[Help] Reliable way to get VIN or equivalent non-changing hard vehicle ID needed

[itsMeDavidV]

[Help] Reliable way to get VIN or equivalent non-changing hard vehicle ID needed

[LexNastin]

What you think of something like this?

https://forms.gle/eDDz22vJyV9hwLNi6

[itsMeDavidV]

@ArchGryphon9362 yeah that's a good idea.

You can also tap the b-pillar outside the car. That's where it gets sticky if there's another Tesla around.

And yeah haha it took a lot of digging, I'll dm you on Twitter about the option codes when I get some spare time

[LexNastin]

SHA1 OF THE VIN, THE FIRST 16 NUMBERS THAT GET RETURNED FROM THE HASH!!!!!!!!!!

THAT IS THE 16 HEX NUMBERS IN THE MIDDLE OF THE NAME!!!!!!

Example

VIN: 5YJ3E1EA1KF064316

That means that the BLE name is S04088022ea63a11f? because the SHA1 of 5YJ3E1EA1KF064316 is 04088022ea63a11fbe3db3c58bf506e17f809345. Taking the first 16 bytes of that will be 04088022ea63a11, therefore we do "S" + "04088022ea63a11" + "?" and that is the BLE name. I don't know what the ? is, so we can just do if deviceName.startsWith("S" + "04088022ea63a11") to see if it is the right car!

[kaedenbrinkman]

That makes a lot of sense. Great work!
I'm still curious what the manufacturer data represents. It seems that for most cars the data is the same except for the last ~5 bytes.

The watch app I'm trying to make won't know the VIN of the car you're looking for, (and for some reason the watch is not able to see the device name either), but if some of the details can be found from the manufacturer data, I could at least maybe show the model and color of the car the user is selecting?

The only way I think we could figure this out is to collect the manufacturer data from a bunch of cars, record their configuration, and try to find a pattern. I don't think the Tesla app uses this information :(

[LexNastin]

The manufacturer data stuff is interesting, but I don't think I'll be dedicating much time personally on figuring that stuff out. If someone else wants to, they're welcome.

But ye, the Tesla app doesn't seem to use the manufacturer info from anywhere I've seen.

[itsMeDavidV]

Wow this is awesome, well done guys!

@ArchGryphon9362 there's a beta slot with your name on it for Watchla's go at BLE if you're up for it! Been using it for a few weeks myself and it's definitely a game changer 🙌🏽 should push to beta next week.

Closing this

[LexNastin]

Sad thing, I see it's iOS only? I'm on Android 😅

Anyways, have a good day!

[itsMeDavidV]

Ah lmk when you step away from the dark side haha

[LexNastin]

I find the Apple ecosystem quite amazing, so might switch at some point 😁 (not soon tho prob)

[LexNastin]

Hey, thanks for taking a read through the docs. If I'm honest, I haven't tried much to find any correlations, but people have asked before.

Maybe there is some sort of correlation, but how I believe the app does it (although I barely looked at the code, so I might be greatly mistaken on this), is that it takes the first vehicle that it finds, which means that it might get the wrong one.

I'm not sure if the VIN is transferred over the protocol or not, but I have seen mentions of it in the file. But no, haven't personally gotten it before using the protocol.

Maybe if I look into the app's code more, and maybe gather a few bits of information from people, that might help.

(Also, VCSEC means Vehicle Secondary, which is just a controller for the car's "additional" kinda functionality, but that's what I call the protocol on the website, because that's how the proto file is called everywhere on the app)

Hope that helps in any way, and I'll put in more effort into finding out a correlation as that's what people seen to ask for.

Once again, thanks for your time, have a good day! (also sorry for the long lecture)

[itsMeDavidV]

@ArchGryphon9362 Ha no worries. It's mentioned in the protobuf so there definitely has to be a way to have the car send it.

Unfortunately that + filtering for best RSSI + explicitly directing user to be inside vehicle will have to be the temporary method for now--not ideal.

