An Electric Scooter Community on a Mission to Stamp out Transportation Mediocrity.

Covers electric scooter models whether shared or for consumers.
By Gothicgeek502
#22890
I've tried every flash on a Nano to a BlueTooth that's on here no one seems to replay to forums anymore so I was wondering is the topic dead or the forums dead?

I have a Bird Zero (USA) I've flashed a nano with every code I found on here and bluetooth as well but the scooter runs fine for 5mins at most shuts down and starts flashing lights on the base only. I'll admit I'm not smart with coding so I'm not able to just do it myself, I've searched all over these forums for updates but nothing since june at the earliest.

Helpful tip btw a Nano can run using 3.3v-5v so I used a Lime scooter step down from the green box. (let me know if this might be my problem please)
User avatar
By lexfire
#22938
Hello sir @Gothicgeek502 ,

With an arduino, upload this code :
Code: Select all
void setup() {

  pinMode(5, OUTPUT);
  digitalWrite(5, HIGH);
  
  // initialize Serial1:
  Serial1.begin(9600);
  Serial1.write(0xA6);
  Serial1.write(0x12);
  Serial1.write(0x02);
  Serial1.write(0x10);
  Serial1.write(0x14);
  Serial1.write(0xCF);
  delay(500);
  Serial1.write(0xA6);
  Serial1.write(0x12);
  Serial1.write(0x02);
  Serial1.write(0x11);
  Serial1.write(0x14);
  Serial1.write(0x0B);
}

void loop() {
  delay(500);
  Serial1.write(0xA6);
  Serial1.write(0x12);
  Serial1.write(0x02);
  Serial1.write(0x15);
  Serial1.write(0x14);
  Serial1.write(0x30);
}
Not sure if this one gonna work, but try it ! I got so many and i know that they changed a lot the code to unlock it.
By Gothicgeek502
#22947
lexfire wrote:
Fri Aug 21, 2020 3:40 am
Hello sir @Gothicgeek502 ,

With an arduino, upload this code :
Code: Select all
void setup() {

  pinMode(5, OUTPUT);
  digitalWrite(5, HIGH);
  
  // initialize Serial1:
  Serial1.begin(9600);
  Serial1.write(0xA6);
  Serial1.write(0x12);
  Serial1.write(0x02);
  Serial1.write(0x10);
  Serial1.write(0x14);
  Serial1.write(0xCF);
  delay(500);
  Serial1.write(0xA6);
  Serial1.write(0x12);
  Serial1.write(0x02);
  Serial1.write(0x11);
  Serial1.write(0x14);
  Serial1.write(0x0B);
}

void loop() {
  delay(500);
  Serial1.write(0xA6);
  Serial1.write(0x12);
  Serial1.write(0x02);
  Serial1.write(0x15);
  Serial1.write(0x14);
  Serial1.write(0x30);
}
Not sure if this one gonna work, but try it ! I got so many and i know that they changed a lot the code to unlock it.

exit status 1
'Serial1' was not declared in this scope

Got that when trying to write it to the nano

It's this one here
void loop() {
delay(500);
Serial1.write(0xA6);
Serial1.write(0x12);
Serial1.write(0x02);
Serial1.write(0x15);
Serial1.write(0x14);
Serial1.write(0x30);
}
#22948
lexfire wrote:
Fri Aug 21, 2020 3:40 am
Hello sir @Gothicgeek502 ,

With an arduino, upload this code :
Code: Select all
void setup() {

  pinMode(5, OUTPUT);
  digitalWrite(5, HIGH);
  
  // initialize Serial1:
  Serial1.begin(9600);
  Serial1.write(0xA6);
  Serial1.write(0x12);
  Serial1.write(0x02);
  Serial1.write(0x10);
  Serial1.write(0x14);
  Serial1.write(0xCF);
  delay(500);
  Serial1.write(0xA6);
  Serial1.write(0x12);
  Serial1.write(0x02);
  Serial1.write(0x11);
  Serial1.write(0x14);
  Serial1.write(0x0B);
}

void loop() {
  delay(500);
  Serial1.write(0xA6);
  Serial1.write(0x12);
  Serial1.write(0x02);
  Serial1.write(0x15);
  Serial1.write(0x14);
  Serial1.write(0x30);
}
Not sure if this one gonna work, but try it ! I got so many and i know that they changed a lot the code to unlock it.
This is what I was trying to use
Code: Select all
#include <Arduino.h>

int powerPin = 5;
byte messageA[] = {0xA6, 0x12, 0x02, 0x10, 0x14, 0xCF}; // BLANK CODE?
byte messageB[] = {0xA6, 0x12, 0x02, 0x01, 0x14, 0xE7}; // ESC ON & MPH
byte messageC[] = {0xA6, 0x12, 0x02, 0X05, 0x14, 0xDC}; // LIGHT ON & ESC ON & MPH

void setup() {
// initialize Serial1:
Serial.begin(9600);

pinMode(powerPin, OUTPUT);
digitalWrite(powerPin, HIGH);

Serial.write(messageA, sizeof(messageC));
delay(500);
Serial.write(messageB, sizeof(messageB));

}

void loop() {
delay(500);
Serial.write(messageC, sizeof(messageC));
}
User avatar
By lexfire
#23082
@Gothicgeek502 Hello sir,

