English | 繁體中文 | 简体中文
Tesla Mod for Flipper Zero
Open-source Tesla CAN bus toolkit for Flipper Zero and ESP32. FSD region-gate bypass, TLSSC Restore for VIN-banned cars, nag killer with organic torque variation, GTW Config Replay, live BMS dashboard, and 30+ CAN handlers across Model 3, Model Y, Model S, and Model X. Supports HW3, HW4, and Legacy HW1/HW2. Free alternative to the $200+ S3XY Commander — total cost from $14 with the ESP32 port.
An active FSD package is required for FSD features — either purchased or subscribed. This tool enables FSD functionality at the CAN bus level, but the vehicle still needs a valid FSD entitlement from Tesla. Non-FSD features (nag killer, BMS dashboard, diagnostics) work without any subscription.
Tesla has begun issuing VIN-level bans (April 2026). Affected vehicles lose the TLSSC toggle silently — no OTA, no warning, persists across account transfers and re-subscriptions. The TLSSC Restore feature (v2.10+) can recover stop sign / traffic light control on banned Palladium and HW4 cars via 0x331 DAS config spoofing. See SECURITY.md and issue #18 for the full ban research.
Features
Core FSD
- Auto-detect HW3/HW4 from
GTW_carConfig (0x398), with fallback detection on the ESP32 via 0x39B/0x399/0x3FD/0x3EE when 0x398 isn’t on the tapped bus
- Legacy→HW3 auto-upgrade for Palladium Model S/X — detects
das_hw=0 then upgrades when 0x3FD appears on the bus
- FSD unlock via bit manipulation on
UI_autopilotControl (0x3FD / 0x3EE)
- Legacy mode for HW1/HW2 (Model S/X 2016-2019)
- Speed profile defaults to fastest, syncs from follow-distance stalk (HW4 / Legacy). On HW3 the car’s own FSD speed offset and profile are left alone; the ESP32 HW3 Speed Override toggle brings back the old follow-distance / Autopilot-offset write (#209)
TLSSC Restore (v2.10+)
- Recover Traffic Light and Stop Sign Control on VIN-banned vehicles
- Read-modify-retransmit on CAN ID
0x331 — sets DAS_autopilot to SELF_DRIVING
- Confirmed working on Palladium (Model S Plaid 2023), HW4 Highland (Model 3 Performance 2024), and Intel HW3 (with AP-first workaround)
- Does NOT restore full FSD visualization — only TLSSC (stop signs / traffic lights)
- Recommended banned-car combination: enable TLSSC Restore + TLSSC bit38 (
0x3FD mux 0 bit 38) together — confirmed reliable on HW3 / 2026.2.6 by @RoyRakete (#18). Either toggle alone is unreliable on some banned firmware; the pair re-enables AP/TACC engagement
GTW Config Replay (v2.9+, renamed from “Ban Shield” in v2.15)
- Watches
GTW_carConfig (0x7FF) and replays the learned-healthy bus broadcast in real time when the gateway emits a modified frame
- Learns all 8 mux frames on first run, then auto-arms
- What it actually does: broadcast-layer mask only. When armed, the AP ECU sees the replayed healthy frame instead of the gateway’s modified one. Tesla’s ban writes to GTW NVRAM (which survives reboots) and to server-side flags; this feature does not undo NVRAM state or backend records, only what other on-bus ECUs see in real time.
- What it doesn’t do: prevent bans, undo bans, or change Tesla’s server-side entitlement record. No empirical case of ban prevention has been confirmed in 6 weeks of v2.9-v2.14 deployment. Honest framing per #60 and #67. The v2.14 name “Ban Shield” overpromised — the v2.15 rename reflects what the code actually does.
Nag Killer (v2.1+)
- DAS-aware gating — only echoes when DAS is actually demanding hands-on, zero bus traffic when DAS is satisfied
- Organic torque variation — xorshift32 PRNG random walk in 1.00-1.80 Nm with a grip pulse every 5-9 seconds. Every nag path is capped at ±1.8 Nm since v2.16-beta.11, so grip pulses peak at 1.80 Nm (#122)
- On-demand grip pulse (v2.15+) — when
handsOnLevel rises into a nag-demand state (0 imminent / 3 escalated), an immediate grip pulse fires and the periodic schedule resets. Closes the 2-second yellow-escalation window that could open between scheduled pulses on v2.14 and earlier
- EPAS counter+1 echo on
0x370 with level 0 (nag imminent) and level 3 (escalated alarm) suppression
- Tap Party CAN (X179 pins 2/3) for the nag killer.
