├── README.md └── scooter └── scooter.ino /README.md: -------------------------------------------------------------------------------- 1 | # Voi Scooter Hack 2 | 3 | Recently we've got one of the Voi Scooter Voiager 1. 4 | Usually you have to unlock them with your smartphone and the right app, so we tried to bypass this. 5 | **We were successful.** 6 | 7 | We did a lot of investigation, but this is only the final writeup. 8 | 9 | ![IMG_20190810_124650](https://user-images.githubusercontent.com/53583708/62821286-015cc180-bb73-11e9-92af-c33dca10b4fa.jpg) 10 | 11 | First we removed the black controll box, unscrewed it and removed the interior. We kept the black cable with the green plug. 12 | 13 | ![IMG_20190810_125655](https://user-images.githubusercontent.com/53583708/62821347-bf804b00-bb73-11e9-9658-e9b63131ea33.jpg) 14 | 15 | The cable colors are: 16 | 17 | ``` 18 | RED -> +34VDC 19 | BLACK -> GND 20 | BLUE -> ENABLE 21 | YELLOW -> TX (3.3V !!) 22 | GREEN -> RX 23 | ``` 24 | 25 | We added a buck converter to reduce the Voltage from 34V to 3.3V. 26 | This is powering an Arduino Pro Mini and a HC-06 bluetooth module. 27 | 28 | ``` 29 | GREEN -> Arduino D10 30 | YELLOW -> Arduino D11 31 | BLUE -> Arduino D12 32 | ``` 33 | 34 | The bluetooth module is connected as follows: 35 | 36 | ``` 37 | BT TX -> Arduino D8 38 | BT RX -> Arduino D9 39 | ``` 40 | 41 | On Pin D3 we attached the already existing Buzzer. 42 | 43 | ![IMG_20190810_130433](https://user-images.githubusercontent.com/53583708/62821441-26523400-bb75-11e9-964a-fd15916d9900.jpg) 44 | 45 | ![IMG_20190810_130425](https://user-images.githubusercontent.com/53583708/62821484-f22b4300-bb75-11e9-830d-130dfea5b490.jpg) 46 | 47 | We've added an IMU for shaking recognition as anti theft, but it is not implemented yet. 48 | 49 | The rest of the magic is happening in the code. 50 | Ask if you've got questions. 51 | 52 | ## Future improvements 53 | 54 | - IMU implementation 55 | - Powersafing mode for bluetooth 56 | - Use ENABLE pin for deactivation on charging 57 | - Replace bluetooth with NFC 58 | 59 | -------------------------------------------------------------------------------- /scooter/scooter.ino: -------------------------------------------------------------------------------- 1 | #include 2 | #include "SparkFunLSM6DS3.h" 3 | #include "Wire.h" 4 | 5 | #define BUZ 3 6 | 7 | //Bluetooth serial 8 | #define BT_RX 8 9 | #define BT_TX 9 10 | 11 | //Motorcontroller pins 12 | #define MC_RX 10 13 | #define MC_TX 11 14 | #define EN 12 //dlock pin. if high scooter is up and running. if low, charging mode, motorcontroller deactivated 15 | 16 | #define HOLD 0.01 17 | 18 | SoftwareSerial bt(BT_RX, BT_TX); 19 | SoftwareSerial mc(MC_RX, MC_TX); 20 | 21 | LSM6DS3 IMU; 22 | 23 | 24 | byte standby[] = {0x60, 0x03, 0x00, 0x92, 0x00, 0x00, 0x56, 0xEC}; 25 | 26 | byte start_0[] = {0x60, 0x03, 0x01, 0xE2, 0x00, 0x01, 0x00, 0x1D, 0x71}; 27 | byte start_1[] = {0x60, 0x03, 0x01, 0xE1, 0x00, 0x01, 0xF1, 0xDD, 0xB0}; 28 | 29 | byte stop_0[] = {0x60, 0x03, 0x01, 0xE2, 0x00, 0x01, 0x01, 0xDD, 0xB0}; 30 | byte stop_1[] = {0x60, 0x03, 0x01, 0xE1, 0x00, 0x01, 0xF0, 0x1D, 0x71}; 31 | byte stop_2[] = {0x60, 0x03, 0x01, 0xE2, 0x00, 0x01, 0x00, 0x1D, 0x71}; 32 | 33 | bool state = 0; 34 | bool EnState = 1; 35 | 36 | //float param = {0, 0, 0}; 37 | 38 | void setup() { 39 | pinMode(BUZ, OUTPUT); 40 | pinMode(EN, OUTPUT); 41 | 42 | Serial.begin(9600); 43 | bt.begin(9600); 44 | mc.begin(9600); 45 | 46 | IMU.begin(); 47 | 48 | //enable dlock and lock 49 | digitalWrite(EN, HIGH); 50 | mc.write(stop_1, 9); 51 | 52 | /* 53 | param[0] = IMU.readFloatAccelX(); 54 | param[1] = IMU.readFloatAccelY(); 55 | param[2] = IMU.readFloatAccelZ(); 56 | */ 57 | } 58 | 59 | void loop() { 60 | //select bluetooth rx and look for command 61 | bt.listen(); 62 | if (bt.available()) { 63 | String rec = bt.readString(); 64 | rec.trim(); 65 | 66 | if(rec.equals("Start") && !state){ 67 | state = 1; 68 | 69 | Serial.println("START!"); 70 | mc.write(start_1, 9); 71 | bt.println("started!"); 72 | 73 | //make sound 74 | digitalWrite(BUZ, HIGH); 75 | delay(400); 76 | digitalWrite(BUZ, LOW); 77 | delay(200); 78 | digitalWrite(BUZ, HIGH); 79 | delay(100); 80 | digitalWrite(BUZ, LOW); 81 | 82 | }else if(rec.equals("Stop") && state){ 83 | state = 0; 84 | 85 | Serial.println("STOP!"); 86 | mc.write(stop_1, 9); 87 | bt.println("stopped!"); 88 | 89 | //make sound 90 | digitalWrite(BUZ, HIGH); 91 | delay(100); 92 | digitalWrite(BUZ, LOW); 93 | delay(200); 94 | digitalWrite(BUZ, HIGH); 95 | delay(400); 96 | digitalWrite(BUZ, LOW); 97 | 98 | }else if(rec.equals("Enable") && !EnState){ 99 | EnState = 1; 100 | 101 | Serial.println("ENABLE!"); 102 | digitalWrite(EN, HIGH); 103 | bt.println("enabled!"); 104 | }else if(rec.equals("Disable") && EnState){ 105 | EnState = 0; 106 | 107 | Serial.println("DISABLE!"); 108 | digitalWrite(EN, LOW); 109 | bt.println("disabled!"); 110 | } 111 | } 112 | 113 | } 114 | --------------------------------------------------------------------------------