Hack your Segway E110S / E110SE / E125S

We used to rent scooters from time to time because myself, the misses and the kids like to go for rides on sunny days. It didn't take long before we decided that keep renting scooters wasn't a viable option and that we should treat ourselves to our very own scooters. After doing some research, nerd as I am, we ended up buying two Segway E110SE's.

Update: Check the updates below!

Over here, in the Netherlands, they are sold in two versions: "blue license plates" are limited to 25km/h and drivers aren't required (yet) to wear helmets and "yellow license plates", limited to 45km/h and drivers are required to wear a helmet. Since what we (intended to) use the scooters mostly for was lazy casual touring the countryside we opted for the slow(er) versions. You can't see the countryside when it's all a blur anyway 😆

Our E110SE's at sunset 🥰

Anyhow, though strictly speaking the legal limits are 25km/h and 45km/h, in reality the permitted limits are 34km/h and 54km/h. That's the Netherlands for you, right there. When we bought the scooters we were promised Segway would "soon" release a firmware update (because, yay!) that would 'unlock' our scooters to be able to go up to 34km/h. Don't get me wrong, they are a dream to ride, even at 25km/h, but being able to go a little bit faster would be nice. And, actually, the dealer promising us Segway promised to release an update was what finally made us go for the E110SE.

When december came and we had owned our scooters a few months, I decided to reach out to Segway about this since there had been nothing but silence and more and more people were eager for this update to be rolled out. Long story short: Segway had no official word on an update (yet).

Brand new 🥰

Then, by the end of december I was contacted by "ElectroBreu" who told me he had stumbled upon a hack, or tweak if you will, to unlock the scooters. He had come across a post on Reddit detailing the hack. Unfortunately the post was deleted some time later. I'm not sure why or who deleted it but I do think it's sad that the information is getting lost. So here we are, putting it out there (again) on the web. 

Most important is the 'unlock code' which is 5AA5007057457776656E467A39. Googling it should turn up some results. The actual process is documented here. I (Google) Translated it and posted it as a comment under the now deleted Reddit post. Here it is, verbatim, translation errors and all:

1. Download and install the "BLE Debug Assistant" APP
2. Turn on the electric car, turn off the sensor unlock function in the travel app on the 9th, and don't connect the Bluetooth of the app to the electric car.
3. Open the BLE debugging assistant, find the serial number of the No. 9 electric vehicle found in the Scanner interface, and click the CONNECT button to the right of the serial number
4. After entering the interface, expand the item titled "Unknown Service" (at this time, please note that the Bluetooth connection in the upper right corner should be kept connected, if it is disconnected, it needs to be reconnected). After expansion, there is an upward arrow in the bottom row, click That arrow, a dialog box appears
5. Four radio buttons, select single send. There is a HEX switch option in the middle, turn it on. There is an input box at the bottom, enter the code: 5AA5007057457776656E467A39
6. Click Send at the bottom. Every time you click to send, the car will ring. The specific logic is: execute sending once, turn off the 15Km/h prompt sound, and the speed limit will remain unchanged at 25Km/h; execute send twice, turn off the prompt sound, and cancel the speed limit; execute the third time, the prompt sound and speed limit are restored to the factory state. If it is sent later, it will be executed in the previous three cycles.

The actual test of B90 is valid. After canceling the prompt sound and speed limit, the test was conducted on a small section of gentle uphill road. The maximum speed reached 46Km/h (displayed by the GPS code meter of the mobile phone), the APP cycling record showed the maximum speed of 49.7Km/h, and the maximum display of the car meter was 25Km/h, the flat road test is estimated to be faster. When driving at high speed, the vehicle has no abnormal vibration, and the stability is good. However, due to the higher speed, the braking distance becomes several times longer, and the brakes need to be braked in advance.

Taking into account the braking performance, after the test is completed, the speed limit will be restored to the factory state immediately, up to 25Km/h, and there will be a voice prompt if it exceeds 15Km/h.

Please note that this is the literal output from Google Translate. The process is documented and shown more clearly in this video. I'm not sure on the Android side of things but I am quite sure it's this app and/or this app that we're supposed to use on iOS. "蓝牙连接助手" (the first app) translates to "Bluetooth connection assistant".

Judging from the comments over at Reddit this hack/tweak should work; I haven't tried this myself (yet) because, apparently, the 25km/h version ("blue license plate") will be 'unlocked' to 50+ km/h which is illegal and although I do enjoy speed at times, I don't wish to get pulled over by the police. If anyone has a code or procedure that unlocks the scooter to 34km/h then I'd love to hear about it. Please leave a comment if you have more information.

Ofcourse we personalized our scooters 😁

Update: This hack most likely won't work anymore on any recent versions of the software in the scooters. Segway appears to have 'fixed' this hack; which is a totally legit move on their part if you ask me. I won't go into further discussion on this topic.

Update: Apparently there's a new code: 5aa50070574566511223147a39. I haven't checked it myself, use at your own risk, your mileage may vary.