He found a CAN bus hiding in his e-scooter's USB-C port
Reverse engineering my e-scooter and rewriting the firmware in Rust
Ben reverse engineered his Egret GT e-scooter, discovering that two USB-C pins secretly carry a noncompliant CAN bus. He sniffed the traffic with an ESP32-C6 and mapped throttle, driving mode, and motor speed messages. He also found the scooter leaks odometer and charge history to the manufacturer, and that holding the down button during power-up bypasses the PIN. He then rewrote the display firmware in Rust.
To my surprise, two of the USB-C pins were being used as a CAN bus (which smells horribly noncompliant).
- abound
This is an unbelievably impressive project and a killer write up, very satisfying. I wonder if the author looked into using Slint [1] for the UI, given the codegen bloat issues they had with buoyant (which also looks very cool). I haven't used either, but I've done a few projects with Embassy and am always looking for an excuse to try embedded GUI tools
- trevithick
Reverse engineering like this is black magic to me. The writeup is good. It's detailed and I could follow along with what the author was doing even though I'm too stupid to ever attempt something like this. Nice job author.
I liked bullet 2 in the Introduction.
- zoobab
We need to free up Bosch systems. They use lots of open source libs, but they close the whole chain (like spare batteries) so that you cannot plug external batteries from other suppliers.
- asimovDev
Thank you for posting! I got a e-scooter this spring and wrote my own app for it after reverse engineering the official app + BLE logs. I am not brave enough to do anything with the firmware on it though. Maybe not yet at least
- quietraster
rewriting scooter firmware in rust is the kind of unnecessary excellence i come here for. how did you debug without bricking it, swd probe or pure faith
- blacklion
I'm surprised that all original firmwares were not protected at all.
I've tried to fix firmware of some cheap (but with good DAC and analog schematics) Chinese media player based on STM32 and firmware was protected by no-read fuses and only action possible in this case is to wipe flash, but not to read-out firmware.
And this scooter looks much more professionally-made and expensive product.
- yonatan8070
> To my surprise, two of the USB-C pins were being used as a CAN bus (which smells horribly noncompliant).
Oh god that's awful. Why would anyone in their right mind do this?
- arbirk
I am also rusting my hw. Last week my mouse, this week my EUC (wish me luck). I would rather risk a crash than memory corruption