[MrSpriggs1]

Why don't you try the most current version of the ESP32 Unlocker. That one is out of date.
https://github.com/chappy1978/ES200-Scooter-Unlocker
Good Luck

You are in reason, here you are again and BEST!!!

Is Hackaday.io and ESP libraries installed

[draculauto]

need the seagull es100 binary file?
I can extract it quickly

[MrSpriggs1]

What do you mean you can extract it quickly?

need the seagull es100 binary file?
I can extract it quickly

[draculauto]

With avrdudess I could extract the .hex in binary

[Pata27]

So, i think a found a part of the working principle of those controler.
Command are split in 6 blocs of 2hex chars.
I studied the 4th one, the 5th one and le last one.
I will only speak about those one as i did not try yet to change the first 3.
The 4th one is corresponding to all the parameters that you can activate and desactivate.
The 5th one is the one that allow a maximum speed to the scooter
And the last one is just a CRC-8/maxim that can easily be calculated from the one previously described.

So starting by the result of the 4th bloc.

The string that almost everybody is using now to unlock those scooter is :
A6 12 02 F5 E4 31 (in KPH, there is an other one for MPH but it is the same way of doing)
So if we take the 4th bloc, we have F5. If you write this in binary you got 1 1 1 1 0 1 0.
As seen on the chart i still don't know what is the use of the 2 first digits (maybe somthing with kers but i did not tested it while driving)
The third one (1 in this case) correspond to the curve of acceleration. If you put one you get a faster acceleration than by putting 0.
The 4th one is corresponding to KPH or MPH, putting 1 will give you KPH, 0 MPH.
The 5th one is also unknown, if someone could findout what it is, i will be glad to know it.
The 6th one is the headlight, as usal 1 = on, 0 = off.
The 7th is to make the headlight blink (it as the priority over the headlighton so if you put them both at 1 you will only get a flashing headlight)
And the last one ony is ON/OFF of the scooter.

Now comming to the 5th bloc.

It is also composed of 8 binary values.
I found out that they should all correspond to a speed step.
Like 00000000 = No speed and 11111111 = max speed.
In reality, the wheel cannot run faster than 37.5KPH.
So it will not make a big difference to put a higher value than the one that give you 37.5kph.
Actualy it will maybe help a bit on real road situation, i only tested it free wheeling ...

The last bloc as already known is a crc.

So for example, you want a scooter that Accelerate slowly, a screen in MPH, a blinking headlight and the maximum speed available you should use :
(01)(01)(0)(0)(01)(0)(1)(1)
01 are still unknown values so you can put them as you want, i did not feel any changes only trying free wheeling
So if we take arbitrary 00000011 that give us 0x03 in hex.

For the 5th one, the easiest of picking up the fastest possible is just tu put everyting at 1
so you get 11111111 or 0xFF in hex.

So 0xA6 0x12 0x02 0X03 0xFF
Now that you have the 5 bloc, you can calculate the last one. The easiest way of doing that is to go to this website https://www.crccalc.com/
So if you paste the previous 5 bloc in it you will get 0xBF as a result in CRC-8/maxim


Now you have completed your custom unlock code that look like :
0xA6 0x12 0x02 0X03 0xFF 0xBF

You can paste it in this super short arduino code (i simplified eveything and it still works flawlessly

Code: Select all

#include <Arduino.h>
byte code[] = {0xA6, 0x12, 0x02, 0x03, 0xFF, 0xBF};
void setup() {
Serial.begin(9600);
}
void loop() {
delay(500);
Serial.write(code, sizeof(code));
}

The message a and message b in the previous code that everybody was using was just to (for messageA) lock the scooter at first (not sure why but it was the way it was doing)
and then send the unlock code with the value 11100101 so corresponding to what i found Two first one unknown at 1, fast acceleration at 1,KPH or MPH depending on the one that you where picking up, the third unknown at 0, headlight on, no blinking and scooter on.

I hope i helped everybody to custom there programs and also hopping that someone could find what are the use of the 3 unknown functions in the 4th block

[UgloBuglo]

So, i think a found a part of the working principle of those controler.
...long block of great info...

Amazing!
Well done & thanks for sharing

[ALI.g]

How to get your Impounded Electisan aka Okai Scooter Runninng

Intention of this Tutorial:
This Tutorial is intended to help you to personalize your Electisan aka Okai Scooter.
Actually Jump, Voi, Tier is using them under different names for their rental Systems.

