Live data from Hacker News

Reverse engineering my e-scooter and rewriting the firmware in Rust

bensimms.moe

61–70 of 113 posts

Re: Reverse engineering my e-scooter and rewriting the firmware in Rust

#61
post #35

Earlier quoted context omitted.

What is an EUC? And also what kinda crash are you referring to? i rather have a memory issue than crash my e-scooter (and myself) haha

in this context, it likely refers to an electric unicycle ( https://en.wikipedia.org/wiki/Electric_unicycle )

Thanks, are these popular besides Huaqiangbei (Shenzhen) delivery guys?

Re: Reverse engineering my e-scooter and rewriting the firmware in Rust

#62
post #34

We need to free up Bosch systems. They use lots of open source libs, but they close the whole chain (like spare batteries) so that you cannot plug external batteries from other suppliers.

I took a look into the batteries for the ebike systems, they have some sort of AES based pairing and the chips are read protected. You probably can dump the firmware from the update packages for the things. (maybe some hw exploitation stuff as well?) I did a thing where I put their battery controller on an after market battery with a divisor and it started and paired, but for some reason blew up afterwards.

I now realize it would be easier to write the whole thing wholesale, but.. uhh, it's no small feat, and I have a job soooo...

Bosch should open their shit, it might save them, because it seems the chinese with Avinox will eat their dinner in a couple of years. They seem to be pretty litigious, they went after a forum that documented initiatives to reverse (well, they also hosted pirated diagnostics sw but.. yeah)

Re: Reverse engineering my e-scooter and rewriting the firmware in Rust

#63

Earlier quoted context omitted.

No, you can’t. Just because you can pull the lever on an LLM enough times and get something that works doesn’t mean you’ve done the work. Doing the work implies learning and transferable skills, none of which you get by prompting an LLM.

Yes they can. At the end of the day, whether the food was made in a microwave oven or by a Michelin starred chef, the user is fed. Doing the work means that the work happened. Anything else is secondary.

You wouldn't call someone who puts food in a microwave a chef, would you? And you wouldn't say that putting food in the microwave is the same thing as cooking a Michelin star meal. These are different things.

Re: Reverse engineering my e-scooter and rewriting the firmware in Rust

#64

Reverse engineering like this is black magic to me. The writeup is good. It's detailed and I could follow along with what the author was doing even though I'm too stupid to ever attempt something like this. Nice job author. I liked bullet 2 in the Introduction.

Reverse engineering the way they do it is very satisfying and time consuming. If you want the same results but without the sweat, LLMs are the way to go now. They eat this kind of stuff for lunch. You could literally ask one for a table with all the CAN bus messages and it would figure it out.

I wrote a blog posts where I first did it the traditional way and then, a few months later, the lazy way: https://tomverbeure.github.io/2026/04/12/AMIQ-License-Key-Ge....

Re: Reverse engineering my e-scooter and rewriting the firmware in Rust

#65
post #5

Earlier quoted context omitted.

You only notice the ones that aren't safe. How would you know if someone bypassed the restrictions if they were riding it safely?

Because if they are riding it safely, there would be no need to bypass the restrictions. There is reason for speed limits, they are not there to f--k with people for fun.

That implies that speed itself is unsafe. Which it is not. Airplanes go some 500 mph and mostly don't kill people.

Re: Reverse engineering my e-scooter and rewriting the firmware in Rust

#66

Earlier quoted context omitted.

No, you can’t. Just because you can pull the lever on an LLM enough times and get something that works doesn’t mean you’ve done the work. Doing the work implies learning and transferable skills, none of which you get by prompting an LLM.

Yes they can. At the end of the day, whether the food was made in a microwave oven or by a Michelin starred chef, the user is fed. Doing the work means that the work happened. Anything else is secondary.

A microwave just cooks your input ingredients and if you use non microwave safe containers or food that is not suitable for it, you get edible but hazardous food.

Garbage in, Garbage out. There are minimum expectations on user like ability to source proper materials, use them correctly and an ability to verify/check the result for problems. More important if it's something you want to eat or ride!

Re: Reverse engineering my e-scooter and rewriting the firmware in Rust

#67
post #58

Earlier quoted context omitted.

Having been on the flip side of this divide in the past, there really are a lot of potential safety and reliability problems when using random third party versions of components. While I'm sure there are strong financial incentives to constrain supply, there are also some other strong reasons as well. Also it's very expensive to actually make an ecosystem compared to a close one. The best way to incentivize manufactu…

> there really are a lot of potential safety and reliability problems when using random third party versions of components. What are you talking about? If a seller sells you random junk that causes safety issue, they are liable of the damage like the OEM would if their product was bad. Then, if the seller is in a jurisdiction where you can't hope to sue, then it's either your problem for picking this random seller on…

The closed system doesn’t (only) prevent counterfeit systems, it also prevents someone from maliciously releasing a mod that could make the motor accelerate instead of break at some random time.

It’d be negligent for anyone to release a product like this without locking down the FW.

Many years ago, we did exactly that: our product had FW update support and our biggest concern was a rogue hacker creating a package that would brick the product.

Re: Reverse engineering my e-scooter and rewriting the firmware in Rust

#68
post #35

Earlier quoted context omitted.

in this context, it likely refers to an electric unicycle ( https://en.wikipedia.org/wiki/Electric_unicycle )

Thanks, are these popular besides Huaqiangbei (Shenzhen) delivery guys?

I have an inmotion V10 - soon rusty

Re: Reverse engineering my e-scooter and rewriting the firmware in Rust

#69
post #37

Earlier quoted context omitted.

Pretty much anything hardware based is like this. Everything is 100% closed source and bolted down such that inspecting it is outright impossible without extensive reverse engineering.

I believe one of the feasibilities we have with electric locomotion is the standardization of components: electric motors, motor controllers, batteries and battery chargers. These being interchangeable will lead to lower costs through competition and more innovation. It's disappointing that manufacturers are moving the other way to enable vendor lock-in. But only one manufacturer has to jump the fence and the others…

I’m suspicious of this vision because for example, with battery packs, cells with compatible voltage and size have vastly different characteristics.

Those characteristics, like safe discharge rate, capacity, projected cycle count, are all things that manufactures exaggerate or get wrong.

I don’t think there’s any way that consumers can ever be informed enough to have an efficient market in products such as those

Re: Reverse engineering my e-scooter and rewriting the firmware in Rust

#70

Reverse engineering like this is black magic to me. The writeup is good. It's detailed and I could follow along with what the author was doing even though I'm too stupid to ever attempt something like this. Nice job author. I liked bullet 2 in the Introduction.

Reverse engineering the way they do it is very satisfying and time consuming. If you want the same results but without the sweat, LLMs are the way to go now. They eat this kind of stuff for lunch. You could literally ask one for a table with all the CAN bus messages and it would figure it out. I wrote a blog posts where I first did it the traditional way and then, a few months later, the lazy way: https://tomverbeure…

LLMs are fun until you have to break up a devices that use encrypted firmware files and non-documented interfaces.. that you are back in the past ;-)

But for the rest: Yes. They will be eaten alive by the latest generation of LLMs. I use DS-Flash 4.1 a lot for this. A big helper.

Post reply on HN