6 ms·

Reverse engineering my e-scooter and rewriting the firmware in Rust

448 points by vinhnx 7d ago

trevithick 3d ago
Reverse engineering like this is black magic to me. The writeup is good. It's detailed and I could follow along with what the author was doing even though I'm too stupid to ever attempt something like this. Nice job author. I liked bullet 2 in the Introduction.
- tverbeure 3d ago
  Reverse engineering the way they do it is very satisfying and time consuming. If you want the same results but without the sweat, LLMs are the way to go now. They eat this kind of stuff for lunch. You could literally ask one for a table with all the CAN bus messages and it would figure it out. I wrote a blog posts where I first did it the traditional way and then, a few months later, the lazy way: https://tomverbeure.github.io/2026/04/12/AMIQ-License-Key-Generation.html https://tomverbeure.github.io/2026/04/12/AMIQ-License-Key-Ge....
  - BlackRabbit1 3d ago
    LLMs are fun until you have to break up a devices that use encrypted firmware files and non-documented interfaces.. that you are back in the past ;-) But for the rest: Yes. They will be eaten alive by the latest generation of LLMs. I use DS-Flash 4.1 a lot for this. A big helper.
- callc 3d ago
  Take it one step at a time. I’ve had a fun time just intercepting the Bluetooth communication part for little devices. Most of the time the protocols are not locked down, and if it’s a popular device chances are someone else already did it for you. You can get help by decompiling the Android app for the device which should give more info about the content of the Bluetooth messages. That’s the level I’m at right now. Oscilloscopes and all that look intimidating to me too!
yonatan8070 3d ago
> To my surprise, two of the USB-C pins were being used as a CAN bus (which smells horribly noncompliant). Oh god that's awful. Why would anyone in their right mind do this?
- ranma42 3d ago
  USB-C actually has pins dedicated to application/debug use (SBU1 and SBU2). "SBU1 and SBU2: these are low-speed lines used only for Alternate Mode and accessory mode. For example, with DisplayPort, AUX+ and AUX– transmit over the SBU lines. For audio adapter accessory mode, these lines are used for the microphone input and analog GND."
- fragmede 3d ago
  Cost. It's a clever hardware hack that saves money, and 1 cent saved over 100 million units is $1,000,000!
Founderarcstone 3d ago
what a great project nice work!
BrandoElFollito 3d ago
First of all, this is impressive. I do not know how what the legal context is in your country, but you may need to have a device that uses public roads licensed to do so. In case of any legal issues (accidents, mostly) not only you would not be covered by your insurance, but your situation may worsen for having operated it. Something to keep in mind.
- yonatan8070 3d ago
  Maybe, but in the case of a crash, would anyone go Ghidra-ing inside your scooter's MCU to check if you replaced the firmware? It sounds like as long as you don't say anything, no one will ever know.
- nitros 3d ago
  This is definitely something to be aware of. Installing this firmware definitely invalidates the StVO (though I can always flash the original firmware back). Personally I am morally sound with replacing the firmware of the display unit as the critical functionality is still handled by the motor controller (for example, the brake lever sensors are wired to the motor controller directly, and the display must report the throttle position constantly to not trigger a shutdown); the display unit would need to contain intentionally malicious code to cause problems.
rfgplk 3d ago
My general piece of advice to anyone looking to do this is not to even bother. Just strip the hardware package and replace it with an arduino/bb or an equivalent sbc figure out what the motors are and wire it up yourself. Way faster and less tedious
- the__alchemist 3d ago
  > arduino/bb or an equivalent sbc This is perhaps more of a Maker perspective. I think the article author's approach (What you might classify as embedded engineer) is more suitable broadly. These are categorizations without a fine line, but are IME useful for clustering approaches and preferences. For another example of an adjacent non-obvious clustering, see embedded vs robotics; they don't have as much overlap as you might guess!
ifh-hn 3d ago
Wish I was brainy enough to do this sort of thing!
- j_m_b 3d ago
  That's what is nice about LLMs. You CAN do these things now!
  - nearlyepic 3d ago
    No, you can’t. Just because you can pull the lever on an LLM enough times and get something that works doesn’t mean you’ve done the work. Doing the work implies learning and transferable skills, none of which you get by prompting an LLM.
    - fragmede 3d ago
      Yes they can. At the end of the day, whether the food was made in a microwave oven or by a Michelin starred chef, the user is fed. Doing the work means that the work happened. Anything else is secondary.
      - devsda 3d ago
        A microwave just cooks your input ingredients and if you use non microwave safe containers or food that is not suitable for it, you get edible but hazardous food. Garbage in, Garbage out. There are minimum expectations on user like ability to source proper materials, use them correctly and an ability to verify/check the result for problems. More important if it's something you want to eat or ride!
      - nearlyepic 3d ago
        You wouldn't call someone who puts food in a microwave a chef, would you? And you wouldn't say that putting food in the microwave is the same thing as cooking a Michelin star meal. These are different things.
      - nitros 3d ago
kooi 7d ago
Very nice. Be safe out there when tweaking these things.
- TheChaplain 3d ago
  From what I've seen on the streets, people bypassing the restrictions will not, and there will be injuries.
  - jstanley 3d ago
    You only notice the ones that aren't safe. How would you know if someone bypassed the restrictions if they were riding it safely?
    - TheChaplain 3d ago
      Because if they are riding it safely, there would be no need to bypass the restrictions. There is reason for speed limits, they are not there to f--k with people for fun.
