├── web
    ├── __init__.py
    ├── static
    │   ├── favicon.png
    │   └── style.css
    ├── app.py
    └── templates
    │   └── home.html
├── .gitignore
├── xiaotea
    ├── __init__.py
    ├── enc.py
    ├── dec.py
    └── xiaotea.py
├── bins
    ├── DRV130.bin
    ├── DRV134.bin
    ├── DRV138.bin
    ├── DRV140.bin
    ├── DRV141.bin
    ├── DRV142.bin
    └── DRV143.bin
└── patcher.py


/web/__init__.py:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | __pycache__/
2 | *.py[cod]
3 | 


--------------------------------------------------------------------------------
/xiaotea/__init__.py:
--------------------------------------------------------------------------------
1 | from .xiaotea import XiaoTea


--------------------------------------------------------------------------------
/bins/DRV130.bin:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/BotoX/xiaomi-m365-firmware-patcher/HEAD/bins/DRV130.bin


--------------------------------------------------------------------------------
/bins/DRV134.bin:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/BotoX/xiaomi-m365-firmware-patcher/HEAD/bins/DRV134.bin


--------------------------------------------------------------------------------
/bins/DRV138.bin:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/BotoX/xiaomi-m365-firmware-patcher/HEAD/bins/DRV138.bin


--------------------------------------------------------------------------------
/bins/DRV140.bin:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/BotoX/xiaomi-m365-firmware-patcher/HEAD/bins/DRV140.bin


--------------------------------------------------------------------------------
/bins/DRV141.bin:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/BotoX/xiaomi-m365-firmware-patcher/HEAD/bins/DRV141.bin


--------------------------------------------------------------------------------
/bins/DRV142.bin:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/BotoX/xiaomi-m365-firmware-patcher/HEAD/bins/DRV142.bin


--------------------------------------------------------------------------------
/bins/DRV143.bin:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/BotoX/xiaomi-m365-firmware-patcher/HEAD/bins/DRV143.bin


--------------------------------------------------------------------------------
/web/static/favicon.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/BotoX/xiaomi-m365-firmware-patcher/HEAD/web/static/favicon.png


--------------------------------------------------------------------------------
/xiaotea/enc.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | from sys import argv, exit
 3 | from os.path import getsize
 4 | from xiaotea import XiaoTea
 5 | 
 6 | if len(argv) != 3:
 7 |     exit('Usage: ' + argv[0] + ' <infile> <outfile>')
 8 | 
 9 | cry = XiaoTea()
10 | 
11 | hfi = open(argv[1], 'rb')
12 | hfo = open(argv[2], 'wb')
13 | 
14 | hfo.write(cry.encrypt(hfi.read()))
15 | 
16 | hfo.close()
17 | hfi.close()
18 | 


--------------------------------------------------------------------------------
/web/static/style.css:
--------------------------------------------------------------------------------
 1 | * {
 2 | 	box-sizing: border-box;
 3 | }
 4 | .header {
 5 | 	background-color: #f1f1f1;
 6 | 	padding: 15px;
 7 | }
 8 | .header > h1 {
 9 | 	margin-bottom: 0.1em
10 | }
11 | .content {
12 | 	background-color: #f1f1f1;
13 | 	text-align: left;
14 | 	padding: 10px;
15 | 	margin-top: 7px;
16 | }
17 | @media only screen and (max-width:500px) {
18 | 	/* For mobile phones: */
19 | 	.content ul {
20 | 		padding-left: 10px;
21 | 	}
22 | }
23 | 


--------------------------------------------------------------------------------
/xiaotea/dec.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | from sys import argv, exit
 3 | from os.path import getsize
 4 | from xiaotea import XiaoTea
 5 | 
 6 | if len(argv) != 3:
 7 |     exit('Usage: ' + argv[0] + ' <infile> <outfile>')
 8 | 
 9 | fsize = getsize(argv[1])
10 | 
11 | if fsize % 8:
12 |     exit('Wrong input file size !')
13 | 
14 | cry = XiaoTea()
15 | 
16 | hfi = open(argv[1], 'rb')
17 | hfo = open(argv[2], 'wb')
18 | 
19 | hfo.write(cry.decrypt(hfi.read()))
20 | 
21 | hfo.close()
22 | hfi.close()
23 | 


--------------------------------------------------------------------------------
/xiaotea/xiaotea.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | # Taken from https://electro.club/f/50300 and modified a bit
  3 | from struct import pack, unpack
  4 | 
  5 | UPDKEY = b'\xFE\x80\x1C\xB2\xD1\xEF\x41\xA6\xA4\x17\x31\xF5\xA0\x68\x24\xF0'
  6 | 
  7 | def tea_encrypt_ecb(block, key):
  8 |     y, z = unpack('<LL', block)
  9 |     k = unpack('<LLLL', key)
 10 |     s = 0
 11 | 
 12 |     for i in range(32):
 13 |         s = (s + 0x9E3779B9) & 0xFFFFFFFF
 14 |         y = (y + (((z << 4) + k[0]) ^ (z + s) ^ ((z >> 5) + k[1]))) & 0xFFFFFFFF
 15 |         z = (z + (((y << 4) + k[2]) ^ (y + s) ^ ((y >> 5) + k[3]))) & 0xFFFFFFFF
 16 |     return pack('<LL', y, z)
 17 | 
 18 | def tea_decrypt_ecb(block, key):
 19 |     y, z = unpack('<LL', block)
 20 |     k = unpack('<LLLL', key)
 21 |     s = 0xC6EF3720
 22 | 
 23 |     for i in range(32):
 24 |         z = (z - (((y << 4) + k[2]) ^ (y + s) ^ ((y >> 5) + k[3]))) & 0xFFFFFFFF
 25 |         y = (y - (((z << 4) + k[0]) ^ (z + s) ^ ((z >> 5) + k[1]))) & 0xFFFFFFFF
 26 |         s = (s - 0x9E3779B9) & 0xFFFFFFFF
 27 |     return pack('<LL', y, z)
 28 | 
 29 | def xor(s1, s2):
 30 |     res = bytearray()
 31 |     for i in range(8):
 32 |         res.append(s1[i] ^ s2[i])
 33 |     return res
 34 | 
 35 | def checksum(data):
 36 |     s = 0
 37 |     for i in range(0, len(data), 4):
 38 |         s += unpack('<L', data[i:i+4])[0]
 39 |     return (((s >> 16) & 0xFFFF) | ((s & 0xFFFF) << 16)) ^ 0xFFFFFFFF
 40 | 
 41 | def pad(data):
 42 |     # The data which will be encrypted must be 8 byte aligned!
 43 |     # We also have to write a checksum to the last 4 bytes.
 44 |     # Zero pad for 4-byte aligning first:
 45 |     sz = len(data)
 46 |     if sz % 4:
 47 |         o = (4 - (sz % 4))
 48 |         data += b'\x00' * o
 49 |         sz += o
 50 | 
 51 |     # If we're 8-byte aligned now then add 4 zero pad bytes
 52 |     if (sz % 8) == 0:
 53 |         data += b'\x00\x00\x00\x00'
 54 | 
 55 |     # so we can add our 4 checksum bytes and be 8-byte aligned
 56 |     return data + pack('<L', checksum(data))
 57 | 
 58 | def unpad(data):
 59 |     chk = unpack('<L', data[-4:])[0]
 60 |     s = checksum(data[:-4])
 61 |     assert s == chk, 'checksum does not match!'
 62 |     return data[:-4]
 63 | 
 64 | 
 65 | class XiaoTea:
 66 |     def __init__(self):
 67 |         self.key = UPDKEY
 68 |         self.iv = b'\x00' * 8
 69 |         self.offset = 0
 70 | 
 71 |     def _UpdateKey(self):
 72 |         k = bytearray()
 73 |         for i in range(16):
 74 |             k.append((self.key[i] + i) & 0xFF)
 75 |         self.key = k
 76 | 
 77 |     def encrypt(self, data):
 78 |         data = pad(data)
 79 |         assert len(data) % 8 == 0, 'data must be 8 byte aligned!'
 80 |         res = bytearray()
 81 |         for i in range(0, len(data), 8):
 82 |             ct = tea_encrypt_ecb(xor(self.iv, data[i:i+8]), self.key)
 83 |             res += ct
 84 |             self.iv = ct
 85 |             self.offset += 8
 86 |             if (self.offset % 1024) == 0:
 87 |                 self._UpdateKey()
 88 |         return res
 89 | 
 90 |     def decrypt(self, data):
 91 |         assert len(data) % 8 == 0, 'data must be 8 byte aligned!'
 92 |         res = bytearray()
 93 |         for i in range(0, len(data), 8):
 94 |             ct = data[i:i+8]
 95 |             res += xor(self.iv, tea_decrypt_ecb(ct, self.key))
 96 |             self.iv = ct
 97 |             self.offset += 8
 98 |             if (self.offset % 1024) == 0:
 99 |                 self._UpdateKey()
100 |         return unpad(res)
101 | 