So far known working scooters with this Mod:
-Tier ES-200G
-MyTier ES-200G
-Voi Voiager 2
-Bird Zero

There are plenty of different Versions spreaded in the field. Okai the Manufacturer of these Scooters has actually 7 different Software/Hardware Versions in the field.
ES-200A, ES-200b, ES-200C, ES-200D, ES-200E, ES-200F, ES-200G

I have one of the above listed Scooters how to unlock it?

You will need an Arduino Nano, The Original GPS Box Connector (The black round one) and some kind of powerbank/usb-power to power up the arduino thats it.

The easiest way to test if your Scooter is compatible or not is to use one of the very easy Scripts.

Here you can choose:
-You can try this Version: Turn_Scooter_on.zip *recommended*
-No other Version uploaded yet

Upload:
Use the Arduino IDE Here to open and upload the .ino file to your arduino. If necessary google for the basics in flashing an arduino nano.

Cabling:
-Solder the Green wire to TX from the Arduino
-Solder the blue wire to 3.3V from the arduino

Time to try:
- Connect the Round Plug with your scooter.
- Plug your arduino in the USB Port of your powerbank or whatever

The Light should turn on, the scooter should start.

My Scooter does not start...
Unfortunaley your Scooter is not Compatible til now... We're working hard to unlock more and more revisions and versions. Take a look here from time to time.

My Scooter does start...

Be glad, you have an choosen Scooter.... You can proceed with the code above and built something beautiful out of it.
=======================================================================================================

Bastis Mod
Bastis Mod is an debugging/sending tool for your unlockable scooter. Just connect teh TX and RX line to an Scooter and you'll be able to send whatever you want to the scooter through the Serial Monitor.
Mainfeatures:
-Toggles the light of the scooter on startup
-Accepts Hex and Decimal Input
-If nothing is sent through the serial Monitor different startup commands are sent automatically.
-Scooter responses are written down as Decimal Values in the Serial Port
-The Checksum is calculated by the Arduino

Perfect for debugging and testing some code.

Availability and Download:
-Early 2020 (Sorry Guys)
======================================================================================================
MiTier
The MiTier Mod is intended to be used on the Tier Scooter. I think it will also work on other similiar plattformed scooters.

Mainfeatures:

- Teach in Mode
-Supports 1 Toggle Key and 1 Master Card for reset
- Toggle the Light
-Unlock the Speed Limit (Command not available til now...)
-Enable /Disable Sound
-Change between km/h or mp/h


Needed Hardware:
-Arduino Nano
-RC522 Module (NFC)
-Step Down (Buck) Converter from 42V to 5V
-GPS BOX Original Speaker
-GPS Box
-Reset Switch on the GPS Box

Wiring:

-Coming Soon

Download:

-coming soon

=======================================================================================================

Bastis Mod 0.1
WARNING: This Description and Sofware is old and will replaced by the Bastis Mod v1.0 described above.

Old:

So what you'll need?
-Arduino Nano (~2€)
-Step Down Converter (~2€) (for an first try you can power your arduino by an usb cable.
-XLoader or another Hex file flasher to flash your arduino

How to Install?

-solder the TX line from the arduino to the Green Cable where your GPS Box was...
-solder the Blue Line to 3.3v of your arduino....
-flash the .hex file to your arduino ( I attached an AVRDUDE Uploader)
-the arduino's built in LED will blink now and will try to toggle the scooter on. the light should also turn on...

If you disconnect the Arduino the scooter it will lock itself after around 60 seconds....
So it's at this point your imagination how you want to make the cabling... you could connect an switch/keyswitch to turn on or off the arduino, an 433mhz receiver.


Experimental for Version 0.1: Use the hex file flasher by starting the .cmd file in the .zip file and upload the "upload.hex" file.
Select the comport (Example: write COM1) (Installed Driver needed but is also included as an .dll)
Press enter and the upload should start.

ATTENTION: THIS WAY IS ABSOLUTELY ALPHA. I will work now the next days in making it all a lot better. Please share with me your findings...

hi can you give me access at the file please. Thx

[Iceman88]

So, i think a found a part of the working principle of those controler.
Command are split in 6 blocs of 2hex chars.
I studied the 4th one, the 5th one and le last one.
I will only speak about those one as i did not try yet to change the first 3.
The 4th one is corresponding to all the parameters that you can activate and desactivate.
The 5th one is the one that allow a maximum speed to the scooter
And the last one is just a CRC-8/maxim that can easily be calculated from the one previously described.

