It is a classic Hackaday situation. You have an Egret GT E-scooter. It has a screen that shows the usual dash stats, but that led to an annoyance. You could accidentally enter firmware update mode and, from there, enter operational mode without the security PIN. [Ben] couldnβt let that stand, so he reverse-engineered the protocol and rewrote the firmware in Rust. As he put it, ββ¦ because I have to breakβ¦ everything I ownβ¦β We get it.
The mobile app was useful for some basic info, since sniffing Bluetooth is fairly easy and analyzing mobile code is, more or less, straightforward. Analysis revealed some data that doesnβt show on the display and that several things are sent back to home base tagged with the scooterβs unique ID β another reason to gut the existing firmware.
Internally, the scooter uses the CAN Bus, so out came the oscilloscope and a homebrew CAN decoder.Β Surprisingly, the CAN bus is accessible on the USB-C portβs data pins. Officially, the port is only for charging phones, so you have to wonder what your phone makes of the alien signals on the data pins when it is charging.
Firmware updates actually come in at least three flavors: display, input panel, and main controller. Reverse engineering the firmware update process was crucial to installing the new firmware.
If you own a similar scooter, this post is a goldmine. If you donβt, it is still a very detailed breakdown of a reverse-engineering workflow, and you can apply many of the tools and techniques to your next project.
Of course, another option is to just keep the scooter and replace the brains. If you want to learn more about reverse engineering, there are literally dozens of Hackaday posts to help you get started.
Login
Credit:
