(TUT) Unlocking the Ninebot E-series (E22, E25, E45) to 28 km/h (30 on E45)

User avatar
F0xMaster
Posts: 68
Joined: Fri Jan 10, 2020 10:33 am
Location: Poland

(TUT) Unlocking the Ninebot E-series (E22, E25, E45) to 28 km/h (30 on E45)

Postby F0xMaster Wed Jul 08, 2020 5:21 pm

As we know, some E-series scooters are locked to 20 and 25 km/h. In this guide I will show u how to unlock your e-series scooter models, so that they go 27, or even 30 if you have an E45.

VERY IMPORTANT
Ninebot disabled the SN changing functionality on DRV271. To change the SN on these versions please downgrade the firmware to a lower version.
Using ScooterHacking Utility, to Load Original > DRV > DRV271 and install it. This is a modified version of the update which allows firmware downgrades. Then go to Load Original > DRV and choose any version lower than 271. I suggest 255. This will allow you to change the serial number once again.


Important info
This guide only works on official e-series Ninebot firmware, if you tried unlocking your scooter with custom firmware from esx.cfw.sh you blocked your ability to use this method.
This guide only applies to E-series scooters (E22, E25, E45).
Methods shown in this guide are generally considered safe given extensive testing performed by our community members. You are, however, responsible for any modifications done to your scooter. ScooterHacking.org cannot be held responsible for any damage or legal issues caused by the actions mentioned in this guide.
Please read the entire guide before posting any replies.
Methods shown in this guide DO NOT void the warranty. Change the serial number BACK TO ORIGINAL if you need to send it in for warranty. You can find it on the sticker below the deck.
For any support please visit https://scooterhack.in/discord
No CFW generator exists for the E-series scooters as of moment of wriring, please don't use the ESx one as it may brick your scooter if used on an E-series device.


Requirements
  • Windows 10 laptop or an Android with bluetooth 5.0 or higher
  • Ninebot e-series scooter
  • Ninebot Flasher or IAP
  • At least one hand :)
Links
Ninebot Flasher - https://bit.ly/Ninebot-Flasher
Ninebot IAP - https://iap.scooterhacking.org/
ScooterHacking Utility - https://scooterhack.in/utility

Method 1 - Ninebot Flasher

Step 1 - Download Ninebot Flasher from the link above
Step 2 - Turn on your scooter, and connect to it via Ninebot Flasher
Step 3 - You will see an ESC serial number, type it into the text box in the middle (ALL CAPS), but change the first 4 characters to N2GZ.
Step 4 - Press ctrl-a and click "Write ESC SN" two times, or until the ESC SN changes to N2GZ
For E45D/E, or if you have an external battery you should use N2GQ

Image
Step 5 - Reboot the scooter.

If everything was done correctly, the scooter should now go 28 kph on 'sport' mode. If you have an E45 it'll go 29/30. Enjoy :)
Method 2 - Ninebot IAP

Step 1 - Download Ninebot IAP from https://iap.scooterhacking.org/get
Step 2 - Turn on your scooter
Step 3 - Go to BLE and click "Start scan", select your scooter and click "Connect"
Step 4 - Go to the "Tools" tab, and click "Read".
Wait until Output gives you the serial number and click "Change SN"
Step 5 - Type your current serial number into the box (ALL CAPS), but change the first 4 characters to N2GZ, and click OK.
For E45D/E, or if you have an external battery you should use N2GQ

Image
Step 6 - Reboot the scooter.

If everything was done correctly, the scooter should now go 28 kph on 'sport' mode. If you have an E45 it'll go 29/30. Enjoy :)

Method 3 - ScooterHacking Utility

Step 1 - Download ScootterHacking Utility from https://scooterhack.in/utility
Step 2 - Turn on your scooter
Step 3 - Open the app and click "Scan", then select your scooter
Image
Step 4 - On the main screen press "Change region"
Image
Step 5 - Select one of the included serial numbers, or click "custom" to enter your own SN.
For E45D/E, or if you have an external battery you should use the 30 km/h E45 preset.
Image
Step 6 - Wait for the scooter to reboot.

If everything was done correctly, the SN section should now display an updated serial number as well as the corresponding model number.
Image

The scooter should now go 28 kph on 'sport' mode. If you have an E45 it'll go 29/30. Enjoy :)

Donation links:
Majsi (Ninebot Flasher dev) - https://www.paypal.me/majsinko
Lothean (IAP/SH Utility dev, owner of ScooterHacking) - https://scooterhack.in/donate
Fox Master (Me - the author) - https://scooterhack.in/donatefox

This guide was last updated on: 09.05.21 (dd/mm/yy)
Last edited by F0xMaster on Fri May 21, 2021 1:22 pm, edited 20 times in total.
Sionisus
Posts: 4
Joined: Thu Jul 09, 2020 12:00 pm

Re: (TUT) Unlocking the Ninebot E22E/D to 25-27 km/h

Postby Sionisus Thu Jul 09, 2020 12:02 pm

Hi there,

just followed your TUT several times. However, I was not able to unlock the speed limit as described. Happy to discuss and maybe help out.

