I just picked up a 'New/never used' ES4 that was originally meant for 'Jump'. It has zero miles, zero charge cycles on the batteries, and the batteries were dead enough that I had to 'jump start' them to get them to charge. After doing so, they started charging perfectly. Once I got it charged up to 20% or so, I used 'NinebotIAP' to flash the BLE and DRV to 1.0.9 and 1.5.1, respectively and in that order, but at that time, I left both BMS on the 'rental' 3.x firmware. Everything was still working, batteries continued charging after I put it all back together.
I then used XiaoFlasher to flash the BMS to 1.4.6. It gave me a bunch of trouble, but after numerous retries, it managed to flash both BMS off the 3.x rental firmware to 1.4.6. I think this may be where the charging issue came in, but it could also be a coincidence. I then used the Segway-Ninebot app to upgrade the BMS to 1.4.9 and the DRV to their current version. I believe somewhere in here is where the 14MPH limit (No load, on the bench) came from.
From there, I used the firmware generator here (https://esx.cfw.sh) with 'Version Spoofing', a mild change to motor power current (50000; from what I gather, a bit lower is still safe), speed limit of 36k/hr, and 'set write permission for all registers', then flashed DRV with 'NinebotIAP'. Flash went perfectly, but even with the CFW, It's still limited to 14MPH. Could it be that the batteries are at 50%? I'd think that it would be able to give pretty much top speed until the end. This one isn't too major, but it would be nice to figure it out.
On the charging, does anyone have any thoughts? Right now, if the scooter is off, when I plug the charger in, it beeps and wakes up, but that's it. The light on the charger never changes from green (I have another 7S lithium charger that when plugged in to A/C stays green if the output isn't connected but changes to red when connected to cells needing charge, so I have doubts about it being the charger). The behavior is the same if I remove the external battery/mount and connect the charger to the onboard 'ES2' port - scooter beeps and powers on, but no charge.
Edit: It seems to be the BMS choosing not to take a charge - I tinkered with the external battery some more this morning and when I applied power from the charger to the output port, which was how the batteries/BMS's were re-activated, the chargers indicator went to red, indicating the batteries were taking a charge.
Edit 2: I figured out about the external Julet connector that was for the GPS module having the required serial lines, rather than using the pins where the external battery connected, which has been the most trouble free way to flash but obviously prevented me from flashing the external battery with a physical serial connection (Bluetooth with 'XiaoFlasher ' was hit or miss with a lot of failures). Definitely going to have to make a cable for that. Anyway, I flashed 1.2.2 into both BMS with 'NinebotIAP' and now the batteries are taking a charge through the external batteries charge port, so I stepped it up to 1.4.6, testing charging after each step, and every one including 1.4.6 is now charging fine, but oddly, the indicator lights on the external pack aren't pulsing indicating it's charging... Maybe that was a feature of the 3.0.1 'rental' firmware that was originally on them. Might be nice to fix that, but in the end, it's minor.