Any web developers/programmers? Need help to download EKD01 display firmware

jbogator

New here
Joined
Jul 14, 2023
Messages
20
Location
Manila
I think my display is a "lemon" and im unable to update the firmware using the bikego app.

I ran packet captures to get the url the app is connecting to

http://47.88.15.150:8866/bikego-api...n=EKD01_BF_V15&controllerVersion=&otaVersion=

Using my browser, i get the following response

{"code":0,"msg":"success","data":[{"id":"1793461597712252930","packageName":"EKD01_BF_V15-EKD01_BF_V22-1716429145_ke","companyName":"阿科思迈","companyCode":"BF","meterModelCode":"EKD01","originVersion":15,"targetVersion":22,"packageType":"MCU","packageSize":88,"packagePath":"20240523/0e2d5f5588a64067aaf9bae9a7cf70a9.pack","description":"EKD01_BF_V15-EKD01_BF_V22-1716429145_ke","downloadCount":27,"installCount":26,"remark":"","status":0,"createDate":"2024-05-23 09:59:00"}]}

According to my limited coding knowledge, this response tells me there is a download available. I need help downloading the *.pack file so i can update my display firmware manually via the bikego app
 
Solution
I got it! I got the firmware files and i was able to update my display.

Here's the link to download. This is a zip file that contains the firmware for EKD01/B02N UART display, an instruction manual, com port drivers and the update tool.

You will need a usb c to usb a cable to connect to your PC.

The PDF manual is very easy to follow.

Disclaimer: i'm not responsible if your display gets bricked. Proceed at your own risk

Note: the link will expire in 13 days

网易邮箱超大附件下载
If you could get another one of the displays that works, you could trace a real response and copy it.

Otherwise, that's a blob of JSON that some piece of code in the controller is supposed to respond to to pull the update.
We know the filename, but not how to get it. This JSON blob doesn't explain how to get it.

That part is not easy to find, without a working stunt double, you'll probably need to:
- somehow dump the program code and disassemble it and trace it.
- run a fuzzer on that website to discover what commands it responds to and hope you don't get banned for excessive requests.

In either case it would be a lot easier to just get a new display.
If you called my dev shop and asked me to do this for you, i'd tell you to not waste your money on my services. This is a job for a highly skilled person with a lot of free time on their hands.
 
I know someone with a working display but he has already updated to the latest firmware and no longer gets the "update is available" prompt.

You may be right, easier to just buy a new one.

I found a firmware converting this display from bafang to tongsheng but not the other way around. Close but no cigar
 
That blob indicates it's been over a year since last update. I'm not gonna hold my breath

I guess i'm just gonna have to live with it until i can purchase a new one

Thanks for your inputs
 
I got it! I got the firmware files and i was able to update my display.

Here's the link to download. This is a zip file that contains the firmware for EKD01/B02N UART display, an instruction manual, com port drivers and the update tool.

You will need a usb c to usb a cable to connect to your PC.

The PDF manual is very easy to follow.

Disclaimer: i'm not responsible if your display gets bricked. Proceed at your own risk

Note: the link will expire in 13 days

网易邮箱超大附件下载
 
Solution
I got it! I got the firmware files and i was able to update my display.

Here's the link to download. This is a zip file that contains the firmware for EKD01/B02N UART display, an instruction manual, com port drivers and the update tool.

You will need a usb c to usb a cable to connect to your PC.

The PDF manual is very easy to follow.

Disclaimer: i'm not responsible if your display gets bricked. Proceed at your own risk

Note: the link will expire in 13 days

网易邮箱超大附件下载
Very cool that you found this. I know that finding particular software can be a challenge. You completed that challenge! Congrats on your triumph.
 
Very cool that you found this. I know that finding particular software can be a challenge. You completed that challenge! Congrats on your triumph.
Yes sir! I've been nerding out about this for months. Truly satisfying! I'm so excited i even went back to a post on FB where some people were experiencing the same problem as me and gave this gem to them. Sharing is caring!

Now, forward looking. This display needs to have eggrider functionalities. 🤔
 
If you could get another one of the displays that works, you could trace a real response and copy it.

Otherwise, that's a blob of JSON that some piece of code in the controller is supposed to respond to to pull the update.
We know the filename, but not how to get it. This JSON blob doesn't explain how to get it.

That part is not easy to find, without a working stunt double, you'll probably need to:
- somehow dump the program code and disassemble it and trace it.
- run a fuzzer on that website to discover what commands it responds to and hope you don't get banned for excessive requests.

