. 01:11.350 --> 01:19.130 The hardware changes that have to occur in order to make a car move at Ludicrous speeds. 01:19.130 --> 01:26.630 The data stored within the diagnostic program that Tesla uses within its service center is called Toolbox. 01:27.330 --> 01:34.130 Some of the firmware changes, in fact, all of the firmware changes that have to occur to the battery management system to make it work. 01:34.130 --> 01:38.350 The process of modifying the high-current shunt. 01:38.370 --> 01:47.850 For those of you who haven't heard the term before, shunt is a method within electrical and electronics of measuring current using a known resistance value. 01:47.850 --> 01:57.390 And this is a device within the high-voltage battery that has to be modified in order to allow it to handle the power of Ludicrous. 01:57.390 --> 02:01.450 And it turns out it was a very important part of this whole process. 02:02.010 --> 02:22.030 And then we'll actually go over the upgrade process, how I failed and bricked the car, what I learned and had to have it towed across state lines, and some pretty cool things on how I was able to dig a little bit deeper on how the gateway works and some special files that it stores that determine the configuration of the car. 02:22.130 --> 02:25.290 And then next steps, can we actually take Ludicrous speed further? 02:25.290 --> 02:25.950 Should we? 02:26.070 --> 02:28.610 And what we need to do to make that happen. 02:34.560 --> 02:38.780 So a little bit about the architecture of the Model S overall. 02:39.640 --> 02:41.300 It has the central display. 02:41.300 --> 02:49.420 So if you sit in a Model S, there's a large screen to your right or to your left if you're a passenger or to your left if you're in a right-hand drive vehicle. 02:49.500 --> 02:51.820 And then there's also instrument cluster. 02:51.820 --> 02:59.340 Both of those actually run the NVIDIA Tegra up until recently where the central display switched over to Intel Atom. 02:59.500 --> 03:09.060 All this is gonna be, assuming it's an NVIDIA Tegra base because that Tegra has to be rooted for this research to work. 03:09.340 --> 03:13.600 The next component that's really critical to this is the gateway. 03:13.920 --> 03:20.260 The gateway sits between the central display, the instrument cluster and the rest of the vehicle. 03:20.300 --> 03:31.120 It acts as a firewall between the various CAN buses and between the CAN buses and the infotainment features as well as the internet connectivity and Wi-Fi connectivity, et cetera. 03:31.820 --> 03:37.680 The next component that's critical to this because that's where all the modifications in are the Powertrain CAN bus. 03:37.680 --> 03:41.320 This is a standard CAN bus running at 500 kilobits a second. 03:41.320 --> 03:49.640 It contains the battery management system, the drive units, all the charging and thermal controller set on that CAN bus. 03:50.080 --> 03:51.920 Beyond that, it's a standard vehicle CAN bus. 03:51.920 --> 03:58.000 It runs at, again, 500 kilobits a second, uses 11-bit arbitration IDs. 03:58.000 --> 04:00.340 And very importantly, it supports UDS. 04:00.800 --> 04:06.640 Many of the routines that you actually have to modify to do this require UDS to work. 04:06.780 --> 04:11.340 And having some knowledge of UDS turned out to be critical for me to do this research. 04:11.340 --> 04:13.100 I managed to learn quite a bit about it. 04:14.420 --> 04:17.940 So next we have the battery management system. 04:18.040 --> 04:23.640 Battery management system is a board that sits inside the battery pack at the rear. 04:24.240 --> 04:30.580 Primary microprocessor on is a TI TMS320C2809. 04:30.760 --> 04:32.380 There's a hardware backup for it. 04:32.380 --> 04:37.160 So in case there's some type of hardware failure, the hardware backup is an Altera CPLD. 04:37.860 --> 04:42.140 It's critical for one step of the process that we're going to do later. 04:42.140 --> 04:45.800 And then there's a current shunt and pre-charge resistor. 04:46.840 --> 04:50.040 The full reversing of these components is an ongoing project. 04:50.040 --> 04:57.540 So if you want to help reach out to me, because there's some of the skills like assembly for the TMS320 that I'm not very good with. 04:58.860 --> 05:02.680 So here's a skipped over some of the steps because it's easier to show on the screen. 05:02.680 --> 05:09.220 The high voltage contactors, you can see in the middle of those round circles with two large terminal posts on them. 05:09.300 --> 05:14.040 The high current shunt that sits, connects directly to the battery management system. 05:14.040 --> 05:19.700 It sits between one of the bus bars going from the battery to the contactors. 05:19.880 --> 05:21.140 There's a pre-charge resistor. 05:21.140 --> 05:31.600 So the way that the contactors are engaged are, when the vehicle wants to enable battery power to the rest of the vehicle, one of the contactors closes. 05:31.700 --> 05:43.380 And then the pre-charge resistor sits there as a slow, relatively slow current path for the rest of the high voltage system to come up to match the voltage of the battery. 