Open-source Tesla CAN bus toolkit for Flipper Zero and ESP32. FSD region-gate bypass, TLSSC Restore for VIN-banned cars, nag killer with organic torque variation, Ban Shield, live BMS dashboard, and 30+ CAN handlers across Model 3, Model Y, Model S, and Model X. Supports HW3, HW4, and Legacy HW1/HW2. Free alternative to the $200+ S3XY Commander — total cost from $14 with the ESP32 port.
Important
An active FSD package is required for FSD features — either purchased or subscribed. This tool enables FSD functionality at the CAN bus level, but the vehicle still needs a valid FSD entitlement from Tesla. Non-FSD features (nag killer, BMS dashboard, diagnostics) work without any subscription.
Caution
Tesla has begun issuing VIN-level bans (April 2026). Affected vehicles lose the TLSSC toggle silently — no OTA, no warning, persists across account transfers and re-subscriptions. The TLSSC Restore feature (v2.10+) can recover stop sign / traffic light control on banned Palladium and HW4 cars via 0x331 DAS config spoofing. See SECURITY.md and issue #18 for the full ban research.
- Auto-detect HW3/HW4 from
GTW_carConfig(0x398), with fallback detection via0x3FD/0x399/0x3EEwhen0x398isn't on the tapped bus - Legacy→HW3 auto-upgrade for Palladium Model S/X — detects
das_hw=0then upgrades when0x3FDappears on the bus - FSD unlock via bit manipulation on
UI_autopilotControl(0x3FD/0x3EE) - Legacy mode for HW1/HW2 (Model S/X 2016-2019)
- Speed profile defaults to fastest, syncs from follow-distance stalk
- Recover Traffic Light and Stop Sign Control on VIN-banned vehicles
- Read-modify-retransmit on CAN ID
0x331— setsDAS_autopilotto SELF_DRIVING - Confirmed working on Palladium (Model S Plaid 2023), HW4 Highland (Model 3 Performance 2024), and Intel HW3 (with AP-first workaround)
- Does NOT restore full FSD visualization — only TLSSC (stop signs / traffic lights)
- Freezes
GTW_carConfig(0x7FF) in its healthy state - Learns all 8 mux frames on first run, then auto-arms
- Any server-side ban push is blocked at the CAN frame level in real-time
- DAS-aware gating — only echoes when DAS is actually demanding hands-on, zero bus traffic when DAS is satisfied
- Organic torque variation — xorshift32 PRNG random walk in 1.00-2.40 Nm with grip pulse excursions to 3.10-3.30 Nm every 5-9 seconds
- EPAS counter+1 echo on
0x370with level 0 (nag imminent) and level 3 (escalated alarm) suppression
- Live BMS dashboard: pack voltage, current, SoC, temperature range
- Vehicle speed, steering angle, motor torque, brake state
- DAS status: hands-on nag level, lane change state, blind spot warning, FCW, vision speed limit
- GTW autopilot tier readback (NONE/HIGHWAY/ENHANCED/SELF_DRIVING/BASIC)
- OTA detection with debounce — auto-suspends TX during firmware updates
| Setting | Description |
|---|---|
| Mode | Active / Listen-Only / Service. Listen-Only is the first-boot default — MCP2515 is in hardware listen-only mode and physically cannot TX. |
| Force FSD | Bypass the isFSDSelectedInUI check. Does not bypass Tesla's server-side entitlement — only affects local CAN frame flow. |
| TLSSC Restore | 0x331 DAS config spoof to recover TLSSC on banned vehicles. Triggers MCU reboot. |
| Ban Shield | Freeze GTW_carConfig (0x7FF) to block server-side VIN bans. Auto-learns healthy state, then arms. |
| Nag Killer | DAS-aware EPAS counter+1 echo with organic torque variation. |
| Suppress Chime | Kill the ISA speed warning chime (HW4 only, 0x399). |
| Emerg. Vehicle | Enable emergency vehicle detection flag (HW4 only, bit59). |
| Precondition | Battery preheat trigger via 0x082. |
| MCP Crystal | 16 / 8 / 12 MHz — match your CAN module's crystal frequency. |
| Tesla HW | Bits Modified | Speed Profile |
|---|---|---|
| Legacy (HW1/HW2) | bit46 | 3 levels (0-2) |
| HW3 | bit46 | 3 levels (0-2) |
| HW4 (FSD V14+) | bit46 + bit60, bit47 | 5 levels (0-4) |
| Component | Description | Price |
|---|---|---|
| Flipper Zero | The multi-tool device | ~$170 |
| Electronic Cats CAN Bus Add-On | MCP2515-based CAN transceiver (v1.2 supported) | ~$30 |
| OBD-II cable or X179 pigtail | Connect to Tesla's CAN bus | ~$5-10 |
Full-featured ESP32 port with WiFi web dashboard, NVS settings persistence, deep sleep, and factory reset. Same CAN logic as the Flipper app.
