Reverse engineering my e-scooter and rewriting the firmware in Rust
summary
The author reverse engineered the hardware and firmware of an Egret GT e-scooter to understand its inner workings and ultimately rewrite the display unit's firmware in Rust. By analyzing CAN bus traffic and dumping the MCU flash, the author mapped the communication protocols between the controller, display, and battery. This process revealed a lack oft authentication in the firmware update process, allowing for custom firmware to be flashed. The final implementation uses the Rust Embassy framework and an actor-model architecture to manage peripherals and system state safely and efficiently.
key points
- The author discovered a non-compliant use of the USB-C port as a CAN bus, which allowed them to sniff and decode the messages controlling throttle, driving modes, and motor speed.
- By dumping the flash and RAM of the MCU using SWD ports and analyzing the code in Ghidra, the author identified the bootloader, main application, and the unencrypted firmware update mechanism.
- The rewritten firmware was implemented in Rust, requiring the creation of a custom Hardware Access Library (HAL) for the AT32F415 MCU and an actor-model design to handle asynchronous tasks like ADC readings and CAN communication.
who should read it
Embedded systems engineers, security researchers, and hobbyists interested in reverse engineering, Rust for firmware development, and the inner workings of electric mobility hardware.
discussion positive
consensus
Commenters generally admire the technical feat of rewriting scooter firmware in Rust and reverse engineering the hardware. While there is a debate regarding the role of LLMs in accelerating reverse engineering, most agree that hardware vendor lock-in is a common, anti-consumer practice. However, some caution that open-sourcing high-capacity battery systems could lead to safety risks due to the danger of low-quality third-party components.
top insight
The use of USB-C pins for a CAN bus is highlighted as a cost-saving hardware hack that prioritizes cheap, reliable connectors over protocol compliance. This demonstrates how manufacturers often repurpose standard physical interfaces for proprietary communication to reduce per-unit costs in mass production. This insight reveals the truth behind non-compliant hardware choices in consumer electronics.
Generated by an LLM from the article and thread. Check the sources before relying on it.