05:43.380 --> 05:46.760 And it's only then that the BMS allows the other contactors to close. 05:46.760 --> 05:56.560 So you don't get inrush current and you don't get damaged components from the massive amount of power that's in that battery system. 05:56.800 --> 06:01.680 From there, we actually have 16 battery management boards. 06:01.680 --> 06:08.920 These contain all the bleed resistors so it can balance the voltage across all the packs. 06:08.920 --> 06:14.200 There are 96 of them, I believe six in each of the 16 modules. 06:14.200 --> 06:22.700 And then the BMDs also manage the, they monitor the temperature and of course the voltage of the individual battery modules. 06:22.900 --> 06:25.780 And then the last thing you see on the far right, voltage sense. 06:26.820 --> 06:34.000 Voltage sense is the component that actually sits on the four contactors of the battery. 06:34.000 --> 06:46.260 So not only can it actually detect when the battery contactors are open or closed, so if they're not in a state where the BMS expects them, but they're also used to measure the current voltage level coming from the battery. 06:50.510 --> 06:55.730 So a little bit of history, and this will be relevant in just a manual CY. 06:55.730 --> 07:03.350 So in 2014 of October, the performance dual motor Model S was announced. 07:03.390 --> 07:15.710 This was ridiculously fast when it was released, something like 3.4 seconds, zero to 60, but it wasn't until July of the next year that Ludicrous was announced. 07:15.710 --> 07:24.330 So when Ludicrous was announced, they announced it as a $10,000 option on new models of the new versions of the Model S. 07:24.670 --> 07:26.770 And it was $10,000 for a while. 07:26.770 --> 07:30.350 I think eventually they gave it away for free, but they keep going back and forth on it. 07:30.350 --> 07:31.530 That's really up to them. 07:31.530 --> 07:38.170 So it's always been kind of an optional item to make the car a little bit faster and have Ludicrous power on it. 07:38.790 --> 07:48.830 So $10,000 for new buyers, but as an offer for existing P85D owners, they offered it as a $5,000 upgrade. 07:49.610 --> 07:56.030 And the press release actually mentioned that the upgrade involved putting in new contactors and a pyrofuse. 07:56.370 --> 08:06.550 But after a while, of many of the performance battery packs, so the battery packs that would go into the car would already be capable of running Ludicrous mode and they just wouldn't have the feature turned on. 08:07.890 --> 08:16.690 And when I say Ludicrous capable, what I mean is that all you have to do is modify a single file on the gateway of the vehicle. 08:16.690 --> 08:21.610 So you route the vehicle, modify the single file, and it has Ludicrous mode. 08:22.910 --> 08:35.610 All the P100Ds, as far as I understand, and all the newer Model S's that are dual motor performance, all you have to do is modify this single line on the gateway. 08:35.610 --> 08:38.190 So I've got a little bit of information about that. 08:38.190 --> 08:43.030 So the gateway has this file called internal.dat. 08:43.030 --> 08:45.890 It stores the car's configuration. 08:46.390 --> 09:00.290 It has like, you know, for example, the type of wheels that are on it so that the displays actually reflect correctly, the color of the car, the version of the thermal controller, the version of the various drive units, and the version of the battery pack. 09:00.950 --> 09:03.930 Bunch of other configurations it also controls. 09:03.930 --> 09:09.950 It's also the file that is modified when I heard about how people had supercharging disabled. 09:09.990 --> 09:11.350 That's where it's disabled. 09:11.350 --> 09:14.150 It's actually disabled client side on the vehicle. 09:14.730 --> 09:29.730 But for the purposes of this talk, all you have to do is from a rooted vehicle, request this internal.dat file, make a quick file editor change of which the, you know, VI and nano are both there. 09:29.730 --> 09:36.210 So you go into internal.dat, add this line, performance add-on, and add the value of one. 09:36.890 --> 09:42.830 From there, you copy it back over to the gateway, reboot the gateway, and then boom, the vehicle's ludicrous. 09:43.030 --> 09:44.910 But that's not the case for the earlier models. 09:44.910 --> 09:47.770 The earlier models where you actually had to do quite a bit to the firmware. 09:47.870 --> 09:49.390 I'm just talking about the later ones. 09:49.390 --> 09:54.570 So the later ones that were ludicrous capable already, in other words, the battery was already capable of ludicrous speeds. 09:54.650 --> 09:56.430 This is the only thing you have to change. 09:59.140 --> 10:10.800 So, okay, kind of alluded to earlier, the earlier vehicles, you know, so some of the 90s, all of the 85s released up to that point required hardware. 10:10.800 --> 10:12.680 They required modification of the current shunt. 10:12.680 --> 10:15.700 You had to reflash the firmware in the battery management system. 10:15.900 --> 10:17.980 You had to recalibrate the current shunt. 