| Board | Cost | Build target |
|---|---|---|
| M5Stack ATOM Lite + ATOMIC CAN | ~$14 | m5stack-atom |
| Lilygo T-CAN485 | ~$15 | esp32-lilygo |
| Waveshare ESP32-S3-RS485-CAN | ~$18 | waveshare-s3-can |
| Generic ESP32 + MCP2515 | ~$6 | esp32-mcp2515 |
See esp32/README.md for setup, and HARDWARE.md for the full comparison + wiring diagrams + X179 pinouts.
- OBD-II (under steering column) — Party CAN. May go silent in Drive on some Model 3/Y builds.
- X179 (behind passenger kick panel) — recommended. Pin 13/14 = Bus 6 (mixed forwarding, stays active in all modes). See
HARDWARE.mdfor 20-pin and 26-pin pinouts.
- Go to Releases
- Download
tesla_mod.fap - Copy to your Flipper's SD card:
SD Card/apps/GPIO/tesla_mod.fap
git clone https://github.com/hypery11/flipper-tesla-fsd.git
cd flipper-tesla-fsd
ufbt
# Output: dist/tesla_mod.fapgit clone https://github.com/hypery11/flipper-tesla-fsd.git
cd flipper-tesla-fsd/esp32
pio run -e m5stack-atom # or: esp32-lilygo, waveshare-s3-can, esp32-mcp2515- Plug the CAN Add-On into your Flipper Zero (or flash the ESP32)
- Connect CAN-H/CAN-L to the vehicle via OBD-II or X179 pin 13/14
- Open the app:
Apps > GPIO > Tesla Mod - Select "Auto Detect & Start" (or Force HW3/HW4)
- Wait for detection (up to 8 seconds) — Palladium S/X will auto-upgrade from Legacy to HW3
- The app starts modifying frames automatically when the TLSSC toggle is enabled in the car
| Vehicle | HW | Firmware | Tester | Feature |
|---|---|---|---|---|
| Model S Plaid 2023 (Palladium) | HW3/MCU3 | 2026.2.9.3 | @MiniCS, @nagotti | TLSSC Restore, FSD |
| Model 3 Highland Perf 2024 | HW4 | 2026.8.6 | @kp43h8 | TLSSC Restore, persists after disconnect |
| Model 3 2019-2023 | HW3 | Various | @THER4iN, multiple | FSD, nag killer |
| Model X Raven 2017 (HW3 retrofit) | HW3/MCU2 | 2026.8.3 | @dmagyar | Nag killer, EAP |
| Model Y 2023 (China, MIC) | HW3 | 2026.2.11 | Community | FSD (Force FSD mode) |
| Model 3/Y 2023+ | HW4 | < 2026.2.9 | @vbarrier, @kwangseok73-sudo | FSD |
| Firmware | Issue | Workaround |
|---|---|---|
| 2026.8.6+ | Region lock — FSD neural net refuses to run in some regions | Pull SIM, use Force FSD |
| 2026.8.6 HW4 | HW4 injection path broken on this specific build | Use Force HW3 mode |
| Intel HW3 (banned) | TLSSC toggle restored via 0x331, but enabling it breaks AP | Activate AP first, then inject TLSSC via 0x3FD |
File your own test report via the Car compatibility report template.
Single-bus read-modify-retransmit on Party CAN. No MITM, no second bus tap.