--------------------------------------------------------------------------------
/web/app.py:
--------------------------------------------------------------------------------
  1 | import flask
  2 | import traceback
  3 | import sys
  4 | import os
  5 | import time
  6 | import io
  7 | import zipfile
  8 | import hashlib
  9 | sys.path.append('..')
 10 | from patcher import FirmwarePatcher
 11 | 
 12 | app = flask.Flask(__name__)
 13 | 
 14 | 
 15 | @app.errorhandler(Exception)
 16 | def handle_bad_request(e):
 17 |     return 'Exception occured:\n{}'.format(traceback.format_exc()), \
 18 |             400, {'Content-Type': 'text/plain'}
 19 | 
 20 | # http://flask.pocoo.org/snippets/40/
 21 | @app.context_processor
 22 | def override_url_for():
 23 |     return dict(url_for=dated_url_for)
 24 | 
 25 | def dated_url_for(endpoint, **values):
 26 |     if endpoint == 'static':
 27 |         filename = values.get('filename', None)
 28 |         if filename:
 29 |             file_path = os.path.join(app.root_path,
 30 |                                      endpoint, filename)
 31 |             values['q'] = int(os.stat(file_path).st_mtime)
 32 |     return flask.url_for(endpoint, **values)
 33 | 
 34 | 
 35 | @app.route('/')
 36 | def home():
 37 |     return flask.render_template('home.html')
 38 | 
 39 | @app.route('/cfw')
 40 | def patch_firmware():
 41 |     version = flask.request.args.get('version', None)
 42 |     if version not in ['DRV130', 'DRV134', 'DRV138', 'DRV140', 'DRV141', 'DRV142', 'DRV143']:
 43 |         return 'Invalid firmware version.', 400
 44 | 
 45 |     with open('../bins/{}.bin'.format(version), 'rb') as fp:
 46 |         patcher = FirmwarePatcher(fp.read())
 47 | 
 48 |     kers_min_speed = flask.request.args.get('kers_min_speed', None)
 49 |     if kers_min_speed is not None:
 50 |         kers_min_speed = float(kers_min_speed)
 51 |         assert kers_min_speed >= 0 and kers_min_speed <= 100
 52 |         patcher.kers_min_speed(kers_min_speed)
 53 | 
 54 |     speed_params = flask.request.args.get('speed_params', None)
 55 |     if speed_params:
 56 |         speed_normal_kmh = int(flask.request.args.get('speed_normal_kmh', None))
 57 |         assert speed_normal_kmh >= 0 and speed_normal_kmh <= 100
 58 |         speed_normal_phase = int(flask.request.args.get('speed_normal_phase', None))
 59 |         assert speed_normal_phase >= 0 and speed_normal_phase <= 65535
 60 |         speed_normal_battery = int(flask.request.args.get('speed_normal_battery', None))
 61 |         assert speed_normal_battery >= 0 and speed_normal_battery <= 65535
 62 |         speed_eco_kmh = int(flask.request.args.get('speed_eco_kmh', None))
 63 |         assert speed_eco_kmh >= 0 and speed_eco_kmh <= 100
 64 |         speed_eco_phase = int(flask.request.args.get('speed_eco_phase', None))
 65 |         assert speed_eco_phase >= 0 and speed_eco_phase <= 65535
 66 |         speed_eco_battery = int(flask.request.args.get('speed_eco_battery', None))
 67 |         assert speed_eco_battery >= 0 and speed_eco_battery <= 65535
 68 |         patcher.speed_params(speed_normal_kmh, speed_normal_phase, speed_normal_battery, speed_eco_kmh, speed_eco_phase, speed_eco_battery)
 69 | 
 70 |     brake_params = flask.request.args.get('brake_params', None)
 71 |     if brake_params:
 72 |         brake_limit = int(flask.request.args.get('brake_limit', None))
 73 |         assert brake_limit >= 1 and brake_limit <= 130
 74 |         brake_i_min = int(flask.request.args.get('brake_i_min', None))
 75 |         assert brake_i_min >= 0 and brake_i_min <= 65535
 76 |         brake_i_max = int(flask.request.args.get('brake_i_max', None))
 77 |         assert brake_i_max >= brake_i_min and brake_i_max <= 65535
 78 |         patcher.brake_params(brake_limit, brake_i_min, brake_i_max)
 79 | 
 80 |     motor_start_speed = flask.request.args.get('motor_start_speed', None)
 81 |     if motor_start_speed is not None:
 82 |         motor_start_speed = float(motor_start_speed)
 83 |         assert motor_start_speed >= 0 and motor_start_speed <= 100
 84 |         patcher.motor_start_speed(motor_start_speed)
 85 | 
 86 |     cruise_control_delay = flask.request.args.get('cruise_control_delay', None)
 87 |     if cruise_control_delay is not None:
 88 |         cruise_control_delay = float(cruise_control_delay)
 89 |         assert cruise_control_delay >= 0.1 and cruise_control_delay <= 20.0
 90 |         patcher.cruise_control_delay(cruise_control_delay)
 91 | 
 92 |     cruise_control_nobeep = flask.request.args.get('cruise_control_nobeep', None)
 93 |     if cruise_control_nobeep:
 94 |         patcher.cruise_control_nobeep()
 95 | 
 96 |     instant_eco_switch = flask.request.args.get('instant_eco_switch', None)
 97 |     if instant_eco_switch:
 98 |         patcher.instant_eco_switch()
 99 | 
100 |     boot_with_eco = flask.request.args.get('boot_with_eco', None)
101 |     if boot_with_eco:
102 |         patcher.boot_with_eco()
103 | 
104 |     voltage_limit = flask.request.args.get('voltage_limit', None)
105 |     if voltage_limit is not None:
106 |         voltage_limit = float(voltage_limit)
107 |         assert voltage_limit >= 43.01 and voltage_limit <= 100.00
108 |         patcher.voltage_limit(voltage_limit)
109 | 
110 |     russian_throttle = flask.request.args.get('russian_throttle', None)
111 |     if russian_throttle:
112 |         patcher.russian_throttle()
113 | 
114 |     remove_hard_speed_limit = flask.request.args.get('remove_hard_speed_limit', None)
115 |     if remove_hard_speed_limit:
116 |         patcher.remove_hard_speed_limit()
117 | 
118 |     remove_charging_mode = flask.request.args.get('remove_charging_mode', None)
119 |     if remove_charging_mode:
120 |         patcher.remove_charging_mode()
121 | 
122 |     stay_on_locked = flask.request.args.get('stay_on_locked', None)
123 |     if stay_on_locked:
124 |         patcher.stay_on_locked()
125 | 
126 |     bms_uart_76800 = flask.request.args.get('bms_uart_76800', None)
127 |     if bms_uart_76800:
128 |         patcher.bms_uart_76800()
129 | 
130 |     wheel_speed_const = flask.request.args.get('wheel_speed_const', None)
131 |     if wheel_speed_const:
132 |         wheel_speed_const = int(wheel_speed_const)
133 |         assert wheel_speed_const >= 200 and wheel_speed_const <= 500
134 |         patcher.wheel_speed_const(wheel_speed_const)
135 | 
136 |     # make zip file for firmware
137 |     zip_buffer = io.BytesIO()
138 |     zip_file = zipfile.ZipFile(zip_buffer, 'a', zipfile.ZIP_DEFLATED, False)
139 | 
140 |     zip_file.writestr('FIRM.bin', patcher.data)
141 |     md5 = hashlib.md5()
142 |     md5.update(patcher.data)
143 | 
144 |     patcher.encrypt()
145 |     zip_file.writestr('FIRM.bin.enc', patcher.data)
146 |     md5e = hashlib.md5()
147 |     md5e.update(patcher.data)
148 | 
149 |     info_txt = 'dev: M365;\nnam: {};\nenc: B;\ntyp: DRV;\nmd5: {};\nmd5e: {};\n'.format(
150 |         version, md5.hexdigest(), md5e.hexdigest())
151 | 
152 |     zip_file.writestr('info.txt', info_txt.encode())
153 |     zip_file.comment = flask.request.url.encode()
154 |     zip_file.close()
155 |     zip_buffer.seek(0)
156 |     content = zip_buffer.getvalue()
157 |     zip_buffer.close()
158 | 
159 |     resp = flask.Response(content)
160 |     filename = version + '-' + str(int(time.time())) + '.zip'
161 |     resp.headers['Content-Type'] = 'application/zip'
162 |     resp.headers['Content-Disposition'] = 'inline; filename="{0}"'.format(filename)
163 |     resp.headers['Content-Length'] = len(content)
164 | 
165 |     return resp
166 | 
167 | if __name__ == '__main__':
168 |     app.run('0.0.0.0')
169 | 


