scooter identification (uart protocol)
Posted: Mon Jul 24, 2023 7:23 pm
hi,
a friend of mine works at a swedish hotel that had some electric scooter from some company called AYO - i believe they are now defunct.
i would like to convert this scooter to a personal unlocked one.
i have disassembled the upper part (which hosts a pcb with an stm32, gsm module and other things). i have started to reverse engineer it a bit, but it's hard to figure out what to send to the motor controller without being able to sniff a correct "start" signal (etc). opening up the motor controller is difficult since the cables are glued to it and everything seems very tight down there.
from the upper pcb there is a cable having six wires:
- R (9600 baud uart, 3.3 volts)
- T (9600 baud uart, 3.3 volts)
- C (1.8 volts, not sure what it is)
- A (acceleration, connected to the throttle)
- G (gnd)
- V (+34 volts)
sniffing on the uart pins gives:
on the R pin:, every 200 ms:
0x5a 0x10 0x0a 0x1d 0x00 0x02 0x00 0x55 0x01 0x00 0x00 0x00 0x00 0x8f
0x5a 0x10 0x0a 0x1d 0x00 0x02 0x00 0x55 0x01 0x00 0x00 0x00 0x00 0x8f
on the T pin, every 60 ms:
0x5a 0x30 0x05 0xc7 0x02 0x00 0x00 0x04 0x02
0x5a 0x30 0x05 0xc7 0x02 0x00 0x00 0x04 0x02
is there anyone that knows more about what controller this might be, and/or some documentation of the uart protocol?
thanks.
a friend of mine works at a swedish hotel that had some electric scooter from some company called AYO - i believe they are now defunct.
i would like to convert this scooter to a personal unlocked one.
i have disassembled the upper part (which hosts a pcb with an stm32, gsm module and other things). i have started to reverse engineer it a bit, but it's hard to figure out what to send to the motor controller without being able to sniff a correct "start" signal (etc). opening up the motor controller is difficult since the cables are glued to it and everything seems very tight down there.
from the upper pcb there is a cable having six wires:
- R (9600 baud uart, 3.3 volts)
- T (9600 baud uart, 3.3 volts)
- C (1.8 volts, not sure what it is)
- A (acceleration, connected to the throttle)
- G (gnd)
- V (+34 volts)
sniffing on the uart pins gives:
on the R pin:, every 200 ms:
0x5a 0x10 0x0a 0x1d 0x00 0x02 0x00 0x55 0x01 0x00 0x00 0x00 0x00 0x8f
0x5a 0x10 0x0a 0x1d 0x00 0x02 0x00 0x55 0x01 0x00 0x00 0x00 0x00 0x8f
on the T pin, every 60 ms:
0x5a 0x30 0x05 0xc7 0x02 0x00 0x00 0x04 0x02
0x5a 0x30 0x05 0xc7 0x02 0x00 0x00 0x04 0x02
is there anyone that knows more about what controller this might be, and/or some documentation of the uart protocol?
thanks.