Reverse engineering work — looking for Android users to assist
[[ Edit: instructions in comments if you are able to help! ]]
I like to have full control over the things that I purchase, and as an engineer I very much enjoy the process of figuring out how things work. Through past jobs, I gained experience with eBikes, CAN communication, and some reverse engineering, and I have been putting my skills to work over the last week (and Claude, of course).
I've made some good progress so far: I have fully reverse engineered the BLE protocol that the HMI speaks and can trigger actions and see data coming off of it, replicating what the app can show, and a bit more. I also have been analyzing various apps out there to see what deeper control they may expose (pedal assist sensitivity, etc) with some luck, but it is slow going.
There's plenty more to uncover, but the one big "unlock" I am looking for right now is a firmware image for the bike. With that, a LOT more can be learned. My first thought was to pull the firmware image from the app, given it comes from some OTA server somewhere. Well, bad news: Xplova, the HMI manufacturer, seems to no longer be in business and all the firmware images their servers had on them are dead. I would guess this is a likely reason why the app was shut down. I have done some deep research trying to find those images elsewhere, but I have had no luck.
However, not all is lost just yet — and that's where you come in...
I am looking for people who may have firmware images cached on their phones. You may be able to help if you:
- Have a rooted Android phone (it may work without root, but it makes things considerably easier)
- Used your phone to do a firmware update to the bike. The more recently the better.
- Are comfortable running some debug commands to read various cache folders on your phone (using "adb")
Anyone out there willing to help?
Disclaimer:
My ongoing work is currently a private effort and I make no promises around what I will release, or when. I may choose to release specific tools or documentation in the future to allow others to change settings on their bikes or replace other app functionality that is currently lost. I am more than happy to discuss my work while I explore this effort, so please help me understand what would be useful or helpful. However, I will not discuss the speed limiter on the bike for legal reasons (also, I do not know how it works!).