--------------------------------------------------------------------------------
/web/templates/home.html:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html>
  2 | <html lang="en">
  3 | <head>
  4 | <meta charset="utf-8">
  5 | <meta name="author" content="BotoX">
  6 | <meta name="description" content="Xiaomi Mijia M365 Custom Firmware Toolkit">
  7 | <meta name="viewport" content="width=device-width, initial-scale=1.0">
  8 | <link rel="icon" type="image/png" href="{{ url_for('static', filename='favicon.png') }}">
  9 | <link rel="stylesheet" type="text/css" href="{{ url_for('static', filename='style.css') }}">
 10 | <title>Xiaomi Mijia M365 Custom Firmware Toolkit</title>
 11 | </head>
 12 | 
 13 | <body>
 14 | 
 15 | <div class="header">
 16 |     <h1>Xiaomi Mijia M365 Custom Firmware Toolkit</h1>
 17 |     <a href="https://hackm365.com/">Spanish</a>
 18 |     <a href="https://spzjulien.com/CFW/">French</a>
 19 |     <a href="http://cfw.rollerplausch.com/">German</a>
 20 |     <a href="http://xn--80adrjrfh9d.xn--80atlli8e.xn--p1ai/">Russian</a>
 21 | </div>
 22 | 
 23 | <div class="content">
 24 | <p>
 25 |     Configure your own custom firmware by adjusting the options below.<br>
 26 |     There are safety checks in place to ensure your scooter will not be bricked.<br>
 27 |     Be aware that a higher motor power will shorten the lifetime of your battery and could damage your motor.<br>
 28 |     By default nothing will be patched, enable patches with the "Patch?" checkbox next to them.
 29 | </p>
 30 | 
 31 | <p>
 32 |     Presets:
 33 |     <button onclick="Preset_Default();">Default</button>
 34 |     <button onclick="Preset_BotoX();">BotoX</button>
 35 |     <button onclick="Preset_Rollerplausch();">Rollerplausch.com</button>
 36 |     <button onclick="Preset_DYoC();">DYoC</button>
 37 | </p>
 38 | 
 39 | <noscript>This website (despite it's look) requires some very simple JavaScript which is embedded in this HTML.</noscript>
 40 | 
 41 | <hr>
 42 | <form action="/cfw">
 43 | <ul>
 44 |     <li>
 45 |     <label><b>Base version of your firmware:</b>
 46 |     <select name="version">
 47 |         <option value="DRV143">1.4.3</option>
 48 |         <option value="DRV142">1.4.2</option>
 49 |         <option value="DRV141">1.4.1</option>
 50 |         <option value="DRV140">1.4.0</option>
 51 |         <option value="DRV138" selected>1.3.8</option>
 52 |         <option value="DRV134">1.3.4</option>
 53 |         <option value="DRV130">1.3.0</option>
 54 |     </select></label>
 55 |     <p>1.3.8 is recommended over 1.4.0, it provides a much smoother riding experience.</p>
 56 |     </li>
 57 | 
 58 |     <li>
 59 |     <label><b>Auto-KERS min speed:</b>
 60 |     <input name="kers_min_speed" type="number" step="0.1" min="0" max="100" value="6.0" disabled>&nbsp;km/h</label>
 61 |     <label><input type="checkbox" onchange="CheckForm('kers_min_speed', this);">Patch?</label>
 62 |     <p>
 63 |         The scooter will start braking by itself when it goes above this speed and you're not accelerating.<br>
 64 |         If you want "KERS OFF" then just put this to 40&nbsp;km/h.
 65 |         You will still have recuperative braking when using the brake lever.<br>
 66 |     </p>
 67 |     </li>
 68 | 
 69 |     <li>
 70 |     <label><b>Patch speed control params?</b>
 71 |     <input type="checkbox" name="speed_params" onchange="CheckForm('speed_normal_kmh', this); CheckForm('speed_normal_phase', this); CheckForm('speed_normal_battery', this); CheckForm('speed_eco_kmh', this); CheckForm('speed_eco_phase', this); CheckForm('speed_eco_battery', this);"></label>
 72 |     <p>
 73 |         <label>Normal max speed: <input name="speed_normal_kmh" type="number" step="1" min="0" max="100" value="28" disabled>&nbsp;km/h</label><br>
 74 |         <label>Normal max phase current: <input name="speed_normal_phase" type="number" step="1" min="0" max="65535" value="32000" disabled>&nbsp;mA</label><br>
 75 |         <label>Normal max battery current: <input name="speed_normal_battery" type="number" step="1" min="0" max="65535" value="17000" disabled>&nbsp;mA</label>
 76 |     </p>
 77 |     <p>
 78 |         <label>Eco max speed: <input name="speed_eco_kmh" type="number" step="1" min="0" max="100" value="22" disabled>&nbsp;km/h</label><br>
 79 |         <label>Eco max phase current: <input name="speed_eco_phase" type="number" step="1" min="0" max="65535" value="17000" disabled>&nbsp;mA</label><br>
 80 |         <label>Eco max battery current: <input name="speed_eco_battery" type="number" step="1" min="0" max="65535" value="7000" disabled>&nbsp;mA</label>
 81 |     </p>
 82 |     <p>
 83 |         For Smoothness: Stock (10S) battery: Max 31 km/h, 12S battery: Max 36 km/h<br>
 84 |         To convert the old power constant to mA, use (51575/constant)*17000<br>
 85 |         Motor phases are PWM controlled and instantaneous current exceeds the average. As a rough guide, use 2.0-2.5x battery current.
 86 |     </p>
 87 |     </li>
 88 | 
 89 |     <li>
 90 |     <label><b>Patch brake lever params?</b>
 91 |     <input type="checkbox" name="brake_params" onchange="CheckForm('brake_limit', this); CheckForm('brake_i_min', this); CheckForm('brake_i_max', this);"></label>
 92 |     <p>
 93 |         <label>Lever virtual limit (1-130): <input name="brake_limit" type="number" step="1" min="1" max="130" value="115" disabled></label><br>
 94 |         <label>Minimum phase current: <input name="brake_i_min" type="number" step="1" min="0" max="65535" value="8000" disabled onchange="GetForm('brake_i_max').min = this.value;">&nbsp;mA</label><br>
 95 |         <label>Maximum phase current: <input name="brake_i_max" type="number" step="1" min="8000" max="65535" value="30000" disabled>&nbsp;mA</label>
 96 |     </p>
 97 |     </li>
 98 | 
 99 |     <li>
100 |     <label><b>Motor start speed:</b>
101 |     <input name="motor_start_speed" type="number" step="0.01" min="0" max="100" value="5.0" disabled>&nbsp;km/h</label>
102 |     <label><input type="checkbox" onchange="CheckForm('motor_start_speed', this);">Patch?</label>
103 |     <p>Minimum speed in km/h before the engine will start.</p>
104 |     </li>
105 | 
106 |     <li>
107 |     <label><b>Cruise control delay:</b>
108 |     <input name="cruise_control_delay" type="number" step="0.1" min="0.1" max="20" value="5.0" disabled>&nbsp;seconds</label>
109 |     <label><input type="checkbox" onchange="CheckForm('cruise_control_delay', this);">Patch?</label>
110 |     <br>
111 |     <p>How many seconds it takes for cruise control to kick in.</p>
112 |     </li>
113 | 
114 |     <li>
115 |     <label><b>Cruise control no beep:</b>
116 |     <input type="checkbox" name="cruise_control_nobeep"></label>
117 |     <br>
118 |     <p>Disables beep sound when cruise control enables.</p>
119 |     </li>
120 | 
121 |     <li>
122 |     <label><b>Instant mode switch:</b>
123 |     <input type="checkbox" name="instant_eco_switch"></label>
124 |     <p>
125 |         Switch instantly between Eco and Normal mode while driving.<br>
126 |         Warning! This can be very sudden and cause injury!
127 |     </p>
128 |     </li>
129 | 
130 |     <li>
131 |     <label><b>Boot with ECO mode:</b>
132 |     <input type="checkbox" name="boot_with_eco"></label>
