プログラミング
電動スクーターの逆アセンブルとファームウェアのRustによる書き換え
Reverse engineering my e-scooter and rewriting the firmware in Rust (bensimms.moe)
要約
この記事は、筆者が自身の電動スクーター「Egret GT」のハードウェアとファームウェアをリバースエンジニアリングした過程を詳述しています。Bluetooth通信の解析から始まり、スクーターがファームウェアアップデートや非表示のテレメトリデータを送信していることを発見しました。さらに、USB-CポートがCANバスとして使用されていることを突き止め、ESP32-C6とCANバスモジュールを用いてカスタムファームウェアを開発し、ディスプレイユニットの機能を書き換えることに成功した技術的な挑戦について語られています。
全文翻訳
電動スクーターのファームウェアをRustでリバースエンジニアリングし、書き換える
1CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]2CAN_FRAME:1025,false,[74, bd, 0, 0, 16, c, 0, 0]3CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]4CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]5CAN_FRAME:1025,false,[74, bd, 0, 0, 16, c, 0, 0]6CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]7CAN_FRAME:513,false,[0, 0, 0, 0, 0]8CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]9CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]10CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]11CAN_FRAME:1025,false,[73, bd, 0, 0, 3, c, 0, 0]12CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]13CAN_FRAME:513,false,[0, 0, 0, 0, 0]14CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]15CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]16CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]17CAN_FRAME:1025,false,[73, bd, 0, 0, 3, c, 0, 0]18CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]19CAN_FRAME:513,false,[0, 0, 0, 0, 0]20CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]21CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]22CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]23CAN_FRAME:1025,false,[72, bd, 0, 0, ef, b, 0, 0]24CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]25CAN_FRAME:513,false,[0, 0, 0, 0, 0]26CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]27CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]28CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]29CAN_FRAME:1025,false,[72, bd, 0, 0, ef, b, 0, 0]30CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]31CAN_FRAME:513,false,[0, 0, 0, 0, 0]32CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]33CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]34CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]35CAN_FRAME:1025,false,[74, bd, 0, 0, e9, b, 0, 0]36CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]37CAN_FRAME:513,false,[0, 0, 0, 0, 0]38CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]39CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]40CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]41CAN_FRAME:1025,false,[74, bd, 0, 0, e9, b, 0, 0]42CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]43CAN_FRAME:774,false,[55, 0, 0, 0, 2, 0, 0, 0]44CAN_FRAME:513,false,[0, 0, 0, 0, 0]45CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]46CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]47CAN_FRAME:768,false,[0, 5a, 64, 5a, 64, 0, 0, 0]48CAN_FRAME:494,false,[60, 0, 0, 0, 0, 0, 0, 0]49CAN_FRAME:495,false,[4c, 44, 2e, 43, 52, 2e, 53, 38]50CAN_FRAME:495,false,[30, 37, 2e, 43, 2e, 32, 2e, 31]51CAN_FRAME:495,false,[45, 47, 2e, 32, 2e, 32, 2e, 31]52CAN_FRAME:495,false,[31, 0, 0, 0, 0, 0, 0, 0]53CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]54CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]55CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]56CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]57CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]58CAN_FRAME:768,false,[0, 5a, 64, 5a, 64, 0, 0, 0]59CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]60CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]61CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]62CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]63CAN_FRAME:1856,true,[4b, 0]64CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]65CAN_FRAME:1025,false,[74, bd, 0, 0, e4, b, 0, 0]66CAN_FRAME:1857,true,[4b, 0, 0, 0, 69, 99, 52, 42]67CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]68CAN_FRAME:1860,true,[1]69CAN_FRAME:1861,true,[1, 15, 57, 20, 50, 59, 54, 34]70CAN_FRAME:774,false,[54, 0, 0, 0, 2, 0, 0, 0]71CAN_FRAME:513,false,[0, 0, 0, 0, 2]72CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, ff, 1f]73CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]74CAN_FRAME:768,false,[0, 5a, 64, 5a, 64, 0, 0, 0]
1CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]2CAN_FRAME:1025,false,[74, bd, 0, 0, 16, c, 0, 0]3CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]4CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]5CAN_FRAME:1025,false,[74, bd, 0, 0, 16, c, 0, 0]6CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]7CAN_FRAME:513,false,[0, 0, 0, 0, 0]8CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]9CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]10CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]11CAN_FRAME:1025,false,[73, bd, 0, 0, 3, c, 0, 0]12CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]13CAN_FRAME:513,false,[0, 0, 0, 0, 0]14CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]15CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]16CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]17CAN_FRAME:1025,false,[73, bd, 0, 0, 3, c, 0, 0]18CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]19CAN_FRAME:513,false,[0, 0, 0, 0, 0]20CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]21CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]22CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]23CAN_FRAME:1025,false,[72, bd, 0, 0, ef, b, 0, 0]24CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]25CAN_FRAME:513,false,[0, 0, 0, 0, 0]26CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]27CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]28CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]29CAN_FRAME:1025,false,[72, bd, 0, 0, ef, b, 0, 0]30CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]31CAN_FRAME:513,false,[0, 0, 0, 0, 0]32CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]33CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]34CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]35CAN_FRAME:1025,false,[74, bd, 0, 0, e9, b, 0, 0]36CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]37CAN_FRAME:513,false,[0, 0, 0, 0, 0]38CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]39CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]40CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]41CAN_FRAME:1025,false,[74, bd, 0, 0, e9, b, 0, 0]42CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]43CAN_FRAME:774,false,[55, 0, 0, 0, 2, 0, 0, 0]44CAN_FRAME:513,false,[0, 0, 0, 0, 0]45CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]46CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]47CAN_FRAME:768,false,[0, 5a, 64, 5a, 64, 0, 0, 0]48CAN_FRAME:494,false,[60, 0, 0, 0, 0, 0, 0, 0]49CAN_FRAME:495,false,[4c, 44, 2e, 43, 52, 2e, 53, 38]50CAN_FRAME:495,false,[30, 37, 2e, 43, 2e, 32, 2e, 31]51CAN_FRAME:495,false,[45, 47, 2e, 32, 2e, 32, 2e, 31]52CAN_FRAME:495,false,[31, 0, 0, 0, 0, 0, 0, 0]53CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]54CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]55CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]56CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]57CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]58CAN_FRAME:768,false,[0, 5a, 64, 5a, 64, 0, 0, 0]59CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]60CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]61CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]62CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]63CAN_FRAME:1856,true,[4b, 0]64CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]65CAN_FRAME:1025,false,[74, bd, 0, 0, e4, b, 0, 0]66CAN_FRAME:1857,true,[4b, 0, 0, 0, 69, 99, 52, 42]67CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]68CAN_FRAME:1860,true,[1]69CAN_FRAME:1861,true,[1, 15, 57, 20, 50, 59, 54, 34]70CAN_FRAME:774,false,[54, 0, 0, 0, 2, 0, 0, 0]71CAN_FRAME:513,false,[0, 0, 0, 0, 2]72CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, ff, 1f]73CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]74CAN_FRAME:768,false,[0, 5a, 64, 5a, 64, 0, 0, 0]
本文はCANフレームのデータのみで、記事本文のテキストは提供されていません。そのため、本文の翻訳はできません。