Cheers
Sion
User avatar
F0xMaster
Posts: 68
Joined: Fri Jan 10, 2020 10:33 am
Location: Poland

Re: (TUT) Unlocking the Ninebot E22E/D to 25-27 km/h

Postby F0xMaster Thu Jul 09, 2020 9:47 pm

Hi there,

just followed your TUT several times. However, I was not able to unlock the speed limit as described. Happy to discuss and maybe help out.

Cheers
Sion
Thank you for your reply.

The previous version of this guide (released yesterday) was based on limited information, but thanks to our fellow SH member we managed to update the guide, with the CORRECT serial number prefix. The CORRECT prefix is N2GZ, and will allow you to reach 26 km/h. Sorry for wasting some of your time, I'm trying my very best :)
EDITED ON JULY 19TH DUE TO OUTDATED INFO
Last edited by F0xMaster on Sat Jul 18, 2020 10:42 pm, edited 1 time in total.
Sionisus
Posts: 4
Joined: Thu Jul 09, 2020 12:00 pm

Re: (TUT) Unlocking the Ninebot E22E/E22D/E25D to 25-27 km/h

Postby Sionisus Fri Jul 10, 2020 5:11 am

Thanks. Very much appreciated. I will try it again later today. However, if I can help out with anything. Just let me know.
Sionisus
Posts: 4
Joined: Thu Jul 09, 2020 12:00 pm

Re: (TUT) Unlocking the Ninebot E22E/E22D/E25D to 25-27 km/h

Postby Sionisus Fri Jul 10, 2020 9:41 am

Just did a quick test. Works perfect!
User avatar
F0xMaster
Posts: 68
Joined: Fri Jan 10, 2020 10:33 am
Location: Poland

Re: (TUT) Unlocking the Ninebot E22E/E22D/E25D to 25-27 km/h

Postby F0xMaster Fri Jul 10, 2020 10:01 am

Just did a quick test. Works perfect!
Tests have been concluded and the guide has been updated AGAIN. The FINAL version lets you reach 28 km/h freewheeling, and 26 on the ground. It won't be updated until we get a CFW generator, as that's as fast as it can go without the external battery. You can try again with the new prefix ;)
Sionisus
Posts: 4
Joined: Thu Jul 09, 2020 12:00 pm

Re: (TUT)(Updated) Unlocking the Ninebot E22E/D and E25E/D to 28 km/h

Postby Sionisus Fri Jul 10, 2020 10:37 am

Jesus.... should have waited like 20 minutes ;-) you guys are blazing fast
moizor
Posts: 1
Joined: Sat Jul 11, 2020 2:15 pm

Re: (TUT)(Updated) Unlocking the Ninebot E22E/D and E25E/D to 28 km/h

Postby moizor Sat Jul 11, 2020 2:18 pm

Ola guys!

Thanks for the Tutorial.

For me, owner of an e22e with external battery, the hack with N2GZ works like a charm and speedgoes up to 29, and some peaks at 30.

So again thanks a lot.

Just ordered a G30 Max, and will try to unlock it up to 33 (hack available also through Ninebot Flasher).

Have a nice day.
Scootergaga
Posts: 1
Joined: Mon Jul 13, 2020 1:00 pm

Re: (TUT)(Updated) Unlocking the Ninebot E22E/D and E25E/D to 28 km/h

Postby Scootergaga Mon Jul 13, 2020 1:04 pm

Hi, I have a E22E with extra battery, I’ve tried this hack. My speed now reaches 16mph freewheeling. Do you have any idea why it hasn’t reached its full potential speed?

Thanks
abordsky
Posts: 1
Joined: Mon Jul 13, 2020 11:09 pm

Re: (TUT)(Updated) Unlocking the Ninebot E22E/D and E25E/D to 28 km/h

Postby abordsky Mon Jul 13, 2020 11:14 pm

Hi,

I have an E22 with an external battery.

Originally, it was 26 to 27 kph.

Tried the TUT, now it's 29 to 30 kph.

Any way this can go up?

By the way, N2GZ prefix worked for me not the N2GX

Thank you

Return to “Ninebot ES and E-series”

Who is online

Users browsing this forum: No registered users and 5 guests