Hello everyone, if anyone is still working on removing speed limits, I can provide some information about the controller. Unfortunately, I broke mine while trying to remove epoxy resin, so I had to stop reverse-engineering the controller. If any of you have already replaced your controller and have the old one, I would welcome donations. Let's get down to business.
The microchip used in the controller is stm32f103c8t, and mine is a 2021 model, which means it uses the ds103 display. Based on the limited information available on the internet, these displays work with CYC X6 or X12 controllers. However, our controllers are custom-built with certain features removed, like Bluetooth.
I strongly believe that motor parameters are stored on the LCD display itself. That's why we can't simply remove the LCD display and hook up UART where the screen connects to retrieve information. However, upon removing the epoxy resin, I noticed a UART connection port next to the controller, which could be used to capture logs of the bootloader. There are three different methods that can be attempted, and I'll explain them as much as I can.
- The first method that comes to mind is to read the firmware on the controller and reverse engineer it. I didn't know the exact location of the UART coms ports, so I accidentally damaged my controller while trying to remove the resin. However, once the location is identified, it should be possible to remove the resin only where the com ports are, giving us direct access to the UART connection to the microcontroller.
- The second method relies on the possibility that the controller uses a communication protocol. Once I receive my non-stock controller, I will hook it up to a logic analyzer to check if I can read the speed information coming from the motor. If it's using a CAN coms protocol, it could be relatively straightforward. Even if it uses a private coms protocol, we can still reverse engineer it by using the existing speed data displayed on the LCD as a reference. By doing this, we can manipulate the motor speed by 5 miles, correct it using an Arduino, and send the corrected value back to the LCD.
- The third and most exciting method would be to remove the microchip, read the firmware, modify it, and then rewrite it with the changes.
see the pictures below of the controller I heater whit air dryer which was a mistake I recommend boiling them in hot water for 20 mins then the epoxy comes out as jelly
or just locate where are the uart connections and slowly use a heat gun.
( I can continue to reverse engineer if one of you source the controller for free or reasonable price
)
