4 ms·
Reverse engineering my e-scooter and rewriting the firmware in Rust
- barbarkaragul 13d ago[dead]
- kooi 16d agoVery nice. Be safe out there when tweaking these things.
- TheChaplain 13d agoFrom what I've seen on the streets, people bypassing the restrictions will not, and there will be injuries.
- jstanley 13d agoYou only notice the ones that aren't safe. How would you know if someone bypassed the restrictions if they were riding it safely?
- TheChaplain 13d agoBecause if they are riding it safely, there would be no need to bypass the restrictions. There is reason for speed limits, they are not there to f--k with people for fun.
- yonatan8070 13d agoYou can remove the speed limit of a vehicle for when you want to have fun on a closed course. You don't have to always go over the factory limit.
- fragmede 13d agoThat implies that speed itself is unsafe. Which it is not. Airplanes go some 500 mph and mostly don't kill people.
- Gigachad 13d agoScooters just don't have the geometry to ride fast safely, they are incredibly prone to flicking the front wheel out and chucking the rider on the ground. The only way they can be ridden safely is riding relatively slowly. "Hasn't crashed yet" is different to "safely"
- ifh-hn 13d agoWish I was brainy enough to do this sort of thing!
- j_m_b 13d agoThat's what is nice about LLMs. You CAN do these things now!
- wkjagt 13d agoMaybe I'm out of touch with the times, but I wouldn't feel safe riding an e-scooter with custom vibe coded firmware.
- m00dy 13d agoIf it is coded in safe Rust, why not ?
- malnourish 13d agoSafe rust does not mean correct logic; best not conflate the two. You could have perfectly safe rust that disables brakes above a certain speed, inverts steering by wire, or adjusts the charging parameters, for example (depending on addressable capabilities).
- gohomeloser 13d ago[dead]
- m00dy 13d agoI meant something deeper.
- IshKebab 13d agoYou don't have to fully vibe code it. Most of this stuff doesn't take massive brains, it is just super tedious - especially the reverse engineering. I've never really had the patience for that (except one USB devices that I did reverse engineer when I was younger). AI really helps with the tedium.
- jimmy76615 13d agoI wanna have a friend like this guy
- asimovDev 13d agoThank you for posting! I got a e-scooter this spring and wrote my own app for it after reverse engineering the official app + BLE logs. I am not brave enough to do anything with the firmware on it though. Maybe not yet at least
- hommelix 13d ago> The updater device then sends 64 byte chunks spread over 9 CAN 0x384 frames Classic CAN uses 8 bytes long frame, so 64 bits. Is it a typo in the post, vor is it using CAN-FD?
- baby_souffle 13d agoMust be. Can 1.x and 2.0 are fixed size frames.
- irishcoffee 13d agoCould be TP.DT, multi packet. My guess is a typo.
- bri3d 13d agoI read this as the chunks are 64 bytes and thus each chunk is split over 9 frames. I haven’t looked yet but it’s probably an ISO-TP esque framing protocol.
- nitros 13d agoYep, this is the case. Nine frames are transmitted with the first frame containing a sequence number and the first five bytes, followed by seven frames containing just data, and a final frame containing the last three bytes of data, and a two byte CRC.
- arbirk 13d agoI am also rusting my hw. Last week my mouse, this week my EUC (wish me luck). I would rather risk a crash than memory corruption
- thenthenthen 13d agoWhat is an EUC? And also what kinda crash are you referring to? i rather have a memory issue than crash my e-scooter (and myself) haha
- Someone 13d agoin this context, it likely refers to an electric unicycle (https://en.wikipedia.org/wiki/Electric_unicycle https://en.wikipedia.org/wiki/Electric_unicycle)
- thenthenthen 13d agoThanks, are these popular besides Huaqiangbei (Shenzhen) delivery guys?
- abound 13d agoThis is an unbelievably impressive project and a killer write up, very satisfying. I wonder if the author looked into using Slint [1] for the UI, given the codegen bloat issues they had with buoyant (which also looks very cool). I haven't used either, but I've done a few projects with Embassy and am always looking for an excuse to try embedded GUI tools [1] https://slint.rs/ https://slint.rs/
- nitros 13d agoHeya, I tried using slint first, but slint needs even more flash, and an allocator on top. Just adding slint (with an empty UI) exhausted my binary size limit.
