fgorina/9BMetrics

Change Serial Number

Closed this issue · 30 comments

Nice source! You can add changing Serial Number?
Tip: If you have Ninebot One E and change Serial Number on "N1OP...", max speed will be ~30 km/h

ILYA do you have a One P Serial number to test?

Yes, My Ninebot One E (with serial number N1OP) is ready!

img_7302
img_7301

I did start editing serial number via application, and accidentally change 3 character from "O" on "E" 😂
img_7303

My test code for changing character of serial number:

    func setModel(model : String){
        if model != "C" && model != "E" && model != "P"  {
            return
        }

        let b0 = UInt8(Int(UnicodeScalar("O").value))
        let b1 = UInt8(Int(UnicodeScalar( (model != "E") ? "P" : "E").value))

        // That write Model

        var message = BLENinebotMessage(commandToWrite: UInt8(17), dat:[b0, b1] )
        if let dat = message?.toNSData(){

            NinebotBluetoothHelper.writeValueForNinebot(dat)
        }

        // Get value to see if it is OK
        message = BLENinebotMessage(com: UInt8(17), dat:[UInt8(2)] )
        if let dat = message?.toNSData(){
            NinebotBluetoothHelper.writeValueForNinebot(dat)
        }
    }

That means using the same serial number and changir N2OE to N2PE works?

I supose there is som calculation to get the Verification Code or similar?

It is necessary to change the fourth symbol to the desired character (C/E/P). After that unlocks a specific speed limit (C ~19km/h, E ~ 22, P ~ 30). I was convinced by the programmer.
img_6960
img_6959

About serial numbers (1-4 symbols):
N1OC - Ninebot One C
N2OC - Ninebot One C+
N1OE - Ninebot One E
N2OE - Ninebot One E+
N1OP - Ninebot One P
N2OP - Ninebot One P (new party)

That seems good. So the question is if the verification code must be sent to the wheel or not. If it is NOT sent to the wheel (so I don't need to look for it) it whould be easy to adapt 9BMetrics to change the Serial Number but I need a verification code to be able to test it with the software in the middle to know the codes it sends.

Probably just writing the variables. should be ok if there are no checks

Probably there are no checks, because I change SN to "P" 2 month ago, and Ninebot app did not resist it :)

Did it forced the “AditionalCode” or not?

Francisco Gorina Vanrell

+34 619 79 01 58
fgorina@gmail.com

El 18 maig 2016, a les 22:32, ILYA notifications@github.com va escriure:

Probably there are no checks, because I change SN to "P" 2 month ago, and Ninebot app did not resist it :)


You are receiving this because you commented.
Reply to this email directly or view it on GitHub #2 (comment)

Additional and Verification Code uses for official method for change SN (via Ninebot Activation Service). It is not for us. We will replace the SN directly

I do it but it seems wants the Verification Code to change it. At least in my machine

OK Will modify the program and try to change the 4 first letters. See if it sticks!!!

Thanks!

Sample code for change third symbol to "A"

    func setThirdSymbolToA(){
        let b0 = UInt8(Int(UnicodeScalar("A").value))

        // That write Model

        var message = BLENinebotMessage(commandToWrite: UInt8(17), dat:[b0] )
        if let dat = message?.toNSData(){
            NinebotBluetoothHelper.writeValueForNinebot(dat)
        }

        // Get value to see if it is OK
        message = BLENinebotMessage(com: UInt8(17), dat:[UInt8(1)] )
        if let dat = message?.toNSData(){
            NinebotBluetoothHelper.writeValueForNinebot(dat)
        }
    }

img_7304

I have tried and for the moment the change doesn't appears. Perhaps I amn doing something erroneus.. Will continue tomorrow

SN changes only after bluetooth reconnect. Check this.

I am able to change the 3rd character (N2OE -> N2PE) for example and back but unable to change the fourth. Don't know the reason for the moment.

When changing the name everything works correct.

Problem is variable 17 has 2 values, the O and the E. Changing the first no problem. Changing the two doesn't work, Must see if I get some error code from the wheel, not that I understand them anyway

I am too.

