How to PERMANENTLY lock Kukirin G2 / G2 Master to 25 km/h so the brake+power unlock combo can't override it?

[Viix]

I own two Kukirin scooters (newer 10×2.75 versions) and I need the opposite of the usual request: I want the 25 km/h limit to be permanent and non-defeatable, so they legally qualify as speed-limited vehicles. Police here know the brake-lever + double-click-power toggle, so because the limit can be removed, they don't accept the scooters as limited.
What I've already established:
The brake + double-click-power toggle works and the state persists across power cycles, but it's reversible — that's the problem.
G2 (48V): controller marked "G300", firmware JBWCK6P-V1.1 / software RND4825-V1.17. No unused/limiter wire on the controller.
G2 Master (52V): dual controllers, board partly labelled "AT2-K-1-PCB", SN LZHB202505KZ2932X. Controllers are potted deep in the deck, can't see the silkscreen. No unused wires on either controller.
Consumer settings menu (triple-press power) on the Master is reduced: it shows P01, P05, P06, P08 only — P02, P03, P04 and P07 are absent. So there's no menu-level global speed limit (P07) and no wheel/voltage params exposed.
The dealer confirmed they have a method to lock it permanently (they charge €99/unit) but won't disclose it, and explicitly said it's not a firmware update — they called it a "secret."
My questions:
Is there a service/engineering menu behind a non-standard entry (button combo or code) that exposes a hard max-speed parameter on this firmware? Exact entry sequence?
If it's a hardware/harness change instead — which existing connector/pins, and what signal (jumper / resistor value) forces a permanent cap that the toggle can't override?
On the dual-controller Master, is the lock a single display-level setting, or does it have to be done per controller?
Goal is genuine compliance — a fixed 25 km/h that survives any button combination. Any verified procedure for these exact controllers appreciated. Thanks!

 

[E-HP]

I own two Kukirin scooters (newer 10×2.75 versions) and I need the opposite of the usual request: I want the 25 km/h limit to be permanent and non-defeatable, so they legally qualify as speed-limited vehicles. Police here know the brake-lever + double-click-power toggle, so because the limit can be removed, they don't accept the scooters as limited.
What I've already established:
The brake + double-click-power toggle works and the state persists across power cycles, but it's reversible — that's the problem.
G2 (48V): controller marked "G300", firmware JBWCK6P-V1.1 / software RND4825-V1.17. No unused/limiter wire on the controller.
G2 Master (52V): dual controllers, board partly labelled "AT2-K-1-PCB", SN LZHB202505KZ2932X. Controllers are potted deep in the deck, can't see the silkscreen. No unused wires on either controller.
Consumer settings menu (triple-press power) on the Master is reduced: it shows P01, P05, P06, P08 only — P02, P03, P04 and P07 are absent. So there's no menu-level global speed limit (P07) and no wheel/voltage params exposed.
The dealer confirmed they have a method to lock it permanently (they charge €99/unit) but won't disclose it, and explicitly said it's not a firmware update — they called it a "secret."
My questions:
Is there a service/engineering menu behind a non-standard entry (button combo or code) that exposes a hard max-speed parameter on this firmware? Exact entry sequence?
If it's a hardware/harness change instead — which existing connector/pins, and what signal (jumper / resistor value) forces a permanent cap that the toggle can't override?
On the dual-controller Master, is the lock a single display-level setting, or does it have to be done per controller?
Goal is genuine compliance — a fixed 25 km/h that survives any button combination. Any verified procedure for these exact controllers appreciated. Thanks!

Do you really want it permanently limited, or just something that prevents them from switching it back to unlimited mode? Can you add a hidden switch that disables the buttons required to switch it back?

 

[Viix]

Good question — you've actually pinned down exactly what I need. I don't need it limited at silicon level; I need the unlock combo to be impossible to trigger, so that anyone trying the standard brake + double-click-power sequence just gets a scooter that stays at 25. A hidden switch that disables the button/signal path needed for the toggle sounds like exactly the right approach — it survives a roadside check, and I can still re-enable it myself if I ever need to.
I'm after a concrete technical solution that works with these specific controllers — which signal line to interrupt and where, and whether the hidden-switch approach needs doing once or once per controller on the Master.
The controllers I'm working with:
G2 (48V): single "G300" controller, firmware JBWCK6P-V1.1 / software RND4825-V1.17
G2 Master (52V): two controllers
Appreciate any pointers on the exact wire/signal to break for the toggle path. Thanks!