In either case it would be a lot easier to just get a new display.
If you called my dev shop and asked me to do this for you, i'd tell you to not waste your money on my services. This is a job for a highly skilled person with a lot of free time on their hands.
In your professional opinion, do we have enough data in this firmware in order to re-engineer it to make it have eggrider functions (bafang programming tool)?

I see a bunch of *.bin files. I know there are softwares out there that can read these.. I'm thinking we can reprogram and recompile.

Feasible?

Where should i start? What material should i research?
 
Maybe PowerISO would be work? There are others, but I’ve used this one the most.

You can mount bin files and see what all is inside. A .bin file is really only a container for other files. Then you might be able to find something a bit more manipulatable (that’s a word, right?). When you are done playing (via hex or text editor) with things, you can repack the .bin and see what happens.

PS, I am not responsible for what could (if anything) happen to your container. As with any other firmware manipulation, you could brick your device rendering it useless.
 
In your professional opinion, do we have enough data in this firmware in order to re-engineer it to make it have eggrider functions (bafang programming tool)?

I see a bunch of *.bin files. I know there are softwares out there that can read these.. I'm thinking we can reprogram and recompile.
Feasible?
Where should i start? What material should i research?

You need a programmer who understands assembly and reverse engineering. It would be multitudes less expensive, time/money wise, to just get the controller you want. That's an epic amount of effort for a small reward.

Here's why i don't know assembly:

learn assembly.png
 
I asked AI...

What programming language is used to make firmware for mediatek mt2502 controller?

The programming language used to develop firmware for the MediaTek MT2502 controller is primarily C.

The MT2502 is a System-on-Chip (SoC) designed for wearables and IoT devices, and firmware development typically leverages the MediaTek LinkIt™ Assist 2502 SDK, which provides a C-based API to access and control the hardware features of the MT2502A SoC and connected peripherals. The SDK supports development within environments like the Eclipse IDE with CDT plug-in, and the firmware runs on a Real-Time Operating System (RTOS) kernel, such as Nucleus RTOS, which is proprietary to MediaTek.

While some documentation suggests limited compatibility with Arduino IDE for certain development boards (e.g., LinkIt ONE), which uses a C/C++-like syntax, the core firmware development for the MT2502 relies on C for low-level hardware control and efficiency.

How hard is it for a beginner to reverse engineer a firmware and reprogram it?

Reverse engineering and reprogramming firmware for a device like the MediaTek MT2502 is a challenging task for a beginner due to its technical complexity, specialized tools, and steep learning curve. Below, I’ll break down the difficulty, key steps, and skills required, keeping it concise yet comprehensive for someone new to the process.

