hypery11/flipper-tesla-fsd

What it solves

Tesla restricts Full Self-Driving (FSD) features behind regional locks, VIN-level bans, and nag warnings that demand constant hands-on attention. Commercial devices like the S3XY Commander cost over $200. This project provides a free, open-source alternative using a Flipper Zero (or an ESP32) to tap into the car's CAN bus, enabling FSD features that the owner already has a valid subscription for, restoring features on banned cars, bypassing the steering-wheel nag, and offering live diagnostics.

How it works

The Flipper Zero's CAN transceiver (MCP2515) taps into the vehicle's CAN network. The app interprets and injects specific CAN frames to manipulate flags like UI_autopilotControl (0x3FD/0x3EE) to enable FSD at the local level. It auto-detects the car's hardware (HW1–HW4) and offers multiple operating modes: Active, Listen-Only, and Service. For the nag killer, it sends an EPAS counter+1 echo on CAN ID 0x370 with organic torque variation (simulating human steering). For banned cars (post-April 2026), the TLSSC Restore feature re-spoofs the 0x331 CAN ID to re-enable stop sign/traffic light control. The GTW Config Replay watches 0x7FF and replays a learned healthy broadcast to mask gateway modifications. Extra features include live BMS dashboard, OTA update detection, performance timers (ESP32), and user-defined CAN capture/test profiles.

Who it's for

Tesla owners who have an active FSD subscription or purchase, but want to unlock region‑gated features, restore VIN‑banned functionality, or bypass nag warnings without paying for expensive commercial hardware. It requires a basic understanding of CAN wiring and some technical tinkering. Note that the tool does not bypass Tesla's server-side entitlement for FSD itself — a valid FSD package is required. Users should also be aware of potential legal/ethical risks and that Tesla may issue VIN bans (as of April 2026).

Highlights

• FSD unlock via bit flips on UI_autopilotControl (0x3FD/0x3EE) — auto‑detects HW3/HW4 with fallback.
• Nag killer with organic torque variation (1.00–1.80 Nm) and on‑demand grip pulses — uses Party CAN (X179 pins 2/3).
• TLSSC Restore for VIN‑banned cars — recovers stop sign / traffic light control via 0x331 DAS config spoofing.
• GTW Config Replay — replays a learned healthy gateway broadcast to mask modified frames (rename from “Ban Shield” in v2.15 to be honest about its actual effect).
• Live BMS dashboard — pack voltage, current, SoC, temperature; ESP32 adds performance timers and estimated G.
• OTA detection with auto‑suspend of TX during updates, and Autopark pause.
• Extra unlocks (ESP32) — Summon EU, Continue on Green, RHD override, Track Mode, Acceleration Mode, and more (experimental).
• CAN Capture and Send Test profiles for safe diagnostics and testing.
• Supports Model 3/Y/S/X across HW1–HW4; free alternative to the $200+ S3XY Commander — total cost from $14 with the ESP32 port.