2022-01-13

Hack your Segway E110S / E110SE / E125S

We used to rent scooters from time to time because myself, the misses and the kids like to go for rides on sunny days. It didn't take long before we decided that keep renting scooters wasn't a viable option and that we should treat ourselves to our very own scooters. After doing some research, nerd as I am, we ended up buying two Segway E110SE's.

Update: Check the updates below!

Over here, in the Netherlands, they are sold in two versions: "blue license plates" are limited to 25km/h and drivers aren't required (yet) to wear helmets and "yellow license plates", limited to 45km/h and drivers are required to wear a helmet. Since what we (intended to) use the scooters mostly for was lazy casual touring the countryside we opted for the slow(er) versions. You can't see the countryside when it's all a blur anyway 😆

Our E110SE's at sunset 🥰

Anyhow, though strictly speaking the legal limits are 25km/h and 45km/h, in reality the permitted limits are 34km/h and 54km/h. That's the Netherlands for you, right there. When we bought the scooters we were promised Segway would "soon" release a firmware update (because, yay!) that would 'unlock' our scooters to be able to go up to 34km/h. Don't get me wrong, they are a dream to ride, even at 25km/h, but being able to go a little bit faster would be nice. And, actually, the dealer promising us Segway promised to release an update was what finally made us go for the E110SE.

When december came and we had owned our scooters a few months, I decided to reach out to Segway about this since there had been nothing but silence and more and more people were eager for this update to be rolled out. Long story short: Segway had no official word on an update (yet).

Brand new 🥰

Then, by the end of december I was contacted by "ElectroBreu" who told me he had stumbled upon a hack, or tweak if you will, to unlock the scooters. He had come across a post on Reddit detailing the hack. Unfortunately the post was deleted some time later. I'm not sure why or who deleted it but I do think it's sad that the information is getting lost. So here we are, putting it out there (again) on the web. 

Most important is the 'unlock code' which is 5AA5007057457776656E467A39. Googling it should turn up some results. The actual process is documented here. I (Google) Translated it and posted it as a comment under the now deleted Reddit post. Here it is, verbatim, translation errors and all:

  1. Download and install the "BLE Debug Assistant" APP
  2. Turn on the electric car, turn off the sensor unlock function in the travel app on the 9th, and don't connect the Bluetooth of the app to the electric car.
  3. Open the BLE debugging assistant, find the serial number of the No. 9 electric vehicle found in the Scanner interface, and click the CONNECT button to the right of the serial number
  4. After entering the interface, expand the item titled "Unknown Service" (at this time, please note that the Bluetooth connection in the upper right corner should be kept connected, if it is disconnected, it needs to be reconnected). After expansion, there is an upward arrow in the bottom row, click That arrow, a dialog box appears
  5. Four radio buttons, select single send. There is a HEX switch option in the middle, turn it on. There is an input box at the bottom, enter the code: 5AA5007057457776656E467A39
  6. Click Send at the bottom. Every time you click to send, the car will ring. The specific logic is: execute sending once, turn off the 15Km/h prompt sound, and the speed limit will remain unchanged at 25Km/h; execute send twice, turn off the prompt sound, and cancel the speed limit; execute the third time, the prompt sound and speed limit are restored to the factory state. If it is sent later, it will be executed in the previous three cycles.

The actual test of B90 is valid. After canceling the prompt sound and speed limit, the test was conducted on a small section of gentle uphill road. The maximum speed reached 46Km/h (displayed by the GPS code meter of the mobile phone), the APP cycling record showed the maximum speed of 49.7Km/h, and the maximum display of the car meter was 25Km/h, the flat road test is estimated to be faster. When driving at high speed, the vehicle has no abnormal vibration, and the stability is good. However, due to the higher speed, the braking distance becomes several times longer, and the brakes need to be braked in advance.

Taking into account the braking performance, after the test is completed, the speed limit will be restored to the factory state immediately, up to 25Km/h, and there will be a voice prompt if it exceeds 15Km/h.

Please note that this is the literal output from Google Translate. The process is documented and shown more clearly in this video. I'm not sure on the Android side of things but I am quite sure it's this app and/or this app that we're supposed to use on iOS. "蓝牙连接助手" (the first app) translates to "Bluetooth connection assistant".

Judging from the comments over at Reddit this hack/tweak should work; I haven't tried this myself (yet) because, apparently, the 25km/h version ("blue license plate") will be 'unlocked' to 50+ km/h which is illegal and although I do enjoy speed at times, I don't wish to get pulled over by the police. If anyone has a code or procedure that unlocks the scooter to 34km/h then I'd love to hear about it. Please leave a comment if you have more information.

Ofcourse we personalized our scooters 😁

Update: This hack most likely won't work anymore on any recent versions of the software in the scooters. Segway appears to have 'fixed' this hack; which is a totally legit move on their part if you ask me. I won't go into further discussion on this topic.

Update: Apparently there's a new code: 5aa50070574566511223147a39. I haven't checked it myself, use at your own risk, your mileage may vary.

37 comments:

  1. I feel the same... not going to risk unlocking it, but it would be great if we could just get some extra km/h on top of the allowed 25.

    Couldn't find any code for that. Do you have an update on it?

    ReplyDelete
    Replies
    1. Dealers have been applying 'legal' speedupdates for about a month now. Contact your dealer for more info.

      Delete
  2. Heb je enig idee of airlock bedoelt wordt met sensor unlock function? Thanks!

    ReplyDelete
    Replies
    1. Sorry, ik heb geen idee wat je bedoelt.

