An Electric Scooter Community on a Mission to Stamp out Transportation Mediocrity.

Enjoy the juice

Hey everybody! I'm back!
Yesterday i found a abandoned Lime right in front of my Flat To view images REGISTER or LOGIN for full access.

I managed to read the BLE Services and Characteristics ^^

Here is the Debug Log:
Code: Select all
nRF Connect, 2020-09-28
lime-931303362012 (4C:24:98:75:34:A2)
V	17:31:34.434	Connecting to 4C:24:98:75:34:A2...
D	17:31:34.434	gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, preferred PHY = LE 1M)
D	17:31:34.925	[Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
D	17:31:34.952	[Callback] Connection state changed with status: 0 and new state: CONNECTED (2)
I	17:31:34.952	Connected to 4C:24:98:75:34:A2
V	17:31:34.991	Discovering services...
D	17:31:34.991	gatt.discoverServices()
I	17:31:35.504	Connection parameters updated (interval: 7.5ms, latency: 0, timeout: 5000ms)
D	17:31:35.846	[Callback] Services discovered with status: 0
I	17:31:35.846	Services discovered
V	17:31:35.898	Generic Access (0x1800)
- Device Name [R] (0x2A00)
- Appearance [R] (0x2A01)
- Peripheral Privacy Flag [R W] (0x2A02)
- Reconnection Address [W] (0x2A03)
- Peripheral Preferred Connection Parameters [R] (0x2A04)
Generic Attribute (0x1801)
- Service Changed [I] (0x2A05)
   Client Characteristic Configuration (0x2902)
Device Information (0x180A)
- System ID [R] (0x2A23)
- Model Number String [R] (0x2A24)
- Serial Number String [R] (0x2A25)
- Firmware Revision String [R] (0x2A26)
- Hardware Revision String [R] (0x2A27)
- Software Revision String [R] (0x2A28)
- Manufacturer Name String [R] (0x2A29)
- IEEE 11073-20601 Regulatory Certification Data List [R] (0x2A2A)
- PnP ID [R] (0x2A50)
Unknown Service (0000fff0-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [R W] (0000fff1-0000-1000-8000-00805f9b34fb)
   Characteristic User Description (0x2901)
- Unknown Characteristic [R] (0000fff2-0000-1000-8000-00805f9b34fb)
   Characteristic User Description (0x2901)
- Unknown Characteristic [W] (000036f5-0000-1000-8000-00805f9b34fb)
   Characteristic User Description (0x2901)
- Unknown Characteristic [N] (000036f6-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
   Characteristic User Description (0x2901)
- Unknown Characteristic [R] (0000fff5-0000-1000-8000-00805f9b34fb)
   Characteristic User Description (0x2901)
- Unknown Characteristic [N R WNR] (0000fff6-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
   Characteristic User Description (0x2901)
- Unknown Characteristic [N R WNR] (0000fff7-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
   Characteristic User Description (0x2901)
D	17:31:35.898	gatt.setCharacteristicNotification(00002a05-0000-1000-8000-00805f9b34fb, true)
D	17:31:35.905	gatt.setCharacteristicNotification(000036f6-0000-1000-8000-00805f9b34fb, true)
D	17:31:35.908	gatt.setCharacteristicNotification(0000fff6-0000-1000-8000-00805f9b34fb, true)
D	17:31:35.911	gatt.setCharacteristicNotification(0000fff7-0000-1000-8000-00805f9b34fb, true)
I	17:31:35.941	Connection parameters updated (interval: 47.5ms, latency: 0, timeout: 5000ms)
I	17:31:38.017	Connection parameters updated (interval: 11.25ms, latency: 0, timeout: 1000ms)
I	17:31:52.734	Notification received from 0000fff6-0000-1000-8000-00805f9b34fb, value: (0x) 41-54-0D-0A
A	17:31:52.734	"(0x) 41-54-0D-0A" received
V	17:34:41.100	Reading all characteristics...
V	17:34:41.101	Reading characteristic 00002a00-0000-1000-8000-00805f9b34fb
D	17:34:41.101	gatt.readCharacteristic(00002a00-0000-1000-8000-00805f9b34fb)
I	17:34:41.124	Read Response received from 00002a00-0000-1000-8000-00805f9b34fb, value: (0x) 6C-69-6D-65-2D-39-33-31-33-30-33-33-36-32-30-31-32, "lime-931303362012"
A	17:34:41.125	"lime-931303362012" received
V	17:34:41.126	Reading characteristic 00002a01-0000-1000-8000-00805f9b34fb
D	17:34:41.126	gatt.readCharacteristic(00002a01-0000-1000-8000-00805f9b34fb)
I	17:34:41.146	Read Response received from 00002a01-0000-1000-8000-00805f9b34fb, value: (0x) 00-00
A	17:34:41.146	"[0] Unknown" received
V	17:34:41.158	Reading characteristic 00002a02-0000-1000-8000-00805f9b34fb
D	17:34:41.158	gatt.readCharacteristic(00002a02-0000-1000-8000-00805f9b34fb)
I	17:34:41.179	Read Response received from 00002a02-0000-1000-8000-00805f9b34fb, value: (0x) 00
A	17:34:41.179	"Privacy is disabled in this device" received
V	17:34:41.186	Reading characteristic 00002a04-0000-1000-8000-00805f9b34fb
D	17:34:41.186	gatt.readCharacteristic(00002a04-0000-1000-8000-00805f9b34fb)
I	17:34:41.213	Read Response received from 00002a04-0000-1000-8000-00805f9b34fb, value: (0x) 50-00-A0-00-00-00-E8-03
A	17:34:41.213	"Connection Interval: 100.00ms - 200.00ms,
Slave Latency: 0,
Supervision Timeout Multiplier: 1000" received
V	17:34:41.221	Reading characteristic 00002a23-0000-1000-8000-00805f9b34fb
D	17:34:41.221	gatt.readCharacteristic(00002a23-0000-1000-8000-00805f9b34fb)
I	17:34:41.247	Read Response received from 00002a23-0000-1000-8000-00805f9b34fb, value: (0x) A2-34-75-00-00-98-24-4C
