Reverse engineering my e-scooter and rewriting the firmware in rust

Last year, the author acquired an Egret GT e-scooter, renowned for its impressive 100km range and comfortable 320x480 LCD display. Intrigued by the scooter's inner workings, the author delved into the vehicle's firmware, uncovering a wealth of information.

Upon starting the scooter, the user could press a button to enter a firmware update mode. Exiting this mode would return the scooter to normal driving operation. The author then turned their attention to the mobile app, which allowed remote unlocking, settings adjustment, and battery level monitoring.

The Bluetooth interface of the app piqued the author's interest, leading them to probe the USB-C port on the display. They discovered that the port was not merely for charging phones, but also served as a CAN bus. To investigate this further, the author built a makeshift CAN logger using an ESP32-C6, SN65HVD230, and MCP2515.

By sniffing the CAN traffic during startup, the author was able to identify key messages related to driving mode, throttle position, and motor speed. The CAN messages were documented and analyzed, providing a deeper understanding of the scooter's inner workings.

The author's curiosity led them to purchase replacement motor controller and display units. After carefully dismantling the controller, they found a STM32F103 clone microcontroller with a SWD port, allowing them to dump the firmware using OpenOCD. With the firmware in hand, they analyzed it using Ghidra, discovering three applications: a bootloader, an updater, and the main application.

By further exploring the code, the author gained insights into the device's safety-critical FOC motor control code and other aspects of the scooter's functionality.