10:18.220 --> 10:28.320 Only then could you actually add that value to the gateway file, internal.dat, and actually reconfigure it to support ludicrous speed. 10:28.320 --> 10:31.660 If you did it before that, it wouldn't show, actually give you the speed. 10:31.660 --> 10:35.380 It would show you the setting, but it wouldn't go any faster. 10:37.160 --> 10:38.360 So we did this. 10:38.440 --> 10:40.540 I actually upgraded an owner vehicle. 10:41.100 --> 10:44.820 We have a contact in Southern California. 10:44.820 --> 10:47.160 For those who don't know, I'm actually located in Las Vegas. 10:47.400 --> 10:53.480 So I threw some online forums of someone else who was actually hacking on their Tesla. 10:54.540 --> 10:55.760 Guy owned a body shop. 10:55.760 --> 10:57.580 He was willing to let me loan his lift. 10:57.580 --> 11:01.880 So a lift isn't something you can just kind of go to a guy and say, hey, can I borrow your lift for a couple of days? 11:02.480 --> 11:04.780 Because they'd be like, no, I have this thing called insurance. 11:04.780 --> 11:06.720 And no, just go away. 11:06.920 --> 11:08.980 So he let me do this, very gracious. 11:08.980 --> 11:10.020 Thank you, Bitbuster. 11:10.120 --> 11:12.060 Call you out here at the end. 11:12.680 --> 11:19.780 But another little quick anecdote, this guy who loaned me this garage, he was actually hacking on a Model S. 11:19.780 --> 11:27.120 He took the car and actually enabled autopilot version two on an autopilot one car. 11:27.120 --> 11:39.480 So he added all eight of the cameras, put in the newer computer, replaced the steering rack and a bunch of other stuff and actually got retrofitted autopilot two. 11:39.580 --> 11:43.780 So all the full self-driving stuff to an older model vehicle. 11:44.020 --> 11:45.020 Pretty cool stuff. 11:45.020 --> 11:46.200 I was pretty impressed with that. 11:46.200 --> 11:48.700 And I believe he's the first person in the world to ever do that. 11:50.300 --> 11:52.520 So here's a picture of the pack dropped. 11:52.820 --> 11:55.720 It was fairly complicated, but not too hard. 11:55.720 --> 12:02.680 You know, you remove the central bolts and then lower it down onto this big heavy rack that can support the weight of the entire vehicle. 12:02.680 --> 12:05.760 And then you remove the ones along the edges and then raise the car back up. 12:05.880 --> 12:07.580 Battery pack drops out. 12:07.580 --> 12:10.080 All the electrical connections are quick disconnects. 12:10.080 --> 12:11.940 The coolant is a quick disconnect. 12:11.980 --> 12:19.100 I believe this is because originally Tesla was toying around with this idea of having swappable battery packs for people on the road. 12:19.100 --> 12:21.420 I believe they had a pilot program at one point. 12:21.700 --> 12:23.620 It just never really seemed to go anywhere. 12:23.620 --> 12:29.500 So they make it really easy to drop the pack as long as you have access to the appropriate equipment. 12:31.780 --> 12:41.240 So here in this next picture, we have a picture of the fuse bay, which is up at the front of the vehicle on the opposite side of where the coolant tubes enter the pack. 12:41.300 --> 12:47.360 Here, the cover over the fuse is removed and the old fuse is visible, the fuse that actually has to come out. 12:49.200 --> 12:57.820 And then on the right, we have the contactor bay with it opened up, the cover plate removed and the old contactors removed. 12:58.920 --> 13:01.860 All right, here we have a close-up of the current shunt. 13:01.860 --> 13:03.860 You can see it sits right next to the BMS. 13:05.800 --> 13:08.580 And then the new contactors are installed at this point. 13:11.300 --> 13:13.940 Here's a close-up of the BMS. 13:14.440 --> 13:21.160 You can see that it just sits at the very bottom of the bay and it's just kind of on the right side or left if you're staring at the car from the front. 13:21.160 --> 13:22.880 But from my perspective, it's on the right. 13:24.120 --> 13:32.440 And you can see the TMS 320 right there, kind of in the middle, CPLD off to the right and what is that between the two? 13:32.580 --> 13:33.780 Enhance. 13:34.020 --> 13:35.740 Oh, that's interesting. 13:35.740 --> 13:37.780 That label says JTAG. 13:38.260 --> 13:40.160 Get into that later. 13:40.720 --> 13:42.440 Yeah, it actually has JTAG. 13:42.440 --> 13:48.000 The BMSs that I messed with on my bench, none of them actually had that connector. 13:48.000 --> 13:57.760 It was all covered over with conformal coating but the one in the car that I modified actually had these headers on here that say JTAG. 13:57.760 --> 13:59.160 Kind of interesting. 14:01.180 --> 14:06.560 Another thing that you have to do is you actually have to replace a second fuse. 14:06.560 --> 14:08.760 So there's older vehicles. 14:08.760 --> 14:11.140 This is underneath the rear seat. 14:11.320 --> 14:16.960 There's a fuse between the center thing called the high voltage junction box and the front drive unit. 14:17.240 --> 14:25.340 So one of the things that I kind of found by digging around in Toolbox that we'll get into later is you actually have to replace this fuse with a bus bar. 14:25.340 --> 14:26.160 Yeah, that's right. 