Jump to content

Ninebot S1 vs S2 - Canada


PuppyLover101

Recommended Posts

:ph34r:  Unfortunately winter is coming... but maybe the wind will blow something my way... :whistling:  Gosh darn Chinook winds here are crazy.  I was riding my usual 20 kph trip while battling 35 kph head winds on the weekend making it an effective 55 kph blast against my poor Ninebot.  I'm not that hardy when it comes to riding in below 8°C weather as your face, hands and ears basically freeze up.  Maybe I'll have to try a scarf with my hoodie on under my helmet.  At one point it just isn't fun any more.  :cry2:

Link to comment
Share on other sites

  • 3 months later...

Got a Ninebot S1 when it was priced at 399CAD back in december. My first wheel ever  and i love it

So the fact about S1 vs S2 are not clear. Is it the same board?  Could it be possible to flash the S2 firmware into the S1 for a bit more speed

motor  S2  450W  S1 500W
Battery is the same (2x310Wh)
Speed limit  S2 24kmh   S1 21.5kmh

S2 engine is less powerful but speed limit is higher ..

But anyway im planning to get a more powerful wheel when summer will come
(tried  my S1 in the snow and its fun )

Link to comment
Share on other sites

4 hours ago, Lavabo said:

Got a Ninebot S1 when it was priced at 399CAD back in december. My first wheel ever  and i love it

So the fact about S1 vs S2 are not clear. Is it the same board?  Could it be possible to flash the S2 firmware into the S1 for a bit more speed

motor  S2  450W  S1 500W
Battery is the same (2x310Wh)
Speed limit  S2 24kmh   S1 21.5kmh

S2 engine is less powerful but speed limit is higher ..

But anyway im planning to get a more powerful wheel when summer will come
(tried  my S1 in the snow and its fun )

I have the same question.  I bought the S1 also.  I'm thinking it's just firmware.  For some reason Segway think North Americans are retards and can't be trusted with higher speeds or farther distances.  For example, our S1s semi-secretly only charge to 80% capacity (regardless of what the app dishonestly states), for a reduced max range, just like the Segway MiniPros sold in Canada.  Whereas in Europe their chargers charge to the full 63v for 100% capacity. 

I find my S1 incredibly slow and wish it would do 24kph like the virtually identical S2.  I don't know how to hack firmware though.  And I'm not willing to gamble hundreds of dollars on buying an S2 mainboard to see if it will work.

Link to comment
Share on other sites

On ‎13‎/‎02‎/‎2018 at 8:10 PM, nte said:

Reflash the S1 and change one character in the serial number and the ecu should think its a S2.

Piece of cake!

But err...how exactly do we go about doing that?

Link to comment
Share on other sites

14 hours ago, nte said:

In order to flash the firmware, wires need to be soldered to the mainboard for the flashing device (I think it was a JTAG programmer). Next step is to download the existing firmware from the main board and onto a computer for modification. Once modified it’s then flashed back onto the mainboard. 

Software for modifying the firmware exists but I don’t think it has support for the S and A models. 

The board doesn't have a JTAG but it does have UART TX/RX. Might be flashable/downloadable if they're using the stock bootloader from STM32. I've got an ST-LINK debugger board that I could try with but I'm wary of taking my whole unit apart again (mostly because it takes ages).

I looked into downloading the firmware by either decompiling the Android app or packet sniffing during firmware upgrade.

Unfortunately, the Android app is packed with SeoNet and I was unsuccessful in unpacking it using android-unpacker (at least in the ADK emulator and on my device), so this ended pretty quickly.

Grabbing anything useful from packet sniffing was also unsuccessful though I do have links to the endpoint (https://api4.ninebot.cn/v4/Vehicle/update_firmware). All requests are encrypted/encoded somehow and I was unable to figure out with what. It looks like Base64 but it is not. Responses are thankfully in plain text. Unfortunately, my S2 unit is up to date so I got nothing useful back.

Requests to anything beyond /v4/sys/init return an invalid data response, even with the exact same request body. Requests seem to be keyed in some way. Every call to /v4/Vehicle/update_firmware is different, though only maybe 30-40 characters towards the end change.

I've attached my Fiddler archive if anyone else wants to take a crack at it.

 

Untitled.png

ninebot.saz

Link to comment
Share on other sites

  • 2 weeks later...

Good Job  and thanks for the new technical tread

My Ninebot S1 would be perfect with a bit more speed and a bit more miles .

One guy on urban360 forum also made a battery extension for his 9bot to 754wh ...

 

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...