ScooterHacking ReFlasher - ESC recovery/downgrade

If you want to discuss about random things
User avatar
Lothean
Site Admin
Posts: 142
Joined: Fri Mar 15, 2019 2:40 am
Location: France
Contact:

ScooterHacking ReFlasher - ESC recovery/downgrade

Postby Lothean Sat Mar 26, 2022 2:51 am

ScooterHacking ReFlasher is a Windows software that facilitates the recovery or downgrade of your Xiaomi/Ninebot ESC/BLE through SWD using an ST-Link programmer.
Currently maintained by BX LR (Lothean) and Topol.

Image

[Download v1.3 | Last version]
ReFlasher can check for updates and automatically install them starting from v1.3. Just run the app and follow the prompts!

Version history and changelog:
[v1.3], January 31st, 2023 - Added support for GD32 Xiaomi ESCs, AT32 Ninebot Max and F-series ESCs, added self-updater, added diagrams
[v1.2], May 9th, 2022 - Added support for BLE boards & Ninebot F-series
[v1.1], March 26th, 2022 - Initial release

ReFlasher supports the following vehicles and boards:
- Ninebot ESx/E/F/Max - all BLE boards, all STM32 & AT32 DRV boards
- Xiaomi M365 & Mi Scooter Lite/1S/Pro/Pro 2/3 - all BLE boards, all STM32 & GD32 DRV boards

How-to:
- Get an ST-Link programmer (even the cheap V2 clones will work - here's an example of how they look like)
- Check the Important notes section at the bottom of the post.
- Launch ReFlasher and hook up the device you want to flash to the ST-Link. You can find per-board pinouts in the "Diagrams" menu at the top of the ReFlasher app. Soldering is recommended, but you should be able to just hold jumper wires on the debug pads if you are patient enough.
- Once the target board is hooked up to the ST-Link, plug the ST-Link into your computer and select your scooter model, BLE or DRV, and input the additional details. Data such as serial number, mileage, or scooter name can be set arbitrarily and don't have to match the previous settings of your vehicle.
- Check the AT32 / GD32 ? section below.
- Hit "Launch recovery" and wait for ReFlasher to finish. If you encounter any error, you can enable the console in the Settings menu for additional verbose.
- Make sure ReFlasher says "All done". Reassemble your board into your scooter just enough to make sure the recovery went well. If it did, finish reassembling. If you flashed a Xiaomi BLE board, you might need to wipe the data of the ScooterHacking Utility Android app before being able to connect over Bluetooth after a recovery. This bug is known and we're working on a fix.

AT32 / GD32 ?:
Newer Xiaomi Ninebot DRV boards ship with ST micro-processor clones - AT branded on Ninebot boards, and GD branded on Xiaomi ones. To check whether or not you should tick the checkbox, you can read the branding on the chip.
If you don't want to remove the conformal coating or if your sight doesn't allow you to, you can tell by the board revision:
- Max DRV, revision 1.1 or above, tick AT32
- F-series DRV, revision 0.9 or above, tick AT32
- Xiaomi DRV, revision 3.1 or above, tick GD32
Additionally, if you can still connect your scooter to the ScooterHacking Utility Android app, the Hardware details dialog in the top right corner menu can tell you what MCU is on board. This data can be wrong if you installed incompatible firmware tho!

IMPORTANT NOTES:
- The WinUSB driver must be installed for your ST-Link to work with this software as it uses OpenOCD.
Download the Zadig utility from the official link, then in "Options", select "List all devices", and install WinUSB
- NET Core v3.1 must be installed for ReFlasher to run. You can get the x64 installer from here or from Microsoft.

Enjoy!

OLD POST TEXT - ignore:
I had this software laying around for a few months now - never got around to finishing the BLE part. But since Segway-Ninebot and Xiaomi decided they wanted to keep modders out of their scooters, I figured making ST-Link flashing easier wouldn't hurt. So I'm releasing this version with DRV flashing only. Depending on how many of you use the software and need new functionalities, I'll see how much time I'll allocate to improve it. Update May 9th, 2022: BLE flashing now added, thanks Topol

It's fairly easy to use, just connect your ST-Link to the SWD pads of your controller. Identifying them is universal across different scooters, there's only one group of 3 pads on those boards. The square pad is GND, the middle one is SWDCLK, the last one is SWDIO. Users - feel free to post pictures of your boards with the correct pinout: I don't have any on hand.