14:26.160 --> 14:30.480 The instructions say you replace the fuse with a bus bar. 14:30.480 --> 14:31.560 So we did that. 14:32.160 --> 14:34.100 Here's the front fuse. 14:34.100 --> 14:38.120 Here's the front fuse removed and here's the front fuse replaced with the bus bar. 14:38.120 --> 14:46.900 Put it all back together, put the seat back in, connect all the high voltage interlocks, back up and that part is done. 14:47.460 --> 14:48.800 So what about front bar? 14:48.800 --> 14:52.420 This is really where the majority of my time went. 14:52.760 --> 14:56.040 The physical work was actually pretty easy to figure out. 14:56.040 --> 14:59.740 Tesla actually publicly talked about the components that were involved. 15:02.050 --> 15:04.370 The firmware was the hard part. 15:04.850 --> 15:07.230 And to do this, we need to dig into some Python. 15:07.730 --> 15:11.330 Tesla uses a diagnostic tool called Toolbox. 15:11.330 --> 15:16.130 It's a Python Windows executable. 15:16.130 --> 15:16.850 That's right. 15:16.850 --> 15:20.890 It's an executable written in Python, but it runs in Windows. 15:20.890 --> 15:23.990 So it's been compiled and then encrypted. 15:23.990 --> 15:29.870 It uses these plugins that are compiled and encrypted, it's designed to work without a connection to the internet. 15:29.870 --> 15:40.370 So all the information that you need to decrypt these indual files called scrambled, as you can kind of see in this image, are actually on the executable. 15:40.370 --> 15:46.470 So if you were able to get an image or grab the correct files, you're able to decrypt these modules. 15:46.470 --> 15:49.950 To be completely honest, this wasn't my work to figure this out. 15:49.950 --> 15:52.430 This was other people that actually figured this out. 15:53.150 --> 15:55.890 They had done some of the decompiling as well. 15:55.890 --> 16:03.770 So you can use uncompile six to actually run the PYC compiled files and get Python source code. 16:03.970 --> 16:05.270 I did a lot of that. 16:05.270 --> 16:13.590 I wrote a really, really ugly Python script to iterate through every single one of the scramble files, because the scramble files are also all kind of zipped up together. 16:13.590 --> 16:18.330 There's a bunch of separate source code files underneath each one in separate directories. 16:18.330 --> 16:26.170 So I iterated through them all, ran uncompile against them, and then did some additional work that I'll talk about in the next slides. 16:26.270 --> 16:29.090 But they also left all the source code comments in place. 16:29.090 --> 16:29.910 So thank you. 16:29.910 --> 16:32.910 That actually helped me figure this out. 16:33.650 --> 16:37.130 So this is an example of just the header of a file. 16:37.430 --> 16:38.990 This is the UDS one. 16:39.430 --> 16:44.130 You can see it actually has all of the comments here in place. 16:44.330 --> 16:52.630 Here's the headers added by uncompile, but it actually shows when it was compiled, who compiled it, who's the author, gives me his email address too. 16:53.090 --> 16:55.630 And then the copyright information on it. 16:58.270 --> 17:02.570 So here's the kind of thing that I was able to actually see by digging through all these. 17:03.050 --> 17:09.510 This is one of the specific files used to configure for Ludicrous. 17:09.510 --> 17:11.110 So this is the performance add-on config. 17:11.110 --> 17:14.770 This is the one that modifies the gateway if you don't do it manually like I did. 17:14.910 --> 17:21.350 And it tells you that you first have to verify the vehicle can be configured. 17:22.630 --> 17:29.510 For Ludicrous mode, the vehicle needs to be all wheel drive and have a battery pack config that supports the 1500 amp current discharge. 17:29.510 --> 17:32.230 So this is assuming the battery pack has already been modified. 17:32.790 --> 17:37.210 There are other routines in Toolbox that actually go through this. 17:37.950 --> 17:42.450 One of the most important things in these Toolbox files were these data structures. 17:42.450 --> 17:49.970 So you can see these two variable names, three variable names, qt-resource-data, qt-resource-name, qt-resource-struct. 17:50.170 --> 17:56.130 My really, really ugly Python script went through those and actually converted those back into binary. 17:56.670 --> 18:03.170 And then from there, I ran binwalk against those binary files and I got a ton of useful information. 18:05.980 --> 18:10.860 Things like this, this is the pointer that tells me exactly how to do it. 18:10.860 --> 18:17.200 It says that, so we already know that the donor vehicle has a pack ID of 57. 18:17.200 --> 18:20.960 I didn't say that previously, but the donor vehicle had a pack ID of 57. 18:20.960 --> 18:29.720 It says, okay, so if you're gonna change pack ID, battery pack ID 57 to 70, here are the three firmware files that you need. 18:29.760 --> 18:32.040 Okay, well, where do I get those firmware files? 18:32.160 --> 18:34.700 Turns out they were stored within those Python data structures. 18:34.700 --> 18:39.520 When I ran binwalk against it, I actually got a tar file of firmware. 