Accessing and Modifying Parameters on STM32FEB-Based Ebike Controller

[eminko]

Hello everyone,


I’m trying to read and possibly modify the parameters of my ebike motor controller, which uses a microcontroller labeled STM32FEB (specifically STM32F103C6T6 on the chip).


On the PCB, there are two labeled pads: TX (SCL) and RX (SDA). Tracing these with a multimeter shows they are connected through resistors to pins 42 (PB6/SCL) and 43 (PB7/SDA) on the STM32 chip, which suggests an I²C interface.


Additionally, there are four unlabelled pads on the PCB. After testing continuity, I found that:

• One pad connects to pin 34 (SWDIO),
• Another to pin 37 (SWCLK),
• A third one is connected to pins 1, 8, 24, 36, and 48, which I believe are GND,
• The fourth seems to have momentary continuity to the same GND pins and continuous continuity to pins 43 and 47.

I would appreciate any guidance on:

• What tools (e.g., ST-Link, logic analyzer, USB-to-I2C, etc.) I should use,
• What software is recommended to read or write to this controller,
• And any experiences or known firmware/protocols used on STM32-based ebike controllers.

Thanks in advance for your help!

 

[amberwolf]

You should probably look at all the open-source firmware threads for various controllers/displays/etc; it's likely all the available answers are in those. There are some for KT / KunTeng, LS / LiShui, TSDZ, etc.

 

[stancecoke]

I’m trying to read and possibly modify the parameters of my ebike motor controller, which uses a microcontroller labeled STM32FEB

The EBiCS firmware was written for this processor. Wether you can read out the memory, depends on the ROP (read out protection) setting. Some manufacturers set it to protect their IP. There are methods to hack it, but I never tried it.
The STM32F103 has no EEPROM to store individual settings, normal flash pages can be used as a "virtual EEPROM", there are code examples from STM. With this you can't modify single memory addresses, you can only write each address once, if you want to rewrite, you have to erase the whole page an then write the complete page again.

Home

Free FOC firmware for Lishui E-Bike-Controllers. Contribute to EBiCS/EBiCS_Firmware development by creating an account on GitHub.

github.com

Regards
stancecoke

 

[eminko]

EBiCS aygıt yazılımı bu işlemci için yazılmıştır. Belleği okuyabilmeniz, ROP (okuma koruması) ayarına bağlıdır. Bazı üreticiler bunu IP'lerini koruyacak şekilde ayarlar. Bunu hacklemenin yöntemleri vardır, ancak ben hiç denemedim.
STM32F103'ün bireysel ayarları saklamak için EEPROM'u yoktur, normal flash sayfaları "sanal EEPROM" olarak kullanılabilir, STM'den kod örnekleri vardır. Bununla tek tek bellek adreslerini değiştiremezsiniz, her adresi yalnızca bir kez yazabilirsiniz, yeniden yazmak isterseniz tüm sayfayı silmeniz ve ardından tüm sayfayı tekrar yazmanız gerekir.

Home

Free FOC firmware for Lishui E-Bike-Controllers. Contribute to EBiCS/EBiCS_Firmware development by creating an account on GitHub.

github.com

Saygılarımla
duruş kok

Thanks for the response. Could you please explain the applications mentioned in the link you shared in more detail? Or if there's someone who can walk me through the process, I’d really appreciate the help. I’ve already erased everything from the controller and disabled the read protection. Now I’m not sure where to begin."

 

[stancecoke]

Could you please explain the applications mentioned in the link you shared in more detail?

?! What is missing in the tutorial in the GitHub wiki?

Of course at the very beginning, you have to reengineer the pin function of the processor.
If you are using a Lishui, I've done it for you already