Es200 2 minutes power off fixed.
Posted: Fri Jan 07, 2022 9:35 pm
Finally i was able to beat this, I had a couple of scooters since ages, (I recovered those from the trash) with this problem.
The problem was that using the arduino to send the control msg {0xA6, 0x12, 0x02, 0x10, 0xF4, 0xcf} via serial every second resulted on the escooter locking after a couple of minutes, looks like they added some type of security on the latest firmware so all the "newer" scotters had this problem, the bord i have is an ES200B, but it should work on an ES200g too.
A friend of mine found a firmware someone extracted and posted it on discord. I tried to find it again but coudnt find it (so I apologise for no providing a source). With that file I decided to make some reverse engineering on the firmware file, looks like the iot unit needs to send a message that starts with 0x7a, 0x12,0x0A,..... That message changes constantly and I coudn't understand how it was calculated, however i did found the flag that disables the scooter, I disabled it on the firmware so it stays on as long as the arduino sends the control msg every second.
The firmware needs to be flashed using stlink or similar (the micro controller is a stm32f103cbt6), the pads are on the board, there is a lot of silicone inside the controller so you need to be really carefull to disasseble it. I removed the screws that hold the sides and had to cut the alumium housing wit a dremmel (cut slow and do not go deep), then I removed the silicone on the flashing pads (use something not metalic otherwise you coud scratch the board).
Here I provide an image of the pads, the firmware to flash and the arduino code I made (I'm using an Arduino nano). based on the other
The wiring might differ so i recommend to measure it before conecting, there is a 40V pin so it could fry whatever you connect it by mistake
The Black is ground (GND)
The red wire is the VIN 42 volt from the battery.
The Blue is called the BTN. It requires a constant 3.3v. (pin 2 on the Nano)
The yellow is TX and will need to be connected to the RX of the Nano.
The green is the RX line and is not required but I connected it anyways.
As always do this at your own risk.
I coudn't upload the files to the forum so I uploaded them to mega (moderators, if i shoudnt do this please let me know):
https://mega.nz/file/wxkWUICJ#dXbIvvQAG ... yyjJqJVt0g
The problem was that using the arduino to send the control msg {0xA6, 0x12, 0x02, 0x10, 0xF4, 0xcf} via serial every second resulted on the escooter locking after a couple of minutes, looks like they added some type of security on the latest firmware so all the "newer" scotters had this problem, the bord i have is an ES200B, but it should work on an ES200g too.
A friend of mine found a firmware someone extracted and posted it on discord. I tried to find it again but coudnt find it (so I apologise for no providing a source). With that file I decided to make some reverse engineering on the firmware file, looks like the iot unit needs to send a message that starts with 0x7a, 0x12,0x0A,..... That message changes constantly and I coudn't understand how it was calculated, however i did found the flag that disables the scooter, I disabled it on the firmware so it stays on as long as the arduino sends the control msg every second.
The firmware needs to be flashed using stlink or similar (the micro controller is a stm32f103cbt6), the pads are on the board, there is a lot of silicone inside the controller so you need to be really carefull to disasseble it. I removed the screws that hold the sides and had to cut the alumium housing wit a dremmel (cut slow and do not go deep), then I removed the silicone on the flashing pads (use something not metalic otherwise you coud scratch the board).
Here I provide an image of the pads, the firmware to flash and the arduino code I made (I'm using an Arduino nano). based on the other
The wiring might differ so i recommend to measure it before conecting, there is a 40V pin so it could fry whatever you connect it by mistake
The Black is ground (GND)
The red wire is the VIN 42 volt from the battery.
The Blue is called the BTN. It requires a constant 3.3v. (pin 2 on the Nano)
The yellow is TX and will need to be connected to the RX of the Nano.
The green is the RX line and is not required but I connected it anyways.
As always do this at your own risk.
I coudn't upload the files to the forum so I uploaded them to mega (moderators, if i shoudnt do this please let me know):
https://mega.nz/file/wxkWUICJ#dXbIvvQAG ... yyjJqJVt0g