18:39.520 --> 18:44.160 And when you untar that file, you get every single one of these hex files of firmware. 18:44.160 --> 18:51.060 It was all stored within the Python executable, all right there, ready to be used. 18:51.060 --> 18:55.140 So for this upgrade, pack 57 becomes pack 70. 18:55.140 --> 19:01.180 Pack 57 is a 1300 amp battery pack, pack 70 is a 1500 amp. 19:02.240 --> 19:11.400 One of the things that I kind of did that I thought was interesting, since we're still talking about the firmware, is I did some differential analysis of the bootloaders. 19:11.400 --> 19:14.540 So I have the two different bootloaders here, 57 and 70. 19:14.540 --> 19:17.240 You can see that there really weren't that many changes. 19:17.260 --> 19:20.100 On one line, it's a single bit that changes. 19:21.060 --> 19:30.220 The other one that, you know, 537 and 730 that you see here are just the R and then the actual number. 19:30.220 --> 19:31.800 One is 57, one is 70. 19:31.800 --> 19:36.540 And then we have this short little string of, you know, group of hex characters. 19:36.540 --> 19:40.320 And that was the only change between the different versions of the bootloader. 19:42.920 --> 19:44.520 But it's not the application file. 19:44.520 --> 19:46.900 Application file had a few, a bunch of different changes. 19:46.900 --> 19:49.500 It's just the bootloaders themselves were all very, very similar. 19:49.500 --> 19:57.240 So to do this upgrade, all the instructions and files that you need for this were stored in these toolbox files. 19:59.300 --> 20:02.960 There also were a bunch of other really helpful files. 20:02.960 --> 20:14.980 DBC files, for those of you who've hacked on a vehicle before, DBC is the instruction file that stores all of the various CAN bus signals so that you can interpret them. 20:14.980 --> 20:21.400 And these individual DBC files for all the various CAN buses of the vehicle were stored within toolbox. 20:21.600 --> 20:32.520 The ODX files, ODX is a XML style format that defines how to do diagnostics, how to do firmware upgrades, how to get security access. 20:33.080 --> 20:36.340 A bunch of other stuff are stored in kind of the ODX file format. 20:36.340 --> 20:41.020 So the diagnostic routines are ODX, the CAN bus interpretation routines are DBC. 20:41.880 --> 20:46.640 And then there were also files that stored the calibration data for the shunt. 20:46.640 --> 20:48.780 Those are stored also in a Python pickle. 20:49.280 --> 21:04.220 Turns out that every single vehicle that was eligible for ludicrous upgrades by upgrading the battery had the shunt calibration values stored as an array within this Python pickle file. 21:04.220 --> 21:14.620 So you have to actually look up the shunt on the vehicle that you're upgrading, compare it to this pickle file and get these shunt calibration values that I'm gonna show you in a little bit. 21:15.320 --> 21:22.420 And then of course, there are all these text comments and other data structures that kind of eventually allowed me to piece together the process. 21:23.620 --> 21:26.700 So kind of talk a little bit more about UDS. 21:26.700 --> 21:28.360 Here's what a UDS file looks like. 21:28.360 --> 21:30.560 This is the one for actually shunt calibration. 21:30.560 --> 21:37.360 It shows that there are all these parameters, HWID, CGI1, CAU1, there's also a CRC value 21:40.420 --> 21:43.220 and a serial number, a serial number. 21:43.220 --> 21:49.120 And again, CAN networks use a DVC file, UDS use ODX or GMD. 21:49.880 --> 21:57.020 So I use the commercial tool Vehicle Spy to actually do the next steps of this research. 21:57.020 --> 22:08.520 I took these DVC files and these ODX files and imported them to Vehicle Spy, plugged it into the bench, plugged it into an actual vehicle and just sat there and listened to traffic so I could try and figure it out. 22:08.540 --> 22:22.420 So it turns out that the ID's 232, the arbitration ID is 232 for the BMS, 266 and 2E5 for the two drive inverters, they identify max power, those are variables. 22:22.420 --> 22:26.360 They vary based on state of charge, temperature and power recently used. 22:26.480 --> 22:42.640 On Sunday, I'm actually gonna have an in-depth, a deep dive into these DVC files and some of the information because I wanna actually map out the entire power curve to see if I can put that back and actually figure out where the power curve is stored in the BMS firmware. 22:43.100 --> 22:50.500 But check that out if you wanna actually see a little bit further into the talk than what I'm able to cover on this. 22:50.740 --> 22:56.760 So what a DVC does, this is what raw CAN bus traffic looks like. 22:56.820 --> 23:02.700 You can see all the IDs, you know, 102 through 302 down here, and you just see a bunch of data. 23:02.700 --> 23:07.000 But once you put in a DVC file, you can actually translate it all. 23:07.000 --> 23:15.160 So you can actually see that all the values for BMS basically means that this is the BMS who's actually sending this. 23:15.860 --> 23:17.420 You can see the power available. 