markovitch wrote: ↑Sun Feb 10, 2019 4:56 am
Hello guys, I'm new to the forums and very glad I've eventually found it to share & get some knowledge.
I'm a programmer, hobbyst logic board repair specialist, currently working on a lime scooter you are trying to reverse
This is an image - REGISTER or LOGIN to view.
I will share what I know and plan to do as I get home in the evening
This is an image - REGISTER or LOGIN to view.
Ok, sorry I'm so late but I want to sum up what I know so far:
Firstly, the main logic board aka: "the gsm-gps-ble brain" - exactly what is hidden inside the green plastic box.
Fig. 1
Everything pretty much explained on the pic. On the other side of the board there is a small realtek audio ic+ audio amplifier and domething more interesting: Awinic AW9523B chip, probably serving as board initializer/ basic gpio handler.
I have also found this strange item under the steering bar (probably some BLE tag, serving as additional "immobilizer"?
This is an image - REGISTER or LOGIN to view.)
Fig. 2
Last thing is OFC most interesting for us. The Controller.
Fig. 3
The controller is made by Tianjin Santroll Automobile Company, listed
HERE as "Lithium battery class bicycle motor vector controller". It has uart (serial, baudrate 9600) communication with the parent (the brain - green box) board.
Controller ouputs are as follows:
- Motor plug:
- A, B, C motor coils (thick yellow/blue/green wires)
- hA, hB, hC Hall sensors (thin yellow/blue/green wires)
- 5V3 - 5.3 V line to sensors (thin red)
- GND - (thin black)
- GSM/GPS 'Brain' (5-pin plug, green inside):
- GPIO (blue)
- TX_1 (yellow)
- 48V (red)
- GND (black)
- RX_1 (green)
- Dashboard (6-pin plug, black inside):
- 48V (red)
- GND (black)
- RX_0 (green)
- TX_0 (yellow)
- HHAND (white)
- EB (blue)
- Programming (5-pin header, wide): (originally disconnected)
- CLK (yellow)
- RST (blue)
- DIO (green)
- GND (black)
- 5V (red)
- Rear light (3-pin header, small):
- HDSIG (white)
- GND (black)
- HD_0 (red)
Controller seems the most important and complicated part of reverse engineering so far.
I wanted to contact Santroll company for this controller documentation, however I don't have WeChat acount (banned after creation for security reasons - dunno why), cannot create Weibo account (unavailable here), and I don't live in China, so cannot telephone there. This company doesn't even have email account.
I even have found their patenting document, describing uart-communicated controller
This is an image - REGISTER or LOGIN to view. HERE
Already found out the controller uses MKE02Z64 NXP ARM-based CPU, will search for any method to dump flash memory from chip, and analyze it in IDA.
Another way is the "low-effort" and I'll try to figure out the protocol used to communicate with the dashboard/display unit, just buy another controller, and code some arduino to use the stock display. (I have oscilloscope, and logic signal analyzer so it is possible)
Would be great If at least one of you guyz could contact Santroll company for controller datasheet/ tech guide
This is an image - REGISTER or LOGIN to view. (model we're looking for is B-WZKB3615A-LB-F4)