A Forum for Scooter Enthusiasts, Scooter Chargers, and Scooter Mechanics.

Discuss the Segway Ninebot ES Kick Scooter in this Forum. Topics include the Segway-Ninebot app, hardware, street riding, and much more.
By John Doe213
Posts
#7460
There are plenty topics about hacking and stealing scooters from various rental brands like VOI, Lime or Bird. But none of them really handle explicit about TIER. So I'm starting this topic for enthusiasts who wants to ride TIERs for free.

What I already found about how the whole rental service is working:
-I sniffed the traffic of the TIER app with Charles proxy. Here are the results:

To view images REGISTER or LOGIN for full access.
Here, the app basically connects to a frontend link from the company "fleetbird"
which is specialized for renting vehicles. You can visit their homepage under this site: https://fleetbird.com/
On YouTube I found some vids about the fleetbird api and hardware in action on a ninebot es2. Here are the links to the vids:




(I asked that guy for the functionality of the activation box.)
As you can obviously see here they attached this little black box down on the column, the same as TIER is using them on their scooters.
To view images REGISTER or LOGIN for full access.

But back to the unlocking part. This is how the scooter gets unlocked by the user:
The users app asks the server to unlock the scooter --> The server checks if everything's fine (Is the user blocked, is there a payment method, etc.) --> If everything's ok, the server sends an unlock request to the scooter and the user can ride.
The scooter does not get unlocked by bluetooth, because one time I faked my GPS orientation to be in front of a scooter and it got unlocked. We need to find out the IP adress of that little black box and we need to find out the unlock request from the server. But I didn't find anything on the internet on how to detect the http traffic from a cellular network.
Maybe these people who already jammed up a TIER scooter would be a HUGE help for this topic. Maybe you could open that little mystery black GPS box and inform us what's inside?
And please, don't come up with "just steal a scooter and just buy new electronics", I don't want to puch that much effort in it.
Hope you could help.
James007 liked this
By John Doe213
Posts
#7461
Anyway, I pulled a scooter in front of my house to see how the charger guys are unlocking it. I bet they don't just struggle it with the locked wheel into their vans.
By caesar.freezer
Posts
#7478
so... there are two types of tier scooters, the one with the little box like the one you posted and one with a bigger box

they (at least the bigger box one) contains a IoT device with gps, bluetooth, sim, battery.

what i can say is, that if you program the dash with st link, you can program the controller over bruetooth and it works, speed limit 30 kmh. To view images REGISTER or LOGIN for full access.
By caesar.freezer
Posts
#7479
John Doe213 wrote:
Fri Apr 26, 2019 2:35 pm
Anyway, I pulled a scooter in front of my house to see how the charger guys are unlocking it. I bet they don't just struggle it with the locked wheel into their vans.
looks like the chargers can unlock it with the app and ride it "for free" to get them
By John Doe213
Posts
#7481
Well, I sad that I put one scooter in front of my house...

To view images REGISTER or LOGIN for full access.


About 9pm I recognized on the scooter, when reservations aren't allowed anymore, that the battery level was on. The display is normally completely off. I was thinking about going downstairs to see if the scooter will start if the display is constantly on, but then I saw how a big white van parked on the roadside. There were two indians inside, one went outside, the other one stayed inside the car. The guy stopped behind the scooter. It looked like he was opening it with the app. But I couldn't see that, as my window is pretty small. He then pulled the scooter off and it started beeping (and probably locking the wheel). But then he went pretty fast from my yard and it didn't looked like he was running.
Anyway, I attached my puny old webcam from 2009 with 2MP on the window to record the whole scene:
By John Doe213
Posts
#7551
I recently found in another topic, that a user called "TIER" transformed a TIER scooter into his own scooter. He made a photo of the electronics and my eagle eyes directly found something strange on the control board:
To view images REGISTER or LOGIN for full access.

Here's a normal control board taht I found somewhere on the internet:
To view images REGISTER or LOGIN for full access.

Do you see that extra socket that is connected with the GPS module on the TIERs control board? A normal es2 control board doesn't have that! And the normal one is green, while TIER has blue control boards. It's seems to be a normal original board from ninebot as their logo is printed on the board. (If you don't see what I mean, just look at the top left corner of the board.)
I asked the user if he could open that black box, because who knows? Maybe there is a micro-USB port that allows to connect to the computer and see the source code idk. Or maybe there is just a reset button, that magically unlocks the scooter. (Yes, I have optimistic hopes.)
I have no clue how the GPS module is communicating with the control board, but I am thinking about next time when I'm in the city and see one, that I just bring a torx screwdriver, unscrew that mystery box and plug out the cables. I really want to see how the scooter is going to interact. I will inform you as soon as I can.
By Keelan Matthews
Posts
#7597
Does anybody know how to connect to the GPS box? I have a Lime and someone told me I can use an ADB interface but i’m not sure sure what that is could anyone explain further?
Lyft has entered into the ES4 game

hi so how are you guys doing. well since it's so[…]

Interesting observations. I might try to re-enfo[…]

How are you guys able to flash the Chinese boards?[…]

Ahhh shit. Just found these fuckers for sale 25 mi[…]