0x370 is on Party CAN — not Vehicle CAN (9/10), and the Chassis CAN copy (13/14 on some harnesses) trips the 2026.14.x preflight. Confirmed working on HW4 2026.20 by tapping 2/3 (#100). A single-CAN board on the wrong pair has nothing to echo — the usual cause of “nag killer does nothing on HW4.” Check your car’s wiring diagram (or the Service Mode → CAN Port page, where available) for which pin is Party on your harness; see HARDWARE.md.
AP-First mode (v2.14+, for 2026.14.x firmware)
- Tesla 2026.14.x added a preflight check that blocks AP/TACC engagement if CAN injection is already active
- When AP-First is enabled, the app monitors
DAS_autopilotState from 0x39B and only starts injecting 0x3FD after AP is engaged. On ESP32, the DAS status source follows detected HW version.
- Nag killer, TLSSC Restore, and GTW Config Replay are unaffected (they target different CAN IDs)
14.x firmware warning (v2.15+)
- Default ON. Flipper running scene replaces the BMS / flags line with
!14.x: TX may stop AP whenever the warning toggle is enabled. ESP32 web dashboard shows a dismissible yellow banner at the top.
- Pessimistic default: most users on 14.x firmware don’t know they’re affected until autosteer disengages mid-drive. The warning reaches them before they enable any TX feature.
- Opt-out via the On 14.x? Settings toggle (Flipper) or the Dismiss button on the banner (ESP32, persisted in NVS). Disable if you are sure you’re on pre-14.x firmware.
- Regional caveat: enforcement intensity varies by market. Some regions (markets without Tesla direct presence) appear to enforce less aggressively. See #122 for the running 14.x / 2026.20 tracker.
- “Does this unlock FSD on 2026.14.x / .20 / .26.x?” Short answer: no — the activation preflight and an off-CAN region lock block it, while nag killer / TLSSC / Summon EU / captures still work. Full explanation in the FSD-on-14.x FAQ (#168), with the frame-level proof in #163.
Diagnostics (read-only, no FSD required)
- Live BMS dashboard: pack voltage, current, SoC (the BMS figure from
0x292 and, on the ESP32, the car’s own from 0x33A), temperature range
- Performance panel (ESP32 web dashboard, read-only, opt-in): acceleration / braking timers (0-50, 0-60 mph, 0-100, 100-0 km/h with a per-session best), estimated longitudinal G (dv/dt of speed, no IMU), wheel slip %, and pack temperature / power. Speed and est. G work on any tap carrying
0x257; wheel slip needs Party CAN (0x175); temperature and power need the BMS frames on a Vehicle-CAN tap. Transmits nothing
- Vehicle speed, steering angle, motor torque, brake state
- DAS status: autopilot state, hands-on nag level, lane change state, blind spot warning, FCW, vision speed limit
- GTW autopilot tier readback (NONE/HIGHWAY/ENHANCED/SELF_DRIVING/BASIC)
- OTA detection with debounce — auto-suspends TX during firmware updates unless the explicit Ignore OTA override is enabled. Only a stable “installing” value counts; on newer cars
0x318 byte6 is a rolling counter and can’t trip it (#183)
- Autopark pause — all TX stops while the car runs in-car Autopark and resumes when it ends; FSD engaged isn’t affected (#180)
CAN Capture + Test Profiles (v2.16+)
- CAN Capture — record every received frame to the SD card in candump format (
apps_data/tesla_mod/captures/). Read-only; safe to run on any car. Feeds tools/tesla_crc_cracker.py.
- Send Test — load a user-authored
.cantest text profile from the SD card and replay your own frames. Defaults to dry-run; transmitting is hard-gated to a parked, stationary car (fail-closed) and re-checked before every frame. Result is logged for a bug report. Format + workflow: docs/cantest-format.md, example: examples/example.cantest.
ESP32 dashboard only for now — the Flipper menu doesn’t have these toggles, so a Flipper never sets the summon bit (bit47).
