Scooter hacking is wonderful – you get to create a better scooter from a pre-made scooter platform, and sometimes you can do that purely through firmware modifications. Typically, hackers have been uploading firmware using Bluetooth OTA methods, and at some point, we’ve seen the always-popular Xiaomi scooters starting to get locked down. Today, we see [Daljeet Nandha] from [RoboCoffee] continue the research of the new Xiaomi scooter realities, where he finds that SWD flashing is way more of a viable avenue that we might’ve expected. Continue reading “Xiaomi Scooter Firmware Hacking Gets Hands-On”→
The story of how [Tony]’s three-wheeled electric scooter came to be has a beginning that may sound familiar. One day, he was browsing overseas resellers and came across a new part, followed immediately by a visit from the Good Ideas Fairy. That’s what led him to upgrade his DIY electric scooter to three wheels last year, giving it a nice speed boost in the process!
The part [Tony] ran across was a dual brushless drive unit for motorizing a mountain board. Mountain boards are a type of off-road skateboard, and this unit provided two powered wheels in a single handy package. [Tony] ended up removing the rear wheel from his electric scooter and replacing it with the powered mountain board assembly.
He also made his own Arduino-based interface to the controller that provides separate throttle and braking inputs, because the traditional twist-throttle of a scooter wasn’t really keeping up with what the new (and more powerful) scooter could do. After wiring everything up with a battery, the three-wheeled electric scooter was born. It’s even got headlights!
[Daljeet Nandha] from [RoboCoffee] writes to us, sharing his research on cryptographic signature-based firmware authenticity checks recently added to the Xiaomi Mi scooter firmware. Those scooters use an OTA firmware update mechanism over BLE, so you can update your scooter using nothing but a smartphone app – great because you can easily get all the good new features, but suboptimal because you can easily get all the bad new features. As an owner of a Mi 1S scooter but a hacker first and foremost, [Daljeet] set up a HTTPS proxy and captured the firmware files that the app downloaded from Xiaomi servers, dug into them, and summarized what he found.
Confirming this update will indefinitely lock you out of any third-party OTA updates
Unlike many of the security measures we’ve seen lacking-by-design, this one secures the OTA firmware updates with what we would consider the industry standard – SHA256 hash with elliptic cryptography-backed signing. As soon as the first firmware version implementing signature checks is flashed into your scooter, it won’t accept anything except further firmware binaries that come with Xiaomi’s digital signature. Unless a flaw is found in the signature checking implementation, the “flash a custom firmware with a smartphone app” route no longer seems to be a viable pathway for modding your scooter in ways Xiaomi doesn’t approve of.
Having disassembled the code currently available, [Daljeet] tells us about all of this – and more. In his extensive writeup, he shares scripts he used on his exploration journey, so that any sufficiently motivated hacker can follow in his footsteps, and we highly recommend you take a look at everything he’s shared. He also gives further insights, explaining some constraints of the OTA update process and pointing out a few security-related assumptions made by Xiaomi, worth checking for bypassing the security implemented. Then, he points out the firmware filenames hinting that, in the future, the ESC (Electronic Speed Control, responsible for driving the motors) board firmware might be encrypted with the same kind of elliptic curve cryptography, and finds a few update hooks in the decompiled code that could enable exactly that in future firmware releases.
One could argue that these scooters are typically modified to remove speed limits, installed there because of legal limitations in a variety of countries. However, the legal speed limits are more nuanced than a hard upper boundary, and if the hardware is capable of doing 35km/h, you shouldn’t be at mercy of Xiaomi to be able to use your scooter to its full extent where considerate. It would be fair to assert, however, that Xiaomi did this because they don’t want to have their reputation be anywhere near “maker of scooters that people can modify to break laws with”, and therefore we can’t expect them to be forthcoming.
The build is very much of the “parts laying around the shop” genre. An old skateboard deck was fitted with nice rubber scooter wheels and a set of handlebars thanks to a series of 3D printed parts. Unfortunately, the first revision had problems with flex in the skateboard deck, which isn’t designed to take the full weight of an adult human standing on one leg. Another skateboard deck was pressed into service, reinforced with a metal pipe for added strength.
From there, [Alexandre] set about creating a front-wheel-drive system using a power drill, several shaft extensions, and a right-angle drive. Clamped to the handlebar tube, the drill’s trigger is controlled via a twist throttle linked up by a string.
It’s not the easiest scooter to ride, with a bit too much torque from a standing start and somewhat scary handling characteristics at times. However, we’re sure with some practice and some tweaks, [Alexandre] will have a useful ride on his hands. If you prefer something wilder, however, consider this walking scooter build. Video after the break.
We have a scooter hack that is odd for a couple of reasons. First, the vehicle in question is a Doc Green EWA 6000, a German clone of a Xiaomi M365, so Country stereotypes be darned. Second, it is about increasing the performance, and when we think of scooters, we get hung up on scoot. The link between these peculiarities is the speed limiter Germany requires on all scooters, which the Chinese model lacks. Despite the law, [Nikolaj] wanted a higher top speed and Bluetooth connectivity. Wireless unlocks advanced features, like cruise control, which are absent in the stock model.
The mainboard is responsible for speed control, but that is merely a component, and you can find third-party replacements. [Nikolaj] found a new part with a German forum member’s help, then recorded his work in English for our sake. The speed boost is nice, but the Bluetooth functionality is a massive improvement by itself. If you live in an area where the law doesn’t allow this sort of thing, think before you upgrade. Aftermarket parts aren’t always drop-in replacements, and in this case, the controller and display needed some finessing to fit, so measure twice and buy once.
When a part on a vehicle fails, oftentimes the response is to fit a new one fresh out the box. However, sometimes, whether by necessity or simply for the love of it, it’s possible to handcraft a solution instead. [Samodel] does just that when whipping up a new exhaust for his scooter out of scrap metal.
It’s a great example of classic backyard metalworking techniques. The flange is recreated using a cardboard template rubbed on the exhaust port, with the residual oil leaving a clear impression. Hard work with a grinder and drill get things started, with an insane amount of filing to finish the piece off nicely. A properly tuned pipe is then sketched out on the computer, and a paper template created. These templates are cut out of an old fridge to create the main muffler section.
There’s plenty of other hacks, too – from quick and dirty pipe bends to handy sheet forming techniques. It’s not the first time we’ve seen great metalworking with scrap material, either. Video after the break.
Sometimes, mechanical parts can be supremely expensive, or totally unavailable. In those cases, there’s just one option — make it yourself. It was this very situation in which I found myself. My electric scooter had been ever so slightly bested by a faster competitor, and I needed redemption. A gearing change would do the trick, but alas, the chain sprocket I needed simply did not exist from the usual online classifieds.
Thus, I grabbed the only tools I had, busied myself with my task. This is a build that should be replicable by anyone comfortable using a printer, power drill, and rotary tool. Let’s get to work!