      - yonatan8070 3d ago
        You can remove the speed limit of a vehicle for when you want to have fun on a closed course. You don't have to always go over the factory limit.
      - fragmede 3d ago
        That implies that speed itself is unsafe. Which it is not. Airplanes go some 500 mph and mostly don't kill people.
jimmy76615 3d ago
I wanna have a friend like this guy
asimovDev 3d ago
Thank you for posting! I got a e-scooter this spring and wrote my own app for it after reverse engineering the official app + BLE logs. I am not brave enough to do anything with the firmware on it though. Maybe not yet at least
hommelix 3d ago
> The updater device then sends 64 byte chunks spread over 9 CAN 0x384 frames Classic CAN uses 8 bytes long frame, so 64 bits. Is it a typo in the post, vor is it using CAN-FD?
- baby_souffle 3d ago
  Must be. Can 1.x and 2.0 are fixed size frames.
- irishcoffee 3d ago
  Could be TP.DT, multi packet. My guess is a typo.
- bri3d 3d ago
  I read this as the chunks are 64 bytes and thus each chunk is split over 9 frames. I haven’t looked yet but it’s probably an ISO-TP esque framing protocol.
  - nitros 3d ago
    Yep, this is the case. Nine frames are transmitted with the first frame containing a sequence number and the first five bytes, followed by seven frames containing just data, and a final frame containing the last three bytes of data, and a two byte CRC.
barbarkaragul 3d ago
[dead]
arbirk 3d ago
I am also rusting my hw. Last week my mouse, this week my EUC (wish me luck). I would rather risk a crash than memory corruption
- thenthenthen 3d ago
  What is an EUC? And also what kinda crash are you referring to? i rather have a memory issue than crash my e-scooter (and myself) haha
  - Someone 3d ago
    in this context, it likely refers to an electric unicycle (https://en.wikipedia.org/wiki/Electric_unicycle https://en.wikipedia.org/wiki/Electric_unicycle)
    - thenthenthen 3d ago
      Thanks, are these popular besides Huaqiangbei (Shenzhen) delivery guys?
      - arbirk 3d ago
        I have an inmotion V10 - soon rusty
abound 3d ago
This is an unbelievably impressive project and a killer write up, very satisfying. I wonder if the author looked into using Slint [1] for the UI, given the codegen bloat issues they had with buoyant (which also looks very cool). I haven't used either, but I've done a few projects with Embassy and am always looking for an excuse to try embedded GUI tools [1] https://slint.rs/ https://slint.rs/
- nitros 3d ago
  Heya, I tried using slint first, but slint needs even more flash, and an allocator on top. Just adding slint (with an empty UI) exhausted my binary size limit.
  - uneoneuno 3d ago
    I've got a happy run G300 pro that has a controller I've been considering digging into. It doesn't seem tuned to the motor. This is great inspiration to start digging in. It actually seems a bit clever to use the USB pins as a CAN bus
  - abound 3d ago
    Oh wow, good to know! Cool project, best of luck with your motor controller firmware
ivo_repairs 3d ago
[flagged]
quietraster 3d ago
rewriting scooter firmware in rust is the kind of unnecessary excellence i come here for. how did you debug without bricking it, swd probe or pure faith
- nitros 3d ago
  With a SWD probe on the cracked open display initially, and this was necessary while I was still writing/porting the peripheral drivers. Once the firmware was stable (and after I'd asserted that it wasn't possible to accidentally brick the scooter) I moved to testing on the real scooter where the only feedback is if things work or not.
zoobab 3d ago
We need to free up Bosch systems. They use lots of open source libs, but they close the whole chain (like spare batteries) so that you cannot plug external batteries from other suppliers.
- RealityVoid 3d ago
  I took a look into the batteries for the ebike systems, they have some sort of AES based pairing and the chips are read protected. You probably can dump the firmware from the update packages for the things. (maybe some hw exploitation stuff as well?) I did a thing where I put their battery controller on an after market battery with a divisor and it started and paired, but for some reason blew up afterwards. I now realize it would be easier to write the whole thing wholesale, but.. uhh, it's no small feat, and I have a job soooo... Bosch should open their shit, it might save them, because it seems the chinese with Avinox will eat their dinner in a couple of years. They seem to be pretty litigious, they went after a forum that documented initiatives to reverse (well, they also hosted pirated diagnostics sw but.. yeah)
- surajrmal 3d ago
  Having been on the flip side of this divide in the past, there really are a lot of potential safety and reliability problems when using random third party versions of components. While I'm sure there are strong financial incentives to constrain supply, there are also some other strong reasons as well. Also it's very expensive to actually make an ecosystem compared to a close one. The best way to incentivize manufacturers to do it is by creating a competing product that is open and having that differentiating feature drive sales away. That's generally the approach that works best.
  - stymaar 3d ago
    > there really are a lot of potential safety and reliability problems when using random third party versions of components. What are you talking about? If a seller sells you random junk that causes safety issue, they are liable of the damage like the OEM would if their product was bad. Then, if the seller is in a jurisdiction where you can't hope to sue, then it's either your problem for picking this random seller on their website, or we should make it Amazon's problem to feature this kind of sellers in the first place. Surely the biggest retailer on the planet could afford vetting businesses selling on its platform to protect consumers' safety. In any case, the fact that Bosch's ecosystem is closed offers no additional protection whatsoever, as shady sellers already sell counterfeit components (that may or may not work at all).