- Summon EU Unlock —
0x3FD mux1: clears bit19 (EU AP restriction) and sets bit47 (summon-enable) to expose Summon on EU-restricted cars
- Continue on Green —
0x3FD mux0 bit39 UI_fsdContinueOnGreenWithCIPV — continue through a green light behind a lead car without a stalk confirmation; pairs with TLSSC
- Right-Hand Drive (RHD) override —
0x3F8 bit41 UI_drivingSide = RHD. RHD markets only
- AP branch/tier selector —
0x3FD mux1 bits 40-42 UI_apmv3Branch: Live / Stage / Dev / Stage2 / EAP / Demo. Experimental, non-persistent UI hint — reverts when injection stops
- Adjustable Track Mode —
0x313 UI_trackModeSettings: Handling Balance + Stability Assist + post-drive cooling, checksum recomputed. Vehicle bus; defaults to rotation 100 / stability 30%, and works on non-Performance trims too
- Acceleration Mode (experimental) —
0x334 UI_powertrainControl UI_pedalMap (byte0 bits 5-6): Off (pass-through) / Chill / Standard / Performance, written into the car’s own frame with the counter kept and the checksum recomputed. A new mode only switches at standstill; Off, or a mode change on the touchscreen while driving, goes back to pass-through at once. The touchscreen keeps showing your own setting. 0x334 is on Vehicle and Chassis CAN, not OBD-II Party CAN. It changes the pedal map only, not the drive unit’s power rating. Not car-validated yet. Idea from ColinM-sys/tesla-can-boost (#211)
Settings (runtime toggles)
Most toggles are on both builds. Flipper only: GTW Config Replay, Emerg. Vehicle, ScrollPress AP, Nav FSD Route, Lane Graph, Tier Override, Dev Mode, Hands-Off, Force LHD, MCP Crystal. ESP32 only: FSD Unlock (master switch for the 0x3FD FSD bits, off by default), HW3 Speed Override, Ignore OTA, Abort Guard, Continuous AP, China Mode, Right-Hand Drive, the Extra unlocks above and the Hardware selector (the Flipper uses Force HW3/HW4/Legacy in its main menu).
Stable (car-tested):
| Setting |
Description |
| Mode |
Active / Listen-Only / Service. Listen-Only is the first-boot default — MCP2515 is in hardware listen-only mode and physically cannot TX. |
| Nag Killer |
DAS-aware EPAS counter+1 echo with organic torque variation. |
| Force FSD |
Bypass the isFSDSelectedInUI check. Does not bypass Tesla’s server-side entitlement — only affects local CAN frame flow. |
| Ignore OTA |
Allows CAN TX in Active mode even when 0x318 reports a Tesla OTA update in progress. Default is off. |
| TLSSC Restore |
0x331 DAS config spoof to recover TLSSC on banned vehicles. Triggers MCU reboot. |
| AP-First (14.x) |
Delay 0x3FD injection until AP is engaged. Required for Tesla firmware 2026.14.x. |
| GTW Config Replay |
Replay learned-healthy GTW_carConfig (0x7FF) broadcasts when the gateway emits modified frames. CAN-broadcast-layer mask only — does not undo NVRAM or backend-side ban flags, does not prevent bans. Renamed from “Ban Shield” in v2.15 (#60, #67). |
| Suppress Chime |
Kill the ISA speed warning chime (HW4 only, 0x399). On ESP32 this is active only after HW4 detection; Legacy/HW3 use 0x399 as DAS status instead. |
| Emerg. Vehicle |
Enable emergency vehicle detection flag (HW4 only, bit59). |
| Precondition |
Battery preheat trigger via 0x082. |
Beta (untested, please report results):
| Setting |
CAN ID |
Description |
| ScrollPress AP |
0x3C2 mux=1 |
HW4-only, Service mode only. Engages AP via a time-based, human-like scroll-wheel gesture (press ~250ms → scroll-up ~150ms → press ~250ms → scroll-up) on swcRightPressed (bits 12-13) + swcRightScrollTicks (bits 24-29), fired when DAS_autopilotState rises 0→1 — no 0x3FD touch. First known 2026.14.x bypass; discovered + bench-verified on Highland HW4 / 2026.14.2 by @JakNo (#43, timed flow #82). HW3 disabled in v2.15 after @DmitroPanteliuk’s emergency-brake report on Intel HW3 2026.14.6 |
| Nav FSD Route |
0x3F8 bits 13/48/49 |
Enable nav-based FSD routing (EU/restricted regions) |
| TLSSC bit38 |
0x3FD mux0 bit38 |
Explicit TLSSC enable; pair with TLSSC Restore (0x331) as the recommended banned-car combo |
| Lane Graph |
0x3FD mux1 bit45 |
UI_showLaneGraph — lane visualization on non-FSD tier |
| Tier Override |
0x7FF mux=2 |
Force GTW_autopilot to SELF_DRIVING (more aggressive than GTW Config Replay — actively writes rather than replays) |
| Dev Mode |
0x3F8 bit5 |
UI_dasDeveloper flag |
| Right-Hand Drive (RHD) |
0x3F8 bit41 |
UI_drivingSide = RHD (bit41 set, bit40 clear — mutually exclusive with the old LHD probe). RHD markets only. Honest note: the earlier Force-LHD probe was empirically ineffective — values 0/1/2 all left FSD on the LHD side on a banned RHD HW3 / 2026.2.6 (#66); RHD now ships as the requested-direction override (ESP32; the Flipper menu still has the old Force LHD toggle) |
| Hands-Off |
0x3F8 bit14 |
UI-level hands-on disable (second nag vector) |
| Telemetry Off |
0x3F8 bits 19/42/43/44/55 + 0x3FD mux1 bits 48/50 |
Clears the reachable telemetry-enable flags (clip / trip / road-segment on 0x3F8, cabin-camera / China on 0x3FD). Experimental — reachable flags only, not the Vehicle-bus ECU log-upload, and not a ban guarantee. Use only with SIM pulled |
14.x experimental (off by default, please report):
These target Tesla 2026.14.x / 2026.20 behaviour and are all off by default. They are probes, not confirmed universal fixes — see #122 for live status. Toggle in the ESP32 web dashboard (and Flipper Settings where available).
