How to Downgrade Ninebot Max/G30 DRV 1.7.0 Without STLink
March 27th, 2022
Earlier this month, Ninebot released the DRV 1.7.0 update for the Ninebot Max/G30/G30P/G30D/whatever model you find yourself with that locked downgrading.
Thanks to the work of the folks at scooterhacking.org, we now have a fix!
Best of all it does not require an STLink or taking apart your scooter.
This will solve the issue where flashing with ScooterHacking Utility says “Update failed! Reason: Data format error.” unless you have DRV 1.7.13 or above.
Warning (No Longer an Issue)
As of the latest version of ScooterHacking Utility the below section is no longer an issue.
If you have a max with the new version of the ESC (SN late 21-22), this will brick your controller.
Do not proceed until this has been fixed if you have a new ESC.
If you have accidentally gone through with this procedure on the new ESC, follow this guide on RollerPlausch (in German).
Procedure
This solution requires an android device with BLE and ScooterHacking Utility (SHU) installed.
Download SHU from ScooterHacking.
Make sure the app is up to date before beginning. If you just downloaded it this shouldn’t be an issue.
Open the app and give it Bluetooth/location permissions if you have not already.
Select your device from the list.
The list of available BLE devices.
After clicking the device, you will be prompted letting you know you are on a restricted DRV.
Click “yes” to begin the downgrade.
The prompt notifying you of the restriction.
It will then say “Removing DRV firmware restrictions”.
The prompt notifying you of the restrictions being removed.
Click outside this message to begin the flash after 30 or so seconds.
Flashing ‘stock’ 1.6.3.
Your version number should now reflect the downgrade to 1.6.3 and you can reflash your custom firmware or stock.
Make sure you do not use the official app as it may force an update again.
1.6.3 showing a successful downgrade.
Comments
will this work on Ninebot KickScooter MAX G2 with firmware 1.7.0 serial 02GVA?
I don’t think reflasher supports the G2 and I also don’t think there are any firmware files dumped yet publicly to use stlink utility/openocd for. Be careful as the G2 is based on a different architecture so attempting to use G30 methods may brick it.
That’s for sure? There is no way for ninebot max g2?
I think there is like a $50 firmware you can buy from XiaoDash but nothing from the SH team/community from what I know of
Thank you!
Do you have a link to someone who does ST-Link it on eBay USA?
I don’t mind posting it to them!
Thanks for all your help!
Suzy
Hi Joey
For some reason I wasn’t able to reply directly to your comment.
I have the problem with the MAX G30 unable to change region.
Thanks for your reply! I’m in the UK, do you have a link to someone on eBay that I could post the controller to? I tried looking but I couldn’t find.
Do you think I would be able to disconnect and reconnect the controller myself? I have some building computer skills.
Sorry to ask a silly question, how do you know we need a gen 2/at 32 controller?
Thanks again
Suzy
I broke the comment reply feature a year or two back and just haven’t gotten around to fixing it haha, definitely need to get to that.
I checked around on ebay.co.uk to see if I could find anyone and I couldn’t either, surprised someone hasn’t set that up people seem to make a killing doing that here.
Yes the scooter is super easy to assemble/disassemble, everything is just screws and plugs! If you’ve done any computer building its similar.
I can identify the controller model from the versions you posted:
BLE 1.1.8
DRV AT32F 1.8.7
BMS 1.7.4.0
The AT32F is the processor that the gen 2 controller is based on.
I wrote a little more about the esc versions and their differenced here: https://joeybabcock.me/wiki/Ninebot_Max_ESC_Generations
Hi! I appreciate your site! I have learned a lot!
My teenage son was messing around with a scooter app to try and make his ninebot max g30 faster and he changed the region to DE and now its on 20km/h instead of 30km/h and I can’t change it back.
I, the mother is clueless about scooter firmware but after reading about it for many hours I’m guessing that it can’t be changed as its on the latest firmware due to having the ninebot app, unless something new has come up.
This is what it says in the utility app:
BLE 1.1.8
DRV AT32F 1.8.7
BMS 1.7.4.0
ST link looks way too complicated for me.
What are my options apart from buying another scooter? I don’t mind spending some cash to fix it.
New controller?
Wait till the firmware can be hacked?
Maybe something new is out to fix this?
Thanks in advance!
New controller if it comes with the right firmware/region, its kind of hit or miss what region/firmware it will be but if you do go that route definitely make sure that you are getting the right model (gen 2/at32 controller not the silver gen 1).
It is unlikely the firmware downgrade protection willo be bypassed unless Segway’s signing key somehow leaks but I don’t know of anyone actively working on a solution since there isn’t really a solution to proper encryption.
Not sure where you are based out of but there are people who will STLink it for you (I am in the US and I know there are people on ebay who will do it here).
hola, tengo u ninebot g30 leII , lo tengo en la version BLE 1.1.3
DRV STM32F 11.8.7
BMS 1.5.8
Intentamos cambiar la version , y no pasda de 12km/h en ninguna de las 3 velocidades, intento cambiar version desde scooter hacking y dice Flashing failed , no puedo cambiar a ninguna version y no pasa de 12 km h. sabe que puede suceder o como solucionar esto. se lo agradeceria mucho. gracias
dude… THANK YOU!! I was able to install the SHFW without any issue and set the curve and off I went!! coasting at 22mph now and can free coast down hills without using any power at all!!
