English | 繁體中文 | 简体中文

Tesla Mod for Flipper Zero

Open-source Tesla CAN bus toolkit for Flipper Zero and ESP32. FSD region-gate bypass, TLSSC Restore for VIN-banned cars, nag killer with organic torque variation, GTW Config Replay, live BMS dashboard, and 30+ CAN handlers across Model 3, Model Y, Model S, and Model X. Supports HW3, HW4, and Legacy HW1/HW2. Free alternative to the $200+ S3XY Commander — total cost from $14 with the ESP32 port.

[!IMPORTANT] An active FSD package is required for FSD features — either purchased or subscribed. This tool enables FSD functionality at the CAN bus level, but the vehicle still needs a valid FSD entitlement from Tesla. Non-FSD features (nag killer, BMS dashboard, diagnostics) work without any subscription.

[!CAUTION] Tesla has begun issuing VIN-level bans (April 2026). Affected vehicles lose the TLSSC toggle silently — no OTA, no warning, persists across account transfers and re-subscriptions. The TLSSC Restore feature (v2.10+) can recover stop sign / traffic light control on banned Palladium and HW4 cars via 0x331 DAS config spoofing. See SECURITY.md and issue #18 for the full ban research.

Features

Core FSD

• Auto-detect HW3/HW4 from GTW_carConfig (0x398), with fallback detection on the ESP32 via 0x39B/0x399/0x3FD/0x3EE when 0x398 isn't on the tapped bus
• Legacy→HW3 auto-upgrade for Palladium Model S/X — detects das_hw=0 then upgrades when 0x3FD appears on the bus
• FSD unlock via bit manipulation on UI_autopilotControl (0x3FD / 0x3EE)
• Legacy mode for HW1/HW2 (Model S/X 2016-2019)
• Speed profile defaults to fastest, syncs from follow-distance stalk (HW4 / Legacy). On HW3 the car's own FSD speed offset and profile are left alone; the ESP32 HW3 Speed Override toggle brings back the old follow-distance / Autopilot-offset write (#209)

TLSSC Restore (v2.10+)

• Recover Traffic Light and Stop Sign Control on VIN-banned vehicles
• Read-modify-retransmit on CAN ID 0x331 — sets DAS_autopilot to SELF_DRIVING
• Confirmed working on Palladium (Model S Plaid 2023), HW4 Highland (Model 3 Performance 2024), and Intel HW3 (with AP-first workaround)
• Does NOT restore full FSD visualization — only TLSSC (stop signs / traffic lights)
• Recommended banned-car combination: enable TLSSC Restore + TLSSC bit38 (0x3FD mux 0 bit 38) together — confirmed reliable on HW3 / 2026.2.6 by @RoyRakete (#18). Either toggle alone is unreliable on some banned firmware; the pair re-enables AP/TACC engagement

GTW Config Replay (v2.9+, renamed from "Ban Shield" in v2.15)

• Watches GTW_carConfig (0x7FF) and replays the learned-healthy bus broadcast in real time when the gateway emits a modified frame
• Learns all 8 mux frames on first run, then auto-arms
• What it actually does: broadcast-layer mask only. When armed, the AP ECU sees the replayed healthy frame instead of the gateway's modified one. Tesla's ban writes to GTW NVRAM (which survives reboots) and to server-side flags; this feature does not undo NVRAM state or backend records, only what other on-bus ECUs see in real time.
• What it doesn't do: prevent bans, undo bans, or change Tesla's server-side entitlement record. No empirical case of ban prevention has been confirmed in 6 weeks of v2.9-v2.14 deployment. Honest framing per #60 and #67. The v2.14 name "Ban Shield" overpromised — the v2.15 rename reflects what the code actually does.

Nag Killer (v2.1+)

• DAS-aware gating — only echoes when DAS is actually demanding hands-on, zero bus traffic when DAS is satisfied
• Organic torque variation — xorshift32 PRNG random walk in 1.00-1.80 Nm with a grip pulse every 5-9 seconds. Every nag path is capped at ±1.8 Nm since v2.16-beta.11, so grip pulses peak at 1.80 Nm (#122)
• On-demand grip pulse (v2.15+) — when handsOnLevel rises into a nag-demand state (0 imminent / 3 escalated), an immediate grip pulse fires and the periodic schedule resets. Closes the 2-second yellow-escalation window that could open between scheduled pulses on v2.14 and earlier
• EPAS counter+1 echo on 0x370 with level 0 (nag imminent) and level 3 (escalated alarm) suppression
• Tap Party CAN (X179 pins 2/3) for the nag killer. 0x370 is on Party CAN — not Vehicle CAN (9/10), and the Chassis CAN copy (13/14 on some harnesses) trips the 2026.14.x preflight. Confirmed working on HW4 2026.20 by tapping 2/3 (#100). A single-CAN board on the wrong pair has nothing to echo — the usual cause of "nag killer does nothing on HW4." Check your car's wiring diagram (or the Service Mode → CAN Port page, where available) for which pin is Party on your harness; see HARDWARE.md.

AP-First mode (v2.14+, for 2026.14.x firmware)

• Tesla 2026.14.x added a preflight check that blocks AP/TACC engagement if CAN injection is already active
• When AP-First is enabled, the app monitors DAS_autopilotState from 0x39B and only starts injecting 0x3FD after AP is engaged. On ESP32, the DAS status source follows detected HW version.
• Nag killer, TLSSC Restore, and GTW Config Replay are unaffected (they target different CAN IDs)

14.x firmware warning (v2.15+)

• Default ON. Flipper running scene replaces the BMS / flags line with !14.x: TX may stop AP whenever the warning toggle is enabled. ESP32 web dashboard shows a dismissible yellow banner at the top.
• Pessimistic default: most users on 14.x firmware don't know they're affected until autosteer disengages mid-drive. The warning reaches them before they enable any TX feature.
• Opt-out via the On 14.x? Settings toggle (Flipper) or the Dismiss button on the banner (ESP32, persisted in NVS). Disable if you are sure you're on pre-14.x firmware.
• Regional caveat: enforcement intensity varies by market. Some regions (markets without Tesla direct presence) appear to enforce less aggressively. See #122 for the running 14.x / 2026.20 tracker.
• "Does this unlock FSD on 2026.14.x / .20 / .26.x?" Short answer: no — the activation preflight and an off-CAN region lock block it, while nag killer / TLSSC / Summon EU / captures still work. Full explanation in the FSD-on-14.x FAQ (#168), with the frame-level proof in #163.

Diagnostics (read-only, no FSD required)

• Live BMS dashboard: pack voltage, current, SoC (the BMS figure from 0x292 and, on the ESP32, the car's own from 0x33A), temperature range
• Performance panel (ESP32 web dashboard, read-only, opt-in): acceleration / braking timers (0-50, 0-60 mph, 0-100, 100-0 km/h with a per-session best), estimated longitudinal G (dv/dt of speed, no IMU), wheel slip %, and pack temperature / power. Speed and est. G work on any tap carrying 0x257; wheel slip needs Party CAN (0x175); temperature and power need the BMS frames on a Vehicle-CAN tap. Transmits nothing
• Vehicle speed, steering angle, motor torque, brake state
• DAS status: autopilot state, hands-on nag level, lane change state, blind spot warning, FCW, vision speed limit
• GTW autopilot tier readback (NONE/HIGHWAY/ENHANCED/SELF_DRIVING/BASIC)
• OTA detection with debounce — auto-suspends TX during firmware updates unless the explicit Ignore OTA override is enabled. Only a stable "installing" value count