 

[E-HP]

Good question — you've actually pinned down exactly what I need. I don't need it limited at silicon level; I need the unlock combo to be impossible to trigger, so that anyone trying the standard brake + double-click-power sequence just gets a scooter that stays at 25. A hidden switch that disables the button/signal path needed for the toggle sounds like exactly the right approach — it survives a roadside check, and I can still re-enable it myself if I ever need to.
I'm after a concrete technical solution that works with these specific controllers — which signal line to interrupt and where, and whether the hidden-switch approach needs doing once or once per controller on the Master.
The controllers I'm working with:
G2 (48V): single "G300" controller, firmware JBWCK6P-V1.1 / software RND4825-V1.17
G2 Master (52V): two controllers
Appreciate any pointers on the exact wire/signal to break for the toggle path. Thanks!

Unfortunately the controller model/serial numbers don’t really help much since there are so many controllers out there. The displays usually have at least 5 conductors, battery (+), ground, display lock (aka key lock, to sends battery voltage/signal to the controller to turn it on). The 2 other conductors are for data, send and receive. You will likely need to disable the send data conductor. A picture of your display connector would be helpful.

 

[Viix]

I'll post the info for both scooters as separate blocks. Goal for both is the same: make the 25 km/h limit non-defeatable by killing the brake + double-click-power unlock toggle, ideally reversible by me. Important constraint I've realised: the brake signal also drives the brake light + motor cutoff, so I can't just put a plain switch in the brake line — that would leave me riding with no brake light (illegal here) and no motor cutoff. So I'm looking for something smarter, or a signal I've misidentified. Photos attached per block.

■ KuKirin G2 (48V, single motor)




Motor controller: G300, 48V, limited current 25±1A. Firmware JBWCK6P-V1.1, software RND4825-V1.17. Label connectors: 8-pin line, Taillight, Motor line (phases Blue/Green/Yellow).

• Cockpit/control board: silkscreen G6SB1-v32 (2024-05-18). Printed pinouts:
  • Acceler: +5V · GND · SP · K1n- · K1n+
  • MainCtrl harness to controller: TX · RX · SP · +15V · BK · PCtrl · GND · BAT
  • Lock (lock+/lock-), Buz (Buz+/Buz-), Lamp/Led, pass+/pass-
  • An unpopulated vertical header next to MainCtrl (test/serial pads?)
• I can see a discrete BK (brake) line here. Is the unlock combo detected by the G300 controller or by this cockpit board? And does BK carry the brake-light signal too, or is the light driven separately so I could intercept only the combo path?

---

■ KuKirin G2 Master (52V, dual motor)

• TWO controllers, brand LENZOD, marked AT2-K1-PCBA-V4 / 70.01.000530, S/N LZHB202505KZ2932X.
• Display: KuKirin hexagonal LCD (power button is in the display), connects via a single round aviation connector.
• The controller↔harness signal connector is clearly a 7-pin connector: 7 wires + 1 looped/bridged pin (the loop is visible on both the cable plug and the controller socket — looks like a jumper/detect loop, not a signal).
• Wire colours present: blue, red, black, purple, yellow, green, white/grey. No silkscreen labels on this controller, unlike the G2.
• Since the power button is in the display, I assume the combo is detected at the display and sent to both controllers over comms — so I shouldn't need to touch either motor controller, just the brake line before the display. Correct?
• See attached connector photo — the 7 wires + 1 looped/bridged pair are clearly visible in the housing.

Extra question for the Master:

• What is the looped pin on this 7-pin connector for — is it a detect/enable loop the controller checks (i.e. breaking it disables the controller), or just a bridge between two pins? Could it be relevant to forcing a permanent limited state?