448 points by vinhnx 7d ago

Reverse engineering like this is black magic to me. The writeup is good. It's detailed and I could follow along with what the author was doing even though I'm too stupid to ever attempt something like this. Nice job author. I liked bullet 2 in the Introduction.

tverbeure 3d ago
Reverse engineering the way they do it is very satisfying and time consuming. If you want the same results but without the sweat, LLMs are the way to go now. They eat this kind of stuff for lunch. You could literally ask one for a table with all the CAN bus messages and it would figure it out. I wrote a blog posts where I first did it the traditional way and then, a few months later, the lazy way: https://tomverbeure.github.io/2026/04/12/AMIQ-License-Key-Generation.html https://tomverbeure.github.io/2026/04/12/AMIQ-License-Key-Ge....
- BlackRabbit1 3d ago
  LLMs are fun until you have to break up a devices that use encrypted firmware files and non-documented interfaces.. that you are back in the past ;-) But for the rest: Yes. They will be eaten alive by the latest generation of LLMs. I use DS-Flash 4.1 a lot for this. A big helper.
callc 3d ago
Take it one step at a time. I’ve had a fun time just intercepting the Bluetooth communication part for little devices. Most of the time the protocols are not locked down, and if it’s a popular device chances are someone else already did it for you. You can get help by decompiling the Android app for the device which should give more info about the content of the Bluetooth messages. That’s the level I’m at right now. Oscilloscopes and all that look intimidating to me too!

yonatan8070 3d ago

> To my surprise, two of the USB-C pins were being used as a CAN bus (which smells horribly noncompliant). Oh god that's awful. Why would anyone in their right mind do this?

ranma42 3d ago
USB-C actually has pins dedicated to application/debug use (SBU1 and SBU2). "SBU1 and SBU2: these are low-speed lines used only for Alternate Mode and accessory mode. For example, with DisplayPort, AUX+ and AUX– transmit over the SBU lines. For audio adapter accessory mode, these lines are used for the microphone input and analog GND."
fragmede 3d ago
Cost. It's a clever hardware hack that saves money, and 1 cent saved over 100 million units is $1,000,000!