Try this one if this is still not working :
Code: Select all
#include <Arduino.h>

int powerPin = 5;
byte messageA[] = {0xA6, 0x12, 0x02, 0x10, 0x14, 0xCF}; // MAKES HEADLIGHT BLINK ONCE
byte messageG[] = {0xA6, 0x12, 0x02, 0XE5, 0xE4, 0xDD}; // LIGHT ON & ESC ON & MPH & FAST

void setup() {
// initialize Serial1:
Serial.begin(9600);
pinMode(powerPin, OUTPUT);
digitalWrite(powerPin, HIGH);
Serial.write(messageA, sizeof(messageA));
delay(1000);
}

void loop() {
delay(1000);
Serial.write(messageG, sizeof(messageG));
}
How is this going with the code that i shared you last week ?
#23114
lexfire wrote:
Tue Aug 25, 2020 8:43 am
@Gothicgeek502 Hello sir,

Try this one if this is still not working :
Code: Select all
#include <Arduino.h>

int powerPin = 5;
byte messageA[] = {0xA6, 0x12, 0x02, 0x10, 0x14, 0xCF}; // MAKES HEADLIGHT BLINK ONCE
byte messageG[] = {0xA6, 0x12, 0x02, 0XE5, 0xE4, 0xDD}; // LIGHT ON & ESC ON & MPH & FAST

void setup() {
// initialize Serial1:
Serial.begin(9600);
pinMode(powerPin, OUTPUT);
digitalWrite(powerPin, HIGH);
Serial.write(messageA, sizeof(messageA));
delay(1000);
}

void loop() {
delay(1000);
Serial.write(messageG, sizeof(messageG));
}
How is this going with the code that i shared you last week ?
I just saw this code and will try it tomorrow I've been doing a lot of Physical therapy so I'll let you know
By Risitas98
#24686
Hi. This code worked :
Code: Select all
#include <Arduino.h>

int powerPin = 5;
byte messageA[] = {0xA6, 0x12, 0x02, 0x10, 0x14, 0xCF}; // BLANK CODE?
byte messageB[] = {0xA6, 0x12, 0x02, 0x01, 0x14, 0xE7}; // ESC ON & MPH
byte messageC[] = {0xA6, 0x12, 0x02, 0X05, 0x14, 0xDC}; // LIGHT ON & ESC ON & MPH

void setup() {
// initialize Serial1:
Serial.begin(9600);

pinMode(powerPin, OUTPUT);
digitalWrite(powerPin, HIGH);

Serial.write(messageA, sizeof(messageC));
delay(500);
Serial.write(messageB, sizeof(messageB));

}

void loop() {
delay(500);
Serial.write(messageC, sizeof(messageC));
}
But the scooter just shut down after 1 min due to a heartbeat algorithm that block the scooter even if it's unlocked. Does anyone cracked it ?
By 1215941571
#25327
Risitas98 wrote:
Mon Sep 14, 2020 1:00 pm
Hi. This code worked :
Code: Select all
#include <Arduino.h>

int powerPin = 5;
byte messageA[] = {0xA6, 0x12, 0x02, 0x10, 0x14, 0xCF}; // BLANK CODE?
byte messageB[] = {0xA6, 0x12, 0x02, 0x01, 0x14, 0xE7}; // ESC ON & MPH
byte messageC[] = {0xA6, 0x12, 0x02, 0X05, 0x14, 0xDC}; // LIGHT ON & ESC ON & MPH

void setup() {
// initialize Serial1:
Serial.begin(9600);

pinMode(powerPin, OUTPUT);
digitalWrite(powerPin, HIGH);

Serial.write(messageA, sizeof(messageC));
delay(500);
Serial.write(messageB, sizeof(messageB));

}

void loop() {
delay(500);
Serial.write(messageC, sizeof(messageC));
}
But the scooter just shut down after 1 min due to a heartbeat algorithm that block the scooter even if it's unlocked. Does anyone cracked it ?
I don't believe this was ever cracked unfortunately. I'm sure it's possible but I know every scooter has a specific security sequence of codes. It'll be very difficult to develop a universal solution unless someone can figure out the actual algorithm itself. Maybe someone who specializes in cryptography. But with scooter companies updating the scooters with the intention of fixing people unlocking them, I doubt it's easily possible for the average person.

If you are really desperate, connect the enabler pin and spam change it from high and low and spam the unlock code. When the scooter shuts down, it will instantly power back up. You will just have a stutter for like a brief second every 3 minutes or so. But I mean it's probably going to be the best solution for now. The only other way is to swap out the motor controller with one that hasn't been updated. I got lucky and found a old motor controller that wasn't updated. Or maybe someone can sniff the codes the controller sends to the dashboard and make a custom motor controller to perminantly hack the zero. If a custom controller was made for the zero, all the stock parts could be used and bird can never patch it. Just some thoughts, thanks!
New Lime Gen4 (V2) - Okai ES400A

I cant seem to get my battery to release, tried 5v[…]

Yeah, that all sounds neat with the electric loc[…]

Ninebot Max snsc 2.2/2.3 converted!

can u send me info also , much appreciai]ted […]

1. Flash bms via gps cable with CP2102 UART to U[…]