scooter identification (uart protocol)

[jsi]

hi,
a friend of mine works at a swedish hotel that had some electric scooter from some company called AYO - i believe they are now defunct.

i would like to convert this scooter to a personal unlocked one.

i have disassembled the upper part (which hosts a pcb with an stm32, gsm module and other things). i have started to reverse engineer it a bit, but it's hard to figure out what to send to the motor controller without being able to sniff a correct "start" signal (etc). opening up the motor controller is difficult since the cables are glued to it and everything seems very tight down there.

from the upper pcb there is a cable having six wires:
- R (9600 baud uart, 3.3 volts)
- T (9600 baud uart, 3.3 volts)
- C (1.8 volts, not sure what it is)
- A (acceleration, connected to the throttle)
- G (gnd)
- V (+34 volts)

sniffing on the uart pins gives:

on the R pin:, every 200 ms:
0x5a 0x10 0x0a 0x1d 0x00 0x02 0x00 0x55 0x01 0x00 0x00 0x00 0x00 0x8f
0x5a 0x10 0x0a 0x1d 0x00 0x02 0x00 0x55 0x01 0x00 0x00 0x00 0x00 0x8f

on the T pin, every 60 ms:
0x5a 0x30 0x05 0xc7 0x02 0x00 0x00 0x04 0x02
0x5a 0x30 0x05 0xc7 0x02 0x00 0x00 0x04 0x02

is there anyone that knows more about what controller this might be, and/or some documentation of the uart protocol?

thanks.

[Awriout]

I have never get this error. I also wanna know the answer.geometry dash online

[sonar2]

on the R pin:, every 200 ms:
0x5a 0x10 0x0a 0x1d 0x00 0x02 0x00 0x55 0x01 0x00 0x00 0x00 0x00 0x8f
0x5a 0x10 0x0a 0x1d 0x00 0x02 0x00 0x55 0x01 0x00 0x00 0x00 0x00 0x8f

on the T pin, every 60 ms:
0x5a 0x30 0x05 0xc7 0x02 0x00 0x00 0x04 0x02
0x5a 0x30 0x05 0xc7 0x02 0x00 0x00 0x04 0x02

Rx data
1. 0x5a - start byte
2. 0x10 - sender
3. 0x0a - number of data(4~13)
4. 0x1d - battery percent
5. 0x00 - speed
6. 0x02 - speed unit (01 km/h, 02 mph)
.
.
14. 8f - checksum(sum of 2~13)

Tx data
1. 0x5a - start byte
2. 0x30 - sender
3. 0x05 - number of data[4~8)
.
.
9. 0x02 - checksum(sum of 2~8)

[maruusa]

I learned a lot more information about the types of scooters and how to identify them. fnf

[perfectlyslice]

on the R pin:, every 200 ms:
0x5a 0x10 0x0a 0x1d 0x00 0x02 0x00 0x55 0x01 0x00 0x00 0x00 0x00 0x8f
0x5a 0x10 0x0a 0x1d 0x00 0x02 0x00 0x55 0x01 0x00 0x00 0x00 0x00 0x8f

on the T pin, every 60 ms:
0x5a 0x30 0x05 0xc7 0x02 0x00 0x00 0x04 0x02
0x5a 0x30 0x05 0xc7 0x02 0x00 0x00 0x04 0x02

Rx data
1. 0x5a - start byte
2. 0x10 - sender
3. 0x0a - number of data(4~13)
4. 0x1d - battery percent
5. 0x00 - speed
6. 0x02 - speed unit (01 km/h, 02 mph)
.
.
14. 8f - checksum(sum of 2~13)

Tx data
1. 0x5a - start byte
2. 0x30 - sender
3. 0x05 - number of data[4~8)
.
.
9. 0x02 - checksum(sum of 2~8)

It's quite complicated for me.
phrazle