flipper-tesla-fsd

English | 繁體中文 | 简体中文

Tesla Mod for Flipper Zero

Open-source Tesla CAN bus toolkit for Flipper Zero and ESP32. FSD region-gate bypass, TLSSC Restore for VIN-banned cars, nag killer with organic torque variation, GTW Config Replay, live BMS dashboard, and 30+ CAN handlers across Model 3, Model Y, Model S, and Model X. Supports HW3, HW4, and Legacy HW1/HW2. Free alternative to the $200+ S3XY Commander — total cost from $14 with the ESP32 port.

Features

Core FSD

• Auto-detect HW3/HW4 from GTW_carConfig (0x398), with fallback detection on the ESP32 via 0x39B/0x399/0x3FD/0x3EE when 0x398 isn’t on the tapped bus
• Legacy→HW3 auto-upgrade for Palladium Model S/X — detects das_hw=0 then upgrades when 0x3FD appears on the bus
• FSD unlock via bit manipulation on UI_autopilotControl (0x3FD / 0x3EE)
• Legacy mode for HW1/HW2 (Model S/X 2016-2019)
• Speed profile defaults to fastest, syncs from follow-distance stalk (HW4 / Legacy). On HW3 the car’s own FSD speed offset and profile are left alone; the ESP32 HW3 Speed Override toggle brings back the old follow-distance / Autopilot-offset write (#209)

TLSSC Restore (v2.10+)

• Recover Traffic Light and Stop Sign Control on VIN-banned vehicles
• Read-modify-retransmit on CAN ID 0x331 — sets DAS_autopilot to SELF_DRIVING
• Confirmed working on Palladium (Model S Plaid 2023), HW4 Highland (Model 3 Performance 2024), and Intel HW3 (with AP-first workaround)
• Does NOT restore full FSD visualization — only TLSSC (stop signs / traffic lights)
• Recommended banned-car combination: enable TLSSC Restore + TLSSC bit38 (0x3FD mux 0 bit 38) together — confirmed reliable on HW3 / 2026.2.6 by @RoyRakete (#18). Either toggle alone is unreliable on some banned firmware; the pair re-enables AP/TACC engagement

GTW Config Replay (v2.9+, renamed from “Ban Shield” in v2.15)

• Watches GTW_carConfig (0x7FF) and replays the learned-healthy bus broadcast in real time when the gateway emits a modified frame
• Learns all 8 mux frames on first run, then auto-arms
• What it actually does: broadcast-layer mask only. When armed, the AP ECU sees the replayed healthy frame instead of the gateway’s modified one. Tesla’s ban writes to GTW NVRAM (which survives reboots) and to server-side flags; this feature does not undo NVRAM state or backend records, only what other on-bus ECUs see in real time.
• What it doesn’t do: prevent bans, undo bans, or change Tesla’s server-side entitlement record. No empirical case of ban prevention has been confirmed in 6 weeks of v2.9-v2.14 deployment. Honest framing per #60 and #67. The v2.14 name “Ban Shield” overpromised — the v2.15 rename reflects what the code actually does.

Nag Killer (v2.1+)

• DAS-aware gating — only echoes when DAS is actually demanding hands-on, zero bus traffic when DAS is satisfied
• Organic torque variation — xorshift32 PRNG random walk in 1.00-1.80 Nm with a grip pulse every 5-9 seconds. Every nag path is capped at ±1.8 Nm since v2.16-beta.11, so grip pulses peak at 1.80 Nm (#122)
• On-demand grip pulse (v2.15+) — when handsOnLevel rises into a nag-demand state (0 imminent / 3 escalated), an immediate grip pulse fires and the periodic schedule resets. Closes the 2-second yellow-escalation window that could open between scheduled pulses on v2.14 and earlier
• EPAS counter+1 echo on 0x370 with level 0 (nag imminent) and level 3 (escalated alarm) suppression
• Tap Party CAN (X179 pins 2/3) for the nag killer. 0x370 is on Party CAN — not Vehicle CAN (9/10), and the Chassis CAN copy (13/14 on some harnesses) trips the 2026.14.x preflight. Confirmed working on HW4 2026.20 by tapping 2/3 (#100). A single-CAN board on the wrong pair has nothing to echo — the usual cause of “nag killer does nothing on HW4.” Check your car’s wiring diagram (or the Service Mode → CAN Port page, where available) for which pin is Party on your harness; see HARDWARE.md.