I have KERS turned off as I heard leaving it on can overpower the controller. I set the curve to 30AMPs and very easy at the start.
any input on if I should leave the KERS off? would be nice to get some form of recuperation from slowing down on the steep hills š but not worth blowing the controller up.
You will have to ask others about their experience using kers and shfw, I run all my ESX on stock as I blew up a ton of controllers in the early days of CFW.
No doubt it’s improved since then but I’ve always been happy with mine at 19-20mph stock.
you seem to know your stuff!!
been searching everywhere and really hoping for an answer to my q…
I have a Ninebot ES2 and it is refurbished running the following software…
BLE : 1.1.0
DRV : STM32F | 1.6.4
BMS : 1.6.0
can I install SHFW from their android utility as is? or do I need to downgrade first? If I need to downgrade, can I do it through the app? if so, would I use something like 1.5.5 for DRV?
if I can install SHFW, should I do the
Regular Base 133
or
Beta Base 255?
that k you for having this website!! it’s awesome and you are amazing for even answering all the posts you already have!!
> can I install SHFW from their android utility as is?
Yes!
> do I need to downgrade first?
No, Ninebot never released a locked firmware version for the ESX luckily so at least for now you are good.
> If I need to downgrade, can I do it through the app? if so, would I use something like 1.5.5 for DRV?
Yes you can use scooterhacking utility to load any firmware you’d like for the esx. I run 1.5.1 on all mine.
> if I can install SHFW, should I do the Regular Base 133 or Beta Base 255?
Try the more up to date version. I have not done shfw on esx but if you can run 255 that would probably be better.
Hi!
ItĀ“s fully charged and tires is full. How much is weight limit?
SN: N4GNC
ESC region US-G30LP.
N4GN should have the full speed… Especially freewheeling.
You could try N4GSD instead?
The weight limit is 220lbs/100kg
Iāve tried scooterhacking utilities.
My other scooter model is: Ninebot Max G30D
BLE version is 1.1.4
DRV version is 1.2.6 (STM32F)
BMS version is 1.5.6
When i change the region to US G30P it only come to 20 km/h byt when I changed the region to US G30LP i comes up to 27 km/h without weight, with weight it comes to max 22 km/h. When you go uphill, it reaches a maximum of 10 km/h. What am I doing wrong?
Do I need to update BLE or DRV as well?
Thank you for your patience!
Make sure its fully charged, tires are full, and that you are not over the weight limit. What serial prefix do you have (first 5 digits of your sn)?
Hi!
My scooter model is: Ninebot MAX G30 MAX
If my DRV version is higher than 1.7.0 and I don’t want to buy stlink. Which part of the scooter can I change so that I can use the program to drive at a higher speed? Is it just one thing or several things I need to change for it to work?
Depends on a couple different factors, if you are on 1.7.0 you can downgrade over bluetooth, if not you will need to either use an stlink or replace the controller.
Thanks for quick reply!
If I get a Stlink. Can I downgrade? If so, which Stlink should I buy and which version do I have to downgrade to for it to work?
Hi,
Iām stuck with DE region and SN (N4GED2106K4015). Iāve tried with ninebot IAP (by changing SN), Iāve tried scooterhacking utilities, and xiaoflasher .
My scooter model is: Ninebot MAX G30 MAX
BLE version is 1.1.4
DRV version is 1.7.13 (STM32F)
BMS version is 1.3.4
BMS Serial nubmer: 3GA0016A10001 (Battery has the default number)
To fix it i have to change BMS Serial number.
What should I start with? How do I change the BMS SN?
Please help!
Unfortunately, if you click the first thing on the page which is that red banner you will see that your version is too high to downgrade without an stlink.
Anything above 1.7.0 cannot be downgraded over the air and the german version does not allow changing the serial number because of Germany’s laws.
https://joeybabcock.me/blog/electric-scooters/how-to-stlink-fix-bricked-ninebot-max-g30-controller-esc/
PRETTY PLEASE HELP ME?. I’ve been trying all this stuff that’s been posted….somehow I have locked one of the scooters and my boyfriend is not a happy camper?. We have the ninebot Max G30’s and he (for some strange reason…. because he usually tells me when techie stuff needs done) did the update on the scooters. This was at least a couple of months ago…. Since then they won’t show battery levels on the scooter…app shows full battery scooter shows only red line. It won’t go out of drive mode and goes very slowly. I’ve tried going thru Segway but he bought them used from a guy at his work so I don’t have any of the info they are asking for AND they said the software can’t be rolled back. I’m getting messages that say… Firmware package is not compatible with your current hardware, aborting. … There is no public SHFW release currently available for your platform check back later. … And a very long error message that talks about board types….. Brick your controller…. sounded bad so I cancelled….
What am I missing here??
