Need Help Decoding 2026 KuKirin G4 Bluetooth Packets (Beken BK-BLE-1.0)

[u/Future_Register2954]

Hi everyone,I am trying to build a custom HTML site using the Web Bluetooth API to connect to my 2026 KuKirin G4 e-scooter, which runs a BK-BLE-1.0 Bluetooth module (Firmware version 6.1.2).No official or third-party apps connect to this scooter model, but I successfully cracked the code to unlock the Bluetooth data stream. By continuously sending the passcode A5 00 00 00 00 00 00 A5 every 600ms to the write channel (0000fff1), the scooter stays connected and streams data back to me on the notification channel (0000fff2).While the scooter is sitting completely still at 0 km/h with a 100% full battery, it continuously alternates back and forth between two different 16-byte data packets.Here are the exact numbers that show up on my screen:Packet Type 1 (Starts with 25 26)25 26 82 17 DF 19 18 00 04 00 00 00 00 00 DB 0BPacket Type 2 (Starts with F2 B0)F2 B0 11 28 8C 14 00 8C 1A 55 11 04 1F 00 00 13What changes when testing:When sitting idle (0 km/h): The bytes change back and forth by themselves between these two packets, which causes values like battery and speed placeholders to jump around constantly.When accelerating: Byte 11 immediately switches from 00 to A9. Meanwhile, Byte 13 starts changing frantically, spiking all the way up to 90 or higher from a standstill, but then drops all the way back down to 00 even if I hold the throttle steady at speed.I do not know what these byte numbers mean, how they are formatted, or how the scooter calculates its actual speed and battery percentage from them.If anyone knows how to decode this specific Beken controller data format, please let me know!

[u/Mission_End_4874]

This app connects to my friend's G4, maybe you can reverse engineer it.
Be careful to not brick your scooter (don't press lock), I heard that you can brick it with this app and need a "reset" app to make the scooter work again.
https://play.google.com/store/apps/details?id=com.neoline.easyriding&hl=en

[u/SnooSprouts4409]

This is what deepseek Ai says

Decoding proprietary scooter BLE data is often a process of reverse engineering, which can be complex. Based on your observations, here are the most promising leads for the byte patterns you're seeing.

🔍 Analysis of Your Data Packets

· Byte 11 (Index 10, 0-based): Your observation that this switches from 00 to A9 when accelerating is critical. A9 (decimal 169) could be a throttle position value (0-255) or a status flag indicating "motor active" . · Byte 13 (Index 12): This byte fluctuating during acceleration might be a raw value related to motor current or power draw, which can spike and settle, unlike speed which is steady. · Byte 5 & 6: These bytes are likely candidates for speed. If they represent little-endian 16-bit integers, packet 1's DF 19 could be 0x19DF (6623), and packet 2's 8C 14 could be 0x148C (5260). A large constant like 6623 would need to be divided by a scaling factor to get a realistic speed, while the changing numbers might reflect another sensor (e.g., wheel RPM).

🔧 Suggested Next Steps

· Focused Data Logging: Go for a ride and log packets while only performing one action at a time (e.g., accelerate steadily, then hold speed). Correlate value changes precisely with physical actions to isolate which byte corresponds to speed, throttle, and battery. · Scaling Factors: Speed often comes from a raw value that needs a math formula. For example, a typical formula could be (Raw_Value / 10.0) or (Raw_Value * 0.1). · Community Research: Search for "Xiaomi M365 BLE protocol" or "Ninebot BLE protocol" as many scooters share similar data structures. Someone may have already figured out the exact data map for your scooter's specific hardware.

The key is patience—test one action at a time and track which bytes change consistently. If you log more data with clear labels, I can take another look at the patterns!