- Gateway/ECU sends a frame on the CAN bus
- Flipper/ESP32 catches it, modifies the target bits
- Retransmits — the receiver uses the latest frame
| CAN ID | Name | Direction | Role |
|---|---|---|---|
0x331 |
DAS_autopilotConfig |
TX | TLSSC Restore — set tier to SELF_DRIVING |
0x370 |
EPAS3P_sysStatus |
TX | Nag killer — counter+1 echo with organic torque |
0x399 |
ISA_speedLimit |
TX | Speed chime suppression (HW4) |
0x3FD |
UI_autopilotControl |
TX | FSD unlock — bit46/60 (HW3/HW4) |
0x3EE |
UI_autopilotControl |
TX | FSD unlock — Legacy HW1/HW2 |
0x7FF |
GTW_carConfig |
TX | Ban Shield — freeze healthy config |
0x082 |
UI_tripPlanning |
TX | Battery preconditioning trigger |
0x398 |
GTW_carConfig |
RX | HW version detection |
0x318 |
GTW_carState |
RX | OTA detection (auto-suspend TX) |
0x39B |
DAS_status |
RX | AP state, nag level, lane change, blind spot |
0x132 |
BMS_hvBusStatus |
RX | Pack voltage / current |
0x292 |
BMS_socStatus |
RX | State of charge |
0x312 |
BMS_thermalStatus |
RX | Battery temperature |
Full list of 37 handlers (14 TX, 23 RX) in fsd_logic/fsd_handler.h.
Does FSD stay unlocked after I unplug? No. Real-time frame modification. Unplug = back to stock.
Can this work without an FSD subscription? FSD features (TLSSC, traffic light/stop sign control) require the FSD entitlement from Tesla. Without it, the AP ECU has no neural network weights loaded. Non-FSD features (nag killer, BMS dashboard, speed chime suppress, diagnostics) work on any AP-capable car.
What about VIN-level bans?
Tesla has been banning VINs server-side since April 2026. The ban downgrades GTW_autopilot tier from SELF_DRIVING to ENHANCED and removes the TLSSC toggle. The TLSSC Restore feature (0x331) can recover stop sign/traffic light control on Palladium and HW4. See issue #18 for the full research. The Ban Shield (0x7FF) can block ban pushes if the AP ECU reads 0x7FF from CAN.
Flipper Zero vs ESP32 — which should I get? ESP32 is cheaper ($14 vs $200+), has WiFi dashboard, NVS persistence, and deep sleep. Flipper is more portable and has a built-in screen. Both run the same CAN logic. If you don't already own a Flipper, get the ESP32.
Does this support Model S / Model X?
Yes. Palladium S/X (2021+) is confirmed working with TLSSC Restore. Pre-2021 S/X with HW3 retrofit works via Legacy→HW3 auto-upgrade. HW1/HW2 Model S/X uses Legacy mode (0x3EE). Model S/X uses different BMS CAN IDs — BMS dashboard may show incorrect values.
Can this brick my car? Only UI config frames are touched. No writes to brakes, steering, or powertrain. The app boots in Listen-Only mode by default. See SECURITY.md for the full TX surface list.
Do I need a Flipper CAN Add-On? For the Flipper: yes, any MCP2515-based module (Electronic Cats, generic boards). For ESP32: built-in CAN transceiver on most supported boards (M5Stack ATOMIC CAN, Lilygo T-CAN485, Waveshare S3).
| Project | What it is | Hardware |
|---|---|---|
| ev-open-can-tools | The upstream community project, now on GitHub. Formerly Tesla-OPEN-CAN-MOD on GitLab (group removed April 2026). |
RP2040 CAN, Feather M4, ESP32 |
| dzid26/ESP32-DualCAN | "Dorky Commander" — open-source hardware alternative to the S3XY Commander | ESP32 + dual CAN |
| tuncasoftbildik/tesla-can-mod | Arduino reference implementation with frame templates | Arduino + MCP2515 |
| tumik/S3XY-candump | Python CAN dump tool via S3XY Commander (Panda protocol) | Commander dongle |
- commaai/opendbc — Tesla CAN signal database
- ElectronicCats/flipper-MCP2515-CANBUS — MCP2515 driver for Flipper
- Community contributors: @THER4iN, @MiniCS, @kp43h8, @gauner1986, @dmagyar, @ViPiMP, @marcobellinoroci-source, @danpadure, @bruvv, @Symness, @hkloudou, @nagotti, @patatman, @JordanzhaoD — ban research, platform testing, ESP32 improvements, bug fixes
Starmixcraft/tesla-fsd-can-mod— original CanFeather FSD research (GitLab repo removed; mirror at Karolynaz/waymo-fsd-can-mod)
GPL-3.0
Educational and research use only. FSD is a premium Tesla feature and must be properly purchased or subscribed to. Modifying vehicle systems may void your warranty and may violate local laws. You are solely responsible for what you do with this. Full safety and responsible-use notes in SECURITY.md.