133 |     <p>The scooter will always start in Eco mode.</p>
134 |     </li>
135 | 
136 |     <li>
137 |     <label><b>Russian throttle algorithm (from CFW):</b>
138 |     <input type="checkbox" name="russian_throttle"></label>
139 |     <p>
140 |         Changes the throttle algorithm from speed-control to power-control.<br>
141 |         Ignores speed control params.
142 |     </p>
143 |     </li>
144 | 
145 |     <li>
146 |     <label><b>Battery voltage limit:</b>
147 |     <input name="voltage_limit" type="number" step="0.01" min="43.01" max="100.00" value="43.01" disabled>&nbsp;Volt</label>
148 |     <label><input type="checkbox" onchange="CheckForm('voltage_limit', this);">Patch?</label>
149 |     <p>If you want to connect a custom battery with a higher voltage.</p>
150 |     </li>
151 | 
152 |     <li>
153 |     <label><b>Remove hard speed limit of 35&nbsp;km/h:</b>
154 |     <input type="checkbox" name="remove_hard_speed_limit"></label>
155 |     <p>Removes code which checks that the speed is below 34.78km/h (12000/345).</p>
156 |     </li>
157 | 
158 |     <li>
159 |     <label><b>Remove charging mode:</b>
160 |     <input type="checkbox" name="remove_charging_mode"></label>
161 |     <p>Fixes issue of scooter going into charge mode with an external battery connected in parallel.</p>
162 |     </li>
163 | 
164 |     <li>
165 |     <label><b>Stay on when scooter is locked:</b>
166 |     <input type="checkbox" name="stay_on_locked"></label>
167 |     <p>Disables auto shutdown when the scooter is locked so it stays on forever.</p>
168 |     </li>
169 | 
170 |     <li>
171 |     <label><b>Change ESC<->BMS baud rate to 76800:</b>
172 |     <input type="checkbox" name="bms_uart_76800"></label>
173 |     <p>Only if you use the <a href="https://github.com/BotoX/xiaomi-m365-compatible-bms" target="_blank">compatible open source BMS</a>!</p>
174 |     </li>
175 | 
176 |     <li>
177 |     <label><b>Wheel speed multiplier:</b>
178 |     <input name="wheel_speed_const" type="number" step="1" min="200" max="500" value="345" disabled></label>
179 |     <label><input type="checkbox" onchange="CheckForm('wheel_speed_const', this);">Patch?</label>
180 |     <p>For 10" wheels use 315, don't change otherwise.</p>
181 |     </li>
182 | </ul>
183 | <hr>
184 | 
185 | <p>
186 |     Make sure to double check all of your entered values before submitting!<br>
187 |     <b>I AM RESPONSIBLE FOR THE ENTERED VALUES:</b>
188 |     <input type="submit" value="Patch!"/>
189 |     <button type="button" onclick="Share();">Share</button>
190 |     <span id="shareConfirmation"></span>
191 | </p>
192 | </form>
193 | 
194 | <p>
195 |     <b><span style="color: red;">&#9888;&nbsp;NEW </span>The tool now makes .zip files with both encrypted and unencrypted firmware and an info.txt inside.</b><br>
196 |     <b><span style="color: red;">&#9888;&nbsp;NEW </span>Use the following app made by <a href="https://github.com/CamiAlfa">CamiAlfa</a> to flash your modified firmware: <a href="https://play.google.com/store/apps/details?id=com.m365downgrade">m365 DownG</a></b><br>
197 |     It will automatically chose the correct firmware for your scooter. Don't try to flash the .zip file with the old patched app!
198 | </p>
199 | 
200 | <hr>
201 | <p>
202 |     Source code on GitHub: <a href="https://github.com/BotoX/xiaomi-m365-firmware-patcher" target="_blank">https://github.com/BotoX/xiaomi-m365-firmware-patcher</a>
203 |     <br>
204 |     <b>Donate: <a href="https://paypal.me/BotoXbz" target="_blank">https://paypal.me/BotoXbz</a></b>
205 | </p>
206 | </div>
207 | 
208 | <script>
209 |     var forms = {
210 |         "VERSION": "version",
211 |         "KERS_MIN_SPEED": "kers_min_speed",
212 |         "SPEED_PARAMS": "speed_params",
213 |         "SPEED_NORMAL_KMH": "speed_normal_kmh",
214 |         "SPEED_NORMAL_PHASE": "speed_normal_phase",
215 |         "SPEED_NORMAL_BATTERY": "speed_normal_battery",
216 |         "SPEED_ECO_KMH": "speed_eco_kmh",
217 |         "SPEED_ECO_PHASE": "speed_eco_phase",
218 |         "SPEED_ECO_BATTERY": "speed_eco_battery",
219 |         "BRAKE_PARAMS": "brake_params",
220 |         "BRAKE_LIMIT": "brake_limit",
221 |         "BRAKE_I_MIN": "brake_i_min",
222 |         "BRAKE_I_MAX": "brake_i_max",
223 |         "MOTOR_START_SPEED": "motor_start_speed",
224 |         "CRUISE_CONTROL_DELAY": "cruise_control_delay",
225 |         "CRUISE_CONTROL_NOBEEP": "cruise_control_nobeep",
226 |         "INSTANT_ECO_SWITCH": "instant_eco_switch",
227 |         "BOOT_WITH_ECO": "boot_with_eco",
228 |         "RUSSIAN_THROTTLE": "russian_throttle",
229 |         "VOLTAGE_LIMIT": "voltage_limit",
230 |         "REMOVE_HARD_SPEED_LIMIT": "remove_hard_speed_limit",
231 |         "REMOVE_CHARGING_MODE": "remove_charging_mode",
232 |         "STAY_ON_LOCKED": "stay_on_locked",
233 |         "BMS_UART_76800": "bms_uart_76800",
234 |         "WHEEL_SPEED_CONST": "wheel_speed_const"
235 |     };
236 | 
237 |     var formValues = Object.values(forms);
238 |     var queryStrings = window.location.search.substring(1);
239 |     var queries = queryStrings.split('&');
240 | 
241 |     for (var i = 0; i < queries.length; i++) {
242 |         var query = queries[i];
243 |         var tmp = query.split('=');
244 |         var found = false;
245 | 
246 |         for (var j = 0; j < formValues.length; j++) {
247 |             if (formValues[j] === tmp[0]) {
248 |                 found = true;
249 |                 break;
250 |             }
251 |         }
252 | 
253 |         if(found) {
254 |             if (tmp[1] === 'on') {
255 |                 tmp[1] = true;
256 |             }
257 | 
258 |             ChangeForm(tmp[0], tmp[1], true);
259 |         }
260 |     }
261 | 
262 |     function GetForm(name) {
263 |         return document.getElementsByName(name)[0];
264 |     }
265 | 
266 |     function GetFormValue(name) {
267 |         var o = GetForm(name);
268 | 
269 |         if (o.type === "checkbox") {
270 |             return o.checked;
271 |         }
272 | 
273 |         return o.value;
274 |     }
275 | 
276 |     function GetPatchCheckBox(name) {
277 |         var form = GetForm(name);
278 |         if(form.type != "checkbox") {
279 |             return form.parentElement && form.parentElement.nextElementSibling && form.parentElement.nextElementSibling.children[0];
280 |         }
281 |     }
282 | 
283 |     function CheckForm(name, cb) {
284 |         GetForm(name).disabled = !cb.checked;
285 |     }
286 | 
287 |     function ChangeForm(name, value, patch) {
288 |         var o = GetForm(name);
289 | 
290 |         if (o.type === "checkbox") {
291 |             o.checked = value;
292 |         } else {
293 |             o.value = value;
294 |         }
295 |         if(o.onchange) { o.onchange(); }
296 | 
297 |         if (typeof patch === 'boolean') {
298 |             var cb = GetPatchCheckBox(name);
299 | 
300 |             if (cb) {
301 |                 cb.checked = patch;
302 |                 if(cb.onchange) { cb.onchange(); }
303 |             }
304 |         }
305 |     }
306 | 
307 |     function Preset_Default() {
308 |         ChangeForm(forms.VERSION, "DRV138");
309 |         ChangeForm(forms.KERS_MIN_SPEED, "6.0", false);
310 |         ChangeForm(forms.SPEED_PARAMS, false);
