- Wed Mar 06, 2024 6:15 am
#58329
Has anyone tried this?
I haven’t been checking this thread for past few months, so please excuse me if this is old news here already.
I’ve extracted and analyzed firmware of the battery lock. Here’s the useful bits of what I was able to figure out:
- a command consists of: preamble (2 bytes, 0x46 [F], 0x4c [L]), function (2 bytes), data length (2 bytes, big endian), data, and CRC-16/XMODEM checksum
- function for operating the lock is 0x16 0x10
- it accepts 3 values: 0xf0 shuts the bolt closed, 0xf1 leaves the bolt spring-loaded, 0xf4 holds the bolt in unlocked position
Thus you can control the lock with these 3 messages (sent over 9600bps 8n1 uart on the yellow wire):
CODE: SELECT ALL
46 4c 16 10 00 01 f0 13 6c
CODE: SELECT ALL
46 4c 16 10 00 01 f1 03 4d
CODE: SELECT ALL
46 4c 16 10 00 01 f4 53 e8
Also, I’ve learned how to activate the scooter itself via its CAN bus (using only STM32F103 and a CAN transceiver) and ride it freely like we were used to with ES200G. However, there remain some intricacies which I’m yet to crack, so I’m hesitant to do a write up on it until I understand what’s actually going on there.
-------
EDIT 2/3/2023: I messed up and got the 2 bytes of function code swapped. The correct order is 0x16 0x10 (or 0x1016 in little endian)
Has anyone tried this?
And that one is very likely a MOSFET of some sort (only hooked up to actuator-motor, VDD, GND, and two pins hooked up to the other chip) the other one hooked up to VDD, GND, MTX, MRX, magnetic (reed) switch, one pin to "SWAT".
- By Jnsystems
- By Marius Petz