Founderarcstone 3d ago

what a great project nice work!

BrandoElFollito 3d ago

First of all, this is impressive. I do not know how what the legal context is in your country, but you may need to have a device that uses public roads licensed to do so. In case of any legal issues (accidents, mostly) not only you would not be covered by your insurance, but your situation may worsen for having operated it. Something to keep in mind.

yonatan8070 3d ago
Maybe, but in the case of a crash, would anyone go Ghidra-ing inside your scooter's MCU to check if you replaced the firmware? It sounds like as long as you don't say anything, no one will ever know.
nitros 3d ago
This is definitely something to be aware of. Installing this firmware definitely invalidates the StVO (though I can always flash the original firmware back). Personally I am morally sound with replacing the firmware of the display unit as the critical functionality is still handled by the motor controller (for example, the brake lever sensors are wired to the motor controller directly, and the display must report the throttle position constantly to not trigger a shutdown); the display unit would need to contain intentionally malicious code to cause problems.

rfgplk 3d ago

My general piece of advice to anyone looking to do this is not to even bother. Just strip the hardware package and replace it with an arduino/bb or an equivalent sbc figure out what the motors are and wire it up yourself. Way faster and less tedious

the__alchemist 3d ago
> arduino/bb or an equivalent sbc This is perhaps more of a Maker perspective. I think the article author's approach (What you might classify as embedded engineer) is more suitable broadly. These are categorizations without a fine line, but are IME useful for clustering approaches and preferences. For another example of an adjacent non-obvious clustering, see embedded vs robotics; they don't have as much overlap as you might guess!

ifh-hn 3d ago

Wish I was brainy enough to do this sort of thing!

j_m_b 3d ago
That's what is nice about LLMs. You CAN do these things now!
- nearlyepic 3d ago
  No, you can’t. Just because you can pull the lever on an LLM enough times and get something that works doesn’t mean you’ve done the work. Doing the work implies learning and transferable skills, none of which you get by prompting an LLM.
  - fragmede 3d ago
    Yes they can. At the end of the day, whether the food was made in a microwave oven or by a Michelin starred chef, the user is fed. Doing the work means that the work happened. Anything else is secondary.
    - devsda 3d ago
      A microwave just cooks your input ingredients and if you use non microwave safe containers or food that is not suitable for it, you get edible but hazardous food. Garbage in, Garbage out. There are minimum expectations on user like ability to source proper materials, use them correctly and an ability to verify/check the result for problems. More important if it's something you want to eat or ride!
    - nearlyepic 3d ago
      You wouldn't call someone who puts food in a microwave a chef, would you? And you wouldn't say that putting food in the microwave is the same thing as cooking a Michelin star meal. These are different things.
    - nitros 3d ago

kooi 7d ago

Very nice. Be safe out there when tweaking these things.

TheChaplain 3d ago
From what I've seen on the streets, people bypassing the restrictions will not, and there will be injuries.
- jstanley 3d ago
  You only notice the ones that aren't safe. How would you know if someone bypassed the restrictions if they were riding it safely?
  - TheChaplain 3d ago
    Because if they are riding it safely, there would be no need to bypass the restrictions. There is reason for speed limits, they are not there to f--k with people for fun.
    - yonatan8070 3d ago
      You can remove the speed limit of a vehicle for when you want to have fun on a closed course. You don't have to always go over the factory limit.
    - fragmede 3d ago
      That implies that speed itself is unsafe. Which it is not. Airplanes go some 500 mph and mostly don't kill people.

jimmy76615 3d ago

I wanna have a friend like this guy

asimovDev 3d ago

Thank you for posting! I got a e-scooter this spring and wrote my own app for it after reverse engineering the official app + BLE logs. I am not brave enough to do anything with the firmware on it though. Maybe not yet at least

hommelix 3d ago

> The updater device then sends 64 byte chunks spread over 9 CAN 0x384 frames Classic CAN uses 8 bytes long frame, so 64 bits. Is it a typo in the post, vor is it using CAN-FD?

