[babass69]

Seems like he's been banned!

[KRJ]

Sooo evry one can easly steal Gps has easly 4 bolts that can be unscrew with torx 15/20 when you unscrew just make strong pull out and don't cut cables ! just pull it out with strenght take some screatch or paint in can and make the pipe black so nobody will suspect that it's lime propety . But in case take bandana and mask up so fbi won't find you that easly To view images REGISTER or LOGIN for full access.

Srr for bad Leanguege btw

[James007]

To view images REGISTER or LOGIN for full access.

I tried adding an external battery and I get this error. I'm guess its because the
bms has a different firmware than the internal battery. And I can't update.

[FirstJuicerInTown]

So I decided to give a try to chinese motor controller some of you have used. Before any installation, i wanted to connect everything to see if it works. Everything is connected correctly, but when i’m trying to connect the red ones to the battery (red circle), sparks are coming out, so i think i’m somehow short circuiting it. When i connect only the thinner red one (translated chinese manual says its „lock power supply”) there are no sparks and i have 4,9 V on throttle wires (green circle), but short circuiting them gives no effect, wheel is not moving. It doesn’t matter if i try to connect the thicker one alone or together with thinner, it’s the same effect, only connecting thinner alone „partially works”. Any ideas on what may i be doing wrong?
To view images REGISTER or LOGIN for full access.

To view images REGISTER or LOGIN for full access.

[Mind Train]

How it works without GPS/GSM tracker? how company communicate with the scooter?

Communication is relayed through the renters phone ’app.
When a scooter is scanned, the phone communicates data and GPS with the scooter company. Over Bluetooth, the phone app relays the unlock/lock codes to the scooter.
This saves scooter company money because communication is carried on the renters phone data.
But its higher risk. The company only knows status and location of that scooter the last time somebody rented it.

It's looking like to be easy hackable scooter, only need to know what strings is send via BT and you can repeat it again To view images REGISTER or LOGIN for full access.

[Jameskay]

So I decided to give a try to chinese motor controller some of you have used. Before any installation, i wanted to connect everything to see if it works. Everything is connected correctly, but when i’m trying to connect the red ones to the battery (red circle), sparks are coming out, so i think i’m somehow short circuiting it. When i connect only the thinner red one (translated chinese manual says its „lock power supply”) there are no sparks and i have 4,9 V on throttle wires (green circle), but short circuiting them gives no effect, wheel is not moving. It doesn’t matter if i try to connect the thicker one alone or together with thinner, it’s the same effect, only connecting thinner alone „partially works”. Any ideas on what may i be doing wrong?
To view images REGISTER or LOGIN for full access.

To view images REGISTER or LOGIN for full access.

Hey there
So you should have 4 red wires all together

1 for the hall sensor power ~4.3V output
1 for throttle sensor power ~4.3V output
1 for battery power in ~41V input
1 for the ignition lock that has no voltage

If you're not using an ignition lock that cable can be connected direct to the 41v input wire that goes to the battery
I can't say I saw any Sparks at all when I was setting mine up so doesn't sound great

Once you have double checked the wiring you could always connect the two white wires together (the self study wires) and then connect the power
If the wheel spins you will know that the power , ignition, motor and hall sensor are working .
I didn't take a great photo of my wiring but you can have a look at this one
To view images REGISTER or LOGIN for full access.

To view images REGISTER or LOGIN for full access.

[Anonymous1]

A thought. Since the company is able to unlock the unit remotely..wouldn't there be a way to do this locally or emulate the unlocking part via a 3rd party app?

Yeah, but I think a hard reset would do the thing to get out of the locked state, because you can change all the other settings, just not the locked state. A security feature made by Ninebot, and Voi took advantage of it. Now we just need to figure out how you hard reset the control board.

That would be even better yeah, agreed.

I have an unlocked VOI ES2 that rides when I plug the dashboard. So I'm out of this hassle and I just need to replace the dashboard ?