So starting by the result of the 4th bloc.

The string that almost everybody is using now to unlock those scooter is :
A6 12 02 F5 E4 31 (in KPH, there is an other one for MPH but it is the same way of doing)
So if we take the 4th bloc, we have F5. If you write this in binary you got 1 1 1 1 0 1 0.
As seen on the chart i still don't know what is the use of the 2 first digits (maybe somthing with kers but i did not tested it while driving)
The third one (1 in this case) correspond to the curve of acceleration. If you put one you get a faster acceleration than by putting 0.
The 4th one is corresponding to KPH or MPH, putting 1 will give you KPH, 0 MPH.
The 5th one is also unknown, if someone could findout what it is, i will be glad to know it.
The 6th one is the headlight, as usal 1 = on, 0 = off.
The 7th is to make the headlight blink (it as the priority over the headlighton so if you put them both at 1 you will only get a flashing headlight)
And the last one ony is ON/OFF of the scooter.

Now comming to the 5th bloc.

It is also composed of 8 binary values.
I found out that they should all correspond to a speed step.
Like 00000000 = No speed and 11111111 = max speed.
In reality, the wheel cannot run faster than 37.5KPH.
So it will not make a big difference to put a higher value than the one that give you 37.5kph.
Actualy it will maybe help a bit on real road situation, i only tested it free wheeling ...

The last bloc as already known is a crc.

So for example, you want a scooter that Accelerate slowly, a screen in MPH, a blinking headlight and the maximum speed available you should use :
(01)(01)(0)(0)(01)(0)(1)(1)
01 are still unknown values so you can put them as you want, i did not feel any changes only trying free wheeling
So if we take arbitrary 00000011 that give us 0x03 in hex.

For the 5th one, the easiest of picking up the fastest possible is just tu put everyting at 1
so you get 11111111 or 0xFF in hex.

So 0xA6 0x12 0x02 0X03 0xFF
Now that you have the 5 bloc, you can calculate the last one. The easiest way of doing that is to go to this website https://www.crccalc.com/
So if you paste the previous 5 bloc in it you will get 0xBF as a result in CRC-8/maxim


Now you have completed your custom unlock code that look like :
0xA6 0x12 0x02 0X03 0xFF 0xBF

You can paste it in this super short arduino code (i simplified eveything and it still works flawlessly

Code: Select all

#include <Arduino.h>
byte code[] = {0xA6, 0x12, 0x02, 0x03, 0xFF, 0xBF};
void setup() {
Serial.begin(9600);
}
void loop() {
delay(500);
Serial.write(code, sizeof(code));
}

The message a and message b in the previous code that everybody was using was just to (for messageA) lock the scooter at first (not sure why but it was the way it was doing)
and then send the unlock code with the value 11100101 so corresponding to what i found Two first one unknown at 1, fast acceleration at 1,KPH or MPH depending on the one that you where picking up, the third unknown at 0, headlight on, no blinking and scooter on.

I hope i helped everybody to custom there programs and also hopping that someone could find what are the use of the 3 unknown functions in the 4th block

Hi to all, I have tried this code on Arduino Nano on ES 200 G and unlock motor ok, start motor ok, light on blinking ok but after about one minute the scooter stops, the screen turns off and the flashing light remains. If I plug the charge cable the display light on and errror code 09E.
So is impossible to turn off the scooter.
I have tried to unplug the + cable on Arduino but nothing

[MrSpriggs1]

Pull the battery cable to the ESC

[antonio]

Hello and thx for help

Itried with that version and I have the same issue

Arduino:1.8.9 (Windows Store 1.8.21.0) (Windows 10), Tarjeta:"ESP32 Dev Module, Disabled, Default 4MB with spiffs (1.2MB APP/1.5MB SPIFFS), 240MHz (WiFi/BT), QIO, 80MHz, 4MB (32Mb), 921600, None"

Scooter_Controller_RemoteXY_ESP32:65:16: error: 'LED_BUILTIN' was not declared in this scope

int powerPin = LED_BUILTIN;

^

exit status 1
'LED_BUILTIN' was not declared in this scope

Este informe podría contener más información con
"Mostrar salida detallada durante la compilación"
opción habilitada en Archivo -> Preferencias.

Why don't you try the most current version of the ESP32 Unlocker. That one is out of date.
https://github.com/chappy1978/ES200-Scooter-Unlocker
Good Luck

You are in reason, here you are again and BEST!!!

Is Hackaday.io and ESP libraries installed