311 |         ChangeForm(forms.SPEED_NORMAL_KMH, "28");
312 |         ChangeForm(forms.SPEED_NORMAL_PHASE, 32000);
313 |         ChangeForm(forms.SPEED_NORMAL_BATTERY, 17000);
314 |         ChangeForm(forms.SPEED_ECO_KMH, "22");
315 |         ChangeForm(forms.SPEED_ECO_PHASE, 17000);
316 |         ChangeForm(forms.SPEED_ECO_BATTERY, 7000);
317 |         ChangeForm(forms.BRAKE_PARAMS, false);
318 |         ChangeForm(forms.BRAKE_LIMIT, "115");
319 |         ChangeForm(forms.BRAKE_I_MIN, "8000");
320 |         ChangeForm(forms.BRAKE_I_MAX, "30000");
321 |         ChangeForm(forms.MOTOR_START_SPEED, "5.0", false);
322 |         ChangeForm(forms.CRUISE_CONTROL_DELAY, "5.0", false);
323 |         ChangeForm(forms.CRUISE_CONTROL_NOBEEP, false);
324 |         ChangeForm(forms.INSTANT_ECO_SWITCH, false);
325 |         ChangeForm(forms.BOOT_WITH_ECO, false);
326 |         ChangeForm(forms.RUSSIAN_THROTTLE, false);
327 |         ChangeForm(forms.VOLTAGE_LIMIT, "43.01", false);
328 |         ChangeForm(forms.REMOVE_HARD_SPEED_LIMIT, false);
329 |         ChangeForm(forms.REMOVE_CHARGING_MODE, false);
330 |         ChangeForm(forms.STAY_ON_LOCKED, false);
331 |         ChangeForm(forms.BMS_UART_76800, false);
332 |         ChangeForm(forms.WHEEL_SPEED_CONST, 345, false);
333 |     }
334 | 
335 |     function Preset_BotoX() {
336 |         ChangeForm(forms.VERSION, "DRV138");
337 |         ChangeForm(forms.KERS_MIN_SPEED, "40.0", true);
338 |         ChangeForm(forms.SPEED_PARAMS, true);
339 |         ChangeForm(forms.SPEED_NORMAL_KMH, "31");
340 |         ChangeForm(forms.SPEED_NORMAL_PHASE, 60000);
341 |         ChangeForm(forms.SPEED_NORMAL_BATTERY, 30000);
342 |         ChangeForm(forms.SPEED_ECO_KMH, "26");
343 |         ChangeForm(forms.SPEED_ECO_PHASE, 50000);
344 |         ChangeForm(forms.SPEED_ECO_BATTERY, 20000);
345 |         ChangeForm(forms.BRAKE_PARAMS, true);
346 |         ChangeForm(forms.BRAKE_LIMIT, "115");
347 |         ChangeForm(forms.BRAKE_I_MIN, "8000");
348 |         ChangeForm(forms.BRAKE_I_MAX, "50000");
349 |         ChangeForm(forms.MOTOR_START_SPEED, "3.0", true);
350 |         ChangeForm(forms.CRUISE_CONTROL_DELAY, "5.0", false);
351 |         ChangeForm(forms.CRUISE_CONTROL_NOBEEP, false);
352 |         ChangeForm(forms.INSTANT_ECO_SWITCH, true);
353 |         ChangeForm(forms.BOOT_WITH_ECO, false);
354 |         ChangeForm(forms.RUSSIAN_THROTTLE, false);
355 |         ChangeForm(forms.VOLTAGE_LIMIT, "52.00", true);
356 |         ChangeForm(forms.REMOVE_HARD_SPEED_LIMIT, true);
357 |         ChangeForm(forms.REMOVE_CHARGING_MODE, false);
358 |         ChangeForm(forms.STAY_ON_LOCKED, true);
359 |         ChangeForm(forms.BMS_UART_76800, false);
360 |         ChangeForm(forms.WHEEL_SPEED_CONST, 345, false);
361 |     }
362 | 
363 |     function Preset_Rollerplausch() {
364 |         ChangeForm(forms.VERSION, "DRV138");
365 |         ChangeForm(forms.KERS_MIN_SPEED, "40.0", true);
366 |         ChangeForm(forms.SPEED_PARAMS, true);
367 |         ChangeForm(forms.SPEED_NORMAL_KMH, "30");
368 |         ChangeForm(forms.SPEED_NORMAL_PHASE, 50000);
369 |         ChangeForm(forms.SPEED_NORMAL_BATTERY, 26500);
370 |         ChangeForm(forms.SPEED_ECO_KMH, "19");
371 |         ChangeForm(forms.SPEED_ECO_PHASE, 30000);
372 |         ChangeForm(forms.SPEED_ECO_BATTERY, 15000);
373 |         ChangeForm(forms.BRAKE_PARAMS, true);
374 |         ChangeForm(forms.BRAKE_LIMIT, "115");
375 |         ChangeForm(forms.BRAKE_I_MIN, "8000");
376 |         ChangeForm(forms.BRAKE_I_MAX, "45000");
377 |         ChangeForm(forms.MOTOR_START_SPEED, "3.0", true);
378 |         ChangeForm(forms.CRUISE_CONTROL_DELAY, "5.0", false);
379 |         ChangeForm(forms.CRUISE_CONTROL_NOBEEP, false);
380 |         ChangeForm(forms.INSTANT_ECO_SWITCH, true);
381 |         ChangeForm(forms.BOOT_WITH_ECO, true);
382 |         ChangeForm(forms.RUSSIAN_THROTTLE, false);
383 |         ChangeForm(forms.VOLTAGE_LIMIT, "43.01", false);
384 |         ChangeForm(forms.REMOVE_HARD_SPEED_LIMIT, true);
385 |         ChangeForm(forms.REMOVE_CHARGING_MODE, true);
386 |         ChangeForm(forms.STAY_ON_LOCKED, true);
387 |         ChangeForm(forms.BMS_UART_76800, false);
388 |         ChangeForm(forms.WHEEL_SPEED_CONST, 345, false);
389 |     }
390 | 
391 |     function Preset_DYoC() {
392 |         ChangeForm(forms.VERSION, "DRV138");
393 |         ChangeForm(forms.KERS_MIN_SPEED, "6.0", false);
394 |         ChangeForm(forms.SPEED_PARAMS, false);
395 |         ChangeForm(forms.SPEED_NORMAL_KMH, "31");
396 |         ChangeForm(forms.SPEED_NORMAL_PHASE, 41000);
397 |         ChangeForm(forms.SPEED_NORMAL_BATTERY, 22000);
398 |         ChangeForm(forms.SPEED_ECO_KMH, "20");
399 |         ChangeForm(forms.SPEED_ECO_PHASE, 22000);
400 |         ChangeForm(forms.SPEED_ECO_BATTERY, 9000);
401 |         ChangeForm(forms.BRAKE_PARAMS, false);
402 |         ChangeForm(forms.BRAKE_LIMIT, "115");
403 |         ChangeForm(forms.BRAKE_I_MIN, "8000");
404 |         ChangeForm(forms.BRAKE_I_MAX, "38500");
405 |         ChangeForm(forms.CRUISE_CONTROL_DELAY, "5.0", false);
406 |         ChangeForm(forms.CRUISE_CONTROL_NOBEEP, false);
407 |         ChangeForm(forms.INSTANT_ECO_SWITCH, false);
408 |         ChangeForm(forms.BOOT_WITH_ECO, false);
409 |         ChangeForm(forms.RUSSIAN_THROTTLE, false);
410 |         ChangeForm(forms.VOLTAGE_LIMIT, "52.00", true);
411 |         ChangeForm(forms.REMOVE_HARD_SPEED_LIMIT, false);
412 |         ChangeForm(forms.REMOVE_CHARGING_MODE, false);
413 |         ChangeForm(forms.STAY_ON_LOCKED, false);
414 |         ChangeForm(forms.BMS_UART_76800, false);
415 |         ChangeForm(forms.WHEEL_SPEED_CONST, 345, false);
416 |     }
417 | 
418 |     function Share() {
419 |         var url = location.protocol + '//' + location.host;
420 |         var firstParam = true;
421 | 
422 |         function getSeparator() {
423 |             if (firstParam) {
424 |                 firstParam = false;
425 |                 return '?';
426 |             }
427 | 
428 |             return '&';
429 |         }
430 | 
431 |         for (var i = 0; i < formValues.length; i++) {
432 |             var form = formValues[i];
433 | 
434 |             var formValue = GetFormValue(form);
435 |             var patchCheckbox = GetPatchCheckBox(form);
436 | 
437 |             if (patchCheckbox) {
438 |                 if (patchCheckbox.checked) {
439 |                     url += getSeparator() + form + '=' + formValue;
440 |                 }
441 |             } else if (typeof formValue === 'boolean') {
442 |                 if (formValue) {
443 |                     url += getSeparator() + form + '=on';
444 |                 }
445 |             } else {
446 |                 url += getSeparator() + form + '=' + formValue;
447 |             }
448 |         }
449 | 
450 |         var textArea = document.createElement("textarea");
451 | 
452 |         textArea.value = url;
453 |         document.body.appendChild(textArea);
454 | 
455 |         textArea.focus();
456 |         textArea.select();
457 | 
458 |         document.execCommand('copy');
459 |         document.getElementById('shareConfirmation').innerText = 'Copied!';
460 | 
461 |         document.body.removeChild(textArea);
462 |     }
463 | </script>
464 | 
465 | </body>
466 | 