| Setting |
Description |
| Abort Guard (ESP32) |
Steer-jerk mitigation (#108). The activation jerk is the car aborting the engage (DAS_autopilotState → 8 ABORTING → 9 ABORTED). When on, cuts all activation injection the instant an abort state appears and stays off until a clean disengage. Validated on-car: eliminated the jerk on wide/straight roads (0 in hundreds of cycles, was ~1/25–30). Limit: some narrow roads jump straight to FAULT (9) with no lead, which it can’t catch. |
| Soft Engage |
Steer-jerk mitigation (#108). Holds the activation-edge injection until the wheel is within ±5° of centre. Needs 0x129 (steering angle) on the tapped bus; degrades to AP-First-only if absent. Largely superseded by Abort Guard for straight-road jerks. |
| Nag Burst |
Echoes 0x370 in bursts (~1 s on / ~1.5 s off) instead of continuously (#122). The rest periods are the believed reason some in-the-wild devices evade the stricter 14.x nag detector. Pairs with a ±1.8 Nm steering-torque cap. |
| EPAS-faithful (Mode-C) |
Demand-state torque model that mirrors a real EPAS instead of flipping handsOnLevel (#100). For cars where the standard nag killer trips the preflight. Not yet confirmed on-car. |
| Instant Engage |
Steer-jerk / activation-lag A/B (#108, #129). With AP-First on, injects as soon as AP is engaged (DAS state ≥ 3) instead of waiting out the 1 s stability debounce. Still holds while AP is only available (state 2). |
| Minimal Inject |
Narrow-road steer-jerk probe (#108). Injects only a short burst (5 frames) at the start of each engagement, then stops until the car disengages. Stacks with Instant Engage. |
| Signal Map (ESP32 → advanced) |
Override where the nag killer reads AP-state / hands-on / steering: id + byte/shift/mask (#122). For variants whose 0x39B/0x399 layout differs. Freshness-gated — a wrong map fails closed, and the dashboard warns when the mapped DAS id never shows up on the bus. A field with mask 0 is ignored. Leave DAS id 0 for auto-detect. The Flipper has a preset picker instead (Auto / 0x39B b0 / 0x39B b1 / 0x399 b0). |
Hardware:
| Setting |
Description |
| MCP Crystal |
16 / 8 / 12 MHz — match your CAN module’s crystal frequency. |
| Hardware (ESP32) |
Auto-detect / Force HW4 / Force HW3 / Force Legacy. Auto-detect needs 0x398, which many Model 3/Y never send — pin your car if detection is wrong. NVS-persisted, applied at boot. |
HW Support
| Tesla HW |
Bits Modified |
Speed Profile |
| Legacy (HW1/HW2) |
bit46 |
3 levels (0-2) |
| HW3 |
bit46 |
car’s own (3 levels with HW3 Speed Override) |
| HW4 (FSD V14+) |
bit46 + bit60 |
5 levels (0-4) |
Hardware
Flipper Zero
| Component |
Description |
Price |
| Flipper Zero |
The multi-tool device |
~$170 |
| Electronic Cats CAN Bus Add-On |
MCP2515-based CAN transceiver (v1.2 supported) |
~$30 |
| OBD-II cable or X179 pigtail |
Connect to Tesla’s CAN bus |
~$5-10 |
ESP32 (from $14)
Full-featured ESP32 port with WiFi web dashboard, NVS settings persistence, deep sleep, and factory reset. Same core CAN logic as the Flipper app; a few toggles exist on only one build (see Settings).