Difficulty Level for a Beginner
High Difficulty: Reverse engineering firmware requires understanding low-level programming, hardware architecture, and specialized tools. It involves disassembling binary code, analyzing it, and modifying it without breaking functionality, which is daunting without prior experience.
Time Investment: Expect weeks to months to learn the basics, depending on your starting point and dedication. Practical success could take longer.
Prerequisites: Familiarity with programming (ideally C), basic electronics, and computer architecture is helpful. Without these, the learning curve is steeper.
Key Challenges
Obtaining the Firmware:
Extracting firmware from the MT2502 requires physical access to the device and tools like JTAG/SWD debuggers or serial interfaces. Beginners may struggle with hardware interfacing.
Some devices encrypt or obfuscate firmware, adding complexity.
Reverse Engineering:
Firmware is typically in binary format (machine code). You’ll need to use tools like IDA Pro, Ghidra, or Radare2 to disassemble and analyze it. These tools have a steep learning curve for beginners.
The MT2502 uses an ARM Cortex-M4 core, so you’d need to learn ARM assembly language to understand the disassembled code.
Lack of documentation for proprietary firmware (common with MediaTek) makes it harder to identify functions or data structures.
Modifying the Firmware:
Once analyzed, modifying firmware requires altering the binary code or rewriting parts in C, then recompiling. This demands knowledge of the MT2502’s memory layout, registers, and SDK (e.g., MediaTek LinkIt Assist 2502 SDK).
Mistakes can “brick” the device, rendering it unusable.
Reprogramming:
Flashing modified firmware back to the MT2502 requires tools like MediaTek’s proprietary flashing tools (e.g., SP Flash Tool) or open-source alternatives like OpenOCD. Setting up these tools and ensuring correct configurations is error-prone.
You may need to bypass security features like read protection or digital signatures.
Legal and Ethical Considerations:
Reverse engineering proprietary firmware may violate terms of service or local laws (e.g., DMCA in the U.S.). Beginners must research legal implications to avoid unintentional violations.
Skills and Tools Needed
Programming: Learn C (primary language for MT2502 firmware) and ARM assembly for low-level analysis.
Tools:
Disassemblers/Decompilers: Ghidra (free), IDA Pro (paid), or Radare2.
Debugging Hardware: JTAG/SWD debuggers (e.g., J-Link, ST-Link) for extracting firmware or debugging.
Flashing Tools: MediaTek SP Flash Tool or OpenOCD for reprogramming.
Hex Editors: Tools like HxD to manually inspect and edit binary files.
Emulators/Simulators: QEMU or ARM simulators to test firmware without hardware.
Knowledge:
ARM architecture and instruction set.
RTOS concepts (e.g., Nucleus RTOS used by MediaTek).
Basic electronics for interfacing with the device.
Steps for a Beginner to Get Started
Learn the Basics:
Study C programming and ARM assembly (online resources like Coursera, Udemy, or “ARM Assembly Language” by William Hohl).
Understand embedded systems and microcontrollers (books like “The Art of Electronics” or online tutorials).
Set Up Tools:
Install Ghidra or Radare2 for reverse engineering.
Get a JTAG/SWD debugger and learn to use it with the MT2502.
Extract Firmware:
Use hardware tools to dump the firmware from the MT2502’s flash memory.
Alternatively, check if the manufacturer provides firmware files (unlikely for MediaTek).
Analyze Firmware:
Load the firmware into a disassembler and identify key functions (e.g., initialization, I/O operations).
Look for strings, constants, or known libraries to orient yourself.
Modify and Reprogram:
Make small changes (e.g., alter a string or function) using a hex editor or by recompiling modified C code with the MediaTek SDK.
Flash the modified firmware using SP Flash Tool or equivalent.
Test and Debug:
Test on a non-critical device to avoid bricking valuable hardware.
Use debugging tools to trace issues if the firmware fails.
Resources for Beginners
Tutorials: Check X posts or forums like XDA Developers for MT2502-specific guides (I can search X for relevant posts if needed).
Books: “Practical Reverse Engineering” by Bruce Dang or “The Ghidra Book” by Chris Eagle.
Communities: Join forums like EEVblog, Stack Overflow, or Reddit’s r/ReverseEngineering for advice.
MediaTek SDK: Explore MediaTek’s official documentation for the LinkIt Assist 2502 SDK (if accessible).
Tips to Make It Easier
Start with a simpler microcontroller (e.g., Arduino-based) to practice reverse engineering and firmware modification.
Work on open-source firmware projects to gain experience before tackling proprietary systems like the MT2502.
Use virtual machines or emulators to practice without risking hardware damage.
Conclusion
For a beginner, reverse engineering and reprogramming MT2502 firmware is a complex and time-intensive task requiring dedication to learn C, ARM assembly, and specialized tools. Start with small projects, leverage online resources, and proceed cautiously to avoid legal or hardware issues. If you’d like, I can search X or the web for specific MT2502 reverse engineering guides or provide a step-by-step example for a simpler firmware task to build your skills.
 
I got it! I got the firmware files and i was able to update my display.

Here's the link to download. This is a zip file that contains the firmware for EKD01/B02N UART display, an instruction manual, com port drivers and the update tool.

You will need a usb c to usb a cable to connect to your PC.

The PDF manual is very easy to follow.

Disclaimer: i'm not responsible if your display gets bricked. Proceed at your own risk

Note: the link will expire in 13 days

网易邮箱超大附件下载
Could you advise me where I can find the firmware for the CAN BUS version?
 

Here you go. It's in the description. Watch the video for howto.

Please note that i have no experience with CAN displays and needless to say, proceed at your own risk
This guide is only for "varstorm" displays. I tried it and my display didn't start! I need the original CAN_BUS firmware.
 
This guide is only for "varstorm" displays. I tried it and my display didn't start! I need the original CAN_BUS firmware.
I think it will work for all ekd01 CAN bus displays. Did you download the firmware listed in the description of the video? You need to flash that firmware using the flash tool.

I got my firmware from Greenergy but i got my display from another aliexpress store (Risun). Now my display says varstrom on the boot logo.
 
I think it will work for all ekd01 CAN bus displays. Did you download the firmware listed in the description of the video? You need to flash that firmware using the flash tool.