AP-First mode (v2.14+, for 2026.14.x firmware)

• Tesla 2026.14.x added a preflight check that blocks AP/TACC engagement if CAN injection is already active
• When AP-First is enabled, the app monitors DAS_autopilotState from 0x39B and only starts injecting 0x3FD after AP is engaged. On ESP32, the DAS status source follows detected HW version.
• Nag killer, TLSSC Restore, and GTW Config Replay are unaffected (they target different CAN IDs)

14.x firmware warning (v2.15+)

• Default ON. Flipper running scene replaces the BMS / flags line with !14.x: TX may stop AP whenever the warning toggle is enabled. ESP32 web dashboard shows a dismissible yellow banner at the top.
• Pessimistic default: most users on 14.x firmware don’t know they’re affected until autosteer disengages mid-drive. The warning reaches them before they enable any TX feature.
• Opt-out via the On 14.x? Settings toggle (Flipper) or the Dismiss button on the banner (ESP32, persisted in NVS). Disable if you are sure you’re on pre-14.x firmware.
• Regional caveat: enforcement intensity varies by market. Some regions (markets without Tesla direct presence) appear to enforce less aggressively. See #122 for the running 14.x / 2026.20 tracker.
• “Does this unlock FSD on 2026.14.x / .20 / .26.x?” Short answer: no — the activation preflight and an off-CAN region lock block it, while nag killer / TLSSC / Summon EU / captures still work. Full explanation in the FSD-on-14.x FAQ (#168), with the frame-level proof in #163.

Diagnostics (read-only, no FSD required)

• Live BMS dashboard: pack voltage, current, SoC (the BMS figure from 0x292 and, on the ESP32, the car’s own from 0x33A), temperature range
• Performance panel (ESP32 web dashboard, read-only, opt-in): acceleration / braking timers (0-50, 0-60 mph, 0-100, 100-0 km/h with a per-session best), estimated longitudinal G (dv/dt of speed, no IMU), wheel slip %, and pack temperature / power. Speed and est. G work on any tap carrying 0x257; wheel slip needs Party CAN (0x175); temperature and power need the BMS frames on a Vehicle-CAN tap. Transmits nothing
• Vehicle speed, steering angle, motor torque, brake state
• DAS status: autopilot state, hands-on nag level, lane change state, blind spot warning, FCW, vision speed limit
• GTW autopilot tier readback (NONE/HIGHWAY/ENHANCED/SELF_DRIVING/BASIC)
• OTA detection with debounce — auto-suspends TX during firmware updates unless the explicit Ignore OTA override is enabled. Only a stable “installing” value counts; on newer cars 0x318 byte6 is a rolling counter and can’t trip it (#183)
• Autopark pause — all TX stops while the car runs in-car Autopark and resumes when it ends; FSD engaged isn’t affected (#180)

CAN Capture + Test Profiles (v2.16+)

• CAN Capture — record every received frame to the SD card in candump format (apps_data/tesla_mod/captures/). Read-only; safe to run on any car. Feeds tools/tesla_crc_cracker.py.
• Send Test — load a user-authored .cantest text profile from the SD card and replay your own frames. Defaults to dry-run; transmitting is hard-gated to a parked, stationary car (fail-closed) and re-checked before every frame. Result is logged for a bug report. Format + workflow: docs/cantest-format.md, example: examples/example.cantest.