The ESP32 firmware maps AP/DAS status by detected hardware version:
| Detected HW |
0x399 |
0x39B |
ISA speed chime |
| Legacy HW1/HW2 |
DAS_status |
not used |
disabled |
| HW3 |
DAS_status |
not used |
disabled |
| HW4 |
ISA_SPEED |
DAS_status |
enabled |
| Board |
Cost |
Build target |
| M5Stack ATOM Lite + ATOMIC CAN |
~$14 |
m5stack-atom |
| Lilygo T-CAN485 |
~$15 |
esp32-lilygo |
| Waveshare ESP32-S3-RS485-CAN |
~$18 |
waveshare-s3-can |
| LilyGO TTGO T-Display + MCP2515 |
~$20 |
ttgo-tdisplay |
| LilyGO T-2CAN (dual CAN) |
~$24 |
lilygo-t2can |
| LilyGO T-2CAN FD (dual CAN, MCP2518FD) |
~$25 |
lilygo-t2can-fd |
| Generic ESP32 + MCP2515 |
~$6 |
esp32-mcp2515 |
See esp32/README.md for setup, and HARDWARE.md for the full comparison + wiring diagrams + X179 pinouts.
Connection points
- OBD-II — Party CAN. On 2019+ Model 3 / 2020–April 2024 Model Y it sits in the rear center console area and needs a Tesla adapter cable; 2024+ Juniper / later Highland builds use DoIP (Ethernet) there, not CAN. May go silent in Drive on some Model 3/Y builds.
- X179 (behind the rear center console) — recommended. The pin→bus map varies by harness, so check your car’s wiring diagram before wiring (or the Service Mode → CAN Port page, where the car has it). See
HARDWARE.md for 20-pin and 26-pin pinouts and links to Tesla’s Electrical Reference.
Installation
New to this and not very technical? Pick your hardware — both paths avoid the command line:
Flipper Zero
The easiest way is the official Flipper Apps catalog: in the Flipper mobile app open Apps and search for Tesla Mod, or install it from lab.flipper.net/apps/tesla_mod. The catalog version follows stable releases and can lag behind the betas, so for a beta copy the .fap from Releases yourself:
- Open Releases and download
tesla_mod.fap from the release you want (betas are marked Pre-release).
- Connect the Flipper and open qFlipper (the official desktop app).
- Copy
tesla_mod.fap onto the SD card into apps/GPIO/.
- On the Flipper: Apps → GPIO → Tesla Mod.
ESP32 — flash it straight from your browser, nothing to install:
- Get the flasher: either open the hosted Web Flasher, or download
tesla-flasher.html from the latest release and open it — both work in Chrome, Edge, or Opera on a desktop.
- Plug the board in over USB, press Install next to your board, and pick the serial port.
- When it finishes, connect to the board’s Wi-Fi network and open
http://192.168.4.1 to control it.
The board starts in Listen-Only mode (it can’t transmit) until you enable Active in the dashboard. The wiring to your car depends on your Tesla model/year — see HARDWARE.md or open an issue.
Option 1: Download Pre-built FAP
- Go to Releases
- Download
tesla_mod.fap
- Copy to your Flipper’s SD card:
SD Card/apps/GPIO/tesla_mod.fap
Option 2: Build from Source
git clone https://github.com/hypery11/flipper-tesla-fsd.git
cd flipper-tesla-fsd
ufbt
# Output: dist/tesla_mod.fap
ESP32
Prefer not to build? Flash a pre-built image from the Web Flasher — one click, no toolchain.