Not sure if this is documented in Tesla API but there is a way to get correct option codes from account API which is not accessible from regular API. When I get some time I'll see if theres any way we can get BLE name or UUID from there as well.

Also added to the form and included vehicle_id, please update if you find any correlations! You should try checking against your own reservation number as well.

[LexNastin]

Thanks, for letting me know, I might put this on the "Getting Started" page of the documentation, to let people add theirs. But yeah they have to be inside anyways because well... they have to tap their keycard...

Also! You said you can get correct option codes from a separate API!? I know this is unrelated, but can you point me towards where you found that information, as that sounds like something interesting...

[kaedenbrinkman]

• Have you figured out if there's any correlation between the vehicle's BLE name and any identifying factors to the actual vehicle?

I'm trying to see if I can figure this out, but it's hard. There is an android app (TeslaRadar) that is able to identify the model of a vehicle just using the BLE information. I contacted the developer and he said the app contacts his server which uses a rainbow table to do it - so not something very straightforward.

The most promising place there might be an identifier would be in the manufacturer data returned from a BLE scan. If you read the manufacturer data for Tesla (ID: 76) you get a byte array that is unique for each vehicle. I'm trying to figure out how to decode these arrays, but it's going to take some time.

Here are some examples for random cars I came across:

 # Manufacturer data for several vehicles I came across while testing
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 0, 0, 47, 70, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 0, 0, 165, 65, 197]
 [2, 21, 36, 153, 238, 245, 204, 239, 218, 203, 24, 248, 80, 148, 236, 177, 127, 206, 0, 1, 0, 1, 197]
 [2, 21, 185, 64, 127, 48, 245, 248, 70, 110, 175, 249, 37, 85, 107, 87, 254, 109, 16, 0, 0, 5, 198]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 0, 0, 168, 203, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 0, 0, 227, 159, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 1, 0, 47, 69, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 1, 0, 42, 39, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 0, 0, 211, 129, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 1, 0, 201, 20, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 0, 0, 83, 13, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 1, 0, 119, 46, 197]
 [15, 8, 192, 10, 214, 30, 130, 0, 4, 11, 16, 2, 11, 4]  # I don't think this one is a vehicle
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 0, 0, 55, 63, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 1, 0, 227, 115, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 1, 0, 97, 110, 197]
 [2, 21, 116, 39, 139, 218, 182, 68, 69, 32, 143, 12, 114, 14, 175, 5, 153, 53, 0, 0, 233, 23, 197]

It looks like most of the data is the same for all vehicles, but there are several bytes that differ. I would love to see if it is possible to decode these - perhaps the 5th-to-last byte is a zero for a Model 3 and a 1 for a Model Y, for example.

[LexNastin]

Wow! Nice find! I never even thought of reading the manufacturer data. I'll take a look into this, and see if I find anything promising 😁. A rainbow table might not be bad if it could cover all cases, but yes, finding a pattern would be amazing!

[LexNastin]

Ugh, this is kinda sad, they use only crowdsourced patterns... This might mean one of 2 things, I'll have to reverse engineer the Tesla app, which is more or less easy, or there might be not pattern 😢. Anyways, we'll see!

(Here's a talk he did about it https://youtu.be/Kr9FFXUiyac)

[LexNastin]

Ok so, I just began reverse engineering the app, and I found a few things. When looking for the right car, the VIN is involved! I haven't found much yet, but looking at it, something to do with the VIN gets put through a SHA hasher, I think it was SHA1, and then they check if the name of the car's BLE contains it. If it does, it connects!

SO! I'm gonna spend some time finding out what it was, and will let you guys know!

[LexNastin]

@itsMeDavidV, you can close this issue if you got what you want. I'm not sure what the last character is, but I only seen C for Model 3 (I only ever saw 2 names for it 😅)

[LexNastin]

Commit 2b23a13 changes documentation to explain BLE name!