Extra unlocks (v2.16+, opt-in, default OFF)

ESP32 dashboard only for now — the Flipper menu doesn’t have these toggles, so a Flipper never sets the summon bit (bit47).

• Summon EU Unlock — 0x3FD mux1: clears bit19 (EU AP restriction) and sets bit47 (summon-enable) to expose Summon on EU-restricted cars
• Continue on Green — 0x3FD mux0 bit39 UI_fsdContinueOnGreenWithCIPV — continue through a green light behind a lead car without a stalk confirmation; pairs with TLSSC
• Right-Hand Drive (RHD) override — 0x3F8 bit41 UI_drivingSide = RHD. RHD markets only
• AP branch/tier selector — 0x3FD mux1 bits 40-42 UI_apmv3Branch: Live / Stage / Dev / Stage2 / EAP / Demo. Experimental, non-persistent UI hint — reverts when injection stops
• Adjustable Track Mode — 0x313 UI_trackModeSettings: Handling Balance + Stability Assist + post-drive cooling, checksum recomputed. Vehicle bus; defaults to rotation 100 / stability 30%, and works on non-Performance trims too
• Acceleration Mode (experimental) — 0x334 UI_powertrainControl UI_pedalMap (byte0 bits 5-6): Off (pass-through) / Chill / Standard / Performance, written into the car’s own frame with the counter kept and the checksum recomputed. A new mode only switches at standstill; Off, or a mode change on the touchscreen while driving, goes back to pass-through at once. The touchscreen keeps showing your own setting. 0x334 is on Vehicle and Chassis CAN, not OBD-II Party CAN. It changes the pedal map only, not the drive unit’s power rating. Not car-validated yet. Idea from ColinM-sys/tesla-can-boost (#211)

Settings (runtime toggles)

Most toggles are on both builds. Flipper only: GTW Config Replay, Emerg. Vehicle, ScrollPress AP, Nav FSD Route, Lane Graph, Tier Override, Dev Mode, Hands-Off, Force LHD, MCP Crystal. ESP32 only: FSD Unlock (master switch for the 0x3FD FSD bits, off by default), HW3 Speed Override, Ignore OTA, Abort Guard, Continuous AP, China Mode, Right-Hand Drive, the Extra unlocks above and the Hardware selector (the Flipper uses Force HW3/HW4/Legacy in its main menu).

Stable (car-tested):

Beta (untested, please report results):

14.x experimental (off by default, please report):

These target Tesla 2026.14.x / 2026.20 behaviour and are all off by default. They are probes, not confirmed universal fixes — see #122 for live status. Toggle in the ESP32 web dashboard (and Flipper Settings where available).

Hardware:

HW Support

Hardware

Flipper Zero

ESP32 (from $14)

Full-featured ESP32 port with WiFi web dashboard, NVS settings persistence, deep sleep, and factory reset. Same core CAN logic as the Flipper app; a few toggles exist on only one build (see Settings).

The ESP32 firmware maps AP/DAS status by detected hardware version:

See esp32/README.md for setup, and HARDWARE.md for the full comparison + wiring diagrams + X179 pinouts.

Connection points

• OBD-II — Party CAN. On 2019+ Model 3 / 2020–April 2024 Model Y it sits in the rear center console area and needs a Tesla adapter cable; 2024+ Juniper / later Highland builds use DoIP (Ethernet) there, not CAN. May go silent in Drive on some Model 3/Y builds.
• X179 (behind the rear center console) — recommended. The pin→bus map varies by harness, so check your car’s wiring diagram before wiring (or the Service Mode → CAN Port page, where the car has it). See HARDWARE.md for 20-pin and 26-pin pinouts and links to Tesla’s Electrical Reference.