23:17.420 --> 23:20.520 This is power available before the drive units are engaged. 23:20.520 --> 23:29.820 So this is just the car sitting in an off mode before you press the brake pedal and engage the drive units and wake the car up all the way. 23:30.940 --> 23:35.080 So again, ODX routines for shunt calibration. 23:35.080 --> 23:43.320 Here's the actually ODX routine imported into Vehicle Spy for actually doing the shunt calibration. 23:43.320 --> 23:49.480 So what you do is you actually connect to the car, read the value of the shunt. 23:49.480 --> 23:51.860 You actually have to do some firmware stuff, but I'll go over that in a minute. 23:51.920 --> 23:53.700 And then modify these values. 23:53.700 --> 23:56.280 So these are values that are already modified. 23:56.580 --> 24:05.000 The reason thing I thought was interesting is the CGI1 and CAE1 values are all identical for a ludicrous vehicle where they weren't before. 24:05.320 --> 24:07.840 And then we have a serial number and a CRC. 24:07.840 --> 24:09.380 And then of course the hardware ID. 24:09.880 --> 24:12.260 This is actually, it shows write success with that. 24:12.260 --> 24:14.800 This is actually a read function. 24:15.100 --> 24:18.000 So the 23 is a read function. 24:18.920 --> 24:21.280 There's a separate function for actually writing the shunt. 24:21.280 --> 24:25.360 And again, I actually demonstrate the process on Sunday in the deep dive. 24:26.460 --> 24:35.000 So one of the things I found out by building this all on a bench and doing this work is the shunt also needed a hardware modification. 24:37.280 --> 24:47.020 After I did the upgrade on a bench, I kept getting this error message that would pop up on the central display. 24:47.020 --> 24:52.400 And also, you know, within the DVCs of a CAN bus, it gives you arrays of all the various error messages. 24:52.400 --> 24:55.740 And it talks about overcurrent sense. 24:55.740 --> 25:03.960 There's a particular error message that just popped up showing overcurrent sense after I modified the firmware. 25:03.960 --> 25:06.440 But the error was not there before. 25:07.540 --> 25:17.020 So digging into this, what I did is I actually made a breakout board and used a logic analyzer and analyzed all the signals coming off of this shunt. 25:17.020 --> 25:21.440 Actually, it turns out it's a very simple communications protocol that it used. 25:21.440 --> 25:26.720 But this one wire, as it turns out, eventually connects to the CPLD. 25:26.720 --> 25:35.800 So it looks like that there's a sensor within this shunt that for ludicrous power, they want disconnected. 25:35.800 --> 25:38.240 They don't want it to be able to communicate to the CPU DLD. 25:38.240 --> 25:47.680 And since the CPLD didn't change, assuming it has something to do with it, you know, the current values going through the CPLD, they didn't want to modify. 25:47.680 --> 25:49.080 Tesla didn't want them modified. 25:49.480 --> 25:53.620 So when this wire was disconnected, that error message went away. 25:53.620 --> 26:03.620 So that basically tells me that there's a wire that has to be disconnected during the process of actually doing this upgrade. 26:04.380 --> 26:20.440 So again, go to California, drop the battery pack, drain the battery as much as possible, do all the hardware stuff, modify the shunt, disconnect that wire, very scary stuff. 26:20.940 --> 26:28.600 And then there's actually these special gloves that I purchased, special gloves and special socket wrenches that are used when you're dealing with high voltage. 26:28.600 --> 26:32.640 They're a rubber glove with a leather over lining. 26:32.640 --> 26:36.860 And then you're just careful about, you know, where you're standing and proximity to the other components. 26:36.860 --> 26:45.100 And even though the fuse isolates you, there's still enough of a charge and something where you can shock yourself. 26:45.100 --> 26:49.340 And again, if you're touching the wrong things, you can actually hurt yourself. 26:49.340 --> 26:52.140 So there's quite a few precautions you actually have to do. 26:52.140 --> 26:56.400 I talked to a few Tesla techs and they told me what the gloves were that they were. 26:56.400 --> 27:00.540 So I ordered a set of those and used all possible precautions for doing that. 27:00.760 --> 27:05.320 So we dropped the pack, do all the hardware stuff, reinstall the pack. 27:05.320 --> 27:21.680 So the reinstalling the pack was probably the most pucker factor part of the whole install because I was really nervous about having a rich rebuilds moment and actually damaging one of the leads because then I'd have to leave the vehicle there for a long time and have the customer angry at me. 27:21.680 --> 27:38.500 So I used a bore scope, both back here at the battery pack, these are the main battery pack contacts, going back into the battery and then up front where the coolant lines were, I scoped those and then just very slowly lowered the vehicle onto them all. 27:38.500 --> 27:40.100 Everything went flawlessly. 27:41.060 --> 27:49.420 Reinstalled all the hardware, lifted the car back up, verified everything, dropped it completely off the lift and then had to do all the firmware stuff. 