I got my firmware from Greenergy but i got my display from another aliexpress store (Risun). Now my display says varstrom on the boot logo.
You were right. I tried the upgrade again and it worked. I copied the firmware to C:/ and the upgrade went through without any problems. Everything works, even the "advanced" menu 😃👍
 
I got it! I got the firmware files and i was able to update my display.

Here's the link to download. This is a zip file that contains the firmware for EKD01/B02N UART display, an instruction manual, com port drivers and the update tool.

You will need a usb c to usb a cable to connect to your PC.

The PDF manual is very easy to follow.

Disclaimer: i'm not responsible if your display gets bricked. Proceed at your own risk

Note: the link will expire in 13 days

网易邮箱超大附件下载
Hi,
I am looking for firmware for the B02NU display can you tell me how did you get that file so i can get it as well, or post a new link for the file
 
Hello guys,

does anyone have or know, from where to get firmware for EKD01 display CAN bus for Tongsheng controller?


Varstrom web site allows to download FW for:


Varstrom_EKD_Reprogramming_Tool
EKD01_CAN_BF_N22_bin (for BAFANG can-bus)
EKD01_UART_BF_V32_bin (for BAFANG/Varstrom UART)
EKD01_UART_TSE_N22_bin (for TONGSHENG UART)


...and I need version (...)CAN_TS(...) for TONGSHENG CAN.


I programmed my EKD01 (oryginally N17 fw) from Varstrom with the wrong firmware (for Bafang) which is not compatible with the Tongsheng controller and I'm trying to reverse/save the situation... but I don't have the correct FW (for Tongsheng) :-(


Maybe someone can help?
 
Hello guys,

does anyone have or know, from where to get firmware for EKD01 display CAN bus for Tongsheng controller?


Varstrom web site allows to download FW for:


Varstrom_EKD_Reprogramming_Tool
EKD01_CAN_BF_N22_bin (for BAFANG can-bus)
EKD01_UART_BF_V32_bin (for BAFANG/Varstrom UART)
EKD01_UART_TSE_N22_bin (for TONGSHENG UART)


...and I need version (...)CAN_TS(...) for TONGSHENG CAN.


I programmed my EKD01 (oryginally N17 fw) from Varstrom with the wrong firmware (for Bafang) which is not compatible with the Tongsheng controller and I'm trying to reverse/save the situation... but I don't have the correct FW (for Tongsheng) :-(


Maybe someone can help?
at the very bottom of the "support documents part you can find the original N17-which makes youdisplay talk again to the tongsheng controller. unfortunately there is still no N22 for this controller.
 
It has been a while but i decided to see what i can do and find out about the display. I bought my tsdz8 with the ekd01 from the varstrom store on aliexpres. I managed to back up the firmware of the display with the mediatek flashtool. It's for now not a backup you can just flash straight onto it like the normal one since it a backup of the whole NOR chip including the bootloader in one bin file but i will share it already if someone has some use for it. i renamed it into a txt file instead of a bin file to be able to upload it here directly.
 

Attachments

  • my_backup - Copy.txt
    4.3 MB · Views: 0
I actually got quite a bit further but i don't have time to write it up today i will do that in the next few days. I found out the ekd01 just forwards uart commands it receives via bluetooth to the controller. So the bikego app has the logic. this also means that sniffing the traffic between the bikego app and the ekd tells me the uart commands to control assist level and a few more things. i am also working on reverse engineering the firmware from the assembly but that will probably take bunch more time so i wouldn't expect any result with this soon. In the meantime i am also gonna try to sniff the uart communication between the controller and ekd directly to maybe open up the way for a esp32 or rpi pico 2w based open source screen.
 
Cześć.

Potrzebuję pomocy. Szukam pliku EKD01_uart_bf_n22.bin. Miałem wersję N17, która nie pozwala na modyfikację ustawień prędkości na danym biegu. Motocykl przyspiesza gwałtownie i chciałbym to zmienić.
Przypadkowo zainstalowałem wersję CAN w moim EKD01 i oprogramowanie zmieniło się na takie, jakiego chciałem, ale przycisk minus nie działał i nie komunikował się z kontrolerem i silnikiem.
Zainstalowałem nowszą wersję V32, dostarczoną przez Varstrom, i motocykl działa jak poprzednio.
Próbowałem połączyć się kablem za pomocą aplikacji Speed na Androida i Windowsa, ale kontroler i silnik nie łączą się.

Opcja aktualizacji oprogramowania układowego EKD01 pozostała, ale nigdzie nie mogę znaleźć pliku.
Jeśli masz plik lub znasz jego lokalizację, proszę o pomoc. Dziękuję.
 
Back
Top