--------------------------------------------------------------------------------
/patcher.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python3
  2 | from binascii import hexlify
  3 | import struct
  4 | import keystone
  5 | from xiaotea import XiaoTea
  6 | 
  7 | # https://web.eecs.umich.edu/~prabal/teaching/eecs373-f10/readings/ARMv7-M_ARM.pdf
  8 | MOVW_T3_IMM = [*[None]*5, 11, *[None]*6, 15, 14, 13, 12, None, 10, 9, 8, *[None]*4, 7, 6, 5, 4, 3, 2, 1, 0]
  9 | MOVS_T1_IMM = [*[None]*8, 7, 6, 5, 4, 3, 2, 1, 0]
 10 | 
 11 | def PatchImm(data, ofs, size, imm, signature):
 12 |     assert size % 2 == 0, 'size must be power of 2!'
 13 |     assert len(signature) == size * 8, 'signature must be exactly size * 8 long!'
 14 |     imm = int.from_bytes(imm, 'little')
 15 |     sfmt = '<' + 'H' * (size // 2)
 16 | 
 17 |     sigs = [signature[i:i + 16][::-1] for i in range(0, len(signature), 16)]
 18 |     orig = data[ofs:ofs+size]
 19 |     words = struct.unpack(sfmt, orig)
 20 | 
 21 |     patched = []
 22 |     for i, word in enumerate(words):
 23 |         for j in range(16):
 24 |             imm_bitofs = sigs[i][j]
 25 |             if imm_bitofs is None:
 26 |                 continue
 27 | 
 28 |             imm_mask = 1 << imm_bitofs
 29 |             word_mask = 1 << j
 30 | 
 31 |             if imm & imm_mask:
 32 |                 word |= word_mask
 33 |             else:
 34 |                 word &= ~word_mask
 35 |         patched.append(word)
 36 | 
 37 |     packed = struct.pack(sfmt, *patched)
 38 |     data[ofs:ofs+size] = packed
 39 |     return (orig, packed)
 40 | 
 41 | class SignatureException(Exception):
 42 |     pass
 43 | 
 44 | def FindPattern(data, signature, mask=None, start=None, maxit=None):
 45 |     sig_len = len(signature)
 46 |     if start is None:
 47 |         start = 0
 48 |     stop = len(data) - len(signature)
 49 |     if maxit is not None:
 50 |         stop = start + maxit
 51 | 
 52 |     if mask:
 53 |         assert sig_len == len(mask), 'mask must be as long as the signature!'
 54 |         for i in range(sig_len):
 55 |             signature[i] &= mask[i]
 56 | 
 57 |     for i in range(start, stop):
 58 |         matches = 0
 59 | 
 60 |         while signature[matches] is None or signature[matches] == (data[i + matches] & (mask[matches] if mask else 0xFF)):
 61 |             matches += 1
 62 |             if matches == sig_len:
 63 |                 return i
 64 | 
 65 |     raise SignatureException('Pattern not found!')
 66 | 
 67 | 
 68 | class FirmwarePatcher():
 69 |     def __init__(self, data):
 70 |         self.data = bytearray(data)
 71 |         self.ks = keystone.Ks(keystone.KS_ARCH_ARM, keystone.KS_MODE_THUMB)
 72 | 
 73 |     def encrypt(self):
 74 |         cry = XiaoTea()
 75 |         self.data = cry.encrypt(self.data)
 76 | 
 77 |     def kers_min_speed(self, kmh):
 78 |         val = struct.pack('<H', int(kmh * 345))
 79 |         sig = [0x25, 0x68, 0x40, 0xF6, 0x16, 0x07, 0xBD, 0x42]
 80 |         ofs = FindPattern(self.data, sig) + 2
 81 |         pre, post = PatchImm(self.data, ofs, 4, val, MOVW_T3_IMM)
 82 |         return [(ofs, pre, post)]
 83 | 
 84 |     def speed_params(self, normal_kmh, normal_phase, normal_battery, eco_kmh, eco_phase, eco_battery):
 85 |         ret = []
 86 |         sig = [0x80, 0x28, 0x00, 0xDD, 0x80, 0x20, *[None]*2, 0x68, 0x43, 0x00, 0x0C]
 87 |         ofs = FindPattern(self.data, sig) + 8
 88 |         pre = self.data[ofs:ofs+4]
 89 |         post = bytes(self.ks.asm('MOVW R2, #{:n}'.format(normal_battery))[0])
 90 |         self.data[ofs:ofs+4] = post
 91 |         ret.append([ofs, pre, post])
 92 |         ofs += 4
 93 | 
 94 |         pre = self.data[ofs:ofs+2]
 95 |         post = bytes(self.ks.asm('B #0x2A')[0])
 96 |         self.data[ofs:ofs+2] = post
 97 |         ret.append([ofs, pre, post])
 98 |         ofs += 2
 99 | 
100 |         sig = [0x01, 0x2A, 0x44, 0xF2, 0x68, 0x21, 0x42, 0x46, 0x05, 0xD0]
101 |         ofs = FindPattern(self.data, sig) + 2
102 |         pre, post = PatchImm(self.data, ofs, 4, struct.pack('<H', eco_phase), MOVW_T3_IMM)
103 |         ret.append([ofs, pre, post])
104 |         ofs += 4
105 | 
106 |         ofs += 10
107 |         pre = self.data[ofs:ofs+2]
108 |         post = bytes(self.ks.asm('NOP')[0])
109 |         self.data[ofs:ofs+2] = post
110 |         ret.append([ofs, pre, post])
111 |         ofs += 2
112 | 
113 |         ofs += 8
114 |         pre, post = PatchImm(self.data, ofs, 4, struct.pack('<H', eco_battery), MOVW_T3_IMM)
115 |         ret.append([ofs, pre, post])
116 |         ofs += 4
117 | 
118 |         ofs += 2
119 |         pre = self.data[ofs:ofs+2]
120 |         post = bytes(self.ks.asm('B #0x06')[0])
121 |         self.data[ofs:ofs+2] = post
122 |         ret.append([ofs, pre, post])
123 |         ofs += 2
124 | 
125 |         ofs += 6
126 |         pre, post = PatchImm(self.data, ofs, 2, struct.pack('<B', eco_kmh), MOVS_T1_IMM)
127 |         ret.append([ofs, pre, post])
128 |         ofs += 2
129 | 
130 |         ofs += 6
131 |         pre, post = PatchImm(self.data, ofs, 2, struct.pack('<B', normal_kmh), MOVS_T1_IMM)
132 |         ret.append([ofs, pre, post])
133 |         ofs += 2
134 | 
135 |         ofs += 2
136 |         pre = self.data[ofs:ofs+4]
137 |         post = bytes(self.ks.asm('MOVW R1, #{:n}'.format(normal_phase))[0])
138 |         self.data[ofs:ofs+4] = post
139 |         ret.append([ofs, pre, post])
140 | 
141 |         return ret
142 | 
143 |     # limit: 1 - 130, min: 0 - 65k, max: min - 65k
144 |     def brake_params(self, limit, min, max):
145 |         ret = []
146 |         limit = int(limit)
147 |         assert limit >= 1 and limit <= 130
148 |         min = int(min)
149 |         assert min >= 0 and min < 65536
150 |         max = int(max)
151 |         assert max >= min and max < 65536
152 | 
153 |         sig = [0x73, 0x29, 0x00, 0xDD, 0x73, 0x21, 0x45, 0xF2, 0xF0, 0x53, 0x59, 0x43, 0x73, 0x23, 0x91, 0xFB, 0xF3, 0xF1, None, 0x6C, 0x51, 0x1A, 0xA1, 0xF5, 0xFA, 0x51]
154 |         ofs = FindPattern(self.data, sig)
155 | 
156 |         pre = self.data[ofs:ofs+2]
157 |         post = bytes(self.ks.asm('CMP R1, #{:n}'.format(limit))[0])
158 |         self.data[ofs:ofs+2] = post
159 |         ret.append((ofs, pre, post))
160 |         ofs += 2
161 | 
162 |         ofs += 2
163 |         pre = self.data[ofs:ofs+2]
164 |         post = bytes(self.ks.asm('MOVS R1, #{:n}'.format(limit))[0])
165 |         self.data[ofs:ofs+2] = post
166 |         ret.append((ofs, pre, post))
167 |         ofs += 2
168 | 
169 |         pre = self.data[ofs:ofs+4]
170 |         post = bytes(self.ks.asm('MOVW R3, #{:n}'.format(max - min))[0])
171 |         self.data[ofs:ofs+4] = post
172 |         ret.append((ofs, pre, post))
173 |         ofs += 4
174 | 
175 |         ofs += 2
176 |         pre = self.data[ofs:ofs+2]
177 |         post = bytes(self.ks.asm('MOVS R3, #{:n}'.format(limit))[0])
178 |         self.data[ofs:ofs+2] = post
179 |         ret.append((ofs, pre, post))
180 |         ofs += 2
181 | 
182 |         ofs += 8
183 |         pre = self.data[ofs:ofs+4]
184 |         post = bytes(self.ks.asm('SUB.W R1, R1, #{:n}'.format(min & 0xFF00))[0])
185 |         self.data[ofs:ofs+4] = post
186 |         ret.append((ofs, pre, post))
187 | 
188 |         return ret
189 | 
190 |     def voltage_limit(self, volts):
191 |         val = struct.pack('<H', int(volts * 100) - 2600)
192 |         sig = [0x40, 0xF2, 0xA5, 0x61, 0xA0, 0xF6, 0x28, 0x20, 0x88, 0x42]
193 |         ofs = FindPattern(self.data, sig)
194 |         pre, post = PatchImm(self.data, ofs, 4, val, MOVW_T3_IMM)
195 |         return [(ofs, pre, post)]
196 | 
197 |     def motor_start_speed(self, kmh):