A	17:34:41.247	"(0x) A2-34-75-00-00-98-24-4C" received
V	17:34:41.257	Reading characteristic 00002a24-0000-1000-8000-00805f9b34fb
D	17:34:41.257	gatt.readCharacteristic(00002a24-0000-1000-8000-00805f9b34fb)
I	17:34:41.280	Read Response received from 00002a24-0000-1000-8000-00805f9b34fb, value: (0x) 4D-6F-64-65-6C-20-4E-75-6D-62-65-72, "Model Number"
A	17:34:41.280	"Model Number" received
V	17:34:41.286	Reading characteristic 00002a25-0000-1000-8000-00805f9b34fb
D	17:34:41.286	gatt.readCharacteristic(00002a25-0000-1000-8000-00805f9b34fb)
I	17:34:41.314	Read Response received from 00002a25-0000-1000-8000-00805f9b34fb, value: (0x) 53-65-72-69-61-6C-20-4E-75-6D-62-65-72, "Serial Number"
A	17:34:41.314	"Serial Number" received
V	17:34:41.324	Reading characteristic 00002a26-0000-1000-8000-00805f9b34fb
D	17:34:41.324	gatt.readCharacteristic(00002a26-0000-1000-8000-00805f9b34fb)
I	17:34:41.348	Read Response received from 00002a26-0000-1000-8000-00805f9b34fb, value: (0x) 46-69-72-6D-77-61-72-65-20-52-65-76-69-73-69-6F-6E, "Firmware Revision"
A	17:34:41.348	"Firmware Revision" received
V	17:34:41.357	Reading characteristic 00002a27-0000-1000-8000-00805f9b34fb
D	17:34:41.357	gatt.readCharacteristic(00002a27-0000-1000-8000-00805f9b34fb)
I	17:34:41.382	Read Response received from 00002a27-0000-1000-8000-00805f9b34fb, value: (0x) 48-61-72-64-77-61-72-65-20-52-65-76-69-73-69-6F-6E, "Hardware Revision"
A	17:34:41.382	"Hardware Revision" received
V	17:34:41.391	Reading characteristic 00002a28-0000-1000-8000-00805f9b34fb
D	17:34:41.391	gatt.readCharacteristic(00002a28-0000-1000-8000-00805f9b34fb)
I	17:34:41.415	Read Response received from 00002a28-0000-1000-8000-00805f9b34fb, value: (0x) 53-6F-66-74-77-61-72-65-20-52-65-76-69-73-69-6F-6E, "Software Revision"
A	17:34:41.415	"Software Revision" received
V	17:34:41.422	Reading characteristic 00002a29-0000-1000-8000-00805f9b34fb
D	17:34:41.422	gatt.readCharacteristic(00002a29-0000-1000-8000-00805f9b34fb)
I	17:34:41.449	Read Response received from 00002a29-0000-1000-8000-00805f9b34fb, value: (0x) 4D-61-6E-75-66-61-63-74-75-72-65-72-20-4E-61-6D-65, "Manufacturer Name"
A	17:34:41.449	"Manufacturer Name" received
V	17:34:41.459	Reading characteristic 00002a2a-0000-1000-8000-00805f9b34fb
D	17:34:41.459	gatt.readCharacteristic(00002a2a-0000-1000-8000-00805f9b34fb)
I	17:34:41.483	Read Response received from 00002a2a-0000-1000-8000-00805f9b34fb, value: (0x) FE-00-65-78-70-65-72-69-6D-65-6E-74-61-6C
A	17:34:41.483	"(0x) FE-00-65-78-70-65-72-69-6D-65-6E-74-61-6C" received
V	17:34:41.489	Reading characteristic 00002a50-0000-1000-8000-00805f9b34fb
D	17:34:41.489	gatt.readCharacteristic(00002a50-0000-1000-8000-00805f9b34fb)
I	17:34:41.518	Read Response received from 00002a50-0000-1000-8000-00805f9b34fb, value: (0x) 01-0D-00-00-00-10-01
A	17:34:41.518	"Bluetooth SIG Company: Texas Instruments Inc. <0x000D>
Product Id: 0
Product Version: 272" received
V	17:34:41.538	Reading characteristic 0000fff1-0000-1000-8000-00805f9b34fb
D	17:34:41.538	gatt.readCharacteristic(0000fff1-0000-1000-8000-00805f9b34fb)
I	17:34:41.597	Read Response received from 0000fff1-0000-1000-8000-00805f9b34fb, value: (0x) 01
A	17:34:41.597	"(0x) 01" received
V	17:34:41.608	Reading characteristic 0000fff2-0000-1000-8000-00805f9b34fb
D	17:34:41.608	gatt.readCharacteristic(0000fff2-0000-1000-8000-00805f9b34fb)
I	17:34:41.629	Read Response received from 0000fff2-0000-1000-8000-00805f9b34fb, value: (0x) 02
A	17:34:41.629	"(0x) 02" received
V	17:34:41.641	Reading characteristic 0000fff5-0000-1000-8000-00805f9b34fb
D	17:34:41.641	gatt.readCharacteristic(0000fff5-0000-1000-8000-00805f9b34fb)
D	17:34:41.771	[Broadcast] Action received: android.bluetooth.device.action.BOND_STATE_CHANGED, bond state changed to: BOND_BONDING (11)
I	17:34:41.778	Connection parameters updated (interval: 7.5ms, latency: 0, timeout: 5000ms)
D	17:34:41.815	[Broadcast] Action received: android.bluetooth.device.action.PAIRING_REQUEST, pairing variant: PAIRING_VARIANT_PIN (0)
V	17:34:50.609	Reading characteristic 0000fff6-0000-1000-8000-00805f9b34fb
D	17:34:50.609	gatt.readCharacteristic(0000fff6-0000-1000-8000-00805f9b34fb)
E	17:34:50.624	Error 137 (0x89): GATT AUTH FAIL
D	17:34:50.686	[Broadcast] Action received: android.bluetooth.device.action.BOND_STATE_CHANGED, bond state changed to: BOND_NONE (10)
I	17:34:50.686	Bonding failed
V	17:34:50.726	Reading characteristic 0000fff7-0000-1000-8000-00805f9b34fb
D	17:34:50.726	gatt.readCharacteristic(0000fff7-0000-1000-8000-00805f9b34fb)
E	17:34:50.727	Exception occurred (Reading characteristic failed)
V	17:34:50.772	18 characteristics read
E	17:34:55.643	Error 133 (0x85): GATT ERROR
D	17:34:55.685	[Callback] Connection state changed with status: 8 and new state: DISCONNECTED (0)
E	17:34:55.689	Error 8 (0x8): GATT CONN TIMEOUT
I	17:34:55.689	Disconnected
D	17:34:55.786	[Broadcast] Action received: android.bluetooth.device.action.ACL_DISCONNECTED

