EScooter controller serial sniffing

[amasheep]

Dear modders

I've been trying to gain control over an eScooter drivetrain to control via arduino and figured out the best option would be to intercept the serial communication between the control up on the handlebars and the motor controller.

However, after hooking up a logic analyzer and starting sniffing on the TX and RX pins, the serial information looks identical no matter what information is traveling between the two controllers. Any ideas why I can't see any real data transfer with this setup?

These signals are the TX and RX pins, and they repeat perfectly even when I spam-press the electric brake (which actuates the motor brake, so I know it has to send that data)


These are images of the controller and motor controller:



I'd highly appreciate any pointers to what to try next! Ideally I would be able to control the motor controller without the display-controller, but I'd be happy with any solution to control it.

Thanks

 

[amasheep]

Upon setting a more suitable baud rate (9600) I was able to see some changes in the data. I'll try to analyze it but it seems a bit random at the moment.

Are there any good resources for UART reverse engineering that I should look at before dumping hours into the top google search results?

Thanks.

 

[amberwolf]

There's some threads here where people have reverse engineered various communications on devices (some power supplies with Canbus, some controller/display combinations, etc), but I don't know that any will apply to your system for the end results.

There is a set of videos that may help with the principles used, about decoding the serial stream for an old MIDI I/O box (I have one and was curious how it works, so watched this when I ran across it). I don't think my list is in order so you should look at the descriptions; only a couple directly deal with this: