Tesla Mod for Flipper Zero
June 19, 2026 · View on GitHub
Tesla Mod for Flipper Zero
Open-source Tesla CAN bus toolkit for Flipper Zero and ESP32. FSD region-gate bypass, TLSSC Restore for VIN-banned cars, nag killer with organic torque variation, GTW Config Replay, live BMS dashboard, and 30+ CAN handlers across Model 3, Model Y, Model S, and Model X. Supports HW3, HW4, and Legacy HW1/HW2. Free alternative to the $200+ S3XY Commander — total cost from $14 with the ESP32 port.
Important
An active FSD package is required for FSD features — either purchased or subscribed. This tool enables FSD functionality at the CAN bus level, but the vehicle still needs a valid FSD entitlement from Tesla. Non-FSD features (nag killer, BMS dashboard, diagnostics) work without any subscription.
Caution
Tesla has begun issuing VIN-level bans (April 2026). Affected vehicles lose the TLSSC toggle silently — no OTA, no warning, persists across account transfers and re-subscriptions. The TLSSC Restore feature (v2.10+) can recover stop sign / traffic light control on banned Palladium and HW4 cars via 0x331 DAS config spoofing. See SECURITY.md and issue #18 for the full ban research.
Features
Core FSD
- Auto-detect HW3/HW4 from
GTW_carConfig(0x398), with fallback detection via0x3FD/0x399/0x3EEwhen0x398isn't on the tapped bus - Legacy→HW3 auto-upgrade for Palladium Model S/X — detects
das_hw=0then upgrades when0x3FDappears on the bus - FSD unlock via bit manipulation on
UI_autopilotControl(0x3FD/0x3EE) - Legacy mode for HW1/HW2 (Model S/X 2016-2019)
- Speed profile defaults to fastest, syncs from follow-distance stalk
TLSSC Restore (v2.10+)
- Recover Traffic Light and Stop Sign Control on VIN-banned vehicles
- Read-modify-retransmit on CAN ID
0x331— setsDAS_autopilotto SELF_DRIVING - Confirmed working on Palladium (Model S Plaid 2023), HW4 Highland (Model 3 Performance 2024), and Intel HW3 (with AP-first workaround)
- Does NOT restore full FSD visualization — only TLSSC (stop signs / traffic lights)
- Recommended banned-car combination: enable TLSSC Restore + TLSSC bit38 (
0x3FDmux 0 bit 38) together — confirmed reliable on HW3 / 2026.2.6 by @RoyRakete (#18). Either toggle alone is unreliable on some banned firmware; the pair re-enables AP/TACC engagement
GTW Config Replay (v2.9+, renamed from "Ban Shield" in v2.15)
- Watches
GTW_carConfig(0x7FF) and replays the learned-healthy bus broadcast in real time when the gateway emits a modified frame - Learns all 8 mux frames on first run, then auto-arms
- What it actually does: broadcast-layer mask only. When armed, the AP ECU sees the replayed healthy frame instead of the gateway's modified one. Tesla's ban writes to GTW NVRAM (which survives reboots) and to server-side flags; this feature does not undo NVRAM state or backend records, only what other on-bus ECUs see in real time.
- What it doesn't do: prevent bans, undo bans, or change Tesla's server-side entitlement record. No empirical case of ban prevention has been confirmed in 6 weeks of v2.9-v2.14 deployment. Honest framing per #60 and #67. The v2.14 name "Ban Shield" overpromised — the v2.15 rename reflects what the code actually does.
Nag Killer (v2.1+)
- DAS-aware gating — only echoes when DAS is actually demanding hands-on, zero bus traffic when DAS is satisfied
- Organic torque variation — xorshift32 PRNG random walk in 1.00-2.40 Nm with grip pulse excursions to 3.10-3.30 Nm every 5-9 seconds
- On-demand grip pulse (v2.15+) — when
handsOnLevelrises into a nag-demand state (0 imminent / 3 escalated), an immediate grip pulse fires and the periodic schedule resets. Closes the 2-second yellow-escalation window that could open between scheduled pulses on v2.14 and earlier - EPAS counter+1 echo on
0x370with level 0 (nag imminent) and level 3 (escalated alarm) suppression - Tap Party CAN (X179 pins 2/3) for the nag killer.
0x370is on Party CAN — not Vehicle CAN (9/10), and the gateway-forwarded Chassis copy (13/14) trips the 2026.14.x preflight. Confirmed working on HW4 2026.20 by tapping 2/3 (#100). A single-CAN board on the wrong pair has nothing to echo — the usual cause of "nag killer does nothing on HW4." Check your car's Service Mode → CAN Port page for which pin is Party on your harness; see HARDWARE.md.
AP-First mode (v2.14+, for 2026.14.x firmware)
- Tesla 2026.14.x added a preflight check that blocks AP/TACC engagement if CAN injection is already active
- When AP-First is enabled, the app monitors
DAS_autopilotStatefrom0x39Band only starts injecting0x3FDafter AP is engaged. On ESP32, the DAS status source follows detected HW version. - Nag killer, TLSSC Restore, and GTW Config Replay are unaffected (they target different CAN IDs)
14.x firmware warning (v2.15+)
- Default ON. Flipper running scene replaces the BMS / flags line with
!14.x: TX may stop APwhenever the warning toggle is enabled. ESP32 web dashboard shows a dismissible yellow banner at the top. - Pessimistic default: most users on 14.x firmware don't know they're affected until autosteer disengages mid-drive. The warning reaches them before they enable any TX feature.
- Opt-out via the On 14.x? Settings toggle (Flipper) or the Dismiss button on the banner (ESP32, persisted in NVS). Disable if you are sure you're on pre-14.x firmware.
- Regional caveat: enforcement intensity varies by market. Some regions (markets without Tesla direct presence) appear to enforce less aggressively. See #73 for the running 14.x tracker.
Diagnostics (read-only, no FSD required)
- Live BMS dashboard: pack voltage, current, SoC, temperature range, energy consumption (Wh/km)
- Vehicle speed, steering angle, motor torque, brake state
- DAS status: autopilot state, hands-on nag level, lane change state, blind spot warning, FCW, vision speed limit
- GTW autopilot tier readback (NONE/HIGHWAY/ENHANCED/SELF_DRIVING/BASIC)
- OTA detection with debounce — auto-suspends TX during firmware updates unless the explicit Ignore OTA override is enabled
CAN Capture + Test Profiles (v2.16+)
- CAN Capture — record every received frame to the SD card in candump format (
apps_data/tesla_mod/captures/). Read-only; safe to run on any car. Feedstools/tesla_crc_cracker.py. - Send Test — load a user-authored
.cantesttext profile from the SD card and replay your own frames. Defaults to dry-run; transmitting is hard-gated to a parked, stationary car (fail-closed) and re-checked before every frame. Result is logged for a bug report. Format + workflow: docs/cantest-format.md, example: examples/example.cantest.
Settings (runtime toggles)
Stable (car-tested):
| Setting | Description |
|---|---|
| Mode | Active / Listen-Only / Service. Listen-Only is the first-boot default — MCP2515 is in hardware listen-only mode and physically cannot TX. |
| Nag Killer | DAS-aware EPAS counter+1 echo with organic torque variation. |
| Force FSD | Bypass the isFSDSelectedInUI check. Does not bypass Tesla's server-side entitlement — only affects local CAN frame flow. |
| Ignore OTA | Allows CAN TX in Active mode even when 0x318 reports a Tesla OTA update in progress. Default is off. |
| TLSSC Restore | 0x331 DAS config spoof to recover TLSSC on banned vehicles. Triggers MCU reboot. |
| AP-First (14.x) | Delay 0x3FD injection until AP is engaged. Required for Tesla firmware 2026.14.x. |
| GTW Config Replay | Replay learned-healthy GTW_carConfig (0x7FF) broadcasts when the gateway emits modified frames. CAN-broadcast-layer mask only — does not undo NVRAM or backend-side ban flags, does not prevent bans. Renamed from "Ban Shield" in v2.15 (#60, #67). |
| Suppress Chime | Kill the ISA speed warning chime (HW4 only, 0x399). On ESP32 this is active only after HW4 detection; Legacy/HW3 use 0x399 as DAS status instead. |
| Emerg. Vehicle | Enable emergency vehicle detection flag (HW4 only, bit59). |
| Precondition | Battery preheat trigger via 0x082. |
Beta (untested, please report results):
| Setting | CAN ID | Description |
|---|---|---|
| ScrollPress AP | 0x3C2 mux=1 | HW4-only, Service mode only. Engages AP via a time-based, human-like scroll-wheel gesture (press ~250ms → scroll-up ~150ms → press ~250ms → scroll-up) on swcRightPressed (bits 12-13) + swcRightScrollTicks (bits 24-29), fired when DAS_autopilotState rises 0→1 — no 0x3FD touch. First known 2026.14.x bypass; discovered + bench-verified on Highland HW4 / 2026.14.2 by @JakNo (#43, timed flow #82). HW3 disabled in v2.15 after @DmitroPanteliuk's emergency-brake report on Intel HW3 2026.14.6 |
| Nav FSD Route | 0x3F8 bits 13/48/49 | Enable nav-based FSD routing (EU/restricted regions) |
| TLSSC bit38 | 0x3FD mux0 bit38 | Explicit TLSSC enable; pair with TLSSC Restore (0x331) as the recommended banned-car combo |
| Lane Graph | 0x3FD mux1 bit45 | UI_showLaneGraph — lane visualization on non-FSD tier |
| Tier Override | 0x7FF mux=2 | Force GTW_autopilot to SELF_DRIVING (more aggressive than GTW Config Replay — actively writes rather than replays) |
| Dev Mode | 0x3F8 bit5 | UI_dasDeveloper flag |
| Force LHD | 0x3F8 bits 40-41 | UI_drivingSide signal override. Empirically does not change FSD lane-side behavior (tested on banned RHD HW3 / 2026.2.6 — values 0, 1, 2 all leave FSD on the LHD side; see #66). Likely a UI-only signal. Slated for removal in v2.15 if no value-3 / DAS_settings counter-evidence surfaces |
| Hands-Off | 0x3F8 bit14 | UI-level hands-on disable (second nag vector) |
| Telemetry Off | 0x3F8 bit43 | Disable trip telemetry — may itself be a ban signal, use only with SIM pulled |
Hardware:
| Setting | Description |
|---|---|
| MCP Crystal | 16 / 8 / 12 MHz — match your CAN module's crystal frequency. |
HW Support
| Tesla HW | Bits Modified | Speed Profile |
|---|---|---|
| Legacy (HW1/HW2) | bit46 | 3 levels (0-2) |
| HW3 | bit46 | 3 levels (0-2) |
| HW4 (FSD V14+) | bit46 + bit60, bit47 | 5 levels (0-4) |
Hardware
Flipper Zero
| Component | Description | Price |
|---|---|---|
| Flipper Zero | The multi-tool device | ~$170 |
| Electronic Cats CAN Bus Add-On | MCP2515-based CAN transceiver (v1.2 supported) | ~$30 |
| OBD-II cable or X179 pigtail | Connect to Tesla's CAN bus | ~$5-10 |
ESP32 (from $14)
Full-featured ESP32 port with WiFi web dashboard, NVS settings persistence, deep sleep, and factory reset. Same CAN logic as the Flipper app.
The ESP32 firmware maps AP/DAS status by detected hardware version:
| Detected HW | 0x399 | 0x39B | ISA speed chime |
|---|---|---|---|
| Legacy HW1/HW2 | DAS_status | not used | disabled |
| HW3 | DAS_status | not used | disabled |
| HW4 | ISA_SPEED | DAS_status | enabled |
| Board | Cost | Build target |
|---|---|---|
| M5Stack ATOM Lite + ATOMIC CAN | ~$14 | m5stack-atom |
| Lilygo T-CAN485 | ~$15 | esp32-lilygo |
| Waveshare ESP32-S3-RS485-CAN | ~$18 | waveshare-s3-can |
| Generic ESP32 + MCP2515 | ~$6 | esp32-mcp2515 |
See esp32/README.md for setup, and HARDWARE.md for the full comparison + wiring diagrams + X179 pinouts.
Connection points
- OBD-II (under steering column) — Party CAN. May go silent in Drive on some Model 3/Y builds.
- X179 (behind passenger kick panel) — recommended. Pin 13/14 = Bus 6 (mixed forwarding, stays active in all modes). See
HARDWARE.mdfor 20-pin and 26-pin pinouts.
Installation
Option 1: Download Pre-built FAP
- Go to Releases
- Download
tesla_mod.fap - Copy to your Flipper's SD card:
SD Card/apps/GPIO/tesla_mod.fap
Option 2: Build from Source
git clone https://github.com/hypery11/flipper-tesla-fsd.git
cd flipper-tesla-fsd
ufbt
# Output: dist/tesla_mod.fap
ESP32
git clone https://github.com/hypery11/flipper-tesla-fsd.git
cd flipper-tesla-fsd/esp32
pio run -e m5stack-atom # or: esp32-lilygo, waveshare-s3-can, esp32-mcp2515
Usage
- Plug the CAN Add-On into your Flipper Zero (or flash the ESP32)
- Connect CAN-H/CAN-L to the vehicle via OBD-II or X179 pin 13/14
- Open the app:
Apps > GPIO > Tesla Mod - Select "Auto Detect & Start" (or Force HW3/HW4)
- Wait for detection (up to 8 seconds) — Palladium S/X will auto-upgrade from Legacy to HW3
- The app starts modifying frames automatically when the TLSSC toggle is enabled in the car
Compatibility
Confirmed working (community-tested)
| Vehicle | HW | Firmware | Tester | Feature |
|---|---|---|---|---|
| Model S Plaid 2023 (Palladium) | HW3/MCU3 | 2026.2.9.3 | @MiniCS, @nagotti | TLSSC Restore, FSD |
| Model 3 Highland Perf 2024 | HW4 | 2026.8.6 | @kp43h8 | TLSSC Restore, persists after disconnect |
| Model 3 2019-2023 | HW3 | Various | @THER4iN, multiple | FSD, nag killer |
| Model X Raven 2017 (HW3 retrofit) | HW3/MCU2 | 2026.8.3 | @dmagyar | Nag killer, EAP |
| Model Y 2023 (China, MIC) | HW3 | 2026.2.11 | Community | FSD (Force FSD mode) |
| Model 3/Y 2023+ | HW4 | < 2026.2.9 | @vbarrier, @kwangseok73-sudo | FSD |
Known limitations
| Firmware | Issue | Workaround |
|---|---|---|
| 2026.8.6+ | Region lock — FSD neural net refuses to run in some regions | Pull SIM, use Force FSD |
| 2026.8.6 HW4 | HW4 injection path broken on this specific build | Use Force HW3 mode |
| Intel HW3 (banned) | TLSSC toggle restored via 0x331, but enabling it breaks AP | Activate AP first, then inject TLSSC via 0x3FD |
File your own test report via the Car compatibility report template.
How It Works
Single-bus read-modify-retransmit on Party CAN. No MITM, no second bus tap.
- Gateway/ECU sends a frame on the CAN bus
- Flipper/ESP32 catches it, modifies the target bits
- Retransmits — the receiver uses the latest frame
CAN IDs
| CAN ID | Name | Direction | Role |
|---|---|---|---|
0x331 | DAS_autopilotConfig | TX | TLSSC Restore — set tier to SELF_DRIVING |
0x370 | EPAS3P_sysStatus | TX | Nag killer — counter+1 echo with organic torque |
0x399 | ISA_speedLimit / DAS_status | TX/RX | ESP32 HW-dependent: Legacy/HW3 read DAS status here; HW4 uses ISA speed chime suppression |
0x3FD | UI_autopilotControl | TX | FSD unlock — bit46/60 (HW3/HW4), TLSSC bit38, lane graph bit45 |
0x3F8 | UI_driverAssistControl | TX | Nav FSD route, hands-off, dev mode, LHD, telemetry (beta) |
0x3EE | UI_autopilotControl | TX | FSD unlock — Legacy HW1/HW2 |
0x3C2 | VCLEFT_switchStatus | TX | ScrollPress AP — right-scroll injection on mux=1 (HW4, Service mode, beta) |
0x7FF | GTW_carConfig | TX | GTW Config Replay + active tier override |
0x082 | UI_tripPlanning | TX | Battery preconditioning trigger |
0x398 | GTW_carConfig | RX | HW version detection |
0x318 | GTW_carState | RX | OTA detection (auto-suspend TX) |
0x399 | DAS_status (HW3/Legacy) / ISA_speedLimit (HW4) | RX/TX | HW-dispatched: pre-Highland HW3 reads as DAS_status (AP state + hands-on); HW4 keeps the chime-suppression write path |
0x39B | DAS_status | RX | HW4 + Highland HW3 — AP state (for AP-First), nag level, lane change, blind spot |
0x132 | BMS_hvBusStatus | RX | Pack voltage / current |
0x292 | BMS_socStatus | RX | State of charge |
0x312 | BMS_thermalStatus | RX | Battery temperature |
0x33A | UI_ratedConsumption | RX | Energy consumption (Wh/km) |
Full list of 37 handlers (14 TX, 23 RX) in fsd_logic/fsd_handler.h.
FAQ
Does FSD stay unlocked after I unplug? No. Real-time frame modification. Unplug = back to stock.
Can this work without an FSD subscription? FSD features (TLSSC, traffic light/stop sign control) require the FSD entitlement from Tesla. Without it, the AP ECU has no neural network weights loaded. Non-FSD features (nag killer, BMS dashboard, speed chime suppress, diagnostics) work on any AP-capable car.
What about VIN-level bans?
Tesla has been banning VINs server-side since April 2026. The ban downgrades GTW_autopilot tier from SELF_DRIVING to ENHANCED and removes the TLSSC toggle. The TLSSC Restore feature (0x331) can recover stop sign/traffic light control on Palladium and HW4. See issue #18 for the full research. GTW Config Replay (0x7FF, formerly "Ban Shield") can replay the learned-healthy configuration in real time, but only at the CAN broadcast layer — it does not undo the underlying NVRAM or server-side state.