27:49.420 --> 27:54.620 So it turns out you have to actually flash the BMS with special firmware. 27:54.620 --> 28:00.900 There was those three files that actually says that to do the shunt calibration, you load this file onto the BMS. 28:00.900 --> 28:03.980 So there's a special application file just for doing the shunt calibration. 28:04.220 --> 28:08.640 Look up the shunt value, recalibrate the shunt with the value based on the serial number. 28:08.840 --> 28:12.560 I had already extracted that serial number and validated that it was in the table. 28:12.560 --> 28:14.020 So I knew I was okay there. 28:14.020 --> 28:16.340 That all went without a hitch. 28:16.940 --> 28:33.100 Flash the BMS with its new bootloader, flash the BMS with its new application firmware, updated internal.dat, changed the pack ID, and then tried to do a firmware redeploy, which is the thing that you have to do after you change any component on the vehicle and then drive away, 28:33.100 --> 28:33.700 right? 28:33.800 --> 28:35.580 No, no. 28:35.580 --> 28:37.280 This is where the fun begins. 28:38.200 --> 28:42.140 I used every known technique that I've used before. 28:42.140 --> 28:43.540 I've tried putting on new firmware. 28:43.540 --> 28:45.440 I messed with this for a day and a half. 28:45.760 --> 28:50.440 I think I aged myself quite a bit, but I didn't want to stress myself out. 28:51.080 --> 28:52.240 It failed. 28:52.240 --> 28:54.900 It would not redeploy. 28:54.980 --> 28:56.460 It would not reinstall. 28:56.460 --> 28:58.800 I was getting an error every single time. 28:59.040 --> 29:08.780 So I started logging a lot of data, tried to troubleshoot, couldn't figure it out, was stressed out. 29:08.840 --> 29:17.340 Finally just said, screw it, towed the car from Manchurian-Cucamonga back to Vegas so I can continue to work on it. 29:17.340 --> 29:21.600 But it only cost $360 or $3,600. 29:22.020 --> 29:24.820 So not great, not terrible, right? 29:25.240 --> 29:27.020 But I learned something cool. 29:27.800 --> 29:29.440 I was able to figure something else out. 29:29.440 --> 29:42.660 So flew home, started messing with my bench, trying to replicate this condition, dug through my error logs that I copiously captured and I was noticing an error mentioning something called firmware.rc. 29:42.660 --> 29:45.180 The file was generating some type of error. 29:45.920 --> 29:52.300 It turns out the gateway uses this as a validation check and the values in it are calculated during the upgrade and redeploy. 29:55.140 --> 29:59.180 So in this file stores all these CRC values. 29:59.180 --> 30:01.800 So I had seen one other reference to it. 30:01.980 --> 30:08.220 The Tencent guys had done a previous Tesla hacking presentation where they talked about how the gateway used this file. 30:08.480 --> 30:16.700 So I went to the gateway and said, instead of gwtransferinternal.dat, gwtransferfirmware.rc and boom, it gave me the file. 30:16.780 --> 30:18.920 I saw it and it had all these CRC values. 30:18.920 --> 30:39.340 So all I had to do was look up from the, there's a map of files for this specific BMS firmware that it's supposed to be running for that pack ID and that version of software, made sure that version of software or firmware was running on the BMS and then grabbed its CRC value. 30:39.560 --> 30:44.240 Replaced the CRC value in firmware.rc with the value for the new pack ID. 30:45.540 --> 30:49.880 And then if you look here at the end, you can see there's a separate one for file CRC. 30:50.920 --> 30:58.460 There's even little values for the door handles, this drfp and drrp, those are values for the various door handles. 30:58.720 --> 31:03.000 So if you upgrade the door handle, the new firmware, firmware.rc has to be changed. 31:04.280 --> 31:11.300 It turns out I had a new door handle that I actually had to change to, but it wasn't causing an error that wasn't causing the vehicle to be able to operate. 31:11.300 --> 31:16.660 So what you do is you strip off the CRC line, calculate the new CRC. 31:16.660 --> 31:18.960 It turns out it's a jammed CRC 32. 31:18.960 --> 31:21.380 Someone else figured that out while they're helping me. 31:21.380 --> 31:22.840 I didn't figure that out myself. 31:24.440 --> 31:26.300 And then put the file back on the gateway. 31:26.300 --> 31:31.780 And after I did that, the car woke up, the errors cleared, and that was the problem. 31:31.780 --> 31:34.500 And I eventually figured out the reason for the other failure. 31:35.000 --> 31:37.540 I'm not gonna talk about that, it's really embarrassing. 31:37.840 --> 31:41.340 It was something I added to the car that it didn't have, that it didn't need. 31:41.960 --> 31:46.460 But yeah, hit me up with a beer sometime and I'll talk about it. 31:48.720 --> 31:51.760 So here is the power before and after the upgrade. 31:51.760 --> 31:54.600 I grabbed the CAN bus data before. 31:54.860 --> 31:58.180 Before the upgrade, it had 1305 amps available. 31:58.440 --> 31:59.660 These are static values again. 