Here is a summary of @MRN76 posts in this thread so far
March 13 #1 - MRN76 confirms that the firmware is not encrypted and that the serial number and battery count does determine the speed limits.
March 13 #2 - Link posted to the firmware modification guide written for the C/C+/E/E+ in the Russian language.
March 15 #1 - Confirms that the guide posted is pretty much the same for the A1/S1/S2 with some small changes. An image was posted of the custom firmware modification software titled Dump Editor Ninebot v18.104.22.168. This image shows us how to change the serial number to unlock S2 performance.
The second image is the S series control board. It shows where to solder the wires that need to attach to the programmer.
March 15 #2 - A link to download Dump Editor Ninebot v22.214.171.124
March 16 - At the time of posting, Dump Editor Ninebot v126.96.36.199 is only useful for viewing A1/S1/S2 firmware. It can't make any changes.
March 20 - Dump Editor Ninebot can't change the speed limits beyond the S2 speed limits. Changing the speed limits is theoretically possible if you understand ARM disassembly.
April 14 #1 - The announcement S2 firmware version 1.0.9. This post shows how to obtain version 1.0.9. The last screen shot shows the availability of 1.0.9. No release notes for this version. New changes are unknown.
April 14 #2 - A modified version of 1.0.9 was created. This version has been modified to increase the speed limits of the S2 firmware. This modified firmware is numbered 7.6.0.
With one battery the speed limit is 13.6mph (22km/h).
With two batteries the speed limit is 18.6mph (30km/h).
The no load spin speed is 27.3 to 27.9mph (44-45km/h)
May 8 #1 - Cheap programmers are available. At around $12 for a j-link v8 clone. If you are interested in v7.6.0 you will need to use a j-link v8. v7.6.0 is not freeware, if you are interested in v7.6.0, your board will be programmed remotely and a copy of your original firmware will be given you.
May 8 #2 - Real world tests of a S2 with v7.6.0 showing the limits at 100% battery and 25% battery.