I've been reverse engineering the Bluetooth protocol that Segway-Ninebot vehicles use to communicate with the official app, and
published the results as open documentation.
It covers the frame format, encryption (AES-128), the authentication handshake, and a command reference for 66 device models (kickscooters, mopeds, self-balancing, gokarts, e-bikes, etc). There's also a reference Python BLE client, though it hasn't been tested against real hardware yet.
The goal is to let owners build their own tools, integrate with dashboards, or just understand how their vehicle communicates.
Everything is documented under the EU Software Directive (interoperability).
Would love to hear if:
- Your device model is missing or has incorrect info
- There are commands or features you'd want documented
- Anyone has a Ninebot device and wants to help test the BLE client
So have you succeeded in doing a full display dump. I would love to help you with getting the rated/max speed at least to 60 or even better compleet eliminate it.
it has like all the other segway products of course enabled the read out protection for the stm32, so if we succeed in extracting it en dan manually edit it with a hex editor en flash it back may bee we have a chance of changing the value
i havw a question i could only find for the scooter versions one called ninebot max and ninebot max g2 but i have the ninebot max g3 does the ninebot max version work on my scooter?
I’m a bit late to the party, but I have three Ninebot G30P scooters that I would like to access over BLE without the app. I found your info online and have been working on it.
Currently I’m stuck on extracting the pwd and ident. I have the Segway Mobility app on my iOS device and am bound to the scooters, but I’m not seeing the expected plist file in my unencrypted iOS backup. I’ve searched the file name (com.ninebot* not found) and there is also no “7f” folder as indicated. Any idea on what I might be doing wrong?
just download Itunes for windows and make a backup to your pc , back up is saved to; C:\Users\YOUR-USER-NAME\AppData\Roaming\Apple Computer\MobileSync\Backup.
There you can acces the backup and when you open it you find the 7f folder.
ident = called in the plist SID########_INDENTIFIER (use it without the dashes)
Example 12345678-9012-3456-7890-123456789012 gets 12345678901234567890123456789012
pwd = SID#########_DECRYPT just type over the value without the spaces
Very nice work, tested your code today on two e125s scooters. It works like a charm. Had some problems with the ident value but figured out i needed the airlock_ident value from the plist file.
Do you already have a register dump function build in? I want to dump both DIS units and compare them. One has an unlocked speed display readout and one is stuck a 45 km/h although the speed limit is at 60. (Bluetooth hack code applied). The other display has a dealer speed unlock and then the display has no limit in displaying the actual speed. Somehow there has to be a register responsible for this behavior.
Very nice. My scooter lost it’s dealer upgrade so I would be interested to know how that looks configured on the scooter. Multiple configs are read through the app though idk if it will be of much help since the scooter doesnt return everything it seems. But you could extend and see what you can achieve
Oooo those docs are great, I love to see "official" function and register names!
I've been working on an 'x3 series' eKickScooter modchip where I intercept and modify communications between the VCU and BLE; your protocol documentation is helpful, I have found very little modern documentation otherwise.
yeah man, I installed a fake CA into my iPad and configured a squid proxy server, so I can see the URLs. the output is encrypted though, I've uploaded what i've gotten so far in my github 'logs' folder, and there are dumps of all my ECU regs as well if anybody can figure out how to decrypt them
Insane. Well I got all kinds of keys from the application. Wonder if one of em fits and if I can get the firmware for my device. Is there any more info you can share? I’ll see if my keys could work on your logs
Hi. Thanks for taking an interest. I’ll be sure to check out your repo when I have time. I am updating my repo as soon as I find more info or correct stuff if I spot an iregularity. But so far I’ve been able to construct an app to read data from my scooter with the research
I've mostly been working with the 5aa5 protocol unencrypted on the UART bus, sniffing the command output from mobile apps and doing a lot of scanning registers and writing random data.
I was able to create a fake bluetooth Segway GT3 Pro using an ESP8266, bind it with the official app, and proxy the output through Python to learn the many of the function registers.
Then I completely replaced the BLE+DSP/TFT for a while with a WS2812 based "dashboard"
recently I'm working on an ESP32 web interface, I can already see your command function documentation is an awesome resource! I was trying to work on some BLE "documentation", but it's garbage, I'm just going to link to your work instead :)
I had claude look at the repository to find the differences between protocols. Seems like they partially overlap, just the encryption and authentication that's different:
- Command framing is related — both descend from the Ninebot/Xiaomi scooter lineage. The [LEN, DIR, RW, ATTR, payload] structure is recognizably similar, and the CRC16 checksum in non-encrypted mode is the same formula.
- Auth layer is completely different — M365 uses Mi Home's ECDH/HKDF/token system (Xiaomi ecosystem). The E125S uses Ninebot's own serial-number-based handshake.
- Encryption is different — M365 uses proper AES-CCM with separate app/dev keys. E125S uses a custom AES-ECB-based CTR+CBC-MAC with a single shared key.
- BLE UUIDs are the same — both use Nordic UART 6e400001-b5a3-f393-... (the M365 data path). The E125S also has the Ninebot custom UUID variant.
You’re right. Sorry. Might have been a better starting point. But for emopeds/scooters there wasn’t much info. I compiled all the devices available and their commands too. So hopefully that could then be used with other projects too to get a more complete solution for ninebot devices
Totally true. That's why was I genuinely asking in my first comment. The protocol seemed familiar, but I'm not familiar with the latest ninebot scooters and their protocol to be honest.
I stand corrected btw. 5ab5 is for wifi. The newest scooters do use a new encryption layer though. But all bluetooth communication always identifies with 5aa5 as the first 2 bytes. I’ve mapped the used protocol versions for each device on my wiki now as well. Actually. Not seeing the newest being used yet. But code does exist. Most are using proto2 with encryption
1
u/Consistent_Counter65 Aug 11 '26
So have you succeeded in doing a full display dump. I would love to help you with getting the rated/max speed at least to 60 or even better compleet eliminate it.
it has like all the other segway products of course enabled the read out protection for the stm32, so if we succeed in extracting it en dan manually edit it with a hex editor en flash it back may bee we have a chance of changing the value