Es200 2 minutes power off fixed.

Posts: 2
Joined: Fri Jan 07, 2022 8:29 pm

Es200 2 minutes power off fixed.

Postby camialfa Fri Jan 07, 2022 9:35 pm

Finally i was able to beat this, I had a couple of scooters since ages, (I recovered those from the trash) with this problem.

The problem was that using the arduino to send the control msg {0xA6, 0x12, 0x02, 0x10, 0xF4, 0xcf} via serial every second resulted on the escooter locking after a couple of minutes, looks like they added some type of security on the latest firmware so all the "newer" scotters had this problem, the bord i have is an ES200B, but it should work on an ES200g too.

A friend of mine found a firmware someone extracted and posted it on discord. I tried to find it again but coudnt find it (so I apologise for no providing a source). With that file I decided to make some reverse engineering on the firmware file, looks like the iot unit needs to send a message that starts with 0x7a, 0x12,0x0A,..... That message changes constantly and I coudn't understand how it was calculated, however i did found the flag that disables the scooter, I disabled it on the firmware so it stays on as long as the arduino sends the control msg every second.

The firmware needs to be flashed using stlink or similar (the micro controller is a stm32f103cbt6), the pads are on the board, there is a lot of silicone inside the controller so you need to be really carefull to disasseble it. I removed the screws that hold the sides and had to cut the alumium housing wit a dremmel (cut slow and do not go deep), then I removed the silicone on the flashing pads (use something not metalic otherwise you coud scratch the board).

Here I provide an image of the pads, the firmware to flash and the arduino code I made (I'm using an Arduino nano). based on the other

The wiring might differ so i recommend to measure it before conecting, there is a 40V pin so it could fry whatever you connect it by mistake

The Black is ground (GND)
The red wire is the VIN 42 volt from the battery.
The Blue is called the BTN. It requires a constant 3.3v. (pin 2 on the Nano)
The yellow is TX and will need to be connected to the RX of the Nano.
The green is the RX line and is not required but I connected it anyways.

As always do this at your own risk.

I coudn't upload the files to the forum so I uploaded them to mega (moderators, if i shoudnt do this please let me know): ... yyjJqJVt0g
Posts: 4
Joined: Sun Feb 27, 2022 8:49 pm

Re: Es200 2 minutes power off fixed.

Postby FD88 Wed Mar 02, 2022 4:50 pm


Maybe you are the only one who can help me:

I have a MyTier Go (ES200D) and unfortunately the standard password was changed and the new password has been forgotten. Tier is not willing to help, they will not reset the password again. Therefore, the scooter can not be used at the moment.

Is there any chance to unlock it and make it usable again ???

Best regards from Germany

PS: Of course the scooter is NOT stolen.
Posts: 1
Joined: Tue Mar 22, 2022 10:08 am

Re: Es200 2 minutes power off fixed.

Postby m0st1ted Tue Mar 22, 2022 10:16 am

Hello! Thank you for your work! I have flashed my Tier ES200G with your firmware and IT WORKS. The 2 minutes power off is no more. The arduino code from the archive hasn't worked for me because I had to reset the ESP8266 a few times for it to work. I have found that the 0xA6, 0x12, 0x02, 0x35, 0xFF, 0x38 command works without problem (it has no speed limit).
PS: The RX wire has to be connected! The TX wire is not required.
Posts: 1
Joined: Sun Jun 05, 2022 11:23 pm

Re: Es200 2 minutes power off fixed.

Postby fernlop Sun Jun 05, 2022 11:24 pm

Hey, could you upload the original uncompiled firmware?
Maybe I can crack the security code and create a firmware for an ESP32 that can create the security code so you don't have to open the motor controller.
Posts: 2
Joined: Fri Jun 10, 2022 8:44 am

Re: Es200 2 minutes power off fixed.

Postby youhou Fri Jun 10, 2022 9:19 am

Hello Every body,

In first let me tel you : very nice job!!

I've a potential similar probleme and i would like to know if anybody have an technical explication of my probleme.

To know wat is going on my ES200G controler :
I have Buck convertor to the Red (VIN) and black wires (GND) ... 6c372oO2Zs

I connect it on an ESP32 whithin RemoteXY code. All done ! The ES200 D is running very well.

The problem appear after 3 weeks. The red wire dont have any voltage between black and red...

I have a second scooter for spare, the same issue on some weeks... 2 controllers KO whith
this connection. I suspect the Buck conertor. But i don't know why?? Have you an idea? when i charge the scooter,

the display shows the load and no error but whatever I communicate with the RX pin of the controller like before nothing happens, the scooter don't turn on. :-(

Maybe an security of the controler? In this case I would like to flash with your BIN to test.
The buck convertor is consuming more than the capability of the controler can offer ?

Before i use this buck convertor, i use powerbank and all are done... strange...

thx for reading and may be helping.

Return to “Okai / Electisan”

Who is online

Users browsing this forum: No registered users and 1 guest