I am very interested in BLE Security so let's start To view images REGISTER or LOGIN for full access.

Unfortunately my ST-Link V2 gives me an error when I try to flash the motorcontroller:

20:00:04 : Can not connect to target!
Please select "Connect Under Reset" mode from Target->Settings menu and try again.
If you're trying to connect to a low frequency application , please select a lower SWD Frequency mode from Target->Settings menu.
20:00:05 : No target connected

I tried everything but with no success.

But i can confirm that the magnet switch is present in the german version, too ^^

My ST-Link V2 works and I updated everything, but I guess I found the problem:

To view images REGISTER or LOGIN for full access.

It's a CMOS Operational Amplifier which is broken for sure.
When I connect the motorcontroller to both, battery and charger the red LED starts flashing 7 times.

Ventomann wrote:
Mon Dec 07, 2020 4:39 pm
oh, thank you, since when is that way you still have a chance to find one without ..
sadly not. the new controllers doesn't have these pins anymore for the ST-Link what it said it byself.
the old controllers with the pins was hackable but not for long. after the update / upgrade, this is doesn't work anymore too. sadly.

  • 1
  • 6
  • 7
  • 8
  • 9
  • 10

I found that inside the lift version ninebot Max h[…]


Works without a problem on fw 2.4 https://i.imgur[…]

Firmware version 2.4, patch or no patch still work[…]

did anyone figure out how to flash the new bms (10[…]