He found a CAN bus hiding in his e-scooter's USB-C port
Reverse engineering my e-scooter and rewriting the firmware in Rust
Ben reverse engineered his Egret GT e-scooter, discovering that two USB-C pins secretly carry a noncompliant CAN bus. He sniffed the traffic with an ESP32-C6 and mapped throttle, driving mode, and motor speed messages. He also found the scooter leaks odometer and charge history to the manufacturer, and that holding the down button during power-up bypasses the PIN. He then rewrote the display firmware in Rust.
To my surprise, two of the USB-C pins were being used as a CAN bus (which smells horribly noncompliant).
- asimovDev
Thank you for posting! I got a e-scooter this spring and wrote my own app for it after reverse engineering the official app + BLE logs. I am not brave enough to do anything with the firmware on it though. Maybe not yet at least
- ifh-hn
Wish I was brainy enough to do this sort of thing!
- jimmy76615
I wanna have a friend like this guy