search

lucysrausch / hoverboard-firmware-hack

New Hoverboard Firmware Hack. Now written from scratch and generally much better.
GNU General Public License v3.0
686 stars 403 forks source link

Did anyone look at the hoverboards with two identical separate controllers? #37

Open btsimonh opened 6 years ago

btsimonh commented 6 years ago

I have a hoverboard with two separate controllers (image below).

Did you consider this design of controller at any point? They seem to produce a 200kbaud output (not fully analysed yet, so not sure if they can be controlled). The firmware is protected; can't be extracted. I am on the lookout for a suitable binary file if anyone has one - so far nothing has come up in google. I have done a basic outline of the MCU connections; if anyone is interested, I could write this up.

MCU is GD32F103C8T6, sensor is marked Mb81 (?) but appears to match an MCU-6050 pinout.

20180729_085227

flo199213 commented 6 years ago

I had a look at the two Mainboard device: https://github.com/flo199213/Hoverboard-Firmware-Hack-Gen2 Including schematics, custom firmware, etc. Still not finished. I have a newer finished version on my computer. Will upload it soon.

btsimonh commented 6 years ago

thanks florian, the MCU pinout does not exactly match mine, but I torched one of my boards, so have ordered a new pair from ebay; maybe they will match yours :). Will, check out your repo in detail :).

Jana-Marie commented 6 years ago

We have no firmware blobs for these boards, nor do we write firmware for them. Thanks @flo199213 for pointing out that there is one for these boards.

As far as I know these boards are "generation 1" while the boards with two drivers per board (that we use) are "generation 2".

btsimonh commented 6 years ago

Hi Jan, funny; my ebay boards arrived, and the seller sent me the wrong ones, so I'll be following this repo after all. However; the board (black, YST) that arrived is a little 'updated' with sites for what I assume is bluetooth audio on the sensor boards, and the chinese GD32F103xx CPU rather than STM, plus a couple of extra connectors ('AD'? and a power outlet). I'll fork and add board images and information as time allows. For my (robot) application, I'll be looking to fine positional control rather than speed control...

Is there any original firmware for the combined main board or the original sensor to be found?

drbytes commented 6 years ago

I have one of these boards and was able to flash it after unlocking it. Now I need to figure out how to get it to talk to a Pi. Any pointers?

p-h-a-i-l commented 6 years ago

@drbytes, I guess that this question is not related to the old hardware revison discussed in this Issue? Please open a new Issue to keep topics clean. As a pointer, have a look at the // ###### CONTROL VIA UART (serial) ###### area in config.h, I think this is a good starting point.

tequilahut commented 5 years ago

does anyone have any experience with this board? is this as flat as the others? it's obviously a gd32 chip. i think the pinout to flatten the chip is the one that says:PROHIBIT. the third pad from the left is also GND which actually speaks for it. IMG_5330 IMG_9909

tequilahut commented 5 years ago

I have one of these boards and was able to flash it after unlocking it. Now I need to figure out how to get it to talk to a Pi. Any pointers?

do you know the pinout of the "prohibit" port? is it 3,3v swc gnd swdio? can you share some informations? what kind of software did you use?

tequilahut commented 5 years ago

@drbytes can you share some informations? that would be awesome!!

drbytes commented 5 years ago

I have up on this. Plan was to buil a lawn mower but shortly after I had to replace the mower with a real automower. Project has been sitting in a box ever since :/

tequilahut commented 5 years ago

@drbytes ok thanks. but you flashed those boards already? can you tell me the pinout of the flashins?

I have up on this. Plan was to buil a lawn mower but shortly after I had to replace the mower with a real automower. Project has been sitting in a box ever since :/

56231549-07d4a400-607f-11e9-9602-2250505c3010

is it like this? what programs did you use to unlock those boards?

tequilahut commented 5 years ago

ok I got the pinout from this website: http://www.stm32duino.com/viewtopic.php?t=3485&start=220 ... here my update....

56229306-e624ee00-6079-11e9-95b8-d2aac91e2501

I am using this ST-Link V2 adapter...: https://tenbaht.github.io/sduino/hardware/flashtool/

1 (left) - SWDIO 2 - SWDCLK 3 - GND 4 (right)- VDD

now I can connect via ST-link v2... but not I need to disable the read out protection.....

tequilahut commented 5 years ago

I have a hoverboard with two separate controllers (image below).