198 |         val = struct.pack('<H', int(kmh * 345))
199 |         sig = [0xF0, 0xB4, None, 0x4C, 0x26, 0x68, 0x40, 0xF2, 0xBD, 0x67]
200 |         ofs = FindPattern(self.data, sig) + 6
201 |         pre, post = PatchImm(self.data, ofs, 4, val, MOVW_T3_IMM)
202 |         return [(ofs, pre, post)]
203 | 
204 |     # lower value = more power
205 |     # original = 51575 (~500 Watt)
206 |     # DYoC = 40165 (~650 Watt)
207 |     # CFW W = 27877 (~850 Watt)
208 |     # CFW = 25787 (~1000 Watt)
209 |     def motor_power_constant(self, val):
210 |         val = struct.pack('<H', int(val))
211 |         ret = []
212 |         sig = [0x31, 0x68, 0x2A, 0x68, 0x09, 0xB2, 0x09, 0x1B, 0x12, 0xB2, 0xD3, 0x1A, 0x4C, 0xF6, 0x77, 0x12]
213 |         ofs = FindPattern(self.data, sig) + 12
214 |         pre, post = PatchImm(self.data, ofs, 4, val, MOVW_T3_IMM)
215 |         ret.append((ofs, pre, post))
216 |         ofs += 4
217 | 
218 |         ofs += 4
219 |         pre, post = PatchImm(self.data, ofs, 4, val, MOVW_T3_IMM)
220 |         ret.append((ofs, pre, post))
221 | 
222 |         sig = [0xD3, 0x1A, 0x4C, 0xF6, 0x77, 0x12]
223 |         ofs = FindPattern(self.data, sig, None, ofs, 100) + 2
224 |         pre, post = PatchImm(self.data, ofs, 4, val, MOVW_T3_IMM)
225 |         ret.append((ofs, pre, post))
226 |         ofs += 4
227 | 
228 |         ofs += 4
229 |         pre, post = PatchImm(self.data, ofs, 4, val, MOVW_T3_IMM)
230 |         ret.append((ofs, pre, post))
231 | 
232 |         sig = [0xC9, 0x1B, 0x4C, 0xF6, 0x77, 0x13]
233 |         ofs = FindPattern(self.data, sig, None, ofs, 100) + 2
234 |         pre, post = PatchImm(self.data, ofs, 4, val, MOVW_T3_IMM)
235 |         ret.append((ofs, pre, post))
236 |         return ret
237 | 
238 |     def instant_eco_switch(self):
239 |         ret = []
240 |         sig = [0x2C, 0xF0, 0x02, 0x0C, 0x81, 0xF8, 0x00, 0xC0, 0x01, 0x2A, 0x0A, 0xD0]
241 |         ofs = FindPattern(self.data, sig) + 8
242 |         pre = self.data[ofs:ofs+2]
243 |         post = bytes(self.ks.asm('NOP')[0])
244 |         self.data[ofs:ofs+2] = post
245 |         ret.append((ofs, pre, post))
246 |         ofs += 2
247 | 
248 |         pre = self.data[ofs:ofs+2]
249 |         post = bytes(self.ks.asm('B #0x18')[0])
250 |         self.data[ofs:ofs+2] = post
251 |         ret.append((ofs, pre, post))
252 |         ofs += 2
253 | 
254 |         sig = [0x4C, 0xF0, 0x02, 0x0C, 0x81, 0xF8, 0x00, 0xC0, 0x01, 0x2A, 0x06, 0xD1, 0x2B, 0xB9]
255 |         ofs = FindPattern(self.data, sig, None, ofs, 100) + 8
256 |         pre = self.data[ofs:ofs+6]
257 |         post = bytes(self.ks.asm('NOP;NOP;NOP')[0])
258 |         self.data[ofs:ofs+6] = post
259 |         ret.append((ofs, pre, post))
260 |         ofs += 6
261 | 
262 |         sig = [0x85, 0xF8, 0x34, 0x60, 0x02, 0xE0, 0x0B, 0xB9]
263 |         ofs = FindPattern(self.data, sig, None, ofs, 100) + 6
264 |         pre = self.data[ofs:ofs+2]
265 |         post = bytes(self.ks.asm('NOP')[0])
266 |         self.data[ofs:ofs+2] = post
267 |         ret.append((ofs, pre, post))
268 |         return ret
269 | 
270 |     def boot_with_eco(self):
271 |         ret = []
272 |         sig = [0xB4, 0xF8, 0xEA, 0x20, 0x01, 0x2A, 0x02, 0xD1, 0x00, 0xF8, 0x34, 0x1F, 0x01, 0x72]
273 |         ofs = FindPattern(self.data, sig)
274 |         pre = self.data[ofs:ofs+4]
275 |         post = bytes(self.ks.asm('STRH.W R1, [R4, #0xEA]')[0])
276 |         self.data[ofs:ofs+4] = post
277 |         ret.append((ofs, pre, post))
278 |         ofs += 4
279 | 
280 |         pre = self.data[ofs:ofs+4]
281 |         post = bytes(self.ks.asm('NOP;NOP')[0])
282 |         self.data[ofs:ofs+4] = post
283 |         ret.append((ofs, pre, post))
284 |         return ret
285 | 
286 |     def cruise_control_delay(self, delay):
287 |         delay = int(delay * 200)
288 |         assert delay.bit_length() <= 12, 'bit length overflow'
289 |         sig = [0x35, 0x48, 0xB0, 0xF8, 0xF8, 0x10, 0x34, 0x4B, 0x4F, 0xF4, 0x7A, 0x70, 0x01, 0x29]
290 |         mask= [0xFC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]
291 |         ofs = FindPattern(self.data, sig, mask) + 8
292 |         pre = self.data[ofs:ofs+4]
293 |         post = bytes(self.ks.asm('MOV.W R0, #{:n}'.format(delay))[0])
294 |         self.data[ofs:ofs+4] = post
295 |         return [(ofs, pre, post)]
296 | 
297 |     def cruise_control_nobeep(self):
298 |         sig = [0xA8, 0xF8, None, 0x40, 0x88, 0xF8, 0x07, 0x60, 0x88, 0xF8, 0x10, 0x60, 0x28, 0x78, 0x88, 0xF8, 0x11, 0x00, 0x02, 0x20]
299 |         ofs = FindPattern(self.data, sig) + 22
300 |         pre = self.data[ofs:ofs+2]
301 |         post = bytes(self.ks.asm('NOP')[0])
302 |         self.data[ofs:ofs+2] = post
303 |         return [(ofs, pre, post)]
304 | 
305 |     def remove_hard_speed_limit(self):
306 |         sig = [0x08, 0x60, 0x08, 0x68, 0x42, 0xF6, 0xE0, 0x62, 0x90, 0x42, None, 0xDC, 0x08, 0x68, 0xD0, 0x42]
307 |         ofs = FindPattern(self.data, sig) + 8
308 |         pre = self.data[ofs:ofs+10]
309 |         post = bytes(self.ks.asm('NOP;'*5)[0])
310 |         self.data[ofs:ofs+10] = post
311 |         return [(ofs, pre, post)]
312 | 
313 |     def remove_charging_mode(self):
314 |         sig = [0x19, 0xE0, None, 0xF8, 0x12, 0x00, 0x20, 0xB1, 0x84, 0xF8, 0x3A, 0x50, 0xE0, 0x7B, 0x18, 0xB1, 0x07, 0xE0]
315 |         ofs = FindPattern(self.data, sig) + 6
316 |         pre = self.data[ofs:ofs+2]
317 |         post = bytes(self.ks.asm('NOP')[0])
318 |         self.data[ofs:ofs+2] = post
319 |         return [(ofs, pre, post)]
320 | 
321 |     def stay_on_locked(self):
322 |         sig = [None, 0x49, 0x40, 0x1C, *[None]*2, 0x88, 0x42, 0x03, 0xDB, *[None]*2, 0x08, 0xB9]
323 |         ofs = FindPattern(self.data, sig) + 14
324 |         pre = self.data[ofs:ofs+4]
325 |         post = bytes(self.ks.asm('NOP;NOP')[0])
326 |         self.data[ofs:ofs+4] = post
327 |         return [(ofs, pre, post)]
328 | 
329 |     def bms_uart_76800(self):
330 |         ofs = 0
331 |         while True:
332 |             sig = [0x00, 0x21, 0x4F, 0xF4, 0xE1, 0x30, 0x00, 0x90, 0xAD, 0xF8, 0x08, 0x10, 0x0C, 0x20, 0xAD, 0xF8, 0x04, 0x10, 0xAD, 0xF8, 0x0A, 0x00, 0xAD, 0xF8, 0x06, 0x10]
333 |             ofs = FindPattern(self.data, sig, None, ofs) + 2
334 | 
335 |             # USART3 address
336 |             sig = [0x00, 0x48, 0x00, 0x40]
337 |             try:
338 |                 FindPattern(self.data, sig, None, ofs, 0x100)
339 |                 break
340 |             except SignatureException:
341 |                 continue
342 | 
343 |         pre = self.data[ofs:ofs+4]
344 |         post = bytes(self.ks.asm('MOV.W R0, #76800')[0])
345 |         self.data[ofs:ofs+4] = post
346 |         return [(ofs, pre, post)]
347 | 
348 |     def wheel_speed_const(self, val):
349 |         val = struct.pack('<H', int(val))
350 |         sig = [0xB4, 0xF9, 0x1E, 0x00, 0x40, 0xF2, 0x59, 0x11, 0x48, 0x43]
351 |         ofs = FindPattern(self.data, sig) + 4
352 |         pre, post = PatchImm(self.data, ofs, 4, val, MOVW_T3_IMM)
353 |         self.data[ofs:ofs+4] = post
354 |         return [(ofs, pre, post)]
355 | 
356 |     def russian_throttle(self):
357 |         ret = [dict()]
358 |         # Find address of eco mode, part 1 find base addr
359 |         sig = [0x91, 0x42, 0x01, 0xD2, 0x08, 0x46, 0x00, 0xE0, 0x10, 0x46, 0xA6, 0x4D]
360 |         mask= [0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF]
361 |         ofs = FindPattern(self.data, sig, mask)
362 |         ofs += 10
363 |         imm = struct.unpack('<H', self.data[ofs:ofs + 2])[0] & 0xFF
364 |         ofsa = ofs + imm * 4 + 4 # ZeroExtend '00' + align?
365 |         eco_addr = struct.unpack('<L', self.data[ofsa:ofsa + 4])[0]
366 | 
367 |         ret[0]['eco_base'] = {'ofs': ofs, 'imm': imm, 'ofsa': ofsa, 'addr': hex(eco_addr)}