You not getted error from Ninebot, because using CBCharacteristicWriteType.WithoutResponse on write method.
Unfortunately, I can't change CBCharacteristic for set write access via
let writableCharacteristic = CBMutableCharacteristic(type: characteristic.UUID, properties: [.Read, .Write, .Notify], value: characteristic.value, permissions: [.Readable, .Writeable])

I Believe errors come through another variable number. Will try to get them

The characteristic flags seem fixed by the NB.

Francisco Gorina Vanrell

+34 619 79 01 58
fgorina@gmail.com

El 19 maig 2016, a les 10:15, ILYA notifications@github.com va escriure:

I am too.

You not getted error from Ninebot, because using CBCharacteristicWriteType.WithoutResponse on write method.
Unfortunately, I can't change CBCharacteristic for set write access via
let writableCharacteristic = CBMutableCharacteristic(type: characteristic.UUID, properties: [.Read, .Write, .Notify], value: characteristic.value, permissions: [.Readable, .Writeable])


You are receiving this because you commented.
Reply to this email directly or view it on GitHub #2 (comment)

Hm, may be via kvCodeError or kvCodeWarning ...

Francisco, how's it going with the change serial number?

Maybe it will help to change the serial number. I did dump firmware from my Ninebot One E (before changing SN on "P").
Here it can be seen the address values of the serial number. If you want, I can send the firmware file.
2016-06-14 12 32 53

I will try to write it in one op to see if it works.

Enviat des del meu iPhone

El 14 juny 2016, a les 11:36, ILYA notifications@github.com va escriure:

Maybe it will help to change the serial number. I did dump firmware from my Ninebot One E (before changing SN on "P").
Here it can be seen the address values of the serial number. If you want, I can send the firmware file.


You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

Seems that the positions from address 245760 are the same as the first 128 bytes of the answer array.

I have modified the program to write a full new serial number (14 bytes) so this night at home will try it

Hope it works

Francisco Gorina Vanrell

+34 619 79 01 58
fgorina@gmail.com

El 14 juny 2016, a les 11:36, ILYA notifications@github.com va escriure:

Maybe it will help to change the serial number. I did dump firmware from my Ninebot One E (before changing SN on "P").
Here it can be seen the address values of the serial number. If you want, I can send the firmware file.


You are receiving this because you commented.
Reply to this email directly, view it on GitHub #2 (comment), or mute the thread https://github.com/notifications/unsubscribe/AAV8Uy3gPYXLqa84VHtsmhRK1iPRJ8lxks5qLnYQgaJpZM4IVNeU.

I'm ready to be a tester ;)

I made the test and nothing.

Anyway I uploaded to GitHub the modifications so if you have XCode

- Clone the repository (branch Proves)
- Build and install
- When connected to the wheel go to settings (down left) and mthe new screen lets you enter a S/N ans push he button.

I have had no results. Will try to research more.

Regards

Francisco Gorina Vanrell

+34 619 79 01 58
fgorina@gmail.com

El 15 juny 2016, a les 9:29, ILYA notifications@github.com va escriure:

I'm ready to be a tester ;)


You are receiving this because you commented.
Reply to this email directly, view it on GitHub #2 (comment), or mute the thread https://github.com/notifications/unsubscribe/AAV8UzvOuJi6nyJZCchk-divH7sur6OSks5qL6nBgaJpZM4IVNeU.

Checked. While not working.

Why start to cause commands to write "17", not "16"? Serial number field starts with 16 command.
static let kSerialNo = 16 // 16-22

var message = BLENinebotMessage(commandToWrite: UInt8(17), dat:array )

Hey guys,
I just arrived on your thread. I have a xiaomi m365 scooter with a new motherboard and I have to change the Serial number to get it working (It works with Ninebot).
What would be the best way to achieve that? (I'm a software developer, just don't know where to start ;)) Thanks

hello anyone out there can help me with unlocking me ninebot e25 speed limit.. please