- abound 13d agoOh wow, good to know! Cool project, best of luck with your motor controller firmware
- uneoneuno 13d agoI've got a happy run G300 pro that has a controller I've been considering digging into. It doesn't seem tuned to the motor. This is great inspiration to start digging in. It actually seems a bit clever to use the USB pins as a CAN bus
- leftger 11d ago[dead]
- ivo_repairs 13d ago[flagged]
- quietraster 13d agorewriting scooter firmware in rust is the kind of unnecessary excellence i come here for. how did you debug without bricking it, swd probe or pure faith
- nitros 13d agoWith a SWD probe on the cracked open display initially, and this was necessary while I was still writing/porting the peripheral drivers. Once the firmware was stable (and after I'd asserted that it wasn't possible to accidentally brick the scooter) I moved to testing on the real scooter where the only feedback is if things work or not.
- zoobab 13d agoWe need to free up Bosch systems. They use lots of open source libs, but they close the whole chain (like spare batteries) so that you cannot plug external batteries from other suppliers.
- rfgplk 13d agoPretty much anything hardware based is like this. Everything is 100% closed source and bolted down such that inspecting it is outright impossible without extensive reverse engineering.
- hn_submit 13d agoI believe one of the feasibilities we have with electric locomotion is the standardization of components: electric motors, motor controllers, batteries and battery chargers. These being interchangeable will lead to lower costs through competition and more innovation. It's disappointing that manufacturers are moving the other way to enable vendor lock-in. But only one manufacturer has to jump the fence and the others will be left behind.
- awakeasleep 13d agoI’m suspicious of this vision because for example, with battery packs, cells with compatible voltage and size have vastly different characteristics. Those characteristics, like safe discharge rate, capacity, projected cycle count, are all things that manufactures exaggerate or get wrong. I don’t think there’s any way that consumers can ever be informed enough to have an efficient market in products such as those
- hn_submit 13d agoI can imagine a future where batteries and chargers communicate using an open-source protocol just as they are doing now over USB.
- 13d ago
- rfgplk 13d agoMy general piece of advice to anyone looking to do this is not to even bother. Just strip the hardware package and replace it with an arduino/bb or an equivalent sbc figure out what the motors are and wire it up yourself. Way faster and less tedious
- the__alchemist 13d ago> arduino/bb or an equivalent sbc This is perhaps more of a Maker perspective. I think the article author's approach (What you might classify as embedded engineer) is more suitable broadly. These are categorizations without a fine line, but are IME useful for clustering approaches and preferences. For another example of an adjacent non-obvious clustering, see embedded vs robotics; they don't have as much overlap as you might guess!
- BrandoElFollito 13d agoFirst of all, this is impressive. I do not know how what the legal context is in your country, but you may need to have a device that uses public roads licensed to do so. In case of any legal issues (accidents, mostly) not only you would not be covered by your insurance, but your situation may worsen for having operated it. Something to keep in mind.
- nitros 13d agoThis is definitely something to be aware of. Installing this firmware definitely invalidates the StVO (though I can always flash the original firmware back). Personally I am morally sound with replacing the firmware of the display unit as the critical functionality is still handled by the motor controller (for example, the brake lever sensors are wired to the motor controller directly, and the display must report the throttle position constantly to not trigger a shutdown); the display unit would need to contain intentionally malicious code to cause problems.
- yonatan8070 13d agoMaybe, but in the case of a crash, would anyone go Ghidra-ing inside your scooter's MCU to check if you replaced the firmware? It sounds like as long as you don't say anything, no one will ever know.
- arbirk 13d agoI think you are right, but he did also blog about it..
- Founderarcstone 13d agowhat a great project nice work!
- yonatan8070 13d ago> To my surprise, two of the USB-C pins were being used as a CAN bus (which smells horribly noncompliant). Oh god that's awful. Why would anyone in their right mind do this?
- fragmede 13d agoCost. It's a clever hardware hack that saves money, and 1 cent saved over 100 million units is $1,000,000!
- ranma42 13d agoUSB-C actually has pins dedicated to application/debug use (SBU1 and SBU2). "SBU1 and SBU2: these are low-speed lines used only for Alternate Mode and accessory mode. For example, with DisplayPort, AUX+ and AUX– transmit over the SBU lines. For audio adapter accessory mode, these lines are used for the microphone input and analog GND."
- tverbeure 13d agoMining rigs were using USB-C to transport PCIe x1 by the truckload. Because USB 3.0 cables are dirt cheap and are capable of transporting signals at PCIe x1 data rates. https://www.aliexpress.us/item/3256809341543494.html https://www.aliexpress.us/item/3256809341543494.html
- dezgeg 12d ago4G/5G Telco equipment (ab)use HDMI connectors/cables in a similar way.
