[markovitch]

Hello guys, I'm new to the forums and very glad I've eventually found it to share & get some knowledge.

I'm a programmer, hobbyst logic board repair specialist, currently working on a lime scooter you are trying to reverse To view images REGISTER or LOGIN for full access.


I will share what I know and plan to do as I get home in the evening To view images REGISTER or LOGIN for full access.

Ok, sorry I'm so late but I want to sum up what I know so far:

Firstly, the main logic board aka: "the gsm-gps-ble brain" - exactly what is hidden inside the green plastic box.

Fig. 1

Everything pretty much explained on the pic. On the other side of the board there is a small realtek audio ic+ audio amplifier and domething more interesting: Awinic AW9523B chip, probably serving as board initializer/ basic gpio handler.

I have also found this strange item under the steering bar (probably some BLE tag, serving as additional "immobilizer"? To view images REGISTER or LOGIN for full access.
)

Fig. 2

Last thing is OFC most interesting for us. The Controller.

Fig. 3

The controller is made by Tianjin Santroll Automobile Company, listed HERE as "Lithium battery class bicycle motor vector controller". It has uart (serial, baudrate 9600) communication with the parent (the brain - green box) board.

Controller ouputs are as follows:

1. Motor plug:
   • A, B, C motor coils (thick yellow/blue/green wires)
   • hA, hB, hC Hall sensors (thin yellow/blue/green wires)
   • 5V3 - 5.3 V line to sensors (thin red)
   • GND - (thin black)
2. GSM/GPS 'Brain' (5-pin plug, green inside):
   • GPIO (blue)
   • TX_1 (yellow)
   • 48V (red)
   • GND (black)
   • RX_1 (green)
3. Dashboard (6-pin plug, black inside):
   • 48V (red)
   • GND (black)
   • RX_0 (green)
   • TX_0 (yellow)
   • HHAND (white)
   • EB (blue)
4. Programming (5-pin header, wide): (originally disconnected)
   • CLK (yellow)
   • RST (blue)
   • DIO (green)
   • GND (black)
   • 5V (red)
5. Rear light (3-pin header, small):
   • HDSIG (white)
   • GND (black)
   • HD_0 (red)

Controller seems the most important and complicated part of reverse engineering so far.
I wanted to contact Santroll company for this controller documentation, however I don't have WeChat acount (banned after creation for security reasons - dunno why), cannot create Weibo account (unavailable here), and I don't live in China, so cannot telephone there. This company doesn't even have email account.

I even have found their patenting document, describing uart-communicated controller To view images REGISTER or LOGIN for full access.
HERE

Already found out the controller uses MKE02Z64 NXP ARM-based CPU, will search for any method to dump flash memory from chip, and analyze it in IDA.

Another way is the "low-effort" and I'll try to figure out the protocol used to communicate with the dashboard/display unit, just buy another controller, and code some arduino to use the stock display. (I have oscilloscope, and logic signal analyzer so it is possible)

Would be great If at least one of you guyz could contact Santroll company for controller datasheet/ tech guide To view images REGISTER or LOGIN for full access.
(model we're looking for is B-WZKB3615A-LB-F4)

[RSB0]

Yeah, but I think a hard reset would do the thing to get out of the locked state, because you can change all the other settings, just not the locked state. A security feature made by Ninebot, and Voi took advantage of it. Now we just need to figure out how you hard reset the control board.

That would be even better yeah, agreed.

I have an unlocked VOI ES2 that rides when I plug the dashboard. So I'm out of this hassle and I just need to replace the dashboard ?

Can you detail the unlocking procedure ?

[Lothean]

That would be even better yeah, agreed.

I have an unlocked VOI ES2 that rides when I plug the dashboard. So I'm out of this hassle and I just need to replace the dashboard ?

How did you get it unlocked? I have also replace the dash on a VOI scooter but it still locked?

That would be even better yeah, agreed.

I have an unlocked VOI ES2 that rides when I plug the dashboard. So I'm out of this hassle and I just need to replace the dashboard ?

Can you detail the unlocking procedure ?

It was unlocked when I found it with almost 0% battery in the middle of a rural town about 300km away from where VOI operates. (Local laws allow me to keep this item since it was on my property and nobody claimed it for the moment) My question was if replacing the dashboard would make it fully operational since as of now I can't do anything apart from riding and charging it. (Button does nothing, neither does Bluetooth, Dashboard is black)
Maybe, if you legally acquired one, you might try getting it back on the VOI app, using a prepaid MasterCard with 1€ on it, unlock the scooter (which works and allows for unlimited free rides btw), and straight after that uninstall the app.
The real question is, when it will run out of battery since I don't have a charger (see my other topic), will it lock itself back?

[LetmeRideHellyeah]

Sooo evry one can easly steal Gps has easly 4 bolts that can be unscrew with torx 15/20 when you unscrew just make strong pull out and don't cut cables ! just pull it out with strenght take some screatch or paint in can and make the pipe black so nobody will suspect that it's lime propety . But in case take bandana and mask up so fbi won't find you that easly To view images REGISTER or LOGIN for full access.

Srr for bad Leanguege btw

it becomes a manual scooter.. it has a self destruct mechanism *Lime* once you unplug it... and then replug the mainbox back the damn thing is a paperweight... This is why im not even diddling any money till i can figure out why the hell the thing wont even fire up stock.. Buying random shing shang tsung parts from ebay is a wash as 90% are dud phonys not designed for the es4 bottom recalled box version.. as for this new little tykes version haha its not even a 9bot. i guess lyme got fed up and cancelled their "contract" since that recall catching on fire finger pointing a few months back.

[LetmeRideHellyeah]

Hello guys, I'm new to the forums and very glad I've eventually found it to share & get some knowledge.

I'm a programmer, hobbyst logic board repair specialist, currently working on a lime scooter you are trying to reverse To view images REGISTER or LOGIN for full access.


I will share what I know and plan to do as I get home in the evening To view images REGISTER or LOGIN for full access.

Ok, sorry I'm so late but I want to sum up what I know so far:

Firstly, the main logic board aka: "the gsm-gps-ble brain" - exactly what is hidden inside the green plastic box.

Fig. 1

Everything pretty much explained on the pic. On the other side of the board there is a small realtek audio ic+ audio amplifier and domething more interesting: Awinic AW9523B chip, probably serving as board initializer/ basic gpio handler.

I have also found this strange item under the steering bar (probably some BLE tag, serving as additional "immobilizer"? To view images REGISTER or LOGIN for full access.
)

Fig. 2

Last thing is OFC most interesting for us. The Controller.

Fig. 3

The controller is made by Tianjin Santroll Automobile Company, listed HERE as "Lithium battery class bicycle motor vector controller". It has uart (serial, baudrate 9600) communication with the parent (the brain - green box) board.

Controller ouputs are as follows:

1. Motor plug:
   • A, B, C motor coils (thick yellow/blue/green wires)
   • hA, hB, hC Hall sensors (thin yellow/blue/green wires)
   • 5V3 - 5.3 V line to sensors (thin red)
   • GND - (thin black)
2. GSM/GPS 'Brain' (5-pin plug, green inside):
   • GPIO (blue)
   • TX_1 (yellow)
   • 48V (red)
   • GND (black)
   • RX_1 (green)
3. Dashboard (6-pin plug, black inside):
   • 48V (red)
   • GND (black)
   • RX_0 (green)
   • TX_0 (yellow)
   • HHAND (white)
   • EB (blue)
4. Programming (5-pin header, wide): (originally disconnected)
   • CLK (yellow)
   • RST (blue)
   • DIO (green)
   • GND (black)
   • 5V (red)
5. Rear light (3-pin header, small):
   • HDSIG (white)
   • GND (black)
   • HD_0 (red)

Controller seems the most important and complicated part of reverse engineering so far.
I wanted to contact Santroll company for this controller documentation, however I don't have WeChat acount (banned after creation for security reasons - dunno why), cannot create Weibo account (unavailable here), and I don't live in China, so cannot telephone there. This company doesn't even have email account.

I even have found their patenting document, describing uart-communicated controller To view images REGISTER or LOGIN for full access.
HERE

Already found out the controller uses MKE02Z64 NXP ARM-based CPU, will search for any method to dump flash memory from chip, and analyze it in IDA.

Another way is the "low-effort" and I'll try to figure out the protocol used to communicate with the dashboard/display unit, just buy another controller, and code some arduino to use the stock display. (I have oscilloscope, and logic signal analyzer so it is possible)

Would be great If at least one of you guyz could contact Santroll company for controller datasheet/ tech guide To view images REGISTER or LOGIN for full access.
(model we're looking for is B-WZKB3615A-LB-F4)

inbox me what you have on santroll i have a few vpn accts i can do my best and grab some infos from them. that would be great if they respond and give what you need.

[Gahrlaag]

Yeah, but I think a hard reset would do the thing to get out of the locked state, because you can change all the other settings, just not the locked state. A security feature made by Ninebot, and Voi took advantage of it. Now we just need to figure out how you hard reset the control board.

That would be even better yeah, agreed.

I have an unlocked VOI ES2 that rides when I plug the dashboard. So I'm out of this hassle and I just need to replace the dashboard ?

Mind elaborating a bit here? Like, how do you "start" it if the dashboard isn't working? I orderd a new dash yesterday that I'm hoping will work but I'm unsure if more actions are needed.

[Gahrlaag]

Ok, so after reading around a bit, it seems like the VOI scooters are indeed unlocked via bluetooth and not cellular data! The companys own FAQ states that you "need to be close to the scooter in order to unlock it", making it quite obvious that it's actually via bluetooth and not cellular data it uses. Also, it has to be so that they're using my own phone to upload last known location of the scooter when I'm done riding it. This seems very promising! To view images REGISTER or LOGIN for full access.

[hyacinth]

They are using their GPS tracker for location, not bluetooth. But the unlock procedure is via Bluetooth. Maybe if you log the traffic when you unlock a Voi you can see what post it does to their API.

[babass69]

They are using their GPS tracker for location, not bluetooth. But the unlock procedure is via Bluetooth. Maybe if you log the traffic when you unlock a Voi you can see what post it does to their API.

According to the fact that VOI uses Bluetooth to unlock the scooter, I was thinking about sniffing the exchanges.
But what can I use to do so ?

[hyacinth]

They are using their GPS tracker for location, not bluetooth. But the unlock procedure is via Bluetooth. Maybe if you log the traffic when you unlock a Voi you can see what post it does to their API.

According to the fact that VOI uses Bluetooth to unlock the scooter, I was thinking about sniffing the exchanges.
But what can I use to do so ?

Maybe using Charles Proxy, and a iOS device. Then you can see all the requests the Voi app does.