baby_souffle 3d ago
Must be. Can 1.x and 2.0 are fixed size frames.
irishcoffee 3d ago
Could be TP.DT, multi packet. My guess is a typo.
bri3d 3d ago
I read this as the chunks are 64 bytes and thus each chunk is split over 9 frames. I haven’t looked yet but it’s probably an ISO-TP esque framing protocol.
- nitros 3d ago
  Yep, this is the case. Nine frames are transmitted with the first frame containing a sequence number and the first five bytes, followed by seven frames containing just data, and a final frame containing the last three bytes of data, and a two byte CRC.

barbarkaragul 3d ago

[dead]

arbirk 3d ago

I am also rusting my hw. Last week my mouse, this week my EUC (wish me luck). I would rather risk a crash than memory corruption

thenthenthen 3d ago
What is an EUC? And also what kinda crash are you referring to? i rather have a memory issue than crash my e-scooter (and myself) haha
- Someone 3d ago
  in this context, it likely refers to an electric unicycle (https://en.wikipedia.org/wiki/Electric_unicycle https://en.wikipedia.org/wiki/Electric_unicycle)
  - thenthenthen 3d ago
    Thanks, are these popular besides Huaqiangbei (Shenzhen) delivery guys?
    - arbirk 3d ago
      I have an inmotion V10 - soon rusty

abound 3d ago

This is an unbelievably impressive project and a killer write up, very satisfying. I wonder if the author looked into using Slint [1] for the UI, given the codegen bloat issues they had with buoyant (which also looks very cool). I haven't used either, but I've done a few projects with Embassy and am always looking for an excuse to try embedded GUI tools [1] https://slint.rs/ https://slint.rs/

nitros 3d ago
Heya, I tried using slint first, but slint needs even more flash, and an allocator on top. Just adding slint (with an empty UI) exhausted my binary size limit.
- uneoneuno 3d ago
  I've got a happy run G300 pro that has a controller I've been considering digging into. It doesn't seem tuned to the motor. This is great inspiration to start digging in. It actually seems a bit clever to use the USB pins as a CAN bus
- abound 3d ago
  Oh wow, good to know! Cool project, best of luck with your motor controller firmware

ivo_repairs 3d ago

[flagged]

quietraster 3d ago

rewriting scooter firmware in rust is the kind of unnecessary excellence i come here for. how did you debug without bricking it, swd probe or pure faith

nitros 3d ago
With a SWD probe on the cracked open display initially, and this was necessary while I was still writing/porting the peripheral drivers. Once the firmware was stable (and after I'd asserted that it wasn't possible to accidentally brick the scooter) I moved to testing on the real scooter where the only feedback is if things work or not.

zoobab 3d ago

We need to free up Bosch systems. They use lots of open source libs, but they close the whole chain (like spare batteries) so that you cannot plug external batteries from other suppliers.

RealityVoid 3d ago
I took a look into the batteries for the ebike systems, they have some sort of AES based pairing and the chips are read protected. You probably can dump the firmware from the update packages for the things. (maybe some hw exploitation stuff as well?) I did a thing where I put their battery controller on an after market battery with a divisor and it started and paired, but for some reason blew up afterwards. I now realize it would be easier to write the whole thing wholesale, but.. uhh, it's no small feat, and I have a job soooo... Bosch should open their shit, it might save them, because it seems the chinese with Avinox will eat their dinner in a couple of years. They seem to be pretty litigious, they went after a forum that documented initiatives to reverse (well, they also hosted pirated diagnostics sw but.. yeah)
surajrmal 3d ago
Having been on the flip side of this divide in the past, there really are a lot of potential safety and reliability problems when using random third party versions of components. While I'm sure there are strong financial incentives to constrain supply, there are also some other strong reasons as well. Also it's very expensive to actually make an ecosystem compared to a close one. The best way to incentivize manufacturers to do it is by creating a competing product that is open and having that differentiating feature drive sales away. That's generally the approach that works best.
- stymaar 3d ago
  > there really are a lot of potential safety and reliability problems when using random third party versions of components. What are you talking about? If a seller sells you random junk that causes safety issue, they are liable of the damage like the OEM would if their product was bad. Then, if the seller is in a jurisdiction where you can't hope to sue, then it's either your problem for picking this random seller on their website, or we should make it Amazon's problem to feature this kind of sellers in the first place. Surely the biggest retailer on the planet could afford vetting businesses selling on its platform to protect consumers' safety. In any case, the fact that Bosch's ecosystem is closed offers no additional protection whatsoever, as shady sellers already sell counterfeit components (that may or may not work at all).