Installation

Getting Started (no build tools needed)

New to this and not very technical? Pick your hardware — both paths avoid the command line:

Flipper Zero

The easiest way is the official Flipper Apps catalog: in the Flipper mobile app open Apps and search for Tesla Mod, or install it from lab.flipper.net/apps/tesla_mod. The catalog version follows stable releases and can lag behind the betas, so for a beta copy the .fap from Releases yourself:

1. Open Releases and download tesla_mod.fap from the release you want (betas are marked Pre-release).
2. Connect the Flipper and open qFlipper (the official desktop app).
3. Copy tesla_mod.fap onto the SD card into apps/GPIO/.
4. On the Flipper: Apps → GPIO → Tesla Mod.

ESP32 — flash it straight from your browser, nothing to install:

1. Get the flasher: either open the hosted Web Flasher, or download tesla-flasher.html from the latest release and open it — both work in Chrome, Edge, or Opera on a desktop.
2. Plug the board in over USB, press Install next to your board, and pick the serial port.
3. When it finishes, connect to the board’s Wi-Fi network and open http://192.168.4.1 to control it.

The board starts in Listen-Only mode (it can’t transmit) until you enable Active in the dashboard. The wiring to your car depends on your Tesla model/year — see HARDWARE.md or open an issue.

Option 1: Download Pre-built FAP

1. Go to Releases
2. Download tesla_mod.fap
3. Copy to your Flipper’s SD card: SD Card/apps/GPIO/tesla_mod.fap

Option 2: Build from Source

git clone https://github.com/hypery11/flipper-tesla-fsd.git
cd flipper-tesla-fsd
ufbt
# Output: dist/tesla_mod.fap

ESP32

Prefer not to build? Flash a pre-built image from the Web Flasher — one click, no toolchain.

git clone https://github.com/hypery11/flipper-tesla-fsd.git
cd flipper-tesla-fsd/esp32
pio run -e m5stack-atom    # or: esp32-lilygo, waveshare-s3-can, esp32-mcp2515, ttgo-tdisplay, lilygo-t2can, lilygo-t2can-fd

Usage

1. Plug the CAN Add-On into your Flipper Zero (or flash the ESP32)
2. Connect CAN-H/CAN-L to the vehicle via OBD-II or X179 (your car’s wiring diagram, or Service Mode → CAN Port where available, shows which X179 pins carry which bus)
3. Open the app: Apps > GPIO > Tesla Mod
4. Select “Auto Detect & Start” (or Force HW3/HW4/Legacy)
5. Wait for detection (up to 8 seconds) — Palladium S/X will auto-upgrade from Legacy to HW3
6. The app starts modifying frames automatically when the TLSSC toggle is enabled in the car

Compatibility

Confirmed working (community-tested)

Known limitations

File your own test report via the Car compatibility report template.

How It Works

Single-bus read-modify-retransmit on Party CAN. No MITM, no second bus tap.

1. Gateway/ECU sends a frame on the CAN bus
2. Flipper/ESP32 catches it, modifies the target bits
3. Retransmits — the receiver uses the latest frame

CAN IDs

Full list of 40 handlers (17 TX, 23 RX) in fsd_logic/fsd_handler.h.

FAQ

Does FSD stay unlocked after I unplug? No. Real-time frame modification. Unplug = back to stock.

Can this work without an FSD subscription? FSD features (TLSSC, traffic light/stop sign control) require the FSD entitlement from Tesla. Without it, the AP ECU has no neural network weights loaded. Non-FSD features (nag killer, BMS dashboard, speed chime suppress, diagnostics) work on any AP-capable car.

What about VIN-level bans? Tesla has been banning VINs server-side since April 2026. The ban downgrades GTW_autopilot tier from SELF_DRIVING to ENHANCED and removes the TLSSC toggle. The TLSSC Restore feature (0x331) can recover stop sign/traffic light control on Palladium and HW4. See issue #18 for the full research. GTW Config Replay (0x7FF, formerly “Ban Shield”) can replay the learned-healthy configuration in real time, but only at the CAN broadcast layer — it does not undo the underlying NVRAM or server-side state.

