scooterhacking / ninebotcrypto Goto Github PK

Bare in mind I have ported from the C# code to C (with mbedtls)

I eventually figured out that name is actually the device name (NBScooter0204 for me) and that there is no checksum (maybe the README needs updated to make this clearer)

So I set the name to 'NBScooter0204' (and zero pad to 16 bytes)
encode and send 3E215B00 to the dash
receive and decode 213E5B01 + bleKey + Serial Number

But when I encode and send 3E215C00 + 16x random bytes
The dash fails to respond.

Has anyone had success/traps/failures with this?

Obviously I figured I had mis-ported something, so have spent hours comparing my C version with the C#/Swift/Kotlin and it appears to be functionally the same.

IAP successfully connects, and I have compared it's packet log with mine, and it all decode successfully.

I'm happy to push the C port now/once its working. (just let me know how)

There is a bug in the initial C# implementation that causes the counter to be over-incremented after the first message.
After the 0x5B initial crypto message, the counter goes from 0 to 2. This wasn't disturbing the communication on earlier devices/firmware versions but on newer scooters like the G2, it causes you to encrypt and send every message twice to keep up and thus slows communication down.

This bug was jointly discovered by @ArchGryphon9362 and myself today while I was working on G2 support for the Utility app and while he was writing his improved Swift version as well.

It has been fixed in his version of the library (BetterNinebotCrypto.swift) and I also issued a fix for the Kotlin version. If you are using either of those two, then we'd recommend using the latest version. If you are using other versions, you might encounter this bug and its side effects. Please, take the time to send a pull request if you do fix it.

I will update this issue as other versions get updated.

Hey guys, just wanted to leave props for sharing all of this information!

I have ported the lib to Python and integrated it into a command line utility for authorization with the legacy Nb and the new Mi EC protocol. It all works, tested on my own scooter.

Check it out and feel free to adapt SHCU for newer BLE firmware support: https://github.com/dnandha/miauth

Hello everyone,
Does someone know from where the byte array data basic comes from?
I'm talking about this hex: 97CFB802844143DE56002B3B34780A5D

Regards,
Riccardo

Crash after encrypting second command.

Can I send data without this? My Scooter is Mi Pro2.

Crash if deviceName less then 12 symbols. GoKart, for example.
NBScooter0915 is works, but user can change bluetooth name with official app.

Example with livedata command:

Is there a general protocol for the source and handling of ninebot electric vehicle fault codes?