The author performed a reverse engineering analysis of the Egret GT electric scooter, focusing on its firmware and hardware components. The study began with an investigation of the scooter's mobile application, which communicates via Bluetooth to manage settings, monitor battery levels, and perform firmware updates for the display, controller, and button panel.
Data analysis revealed that the scooter transmits metrics—including motor current, battery voltage, and charging history—to the manufacturer without user notification. The author also discovered that the scooter's VIN is assigned by the mobile app upon connection, allowing for potential spoofing of different scooter models, though speed limit restrictions remained unaffected by this method.
Hardware investigation of the display unit revealed that its USB-C port, marketed for charging, actually utilizes two pins as a CAN bus. The author intercepted this traffic using an ESP32-C6, SN65HVD230, and MCP2515 setup. By visualizing the CAN bus data, the author identified specific IDs for throttle position, driving modes, and motor speed.
To gain deeper access, the author purchased a spare motor controller and disassembled it. The device contained an APM32E103xCxE microcontroller, a clone of the STM32F103. Using the SWD port, the author dumped the flash memory and RAM contents to analyze the firmware structure using Ghidra, ultimately mapping the communication protocols and system functions.