      Delete
  3. Hey RobIII ... thanks for the article 👍
    Question: recently purchased an eScooter E110SE for my 15 yr old ... last week a friend told him at school that someone had operated his scooter - and he can see it on the app ... now he is quite worried it might get stolen from school . . . Are you aware of any info on how this may be possible? Are the keys for your two scooters interchangable or are do they only operate one ? . . . still not a lot of info available on-line
    Cheers

    ReplyDelete
    Replies
    1. My key only works on my scooter, as does hers on her scooter only. Ditto for the remotes.

      Delete
  4. Zojuist heb ik mijn 110SE voorzien van een speed unlock. Drive Modus 1 gaat dan tot 17kmh. Drive Modus 2 tot 25kmh en, wanneer er +70% accu capaciteit is, Drive Modus 3 zal gaan tot 65kmh. Had onlangs controle en deed de speed unlock snel uit middels 2 handelingen (via de bluetooth app). Snel en simpel dus in en uitschakelen. Thanks voor de post, waardeer ik zeer!

    ReplyDelete
    Replies
    1. Is your 100se on latest firmware ?? I've got a firmware update notification and to be honest i kinda don't want to lose my speed unlock hack .

      Delete
  5. Hoi robiii, heb je enig idee wat ik kan doen als ik geen bliep hoor bij het verzenden van de code? Ik ben bang dat het de nieuwste firmware is die roet in het eten gooit.

    ReplyDelete
    Replies
    1. Zoals in de update in deze blogpost te lezen is: voor zover ik weet werkt deze hack niet (meer) bij recente(re) firmwares. Neem contact op met je dealer voor een 'legale' speedupdate.

      Delete
  6. Ik was net bij een dealer voor een proefrit. Hij vroeg mij of ik de snor of brom wou testen. Vanaf zijn smartphone met dealer app? kon hij de modus on the fly veranderen. Blijkbaar is er dus een legale app voor dealers met meer functionaliteit. Lijkt mij interessant om hier naar te zoeken.

    ReplyDelete
    Replies
    1. Die app zal allicht alleen met een eigen login werken en
      misschien alleen maar met een bepaald profiel (van Segway) überhaupt te downloaden zijn in de appstore. Het kan, maar ik geef 't weinig kans.

      Delete
    2. Hier een dealer ;) klopt officiële dealers hebben een eigen app die niet overdraagbaar of te downloaden is.

      Delete
  7. Hi! How do I remove the speed limit if there is no dealer in my area? Is there another HEX code?

    ReplyDelete
    Replies
    1. It's literally in this post, see point 6.

      Delete
  8. Is het nog mogelijk om 5 km harder te kunnen rijden? Scheelt 'n hoop na dagelijks 1,5 uur m'n scooter te moeten rijden, dank u🙏

    ReplyDelete
    Replies
    1. Nee, je kunt een blauw kenteken tot (ongeveer) 30km/u laten 'opvoeren' en een geel kenteken tot (ongeveer) 50km/u bij je dealer. Dat is alles.

      Delete
  9. Hello! I am really interested in getting this for my wife and myself. We both live in The Netherlands for 9 years already and we would like to have something to travel around. We don't know much about drive licenses, I believe you need one to drive stuff with blue license plates, how much does the license cost and where can I get one? Thank you for your post!

    ReplyDelete
    Replies
    1. If you have a driver's license you're good to go. I you don't have one you need to acquire a moped license at the very least. See https://www.cbr.nl/nl/rijbewijs-halen/bromfiets/je-bromfietsrijbewijs-halen.htm which has all the information you need.

      Delete
  10. Waar kan je de app vinden zie hem niet in de Google playstore staan

    ReplyDelete
    Replies
    1. Hier?
      https://play.google.com/store/apps/details?id=com.ninebot.segway

      Delete
    2. Bedoel die van ble debug assistent

      Delete
    3. Bovenaan de post staat:

      "Update: Check the update below"

      En onderaan de post staat:

      "Update: This hack most likely won't work anymore on any recent versions of the software in the scooters. Segway appears to have 'fixed' this hack; which is a totally legit move on their part if you ask me. I won't go into further discussion on this topic."

      Ik snap niet wat daar niet duidelijk aan is en waarom je dan nog die app zou zoeken?

      Delete
  11. 5aa50070574566511223147a39 is the new code, remove speed limiter works but I couldn't get the speed limiter on again.

    ReplyDelete
    Replies
    1. That code is nowhere to be found on the internet currently. Do you have a source?

      Delete
    2. Tested this code on my e110s today, I can put the speed limit back on as well.

      Delete
    3. But where did the code come from?

      Delete
    4. It was posted on Reddit in a closed group. to put on the speed limit you must power on the scooter.

      Delete
    5. I checked on the E125s(45km/h) model, this code change the GPS speed to 45/50 kilometers per hour. Nothing else happens.((( need new code)

      Delete
    6. I got the E125s. Is there still a possibility to remove the speed limit?

      Delete
    7. Have you tried it? If not: why not? If yes: did it work? There's your answer ;-)

      Delete
    8. for the e125s this code works: 5aa50070574566511223147a39

      but it also removes the dealer installed 52kmh limit and the speedo won't show the speed above 45km/h anymore. Is there a way to also revert this?

      Delete
    9. Is it still possible with a apple phone?

      Delete
    10. Yes! But it’s just +5km/h… need unlock full speed😐

      Delete
  12. Kan ik mijn 110se die 25 gaat opvoeren naar 30 kmpu en hoe ?

    ReplyDelete
    Replies
    1. Heb je de blog überhaupt gelezen?
      Probeer het gewoon, werkt het niet bel je je dealer en laat je die 't doen voor een paar tientjes.

      Delete
  13. Werkt dit ook op de 300se? Voor een motorscooter gaat ie net te zacht namelijk

    ReplyDelete