git clone https://github.com/hypery11/flipper-tesla-fsd.git
cd flipper-tesla-fsd/esp32
pio run -e m5stack-atom # or: esp32-lilygo, waveshare-s3-can, esp32-mcp2515, ttgo-tdisplay, lilygo-t2can, lilygo-t2can-fd
Usage
- Plug the CAN Add-On into your Flipper Zero (or flash the ESP32)
- Connect CAN-H/CAN-L to the vehicle via OBD-II or X179 (your car’s wiring diagram, or Service Mode → CAN Port where available, shows which X179 pins carry which bus)
- Open the app:
Apps > GPIO > Tesla Mod
- Select “Auto Detect & Start” (or Force HW3/HW4/Legacy)
- Wait for detection (up to 8 seconds) — Palladium S/X will auto-upgrade from Legacy to HW3
- The app starts modifying frames automatically when the TLSSC toggle is enabled in the car
Compatibility
| Vehicle |
HW |
Firmware |
Tester |
Feature |
| Model S Plaid 2023 (Palladium) |
HW3/MCU3 |
2026.2.9.3 |
@MiniCS, @nagotti |
TLSSC Restore, FSD |
| Model 3 Highland Perf 2024 |
HW4 |
2026.8.6 |
@kp43h8 |
TLSSC Restore, persists after disconnect |
| Model 3 2019-2023 |
HW3 |
Various |
@THER4iN, multiple |
FSD, nag killer |
| Model X Raven 2017 (HW3 retrofit) |
HW3/MCU2 |
2026.8.3 |
@dmagyar |
Nag killer, EAP |
| Model Y 2023 (China, MIC) |
HW3 |
2026.2.11 |
Community |
FSD (Force FSD mode) |
| Model 3/Y 2023+ |
HW4 |
< 2026.2.9 |
@vbarrier, @kwangseok73-sudo |
FSD |
Known limitations
| Firmware |
Issue |
Workaround |
| 2026.8.6+ |
Region lock — FSD neural net refuses to run in some regions |
Pull SIM, use Force FSD |
| 2026.8.6 HW4 |
HW4 injection path broken on this specific build |
Use Force HW3 mode |
| Intel HW3 (banned) |
TLSSC toggle restored via 0x331, but enabling it breaks AP |
Activate AP first, then inject TLSSC via 0x3FD |
File your own test report via the Car compatibility report template.
How It Works
Single-bus read-modify-retransmit on Party CAN. No MITM, no second bus tap.
- Gateway/ECU sends a frame on the CAN bus
- Flipper/ESP32 catches it, modifies the target bits
- Retransmits — the receiver uses the latest frame
CAN IDs
| CAN ID |
Name |
Direction |
Role |
0x331 |
DAS_autopilotConfig |
TX |
TLSSC Restore — set tier to SELF_DRIVING |
0x370 |
EPAS3P_sysStatus |
TX |
Nag killer — counter+1 echo with organic torque |
0x3FD |
UI_autopilotControl |
TX |
FSD unlock — bit46/60 (HW3/HW4), TLSSC bit38, lane graph bit45 |
0x3F8 |
UI_driverAssistControl |
TX |
Nav FSD route, hands-off, dev mode, RHD driving-side (bit41), telemetry-off (beta) |
0x3EE |
UI_autopilotControl |
TX |
FSD unlock — Legacy HW1/HW2 |
0x3C2 |
VCLEFT_switchStatus |
TX |
ScrollPress AP — right-scroll injection on mux=1 (HW4, Service mode, beta) |
0x7FF |
GTW_carConfig |
TX |
GTW Config Replay + active tier override |
0x082 |
UI_tripPlanning |
TX |
Battery preconditioning trigger |
0x313 |
UI_trackModeSettings |
TX |
Track Mode — handling balance / stability / cooling (checksum recomputed; Vehicle bus) |
0x334 |
UI_powertrainControl |
TX |
Acceleration Mode — UI_pedalMap byte0 bits 5-6, set at standstill only (checksum recomputed, counter kept; Vehicle / Chassis bus) |
0x398 |
GTW_carConfig |
RX |
HW version detection |
0x318 |
GTW_carState |
RX |
OTA detection (auto-suspend TX) |
0x399 |
DAS_status (HW3/Legacy) / ISA_speedLimit (HW4) |
RX/TX |
HW-dispatched, both apps: pre-Highland HW3 and Legacy read it as DAS_status (AP state + hands-on); HW4 rewrites it for Suppress Chime and reads the hands-on level from it when the car sends no 0x39B |
0x39B |
DAS_status |
RX |
HW4 + Highland HW3 — AP state (byte0 low nibble, for AP-First), autopark flags (Autopark pause), nag level, lane change, blind spot |
0x132 |
BMS_hvBusStatus |
RX |
Pack voltage / current |
0x292 |
BMS_socStatus |
RX |
State of charge: BMS_socUI (bit 10, 0.1 %), the BMS figure for display; both apps |
0x312 |
BMS_thermalStatus |
RX |
Battery temperature (layout unconfirmed on some cars; implausible readings are hidden) |
0x33A |
UI_range |
RX |
SOC shown on the car’s screen (ESP32 Battery card) |
Full list of 40 handlers (17 TX, 23 RX) in fsd_logic/fsd_handler.h.
FAQ
Does FSD stay unlocked after I unplug?
No. Real-time frame modification. Unplug = back to stock.
Can this work without an FSD subscription?
FSD features (TLSSC, traffic light/stop sign control) require the FSD entitlement from Tesla. Without it, the AP ECU has no neural network weights loaded. Non-FSD features (nag killer, BMS dashboard, speed chime suppress, diagnostics) work on any AP-capable car.