31:59.660 --> 32:01.840 These aren't the ones that are available based on state of charge. 32:01.840 --> 32:03.120 These are a hard limit. 32:03.480 --> 32:06.480 After the upgrade, it had 1516 amps. 32:06.480 --> 32:15.720 But it actually has a separate CAN bus line 202 instead of 702, the debug one, that actually has a slightly lower value. 32:15.720 --> 32:17.040 And I have no idea why. 32:17.040 --> 32:20.500 So if someone from Tesla wants to tell me, I'll keep it to myself. 32:20.500 --> 32:29.940 I'm just really curious why the vehicle has that extra 16 plus eight, 24 amps of power missing. 32:30.280 --> 32:34.960 Actually 23.6 amps of power missing. 32:34.960 --> 32:38.680 So if you can tell me, I'm really curious about that. 32:38.680 --> 32:43.220 It doesn't look like there's any derating going on because that value right above it is there. 32:43.220 --> 32:44.540 It says derating active zero. 32:44.540 --> 32:47.820 So I'm assuming that means no, but I'm curious. 32:49.500 --> 32:53.680 Okay, so here's where we can take this project from here if you want to help. 32:53.920 --> 32:57.260 The TMS320 is supported in IDA Pro. 32:57.260 --> 33:01.360 I've actually got some stuff on that in the Car Hacking Village Deep Dive. 33:02.180 --> 33:06.260 Again, arbitrations AD72 and 202 defined max current. 33:06.260 --> 33:09.000 There's one more for the other drive inverter. 33:09.000 --> 33:10.000 I can't remember what it is. 33:10.000 --> 33:13.960 So it seems possible to increase speed behind ludicrous and actually do it safely. 33:13.960 --> 33:15.480 It has been done by others. 33:15.860 --> 33:34.020 There's a guy back East who actually has a rear wheel drive P85 that he faked the unit out and basically created a CAN bus emulator for the front drive unit and bumped the VMS beyond the limits that it can handle. 33:34.040 --> 33:38.200 So it seems that all you have to do is go into that firmware and bump the values up a bit. 33:38.360 --> 33:41.560 You can probably even recalculate the CRC value. 33:41.560 --> 33:47.720 And it looks like, since we know how to change the gateway, we can just change that as well. 33:47.860 --> 33:51.140 But it can be dangerous if you take this too far, you're gonna burn up the car. 33:51.140 --> 33:54.180 You're gonna start blowing the individual cell fuses. 33:54.760 --> 33:59.100 But there is some room in there, it looks like. 33:59.100 --> 34:05.260 The current amp drain for the Model S batteries, it's only like 6.6 C, 20 amps per cell. 34:05.540 --> 34:11.260 For those of you who worked in RC before, you know that you can actually go beyond that for short periods of time. 34:11.700 --> 34:15.860 But who knows what the IGPTs within the drive unit can handle. 34:15.860 --> 34:18.960 You blow those, you're looking at a really expensive upgrade. 34:19.460 --> 34:24.720 But again, I just wanna reverse engineer this for the personal point of reverse engineering. 34:24.720 --> 34:33.900 I wanna understand where these values are stored so that others more brave than I can actually turn their cars into true drag monsters. 34:34.760 --> 34:46.260 Put in better batteries, maybe double up on the number of batteries and just turn their Model S's into just things that annihilate everything else on the track. 34:46.540 --> 34:51.680 I'd also like to understand the shunt parameters, CAU1, CGI1, I don't know what those are, I just know they had to change. 34:51.680 --> 35:02.540 So again, come check out the Car Hacking Village Deep Dive and we'll do some more analysis of the firmware, we'll actually show where you can take a project from here. 35:03.500 --> 35:09.940 So reference materials, I had to remove the first link so we don't have a copyright, that was the first thing. 35:11.180 --> 35:15.040 But again, thank you to the Space Vessels Moving for inspiring Ludicrous Mode. 35:15.260 --> 35:18.900 And then the P85D announcement, the Ludicrous announcement. 35:19.620 --> 35:25.740 ElectroBoom, if you haven't checked out his YouTube page, pretty funny guy, he actually describes a current shunt better than I ever could. 35:26.200 --> 35:33.120 The data sheet for the TMS320 on TI's site, very helpful for the AIDA stuff that I was working on. 35:33.120 --> 35:38.100 I'd like to thank Intrepid Control Systems, they made the Vehicle Spy software. 35:38.880 --> 35:44.540 Bitbuster, thank you for letting me use your lift in your garage, it was invaluable in this work. 35:44.660 --> 35:51.300 The guys who helped me with the toolbox reversing, I know you are, thank you all, you're invaluable for all this work. 35:51.600 --> 35:57.300 And then the Tesla Security Team, thank you for actually letting me do this talk and being so supportive of this research. 35:57.640 --> 36:04.780 And then of course, all these names, the Model S, P85D, those are all registered trademarks of Tesla. 36:04.860 --> 36:08.580 We are not sponsored by or associated with Tesla in any way. 36:10.000 --> 36:11.880 And thank you for listening. 36:11.880 --> 36:17.900 We're gonna have a Q&A at some point later today, so bring your questions there, I'd be happy to answer them.