[IN EXCLUSIVITY] KS Max: unlock top speed of 30km/h! (Ghetto method)

Post Reply
User avatar
Lothean
Site Admin
Posts: 90
Joined: Fri Mar 15, 2019 2:40 am
Location: France
Contact:
[IN EXCLUSIVITY] KS Max: unlock top speed of 30km/h! (Ghetto method)

Post by Lothean » Sat Sep 07, 2019 1:50 am

I am very happy to introduce you to the new method that will allow you to get the maximum speed out of your KS Max (30km/h), no matter the version you currently have (G30, G30D, SNSC2.0)...

Requirements:
  • Your KS Max (must be Bluetooth-enabled)
  • A Windows 10 PC with BLE
  • Ninebot-Flasher
  • An official ESx dashboard (can be extracted from any Ninebot ESx scooter)
  • Some tools
How-to:
  • Remove your Max dashboard and unplug it from your scooter. Make sure scooter is turned off.
  • Plug your ESx dashboard into your Max and turn on your scooter.
  • Start Ninebot-Flasher and connect to your scooter. If you're pushed back to the connecting screen, just select your scooter again and click Connect.
  • Hit Ctrl+Alt+A: some buttons should appear, we're only interested in the one named Write ESC Sn. If that doesn't work, please ask on Discord.
  • Get your current Max serial number and replace the 5 first characters with N4GSD. Input that serial number in the text field and click Write ESC Sn.
  • Your new serial number should be displayed. If that's the case, you can reassemble your Max and enjoy your new top speed!

DO NOT CONNECT TO THE NINEBOT APP OR UPDATE FIRMWARE WHILE YOU HAVE THE ESx DASH CONNECTED TO YOUR MAX!


Thanks to all the people that made that tutorial possible:
Majsi, dev of Ninebot-Flasher
SurgeSPB, clever Russian dev that found out that using an ESx dashboard bypasses Ninebot encryption ( :lol: )
ScooterHacking.org
And all of the people who provided resources and time to test ;)

Sokret
Posts: 2
Joined: Sat Sep 07, 2019 6:59 am
Re: [IN EXCLUSIVITY] KS Max: unlock top speed of 30km/h! (Ghetto method)

Post by Sokret » Sat Sep 07, 2019 7:03 am

Confirmed this is working. Now that we got 30KPH ride, what a 35KPH would feel? Oh human...

UgloBuglo
Posts: 11
Joined: Sat Jul 13, 2019 9:40 pm
Re: [IN EXCLUSIVITY] KS Max: unlock top speed of 30km/h! (Ghetto method)

Post by UgloBuglo » Sat Sep 07, 2019 7:04 am

Awesome! :D

Kimboo
Posts: 1
Joined: Sat Sep 07, 2019 8:46 am
Re: [IN EXCLUSIVITY] KS Max: unlock top speed of 30km/h! (Ghetto method)

Post by Kimboo » Sat Sep 07, 2019 8:49 am

Thanks a lot for your efforts, this is really cool! :)

As I will need to borrow the ESx dashboard from a friend, I want to ask if this will chance that in any way? Or are all changes only to the Max scooter? Thanks again!

User avatar
Lothean
Site Admin
Posts: 90
Joined: Fri Mar 15, 2019 2:40 am
Location: France
Contact:
Re: [IN EXCLUSIVITY] KS Max: unlock top speed of 30km/h! (Ghetto method)

Post by Lothean » Sat Sep 07, 2019 5:26 pm

Kimboo wrote:
Sat Sep 07, 2019 8:49 am
Thanks a lot for your efforts, this is really cool! :)

As I will need to borrow the ESx dashboard from a friend, I want to ask if this will chance that in any way? Or are all changes only to the Max scooter? Thanks again!
The BLE just passes the command to the ESC, so no change should be done to the dashboard if you follow the tutorial step-by-step.

Hooter78
Posts: 2
Joined: Fri Apr 12, 2019 10:06 pm
Re: [IN EXCLUSIVITY] KS Max: unlock top speed of 30km/h! (Ghetto method)

Post by Hooter78 » Sun Sep 08, 2019 7:48 pm

Will the Other method that doesn't require an extraction be available anytime soon?

Sokret
Posts: 2
Joined: Sat Sep 07, 2019 6:59 am
Re: [IN EXCLUSIVITY] KS Max: unlock top speed of 30km/h! (Ghetto method)

Post by Sokret » Tue Sep 10, 2019 3:49 am

I noticed nothing change to the ES. That can't be verified though

User avatar
Lothean
Site Admin
Posts: 90
Joined: Fri Mar 15, 2019 2:40 am
Location: France
Contact:
Re: [IN EXCLUSIVITY] KS Max: unlock top speed of 30km/h! (Ghetto method)

Post by Lothean » Wed Sep 11, 2019 3:18 am

Sokret wrote:
Tue Sep 10, 2019 3:49 am
I noticed nothing change to the ES. That can't be verified though
Yes it can, by knowing how the Ninebot protocol works.
Packet have a source address and a destination address. The BLE doesn't retain any particular information apart from the BLE name.
In this case, we're only sending and receiving packets from/to the ESC, which is the Max one when connected, of course.


Post Reply