What about VIN-level bans?
Tesla has been banning VINs server-side since April 2026. The ban downgrades GTW_autopilot tier from SELF_DRIVING to ENHANCED and removes the TLSSC toggle. The TLSSC Restore feature (0x331) can recover stop sign/traffic light control on Palladium and HW4. See issue #18 for the full research. GTW Config Replay (0x7FF, formerly “Ban Shield”) can replay the learned-healthy configuration in real time, but only at the CAN broadcast layer — it does not undo the underlying NVRAM or server-side state.
Flipper Zero vs ESP32 — which should I get?
ESP32 is cheaper ($14 vs $200+), has WiFi dashboard, NVS persistence, and deep sleep. Flipper is more portable and has a built-in screen. Both run the same core CAN logic (a few toggles are build-specific, see Settings). If you don’t already own a Flipper, get the ESP32.
Does this support Model S / Model X?
Yes. Palladium S/X (2021+) is confirmed working with TLSSC Restore. Pre-2021 S/X with HW3 retrofit works via Legacy→HW3 auto-upgrade. HW1/HW2 Model S/X uses Legacy mode (0x3EE). Model S/X uses different BMS CAN IDs — BMS dashboard may show incorrect values.
Do I need a Flipper CAN Add-On?
For the Flipper: yes, any MCP2515-based module (Electronic Cats, generic boards). For ESP32: built-in CAN transceiver on most supported boards (M5Stack ATOMIC CAN, Lilygo T-CAN485, Waveshare S3).
| Project |
What it is |
Hardware |
| ev-open-can-tools |
The upstream community project. Active development is on GitHub (v3.1.x stable, v4.0 in beta, GPL-3.0). Formerly Tesla-OPEN-CAN-MOD on GitLab; that group was renamed to ev-open-can-tools and the GitLab repo is now dormant (0 open issues/MRs, last commit 2026-04-25) — track the GitHub repo. |
RP2040 CAN, Feather M4, ESP32 |
| dzid26/ESP32-DualCAN |
“Dorky Commander” — open-source hardware alternative to the S3XY Commander |
ESP32 + dual CAN |
| tuncasoftbildik/tesla-can-mod |
Arduino reference implementation with frame templates |
Arduino + MCP2515 |
| tumik/S3XY-candump |
Python CAN dump tool via S3XY Commander (Panda protocol) |
Commander dongle |
Credits
- commaai/opendbc — Tesla CAN signal database
- ElectronicCats/flipper-MCP2515-CANBUS — MCP2515 driver for Flipper
- Community contributors — the on-car testing, captures, and research this project runs on:
- Protocol, nag killer & 2026.14.x work: @jewelrylin (T-2CAN dual-bus captures, the frame-content preflight test, the X179 Service Mode pinout), @DrStrangeglovebox (the Feifan
0x370 reference capture + HW4 dual-CAN data + safety findings), @ssw0209-sys (the Mode-C steering-torque reference + HW4 14.x testing), @0xAccretion (HW4 Highland China-MIC DAS-layout findings, #116/#117), @dunckencn (China HW3 start-after-AP validation, steer-jerk + bus-off reports), @kristopf007 (HW4 14.x on-car testing), @anoblekman (Highland HW4 DAS decode + the in-car Autopark safety finding, #177/#180), @SkyRaax (nag killer on Party CAN 2/3, HW4 2026.20, #100), @LonelyCheese09 (labelled HW3 2026.14.6 nag captures behind the EPAS-faithful fix, #122), @jim608 (labelled HW3 2026.14.6 nag captures behind the EPAS-faithful fix, #121/#122), @weigibbor (2026.20 China-MIC capture + region-lock tier TX-test, #117), @7hf6cfqzkb-png (activation-lag report that led to Instant Engage, #129), @cquanu (first 2026.14.2 incompatibility report, #52), @deftdawg (on-demand grip pulse testing + integration, #70; TTGO T-Display test reports), @zdenekbouresh (DAS-aware nag gating, ported from ev-open-can-tools PR #5)
- Features, captures & PRs: @JakNo (ScrollPress AP /