Did you consider this design of controller at any point? They seem to produce a 200kbaud output (not fully analysed yet, so not sure if they can be controlled). The firmware is protected; can't be extracted. I am on the lookout for a suitable binary file if anyone has one - so far nothing has come up in google. I have done a basic outline of the MCU connections; if anyone is interested, I could write this up.

MCU is GD32F103C8T6, sensor is marked Mb81 (?) but appears to match an MCU-6050 pinout.

20180729_085227

@btsimonh could you please share your MCU pinout?

mariohoff commented 4 years ago

Hello, I do have such a dual mainboard hoverboard too. Was any progress made on these? It has a gd32103c8t6. Looks like i have unlocked the flash, but didnt get much further. Has anyone tried to get a pinout yet?

board

andresiko commented 4 years ago

Hi Jan, funny; my ebay boards arrived, and the seller sent me the wrong ones, so I'll be following this repo after all. However; the board (black, YST) that arrived is a little 'updated' with sites for what I assume is bluetooth audio on the sensor boards, and the chinese GD32F103xx CPU rather than STM, plus a couple of extra connectors ('AD'? and a power outlet). I'll fork and add board images and information as time allows. For my (robot) application, I'll be looking to fine positional control rather than speed control...

Is there any original firmware for the combined main board or the original sensor to be found?

Did youmanage to flash those boards?

tequilahut commented 4 years ago

Hello, I do have such a dual mainboard hoverboard too. Was any progress made on these? It has a gd32103c8t6. Looks like i have unlocked the flash, but didnt get much further. Has anyone tried to get a pinout yet?

board

Hi did you went any further? its so hard to start from scratch... I have not a single clue what to do....

tequilahut commented 4 years ago

Hi Jan, funny; my ebay boards arrived, and the seller sent me the wrong ones, so I'll be following this repo after all. However; the board (black, YST) that arrived is a little 'updated' with sites for what I assume is bluetooth audio on the sensor boards, and the chinese GD32F103xx CPU rather than STM, plus a couple of extra connectors ('AD'? and a power outlet). I'll fork and add board images and information as time allows. For my (robot) application, I'll be looking to fine positional control rather than speed control... Is there any original firmware for the combined main board or the original sensor to be found?

Did youmanage to flash those boards?

I know that I flashed Them and kind of unlocked them... thats all that I've got so far.. at the moment I don't know how to move on from here.... idk the enviroment and how to start...

mariohoff commented 4 years ago

No sorry. I didn't really have the time and patience to work on it. I just got out my current work (with the original mainboard) a few hours ago. Maybe i'll take another look at the small boards.

The last thing I remember about my boards was that on one side 3 mosfets were dead and I didn't know how much else was affected, but on the other I could write the flash, power of the device, reboot it, read the flash and it was exactly the one I wrote onto it. So it did kinda work, but that's all i had. The pinout can't be that much different though, atleast for the timers ... and I didn't really know where to start either, plus got no scope at home, just some chink logic analyzer.

JohMah commented 3 years ago

I have the dual boards that look very similar. Managed almost to more ore less reverse engineer it. Schematic in Eagle. In case someone is still interested. Hoverboard_JC2015 7 31 V2 0

phpkadir commented 3 years ago

JohMah can you share the detailed schemantics of this cards. if i can solve schemantics i can write a firmware code.

JohMah commented 3 years ago

This is the current status. Hoverboard JC2015.7.31.pdf

benhadad commented 2 years ago

I have a similar model. Wanted to add to the thread and highlight mine had a remote control module plugged into the External-Interface area. I have included a picture of it. remotecontrol module_on_board

Ability-dis commented 2 years ago

I have a similar model. Wanted to add to the thread and highlight mine had a remote control module plugged into the External-Interface area. I have included a picture of it. remotecontrol module_on_board

Hi thanks for sharing .I also have similar board. I was also searching about the "External Interface" function. Can you provide some details about this .Did you purchased the module from market or is it come with the hoverboard?. Can you show the remote and what functions are include in the remote.

I want revers forward and break function.

larsmm commented 2 years ago

Hi, this project is deprecated. Have a look at this project: https://github.com/EFeru/hoverboard-firmware-hack-FOC