- mrheosuper 12d agoAs long as it's not intended for user to plug in, it's fine. Many other vendors also do that.
- trevithick 13d agoReverse engineering like this is black magic to me. The writeup is good. It's detailed and I could follow along with what the author was doing even though I'm too stupid to ever attempt something like this. Nice job author. I liked bullet 2 in the Introduction.
- tverbeure 13d agoReverse engineering the way they do it is very satisfying and time consuming. If you want the same results but without the sweat, LLMs are the way to go now. They eat this kind of stuff for lunch. You could literally ask one for a table with all the CAN bus messages and it would figure it out. I wrote a blog posts where I first did it the traditional way and then, a few months later, the lazy way: https://tomverbeure.github.io/2026/04/12/AMIQ-License-Key-Generation.html https://tomverbeure.github.io/2026/04/12/AMIQ-License-Key-Ge....
- BlackRabbit1 13d agoLLMs are fun until you have to break up a devices that use encrypted firmware files and non-documented interfaces.. that you are back in the past ;-) But for the rest: Yes. They will be eaten alive by the latest generation of LLMs. I use DS-Flash 4.1 a lot for this. A big helper.
- huflungdung 13d agoClearly you are in the past. I have reverse engineered some very difficult undocumented things. I can not go in to details but these were heavily hardened hardware. Custom SoC. of course without datasheets, involved multiple different levels of encryption and architectures of connected devices, broke all of it. All that is left is cryptocell pwn. With very little steering from me eta: passive aggressive winky face
- vablings 12d agoMake a custom harness, literally give the AI access to as much data as possible in terms of the device and it will crack it wide open like an egg. AI is driving digital ownership again and its formidable
- plasticeagle 13d agoVery nice article, but I have a question about the rust bloat issues you encounter. Why do the size of the type names grow the size of the binary? Does rust look them up at runtime, and if not, why can they not be stripped like you would in C++? I like how they used the USB C connector for whatever the hell they felt like. USB C is cheap and reliable, so it makes alot of sense.
- nitros 13d agoThe size of the type name isn't correlative, but the nesting depth of types roughly corresponds with how many function bodies are going to be generated. In the GUI library, the HStack/VStack types are type-parameterized by their children, which results in a new copy of the layout function for each combination of children types.
- Pannoniae 13d agoWell, it's an intersection of things ;) 1. If you have debug symbols on, it's obvious - the type names, layouts and whatnot are embedded in the binary. Bigger names = bigger executable. Of course, this doesn't apply here because on micros you usually don't even have an ELF executable, you upload raw executable code. 2. Even without debug symbols, think about how generics work in statically compiled languages. For each N<T> you need to instantiate the code for all T. The more nested types you have, the more code you instantiate. Usually, these are folded away by the linker, but with deeply nested generics, it's very easy to cause "non-local" effects, for example if you store T in a struct, access its fields or do anything other than treating it as opaque, then the code won't be identical for each T, because the offsets of each field will change depending on the `size_of`. Of course, this assumes LTO because without LTO, crate boundaries are "hard" and you can't optimise/inline across them.
- 1saadcodes 13d agoThis is genuinely very cool. Amazing work and article
- cantalopes 13d agoRewriting things in rust is like running doom on things
- antonvs 12d agoThis is taking the "rewrite it in Rust" meme a little too far. I love it!
- deleted 12d ago[deleted]
- blacklion 12d agoI'm surprised that all original firmwares were not protected at all. I've tried to fix firmware of some cheap (but with good DAC and analog schematics) Chinese media player based on STM32 and firmware was protected by no-read fuses and only action possible in this case is to wipe flash, but not to read-out firmware. And this scooter looks much more professionally-made and expensive product.
- leftger 11d ago[dead]
- arlattimore 12d agoThe Berm Peak YouTube channel did a similar reverse engineering of a retro Tron style e-bike. It didn't require going to new firmware but it is a good video as well about how he could accomplish it, https://www.youtube.com/watch?v=hPrtVGimBYs https://www.youtube.com/watch?v=hPrtVGimBYs.
- leftger 11d ago[dead]
- probablyStimmed 11d agoThis person is my hero, the technical prowess, fearlessness and grit to keep at this for six months is inspiring. I am wondering why Rust in particular made it simpler to use the code or template into another app. That kinda seems like something most languages can achieve.