Questions for both:

1. Is the unlock combo handled at the display/cockpit or at the controller?
2. Does the brake line that the combo uses also drive the brake light + motor cutoff, or are those separate? (If separate, I could block just the combo path and keep the light.)
3. Has anyone built an active inline interceptor — pass the brake signal through normally, but briefly block it only when a power double-click is detected during braking — to kill the combo without losing the brake light? Any reference designs?
4. On the Master: is the brake from the two levers OR'd into one line before the display, or separate?
5. On the Master 7-pin connector, if that looped pin is a mode/detect line — could changing its state (open vs. bridged) force the controller into permanent limited mode, independent of the display toggle?

Any pointers appreciated — happy to measure specific pins with a multimeter if someone tells me what to probe.

 

[E-HP]

I'll post the info for both scooters as separate blocks. Goal for both is the same: make the 25 km/h limit non-defeatable by killing the brake + double-click-power unlock toggle, ideally reversible by me. Important constraint I've realised: the brake signal also drives the brake light + motor cutoff, so I can't just put a plain switch in the brake line — that would leave me riding with no brake light (illegal here) and no motor cutoff. So I'm looking for something smarter, or a signal I've misidentified. Photos attached per block.

■ KuKirin G2 (48V, single motor)

View attachment 389963

View attachment 389962
Motor controller: G300, 48V, limited current 25±1A. Firmware JBWCK6P-V1.1, software RND4825-V1.17. Label connectors: 8-pin line, Taillight, Motor line (phases Blue/Green/Yellow).

• Cockpit/control board: silkscreen G6SB1-v32 (2024-05-18). Printed pinouts:
  • Acceler: +5V · GND · SP · K1n- · K1n+
  • MainCtrl harness to controller: TX · RX · SP · +15V · BK · PCtrl · GND · BAT
  • Lock (lock+/lock-), Buz (Buz+/Buz-), Lamp/Led, pass+/pass-
  • An unpopulated vertical header next to MainCtrl (test/serial pads?)
• I can see a discrete BK (brake) line here. Is the unlock combo detected by the G300 controller or by this cockpit board? And does BK carry the brake-light signal too, or is the light driven separately so I could intercept only the combo path?

---

■ KuKirin G2 Master (52V, dual motor)

View attachment 389964

View attachment 389965

View attachment 389966

View attachment 389967

• TWO controllers, brand LENZOD, marked AT2-K1-PCBA-V4 / 70.01.000530, S/N LZHB202505KZ2932X.
• Display: KuKirin hexagonal LCD (power button is in the display), connects via a single round aviation connector.
• The controller↔harness signal connector is clearly a 7-pin connector: 7 wires + 1 looped/bridged pin (the loop is visible on both the cable plug and the controller socket — looks like a jumper/detect loop, not a signal).
• Wire colours present: blue, red, black, purple, yellow, green, white/grey. No silkscreen labels on this controller, unlike the G2.
• Since the power button is in the display, I assume the combo is detected at the display and sent to both controllers over comms — so I shouldn't need to touch either motor controller, just the brake line before the display. Correct?
• See attached connector photo — the 7 wires + 1 looped/bridged pair are clearly visible in the housing.

Extra question for the Master:

• What is the looped pin on this 7-pin connector for — is it a detect/enable loop the controller checks (i.e. breaking it disables the controller), or just a bridge between two pins? Could it be relevant to forcing a permanent limited state?

Questions for both:

1. Is the unlock combo handled at the display/cockpit or at the controller?
2. Does the brake line that the combo uses also drive the brake light + motor cutoff, or are those separate? (If separate, I could block just the combo path and keep the light.)
3. Has anyone built an active inline interceptor — pass the brake signal through normally, but briefly block it only when a power double-click is detected during braking — to kill the combo without losing the brake light? Any reference designs?
4. On the Master: is the brake from the two levers OR'd into one line before the display, or separate?
5. On the Master 7-pin connector, if that looped pin is a mode/detect line — could changing its state (open vs. bridged) force the controller into permanent limited mode, independent of the display toggle?

Any pointers appreciated — happy to measure specific pins with a multimeter if someone tells me what to probe.

I think your switch would be on the white conductor labeled “Tx” in the first pic, in order to interrupt the signal going to the controller. You could test by removing the pin form the connector temporarily. The downside is that no signals will go to the controller when the switch is open, so changing assist levels, etc. wouldn’t work, so best to flip the switch when you see the cops.