Flipper Zero vs ESP32 — which should I get? ESP32 is cheaper ($14 vs $200+), has WiFi dashboard, NVS persistence, and deep sleep. Flipper is more portable and has a built-in screen. Both run the same CAN logic. If you don't already own a Flipper, get the ESP32.
Does this support Model S / Model X?
Yes. Palladium S/X (2021+) is confirmed working with TLSSC Restore. Pre-2021 S/X with HW3 retrofit works via Legacy→HW3 auto-upgrade. HW1/HW2 Model S/X uses Legacy mode (0x3EE). Model S/X uses different BMS CAN IDs — BMS dashboard may show incorrect values.
Can this brick my car? Only UI config frames are touched. No writes to brakes, steering, or powertrain. The app boots in Listen-Only mode by default. See SECURITY.md for the full TX surface list.
Do I need a Flipper CAN Add-On? For the Flipper: yes, any MCP2515-based module (Electronic Cats, generic boards). For ESP32: built-in CAN transceiver on most supported boards (M5Stack ATOMIC CAN, Lilygo T-CAN485, Waveshare S3).
Related projects
| Project | What it is | Hardware |
|---|---|---|
| ev-open-can-tools | The upstream community project. Active development is on GitHub (v3.0.x, GPL-3.0). Formerly Tesla-OPEN-CAN-MOD on GitLab; that group was renamed to ev-open-can-tools and the GitLab repo is now dormant (0 open issues/MRs, last commit 2026-04-25) — track the GitHub repo. | RP2040 CAN, Feather M4, ESP32 |
| dzid26/ESP32-DualCAN | "Dorky Commander" — open-source hardware alternative to the S3XY Commander | ESP32 + dual CAN |
| tuncasoftbildik/tesla-can-mod | Arduino reference implementation with frame templates | Arduino + MCP2515 |
| tumik/S3XY-candump | Python CAN dump tool via S3XY Commander (Panda protocol) | Commander dongle |
Credits
- commaai/opendbc — Tesla CAN signal database
- ElectronicCats/flipper-MCP2515-CANBUS — MCP2515 driver for Flipper
- Community contributors — the on-car testing, captures, and research this project runs on:
- Protocol, nag killer & 2026.14.x work: @jewelrylin (T-2CAN dual-bus captures, the frame-content preflight test, the X179 Service Mode pinout), @DrStrangeglovebox (the Feifan
0x370reference capture + HW4 dual-CAN data + safety findings), @ssw0209-sys (the Mode-C steering-torque reference + HW4 14.x testing), @0xAccretion (HW4 Highland China-MIC DAS-layout findings, #116/#117), @dunckencn (China HW3 start-after-AP validation, steer-jerk + bus-off reports), @kristopf007 (HW4 14.x on-car testing) - Features, captures & PRs: @JakNo (ScrollPress AP /
0x3C2), @vrs11 (Continuous AP), @sqladm1n (RTC capture-log PR + bus/wiring investigation), @DmitroPanteliuk (full-rate0x229captures), @se7en7777777 (0x485/ Highland / checksum analysis), @RoyRakete (TLSSC banned-car combo), @mamixsystem (post-SOP10 connector reference) - Ban research, platform testing, ESP32, bug fixes: @THER4iN, @MiniCS, @kp43h8, @gauner1986, @dmagyar, @ViPiMP, @marcobellinoroci-source, @danpadure, @bruvv, @Symness, @hkloudou, @nagotti, @patatman, @JordanzhaoD
- Protocol, nag killer & 2026.14.x work: @jewelrylin (T-2CAN dual-bus captures, the frame-content preflight test, the X179 Service Mode pinout), @DrStrangeglovebox (the Feifan
Starmixcraft/tesla-fsd-can-mod— original CanFeather FSD research (GitLab repo removed; mirror at Karolynaz/waymo-fsd-can-mod)
Support the research
If this project saved you money on an aftermarket dongle, helped you understand Tesla's CAN bus, or kept your TLSSC working through a ban, consider supporting the ongoing research and testing.
Funds go toward Tesla parts for testing (banned VINs to recover, different MCU/HW combos), ESP32 hardware variants, and time spent reverse-engineering new firmware versions.
License
GPL-3.0
Disclaimer
Educational and research use only. FSD is a premium Tesla feature and must be properly purchased or subscribed to. Modifying vehicle systems may void your warranty and may violate local laws. You are solely responsible for what you do with this. Full safety and responsible-use notes in SECURITY.md.