Flipper Zero vs ESP32 — which should I get? ESP32 is cheaper ($14 vs $200+), has WiFi dashboard, NVS persistence, and deep sleep. Flipper is more portable and has a built-in screen. Both run the same core CAN logic (a few toggles are build-specific, see Settings). If you don’t already own a Flipper, get the ESP32.

Does this support Model S / Model X? Yes. Palladium S/X (2021+) is confirmed working with TLSSC Restore. Pre-2021 S/X with HW3 retrofit works via Legacy→HW3 auto-upgrade. HW1/HW2 Model S/X uses Legacy mode (0x3EE). Model S/X uses different BMS CAN IDs — BMS dashboard may show incorrect values.

Do I need a Flipper CAN Add-On? For the Flipper: yes, any MCP2515-based module (Electronic Cats, generic boards). For ESP32: built-in CAN transceiver on most supported boards (M5Stack ATOMIC CAN, Lilygo T-CAN485, Waveshare S3).

Related projects

Credits

• commaai/opendbc — Tesla CAN signal database
• ElectronicCats/flipper-MCP2515-CANBUS — MCP2515 driver for Flipper
• Community contributors — the on-car testing, captures, and research this project runs on:
  • Protocol, nag killer & 2026.14.x work: @jewelrylin (T-2CAN dual-bus captures, the frame-content preflight test, the X179 Service Mode pinout), @DrStrangeglovebox (the Feifan 0x370 reference capture + HW4 dual-CAN data + safety findings), @ssw0209-sys (the Mode-C steering-torque reference + HW4 14.x testing), @0xAccretion (HW4 Highland China-MIC DAS-layout findings, #116/#117), @dunckencn (China HW3 start-after-AP validation, steer-jerk + bus-off reports), @kristopf007 (HW4 14.x on-car testing), @anoblekman (Highland HW4 DAS decode + the in-car Autopark safety finding, #177/#180), @SkyRaax (nag killer on Party CAN 2/3, HW4 2026.20, #100), @LonelyCheese09 (labelled HW3 2026.14.6 nag captures behind the EPAS-faithful fix, #122), @jim608 (labelled HW3 2026.14.6 nag captures behind the EPAS-faithful fix, #121/#122), @weigibbor (2026.20 China-MIC capture + region-lock tier TX-test, #117), @7hf6cfqzkb-png (activation-lag report that led to Instant Engage, #129), @cquanu (first 2026.14.2 incompatibility report, #52), @deftdawg (on-demand grip pulse testing + integration, #70; TTGO T-Display test reports), @zdenekbouresh (DAS-aware nag gating, ported from ev-open-can-tools PR #5)
  • Features, captures & PRs: @JakNo (ScrollPress AP / 0x3C2), @vrs11 (Continuous AP; T-2CAN multi-ID capture filters, #210), @sqladm1n (RTC capture-log PR + bus/wiring investigation), @DmitroPanteliuk (full-rate 0x229 captures), @se7en7777777 (0x485 / Highland / checksum analysis), @RoyRakete (TLSSC banned-car combo), @mamixsystem (post-SOP10 connector reference; the definitive frame-level 14.x FSD-engage investigation, #163), @p0sixturtle (Summon / tier-selector pointers, #139), @dahua910 (RHD request, #66), @HamzaObaidat (theatre-mode 0x118 research, #149), @fboulegue (EU / new-harness Juniper reports, #143/#109/#110), @densen2014 (ESP32 HW-selector suggestion #110, TLSSC bit38 toggle PR #159, Summon drive-gear safety-guard suggestion #160), @Tesla234987234sdf (Palladium OTA-latch report + captures, #183/#175; the EU charge-port type on 0x25D and its on-car validation, #228), @tommybsb-lab (ATOM Lite / Juniper field report behind the Signal Map fixes, #100), @sb1089 (HW3 2026.26 nag capture, #122), @ukinora (independent 0x318 rolling-counter analysis; from their fork: the 0x3C2 bus hint, canstat, the 12 V / reset-reason