0x3C2), @vrs11 (Continuous AP; T-2CAN multi-ID capture filters, #210), @sqladm1n (RTC capture-log PR + bus/wiring investigation), @DmitroPanteliuk (full-rate 0x229 captures), @se7en7777777 (0x485 / Highland / checksum analysis), @RoyRakete (TLSSC banned-car combo), @mamixsystem (post-SOP10 connector reference; the definitive frame-level 14.x FSD-engage investigation, #163), @p0sixturtle (Summon / tier-selector pointers, #139), @dahua910 (RHD request, #66), @HamzaObaidat (theatre-mode 0x118 research, #149), @fboulegue (EU / new-harness Juniper reports, #143/#109/#110), @densen2014 (ESP32 HW-selector suggestion #110, TLSSC bit38 toggle PR #159, Summon drive-gear safety-guard suggestion #160), @Tesla234987234sdf (Palladium OTA-latch report + captures, #183/#175; the EU charge-port type on 0x25D and its on-car validation, #228), @tommybsb-lab (ATOM Lite / Juniper field report behind the Signal Map fixes, #100), @sb1089 (HW3 2026.26 nag capture, #122), @ukinora (independent 0x318 rolling-counter analysis; from their fork: the 0x3C2 bus hint, canstat, the 12 V / reset-reason logic, the TPMS groundwork, the 0x33A car SOC decode, the speed SNA guard, the clock-wrap fix, the power-log correction write and the time-budget black-box save, #218/#237/#251), @adrianpadure99 (web-flasher “can’t fetch” report, #176), @danpadure (Autopark-pause-in-traffic report, and the black-box records that found the 0x129 steering-angle, stop-and-go Autopark, and stale-frame-retransmit bugs, #176; HW3 FSD speed-offset report, #209), @Jclevy-CN (HW4 speed-profile bit-63 bug + on-car A/B, #59; ESP32 hardening ideas from their fork), @siksndavis (missing ESP32 Precondition toggle, #192), @maslyankov (M5Stack ATOM Matrix + GPIO 39 button, PR #46), @BenjaminFaal (0x485 gear-shift frame on Juniper, #43), @jangshik (ESP32 Wi-Fi AP+STA request #101, T-2CAN config #96), @TzCoMe (telemetry-disable research behind Telemetry Off), @0n3-70uch (oscilloscope pin map of a post-April-2024 26-pin connector, #52), @TianzeWang (Tesla SOP8/SOP9 electrical-reference pointers, #52), @Tikernel (positive Model Y Juniper HW4 2026.2.11 China compat data), @LeeSSXX (Momentum / Xtreme build error report, #17), @nobless (Acceleration Mode request, #211; captive portal report + fork reliability pointers, #218/#219; the beta.38 dashboard / Wi-Fi regression reports and the beta.40 confirmation on the T-2CAN from macOS and iOS, #223/#225; 2024-07 Fremont Model Y 18/19 capture, and the dumps and black-box records behind the 0x129 steering-angle fix, #211; TPMS, hostname, CAN Bus card and battery requests, #237/#225/#251–#254; the T-2CAN FD boards and the first FD test run, #206; the photo of the car’s tyre screen that settled the TPMS wheel order, #237), @olschmalz-cyber (Wi-Fi drop-loop report on beta.38 and the four-device test that pinned it on the board, then the beta.40 confirmation on two boards, #230), @pirozhkov095-ctrl (first on-board stack / heap reading after the fix, #230), @vanyasvl (original Boost request, #63), @ColinM-sys (tesla-can-boost, the pedal-map idea behind Acceleration Mode), @i520e3e4 (zh-Hans + zh-Hant web dashboard translation, #205; T-2CAN FD request, #206), @mxkr303 (2020 Model 3 SOP4 X120 Party-CAN wiring writeup, and the reports behind the low-memory black-box save fix and the MCP2515 power docs, #191)
- Ban research, platform testing, ESP32, bug fixes: @THER4iN, @MiniCS, @kp43h8, @gauner1986, @dmagyar, @ViPiMP, @marcobellinoroci-source, @danpadure, @bruvv, @Symness, @hkloudou, @nagotti, @patatman, @JordanzhaoD
Starmixcraft/tesla-fsd-can-mod — original CanFeather FSD research (GitLab repo removed; mirror at Karolynaz/waymo-fsd-can-mod)
Support the research
If this project saved you money on an aftermarket dongle, helped you understand Tesla’s CAN bus, or kept your TLSSC working through a ban, consider supporting the ongoing research and testing.
Crypto goes to fsd.fkey.id — one address, multi-chain. Open the page to see the networks it currently accepts.
Funds go toward Tesla parts for testing (banned VINs to recover, different MCU/HW combos), ESP32 hardware variants, and time spent reverse-engineering new firmware versions.
License
GPL-3.0
Disclaimer
Educational and research use only. FSD is a premium Tesla feature and must be properly purchased or subscribed to. Modifying vehicle systems may void your warranty and may violate local laws. You are solely responsible for what you do with this. Full safety and responsible-use notes in SECURITY.md.
评论