Reverse engineering my e-scooter and rewriting the firmware in Rust

Last year, the author purchased an Egret GT e-scooter, which features a 100km range and large tires for a comfortable ride. The scooter comes with a 320x480 LCD display that functions as a HUD, displaying speed, driving mode, battery level, and range. Intrigued by the scooter's inner workings, the author began reverse engineering the device, starting with the mobile app that controls the scooter remotely.

Upon further investigation, the author discovered the USB-C port on the display, which was not merely for phone charging. The author identified two USB-C pins functioning as a CAN bus, which was non-compliant with the manufacturer's claims. Employing an ESP32-C6, SN65HVD230, and MCP2515, the author set up a CAN bus sniffing system and recorded the messages during startup.

After analyzing the CAN traffic, the author identified crucial messages related to throttle, driving mode, and motor speed. The author then purchased replacement motor controller and display units, disassembled the controller, and discovered it contained a STM32F103 clone MCU. Using OpenOCD, the author dumped the flash and RAM contents, allowing them to analyze the firmware with Ghidra.

During the process, the author documented the CAN messages and discovered three applications within the MCU: a bootloader, an updater, and the main application. The main application contained safety-critical code, which the author refrained from modifying.