fromeijn / rewheel-main

Rewheel

Firmware modification tools for the Onewheel Pint, Pint X, XR and GT. Part of the R2Row ('Arturo') project.

Note: The documentation below is for developers. If you just want to re-calibrate your board or patch some firmware, please use https://rewheel.app.

Requirements

• Node.js
• Yarn 2+ (yarn set version stable if you have an Yarn 1.x)

Installation

• Run yarn to install all dependencies from the root directory

Parts

• @rewheel/common - common library that contains all of the patches + common tooling
• @rewheel/cli - command line interface for patching firmware
• @rewheel/web - website for patching firmware + flashing to a device

CLI

# usage
yarn patcher -i [input file] -o [output file] [...patches] --[patch-arg]

# example
yarn patcher -i firmware/dump/5046.bin -o 5046-patched.bin setAngleOffset --angleOfset 5

Website

• Run yarn web:dev
• Open your browser and navigate to http://localhost:5173

Firmware Operations

Dumping Firmware

• Firmware is not provided for copyright reasons. Instructions for dumping your Onewheel firmware are provided here. Warning: it's not for the faint of heart.

Flashing Firmware

• Instructions to flash your Onewheel are located here. Thankfully, this is significantly easier than dumping the firmware to begin with.

Generate Checksum for Firmware

# npm
npm run checksum -- -i [input file]

# or

# yarn
yarn checksum -i [input file]

The patcher uses the checksum of the firmware to set the offsets of each firmware patch.

If your firmware doesn't match a known checksum, open an issue for it. That way, we can find the offsets for that firmware revision and support more firmware.

Disclaimer

• Firmware dumping uses a slightly different process on the GT because it uses a different processor. Documentation is not available just yet.
• This project is not affiliated with or endorsed by Future Motion. Proceed at your own risk - this will void your warranty.

Contributing

If you're able to dump the firmware from a Onewheel that you own, you can use Ghidra to dive into the assembly and even live debug against a working Pint, Pint X, or XR. This can aid in finding more patches for the firmware.

Contributors / Thanks

• lolwheel - patch development, first verifying the exploit from the research paper, Owie
• beeradmoore - OWCE source / documentation on BLE services
• exPHAT - colaboration on the OTA firmware stub
• tire_sire - providing the initial boards to test on
• sdmods - Updated un-bricking instructions
• ZeeWorden Design - Rewheel logo

Sponsors

Thanks to these incredible sponsors for keeping rewheel going! If you'd like to sponsor this project and have your avatar or company logo appear below click here.