Once all hooked up properly, select your scooter model, enter your desired serial number, put your mileage and click "Start recovery". If it doesn't work, make sure to check the console (can be displayed through the Settings drop-down menu) to read the verbose and see what went wrong.
guybrush
Posts: 2
Joined: Thu Apr 04, 2019 12:28 am

Re: ScooterHacking ReFlasher - ESC recovery/downgrade

Postby guybrush Sat Mar 26, 2022 12:54 pm

Thank you, very cool !
Pavel_EST
Posts: 1
Joined: Sun May 08, 2022 8:07 pm

Re: ScooterHacking ReFlasher - ESC recovery/downgrade

Postby Pavel_EST Sun May 08, 2022 8:14 pm

Hello. I was trying to use this app but for any reason it dont work with me. I flashed drv126 fulldump with stlink sucsessfully and then opened ReFlasher. Pressing Launch recovery gives error. Win USB installed.


here is tet from console :
[ReFlasher] Starting..
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : clock speed 1000 kHz
Info : STLINK V2J37S7 (API v2) VID:PID 0483:3748
[ReFlasher] Found ST-Link
Info : Target voltage: 3.099297
Warn : target stm32f1x.cpu examination failed
Error: jtag status contains invalid mode value - communication failure
[ReFlasher] Lost connection
Polling target stm32f1x.cpu failed, trying to reexamine
Examination failed, GDB will be halted. Polling again in 100ms
Info : Previous state query failed, trying to reconnect
Polling target stm32f1x.cpu failed, trying to reexamine
Examination failed, GDB will be halted. Polling again in 100ms
Info : starting gdb server for stm32f1x.cpu on 3333
Info : Listening on port 3333 for gdb connections
Error: mem2array: Read @ 0xe0042004, w=4, cnt=1, failed
[ReFlasher] Unknown error, check console
Error executing event examine-end on target stm32f1x.cpu:
[ReFlasher] Unknown error, check console
C:/Program Files (x86)/ScooterHacking ReFlasher/oocd/bin/..//scripts/mem_helper.tcl:6: Error:
in procedure 'ocd_process_reset'
in procedure 'ocd_process_reset_inner' called at file "embedded:startup.tcl", line 288
in procedure 'mmw' called at file "oocd\scripts\target\stm32f1x.cfg", line 81
in procedure 'mrw' called at file "C:/Program Files (x86)/ScooterHacking ReFlasher/oocd/bin/..//scripts/mem_helper.tcl", line 36
at file "C:/Program Files (x86)/ScooterHacking ReFlasher/oocd/bin/..//scripts/mem_helper.tcl", line 6

Image
User avatar
Lothean
Site Admin
Posts: 142
Joined: Fri Mar 15, 2019 2:40 am
Location: France
Contact:

Re: ScooterHacking ReFlasher - ESC recovery/downgrade

Postby Lothean Mon May 09, 2022 1:05 am

Hello,

Code: Select all

Warn : target stm32f1x.cpu examination failed Error: jtag status contains invalid mode value - communication failure
This looks like an issue with OpenOCD rather than ReFlasher - which is just a wrapper for this software.

Maybe ST-Link Utility uses a lower SWD frequency, we use 1000kHz for the ESC.

You could either try having shorter leads and reducing interferences or lowering the

Code: Select all

adapter speed 1000
to 450 at line 63 in the file located at

Code: Select all

C:\Program Files (x86)\ScooterHacking ReFlasher\oocd\scripts\target\stm32f1x.cfg
User avatar
Visthum
Posts: 6
Joined: Sun Jun 05, 2022 12:19 pm

Re: ScooterHacking ReFlasher - ESC recovery/downgrade

Postby Visthum Thu Jul 28, 2022 4:11 pm

This saved my esc. Make sure to plug it into USB 2.0 port. Was very straight forward to use.
Thank you for this software!
Visthum
kris0725pl
Posts: 1
Joined: Tue Aug 30, 2022 2:33 pm

Re: ScooterHacking ReFlasher - ESC recovery/downgrade

Postby kris0725pl Tue Aug 30, 2022 2:35 pm

Windows 10...app not working. Errot net.core dll
Engeloki
Posts: 1
Joined: Tue Sep 27, 2022 11:14 am

Re: ScooterHacking ReFlasher - ESC recovery/downgrade

Postby Engeloki Tue Sep 27, 2022 11:19 am

Thanks a lot for this! Just revived successfully my Xiaomi 1S. Here are all the connections I used: https://raw.githubusercontent.com/CamiA ... g_pro2.png
curaropge
Posts: 5
Joined: Thu Nov 17, 2022 4:35 am

Re: ScooterHacking ReFlasher - ESC recovery/downgrade

Postby curaropge Fri Nov 18, 2022 1:33 am

Hello,

Code: Select all

Warn : target stm32f1x.cpu examination failed Error: jtag status contains invalid mode value - communication failure
This looks like an issue with OpenOCD rather than ReFlasher - which is just a wrapper for this software.

Maybe ST-Link Utility uses a lower SWD frequency, we use 1000kHz for the ESCretro bowl

You could either try having shorter leads and reducing interferences or lowering the

Code: Select all

adapter speed 1000
to 450 at line 63 in the file located at

Code: Select all

C:\Program Files (x86)\ScooterHacking ReFlasher\oocd\scripts\target\stm32f1x.cfg
This protected my esc. Ensure that it is plugged into a USB 2.0 port. was incredibly simple to use.

Return to “Off topic”

Who is online

Users browsing this forum: No registered users and 2 guests