[weezzer]

Yeah, but I think a hard reset would do the thing to get out of the locked state, because you can change all the other settings, just not the locked state. A security feature made by Ninebot, and Voi took advantage of it. Now we just need to figure out how you hard reset the control board.

That would be even better yeah, agreed.

I have an unlocked VOI ES2 that rides when I plug the dashboard. So I'm out of this hassle and I just need to replace the dashboard ?

How did you get it unlocked? I have also replace the dash on a VOI scooter but it still locked?

[markovitch]

Hello guys, I'm new to the forums and very glad I've eventually found it to share & get some knowledge.

I'm a programmer, hobbyst logic board repair specialist, currently working on a lime scooter you are trying to reverse To view images REGISTER or LOGIN for full access.


I will share what I know and plan to do as I get home in the evening To view images REGISTER or LOGIN for full access.

Ok, sorry I'm so late but I want to sum up what I know so far:

Firstly, the main logic board aka: "the gsm-gps-ble brain" - exactly what is hidden inside the green plastic box.

Fig. 1

Everything pretty much explained on the pic. On the other side of the board there is a small realtek audio ic+ audio amplifier and domething more interesting: Awinic AW9523B chip, probably serving as board initializer/ basic gpio handler.

I have also found this strange item under the steering bar (probably some BLE tag, serving as additional "immobilizer"? To view images REGISTER or LOGIN for full access.
)

Fig. 2

Last thing is OFC most interesting for us. The Controller.

Fig. 3

The controller is made by Tianjin Santroll Automobile Company, listed HERE as "Lithium battery class bicycle motor vector controller". It has uart (serial, baudrate 9600) communication with the parent (the brain - green box) board.

Controller ouputs are as follows:

1. Motor plug:
   • A, B, C motor coils (thick yellow/blue/green wires)
   • hA, hB, hC Hall sensors (thin yellow/blue/green wires)
   • 5V3 - 5.3 V line to sensors (thin red)
   • GND - (thin black)
2. GSM/GPS 'Brain' (5-pin plug, green inside):
   • GPIO (blue)
   • TX_1 (yellow)
   • 48V (red)
   • GND (black)
   • RX_1 (green)
3. Dashboard (6-pin plug, black inside):
   • 48V (red)
   • GND (black)
   • RX_0 (green)
   • TX_0 (yellow)
   • HHAND (white)
   • EB (blue)
4. Programming (5-pin header, wide): (originally disconnected)
   • CLK (yellow)
   • RST (blue)
   • DIO (green)
   • GND (black)
   • 5V (red)
5. Rear light (3-pin header, small):
   • HDSIG (white)
   • GND (black)
   • HD_0 (red)

Controller seems the most important and complicated part of reverse engineering so far.
I wanted to contact Santroll company for this controller documentation, however I don't have WeChat acount (banned after creation for security reasons - dunno why), cannot create Weibo account (unavailable here), and I don't live in China, so cannot telephone there. This company doesn't even have email account.

I even have found their patenting document, describing uart-communicated controller To view images REGISTER or LOGIN for full access.
HERE

Already found out the controller uses MKE02Z64 NXP ARM-based CPU, will search for any method to dump flash memory from chip, and analyze it in IDA.

Another way is the "low-effort" and I'll try to figure out the protocol used to communicate with the dashboard/display unit, just buy another controller, and code some arduino to use the stock display. (I have oscilloscope, and logic signal analyzer so it is possible)

Would be great If at least one of you guyz could contact Santroll company for controller datasheet/ tech guide To view images REGISTER or LOGIN for full access.
(model we're looking for is B-WZKB3615A-LB-F4)

[RSB0]

Yeah, but I think a hard reset would do the thing to get out of the locked state, because you can change all the other settings, just not the locked state. A security feature made by Ninebot, and Voi took advantage of it. Now we just need to figure out how you hard reset the control board.

That would be even better yeah, agreed.

I have an unlocked VOI ES2 that rides when I plug the dashboard. So I'm out of this hassle and I just need to replace the dashboard ?

Can you detail the unlocking procedure ?