logic, the TPMS groundwork, the 0x33A car SOC decode, the speed SNA guard, the clock-wrap fix, the power-log correction write and the time-budget black-box save, #218/#237/#251), @adrianpadure99 (web-flasher “can’t fetch” report, #176), @danpadure (Autopark-pause-in-traffic report, and the black-box records that found the 0x129 steering-angle, stop-and-go Autopark, and stale-frame-retransmit bugs, #176; HW3 FSD speed-offset report, #209), @Jclevy-CN (HW4 speed-profile bit-63 bug + on-car A/B, #59; ESP32 hardening ideas from their fork), @siksndavis (missing ESP32 Precondition toggle, #192), @maslyankov (M5Stack ATOM Matrix + GPIO 39 button, PR #46), @BenjaminFaal (0x485 gear-shift frame on Juniper, #43), @jangshik (ESP32 Wi-Fi AP+STA request #101, T-2CAN config #96), @TzCoMe (telemetry-disable research behind Telemetry Off), @0n3-70uch (oscilloscope pin map of a post-April-2024 26-pin connector, #52), @TianzeWang (Tesla SOP8/SOP9 electrical-reference pointers, #52), @Tikernel (positive Model Y Juniper HW4 2026.2.11 China compat data), @LeeSSXX (Momentum / Xtreme build error report, #17), @nobless (Acceleration Mode request, #211; captive portal report + fork reliability pointers, #218/#219; the beta.38 dashboard / Wi-Fi regression reports and the beta.40 confirmation on the T-2CAN from macOS and iOS, #223/#225; 2024-07 Fremont Model Y 18/19 capture, and the dumps and black-box records behind the 0x129 steering-angle fix, #211; TPMS, hostname, CAN Bus card and battery requests, #237/#225/#251–#254; the T-2CAN FD boards and the first FD test run, #206; the photo of the car’s tyre screen that settled the TPMS wheel order, #237), @olschmalz-cyber (Wi-Fi drop-loop report on beta.38 and the four-device test that pinned it on the board, then the beta.40 confirmation on two boards, #230), @pirozhkov095-ctrl (first on-board stack / heap reading after the fix, #230), @vanyasvl (original Boost request, #63), @ColinM-sys (tesla-can-boost, the pedal-map idea behind Acceleration Mode), @i520e3e4 (zh-Hans + zh-Hant web dashboard translation, #205; T-2CAN FD request, #206), @mxkr303 (2020 Model 3 SOP4 X120 Party-CAN wiring writeup, and the reports behind the low-memory black-box save fix and the MCP2515 power docs, #191)
  • Ban research, platform testing, ESP32, bug fixes: @THER4iN, @MiniCS, @kp43h8, @gauner1986, @dmagyar, @ViPiMP, @marcobellinoroci-source, @danpadure, @bruvv, @Symness, @hkloudou, @nagotti, @patatman, @JordanzhaoD
• Starmixcraft/tesla-fsd-can-mod — original CanFeather FSD research (GitLab repo removed; mirror at Karolynaz/waymo-fsd-can-mod)

Support the research

If this project saved you money on an aftermarket dongle, helped you understand Tesla’s CAN bus, or kept your TLSSC working through a ban, consider supporting the ongoing research and testing.

Crypto goes to fsd.fkey.id — one address, multi-chain. Open the page to see the networks it currently accepts.

Funds go toward Tesla parts for testing (banned VINs to recover, different MCU/HW combos), ESP32 hardware variants, and time spent reverse-engineering new firmware versions.

License

GPL-3.0

Disclaimer

Educational and research use only. FSD is a premium Tesla feature and must be properly purchased or subscribed to. Modifying vehicle systems may void your warranty and may violate local laws. You are solely responsible for what you do with this. Full safety and responsible-use notes in SECURITY.md.