Page 2 of 2

Re: Bird Zero help? Is this topic dead?

Posted: Thu Sep 24, 2020 7:19 am
by Risitas98
1215941571 wrote:
Wed Sep 23, 2020 2:40 am
Risitas98 wrote:
Mon Sep 14, 2020 1:00 pm
Hi. This code worked :
Code: Select all
#include <Arduino.h>

int powerPin = 5;
byte messageA[] = {0xA6, 0x12, 0x02, 0x10, 0x14, 0xCF}; // BLANK CODE?
byte messageB[] = {0xA6, 0x12, 0x02, 0x01, 0x14, 0xE7}; // ESC ON & MPH
byte messageC[] = {0xA6, 0x12, 0x02, 0X05, 0x14, 0xDC}; // LIGHT ON & ESC ON & MPH

void setup() {
// initialize Serial1:
Serial.begin(9600);

pinMode(powerPin, OUTPUT);
digitalWrite(powerPin, HIGH);

Serial.write(messageA, sizeof(messageC));
delay(500);
Serial.write(messageB, sizeof(messageB));

}

void loop() {
delay(500);
Serial.write(messageC, sizeof(messageC));
}
But the scooter just shut down after 1 min due to a heartbeat algorithm that block the scooter even if it's unlocked. Does anyone cracked it ?
I don't believe this was ever cracked unfortunately. I'm sure it's possible but I know every scooter has a specific security sequence of codes. It'll be very difficult to develop a universal solution unless someone can figure out the actual algorithm itself. Maybe someone who specializes in cryptography. But with scooter companies updating the scooters with the intention of fixing people unlocking them, I doubt it's easily possible for the average person.

If you are really desperate, connect the enabler pin and spam change it from high and low and spam the unlock code. When the scooter shuts down, it will instantly power back up. You will just have a stutter for like a brief second every 3 minutes or so. But I mean it's probably going to be the best solution for now. The only other way is to swap out the motor controller with one that hasn't been updated. I got lucky and found a old motor controller that wasn't updated. Or maybe someone can sniff the codes the controller sends to the dashboard and make a custom motor controller to perminantly hack the zero. If a custom controller was made for the zero, all the stock parts could be used and bird can never patch it. Just some thoughts, thanks!
How can I spam the high low thing? Because I don't understand your "enabler pin". I understood that you suggested me to spam the arduino power to constantly unlock and disconnect the arduino to prevent heartbeat algorithm but how can I do that? By changing something on the arduino board or the program of the arduino?

Re: Bird Zero help? Is this topic dead?

Posted: Tue Sep 29, 2020 7:12 pm
by 1215941571
Risitas98 wrote:
Thu Sep 24, 2020 7:19 am
1215941571 wrote:
Wed Sep 23, 2020 2:40 am
Risitas98 wrote:
Mon Sep 14, 2020 1:00 pm
Hi. This code worked :
Code: Select all
#include <Arduino.h>

int powerPin = 5;
byte messageA[] = {0xA6, 0x12, 0x02, 0x10, 0x14, 0xCF}; // BLANK CODE?
byte messageB[] = {0xA6, 0x12, 0x02, 0x01, 0x14, 0xE7}; // ESC ON & MPH
byte messageC[] = {0xA6, 0x12, 0x02, 0X05, 0x14, 0xDC}; // LIGHT ON & ESC ON & MPH

void setup() {
// initialize Serial1:
Serial.begin(9600);

pinMode(powerPin, OUTPUT);
digitalWrite(powerPin, HIGH);

Serial.write(messageA, sizeof(messageC));
delay(500);
Serial.write(messageB, sizeof(messageB));

}

void loop() {
delay(500);
Serial.write(messageC, sizeof(messageC));
}
But the scooter just shut down after 1 min due to a heartbeat algorithm that block the scooter even if it's unlocked. Does anyone cracked it ?
I don't believe this was ever cracked unfortunately. I'm sure it's possible but I know every scooter has a specific security sequence of codes. It'll be very difficult to develop a universal solution unless someone can figure out the actual algorithm itself. Maybe someone who specializes in cryptography. But with scooter companies updating the scooters with the intention of fixing people unlocking them, I doubt it's easily possible for the average person.

If you are really desperate, connect the enabler pin and spam change it from high and low and spam the unlock code. When the scooter shuts down, it will instantly power back up. You will just have a stutter for like a brief second every 3 minutes or so. But I mean it's probably going to be the best solution for now. The only other way is to swap out the motor controller with one that hasn't been updated. I got lucky and found a old motor controller that wasn't updated. Or maybe someone can sniff the codes the controller sends to the dashboard and make a custom motor controller to perminantly hack the zero. If a custom controller was made for the zero, all the stock parts could be used and bird can never patch it. Just some thoughts, thanks!
How can I spam the high low thing? Because I don't understand your "enabler pin". I understood that you suggested me to spam the arduino power to constantly unlock and disconnect the arduino to prevent heartbeat algorithm but how can I do that? By changing something on the arduino board or the program of the arduino?
The security timer that requires the security code starts ticking once the enabler is turned on. The enabler pin is the blue 3.3v pin that you have to give power to so the scooter can be awake and listen for commands. To spam to enabler pin, just connect it to a digital pin on the Arduino and change the pin from high to low rapidly.

So the scooter can only be turned on if the enabler pin is high. Once the scooter is turned on it can last maybe 10 seconds or so with the enabler set to low. But if the enabler is low when the scooter goes into the error state, it will instantly shut down. So the idea is to spam the enabler pin so when the scooter shuts down, it can turn on right away again. I hope this helps.

Re: Bird Zero help? Is this topic dead?

Posted: Sat Jan 22, 2022 10:08 am
by cyberguy
Hi,

Blue pin on my device shows 36 v on multimeter. If I attach to arduino I will burn device I assume. Any comment. thanks

Red 36 v - blue 36 v - yellow 3.3 v - green 3.3 v