368 | 
369 |         # part 2, find offset of base addr
370 |         sig = [0x85, 0xF8, 0x34, 0x60] # STRB.W  R6, [R5, #imm12]
371 |         mask= [0xFF, 0xFF, 0x00, 0x0F] # mask imm12
372 |         ofs = FindPattern(self.data, sig, mask, ofs, 100)
373 |         imm = struct.unpack('<HH', self.data[ofs:ofs + 4])[1] & 0x0FFF
374 |         eco_addr += imm
375 | 
376 |         ret[0]['eco_addr'] = {'ofs': ofs, 'imm': imm, 'addr': hex(eco_addr)}
377 | 
378 |         sig = [0xF0, 0xB5, 0x25, 0x4A, 0x00, 0x24, 0xA2, 0xF8, 0xEC, 0x40, 0x24, 0x49, 0x4B, 0x79, 0x00, 0x2B,
379 |                0x3E, 0xD1, 0x23, 0x4D, 0x2F, 0x68, 0x23, 0x4E, 0x23, 0x4B, 0x00, 0x2F, 0x39, 0xDB, None, 0x64,
380 |                0x01, 0x24, 0x74, 0x82, 0x32, 0x38, 0x01, 0xD5, 0x00, 0x20, 0x02, 0xE0, 0x7D, 0x28, 0x00, 0xDD,
381 |                0x7D, 0x20, 0xB2, 0xF8, 0xEC, 0x60, 0x7D, 0x24, 0x26, 0xB1, 0xB2, 0xF8, 0xEC, 0x20, 0x01, 0x2A,
382 |                0x0B, 0xD0, 0x13, 0xE0, 0xD1, 0xE9, None, 0x21, 0x52, 0x1A, 0x42, 0x43, 0x92, 0xFB, 0xF4, 0xF0,
383 |                0x08, 0x44, 0x29, 0x68, 0x02, 0xF0, None, None, 0x08, 0xE0, 0x4A, 0x8C, 0x89, 0x8C, 0x52, 0x1A,
384 |                0x42, 0x43, 0x92, 0xFB, 0xF4, 0xF0, 0x40, 0x18, 0x00, 0xD5, 0x00, 0x20, 0x19, 0x68, 0x09, 0x1A,
385 |                0x19, 0x68, 0x01, 0xD5, 0x41, 0x1A, 0x00, 0xE0, 0x09, 0x1A, 0x4F, 0xF4, 0x96, 0x72, 0x91, 0x42,
386 |                0x05, 0xDD, 0x19, 0x68, 0x81, 0x42, 0x00, 0xDD, 0x52, 0x42, 0x18, 0x68, 0x10, 0x44, 0x18, 0x60,
387 |                0xF0, 0xBD, 0x1C, 0x60, 0x74, 0x82, 0xF0, 0xBD, *[None] * 4 * 5]
388 |         ofs = FindPattern(self.data, sig)
389 | 
390 |         ofsa = ofs + len(sig) - (4 * 5)
391 |         addr1, addr2, addr3, addr4, addr5 = struct.unpack('<LLLLL', self.data[ofsa:ofsa + 20])
392 | 
393 |         # STRH.W (T2)  Rt, [Rn, #imm12]
394 |         addr1_ofs1 = struct.unpack('<H', self.data[ofs + 6 + 2:ofs + 6 + 2 + 2])[0] & 0xFFF
395 | 
396 |         # LDRB (T1)  Rt, [Rn, #imm5]
397 |         addr2_ofs1 = (struct.unpack('<H', self.data[ofs + 12:ofs + 12 + 2])[0] >> 6) & 0x1F
398 | 
399 |         # STR (T1)  Rt, [Rn, #imm5]
400 |         addr2_ofs2 = (struct.unpack('<H', self.data[ofs + 30:ofs + 30 + 2])[0] >> 6) & 0x1F
401 |         addr2_ofs2 *= 4 # ZeroExtend '00'
402 | 
403 |         # STRH (T1)  Rt, [Rn, #imm5]
404 |         addr4_ofs1 = (struct.unpack('<H', self.data[ofs + 34:ofs + 34 + 2])[0] >> 6) & 0x1F
405 |         addr4_ofs1 *= 2 # ZeroExtend '0'
406 | 
407 |         ret[0]['addrs'] = {
408 |                         '1': [hex(addr1), hex(addr1 + addr1_ofs1)],
409 |                         '2': [hex(addr2), hex(addr2 + addr2_ofs1), hex(addr2 + addr2_ofs2)],
410 |                         '3': [hex(addr3)],
411 |                         '4': [hex(addr4), hex(addr4 + addr4_ofs1)],
412 |                         '5': [hex(addr5)]
413 |                         }
414 | 
415 |         asm = f'''
416 |                 LDR    R3, ={hex(addr2 + addr2_ofs1)}
417 |                 LDRB   R3, [R3]
418 |                 CBNZ   R3, loc_ret
419 |                 AND    R2, R3, #0xFF
420 |                 LDR    R3, ={hex(addr3)}
421 |                 LDR    R1, [R3]
422 |                 CMP    R1, #0
423 |                 BLT    loc_1
424 |                 PUSH   {{R4, R5}}
425 |                 LDR    R1, ={hex(addr4 + addr4_ofs1)}
426 |                 LDR    R5, ={hex(addr2 + addr2_ofs2)}
427 |                 MOVS   R4, #1
428 |                 SUBS   R0, #0x32
429 |                 STR    R2, [R5]
430 |                 STRH   R4, [R1]
431 |                 BMI    loc_3
432 |                 LDR    R2, ={hex(eco_addr)}
433 |                 CMP    R0, #0x7D
434 |                 LDRB   R2, [R2]
435 |                 IT     GE
436 |                 MOVGE  R0, #0x7D
437 |                 CMP    R2, R4
438 |                 BEQ    loc_2
439 |                 MOVS   R3, #0x96
440 |                 MUL    R3, R3, R0
441 |                 LDR    R2, ={hex(addr5)}
442 |                 STR    R3, [R2]
443 | 
444 |                 loc_popret:
445 |                 POP    {{R4, R5}}
446 | 
447 |                 loc_ret:
448 |                 BX     LR
449 | 
450 |                 loc_1:
451 |                 LDR    R1, ={hex(addr5)}
452 |                 ADD.W  R3, R3, #0x1580
453 |                 ADDS   R3, #0x12
454 |                 STR    R2, [R1]
455 |                 STRH   R2, [R3]
456 |                 BX     LR
457 | 
458 |                 loc_2:
459 |                 MOVW   R4, #0x1AF4
460 |                 MOVS   R2, #0x64
461 |                 MUL    R2, R2, R0
462 |                 LDR    R1, ={hex(addr5)}
463 |                 STR    R2, [R1]
464 |                 LDR    R2, [R3]
465 |                 CMP    R2, R4
466 |                 BLE    loc_popret
467 |                 LDR    R3, [R3]
468 |                 LDR    R2, [R1]
469 |                 SUB.W  R3, R3, #0x1AE0
470 |                 SUBS   R3, #0x14
471 |                 ADD.W  R3, R3, R3, LSL#2
472 |                 SUB.W  R3, R2, R3, LSL#1
473 |                 STR    R3, [R1]
474 |                 B      loc_popret
475 | 
476 |                 loc_3:
477 |                 LDR    R3, ={hex(addr5)}
478 |                 MVN    R2, #0x9
479 |                 STR    R2, [R3]
480 |                 B      loc_popret
481 |         '''
482 | 
483 |         res = self.ks.asm(asm)
484 |         assert len(res[0]) <= len(sig), 'new code larger than old code, this won\'t work'
485 |         assert len(res[0]) == 164, 'hardcoded size safety check, if you haven\'t changed the ASM then something is wrong'
486 | 
487 |         # pad with zero for no apparent reason
488 |         padded = bytes(res[0]).ljust(len(sig), b'\x00')
489 | 
490 |         ret[0]['len_sig'] = len(sig)
491 |         ret[0]['len_res'] = len(res[0])
492 |         ret[0]['res_inst'] = res[1]
493 | 
494 |         self.data[ofs:ofs+len(padded)] = bytes(padded)
495 | 
496 |         # additional russian change
497 |         sig = [0x07, 0xD0, 0x0B, 0xE0, 0x00, 0xEB, 0x40, 0x00, 0x40, 0x00, 0x05, 0xE0]
498 |         mask= [0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]
499 |         ofs = FindPattern(self.data, sig, mask) + 8
500 |         pre = self.data[ofs:ofs+2]
501 |         post = bytes(self.ks.asm('NOP')[0])
502 |         self.data[ofs:ofs+2] = post
503 |         ret.append((ofs, pre, post))
504 | 
505 |         return ret
506 | 
507 | 
508 | def eprint(*args, **kwargs):
509 |     print(*args, file=sys.stderr, **kwargs)
510 | 
511 | if __name__ == "__main__":
512 |     import sys
513 |     if len(sys.argv) != 3:
514 |         eprint("Usage: {0} <orig-firmware.bin> <target.bin>".format(sys.argv[0]))
515 |         exit(1)
516 | 
517 |     with open(sys.argv[1], 'rb') as fp:
518 |         data = fp.read()
519 | 
520 |     cfw = FirmwarePatcher(data)
521 | 
522 |     cfw.kers_min_speed(45)
523 |     cfw.speed_params(31, 50000, 30000, 26, 40000, 20000)
524 |     cfw.brake_params(115, 8000, 50000)
525 |     cfw.voltage_limit(52)
526 |     cfw.motor_start_speed(3)
527 |     cfw.instant_eco_switch()
528 |     #cfw.boot_with_eco()
529 |     #cfw.cruise_control_delay(5)
530 |     #cfw.cruise_control_nobeep()
531 |     cfw.remove_hard_speed_limit()
532 |     #cfw.remove_charging_mode()
533 |     #cfw.stay_on_locked()
534 |     #cfw.bms_uart_76800()
535 |     #cfw.russian_throttle()
536 |     #cfw.wheel_speed_const(315)
537 | 
538 |     # Don't flash encrypted firmware to scooter running firmware < 1.4.1
539 |     #cfw.encrypt()
540 | 
541 |     with open(sys.argv[2], 'wb') as fp:
542 |         fp.write(cfw.data)
543 | 


--------------------------------------------------------------------------------