TIA
There’s quite a lot of things to go over here:
When you say “the scooter only shows a red line” what do you mean, like the battery shows dead on the display?
When you say “somehow I have locked one of the scooters” what did you do that locked it?
As for the firmware, that can only be “rolled back” with an STLink procedure which is a bit involved and might need different steps depending on which controller model you have.
You will need to be on a lower firmware version to install SHFW or any other kind of custom firmware.
I hope someone fix a 1.8.7 downgrade. I donāt want to st link.
I hope someone figures out 1.8.7 downgrade. I donāt want to st link.
Yeah that unfortunately is not likely to happen, they did proper signing of firmware updates this time.
Hi, sorry, I didn’t get the notification: restricted drv firmware detected, so I went to flash and clicked on attempt dowgrade but the error that says something about power cycling always appears
Can you find the exact error message?
Hi, Joey or anyone else here:
I am currently “Master control v1.8.7”
Do you know if I can downgrade to under 1.7.13 ?
Also do you recommend the 48v Max Pack from MyMaxMods?
The only way you can do it is with an STLink, do you know which ESC Generation you have?
Hi I recently purchased a G30LP scooter from Amazon in the US and is having trouble downgrading the DRV version.
My currently firmware is:
DRV: 1.7.0
BLE: 1.17
BMS: 1.5.8
I used the ScooterHacking Utility and used the ‘Attempt DRV downgrade’ like you said but each time it just pop up with ‘Data format error’. What should I do here?
I have a Max G30D II with:
BMS Version: 23.4.1
BLE Version: 1.1.7
DRV Version: 1.7.14
I want to change region so it’s not limited to 20km/h.
What are my options?
Sounds like you will likely have to use an STLink and ScooterHacking Reflasher to downgrade that version before you can change the region
(I don’t know if the pending review comment temporarily hides the space formatting, but I didn’t write a giant text block and apologize if it displays like that. I can’t edit to fix it)
I was unlucky enough to receive the first (reported) G30 in North America with the new AT32 controller. Gen2 Motor, DRV 1.7.0, BLE 1.1.7, and BMS 2.3.4 (Those software versions are according to the IAP windows app when connected by BLE)
I saw that the new AT32 controllers are now supported in SHFW v0.2.6, but I don’t have an android & no emulator I tried could pass-through BLE via my USB dongle (computer was made before BLE existed lol). I can get my roommate’s Android and use it if need be, but I figured I’d try IAP since I’d rather avoid asking someone to download an app on their phone unless absolutely necessary lmao
I have my .ENC file with the config I want from max.cfw.sh, but I stalled on flashing until the snow was finally melted (since I was paranoid I’d die on ice), and now I’m struggling to piece back together the actual process to follow for flashing.
I think it goes:
0. Connect via IAP
1. Downgrade to flashable DRV (like 1.2.6)
2. Flash with new config from .ENC file
I successfully connected via IAP, went to downgrade, and it says IAP doesn’t recognize my scooter model beyond being a Ninebot. It wants me to ignore the model in the settings, which I can, but now I’m paranoid IAP actually might not be updated. The Changelogs I found don’t say they added support for it, and documentation is atrocious from what I can find. The Scooter hacking forum is filled w/contradictory information, so I’m at a loss for what to do.
I just really want to avoid ST-Link since waiting a month is annoying, but more importantly I’m extremely paranoid I’ll screw up stripping screws / resealing the battery enclosure. I drive in the rain, snow, and on bumpy roads, so I really want to avoid messing with the waterproofness / structure of the scooter. It’s how I get to work, so I am scared to accidentally damage or brick it.
—–
I trust your knowledge, and was wondering if you were aware of whether IAP could work for downgrading/flashing my specific G30? (Gen2, AT32, DRV1.7.0, BLE 1.1.7)
If not, I assume I’ll have to do the Android method w/SHFW v>0.2.6
(Apologies if this is off-topic, I’ll understand if you don’t answer)
The new AT32 controllers do not work with CFW. The only option for customizing is region changes and SHFW. Luckily it seems you did not upgrade with the app so you should still be able to downgrade using the “attempt downgrade exploit” option in scooterhacking utility. IAP does not have the ability to downgrade those versions, scooterhacking utility on android is the only way.
All things considered I strongly recommend having an STLink on hand if you are going to mess around with firmware just in case, and the “waterproofing seal” on the bottom is really just foam, its not like an iPhone where if you ope it it destroys it.
should I risk this for the ninebot F25E?
This guide is for a max/g30… Make sure you aren’t flashing firmware for the wrong vehicle
hello, I have recently changed a region for my Ninebot F25E and now it’s only doing 12mph instead of 17mph. I’ve tried Factory resetting and changing the serial and it seems to keep redject what I do. it just beeps 3-6 times and makes no difference. is there anything I can do?
What region did you change it to? I don’t have any experience with the F series but I have to imagine the regions are similar to the max series…
So I been researching the hell out of these chinese clone dashboards that are stuck on BLE 9.9.9 (2 of my 4 dashboards are these) and found out that there is a pull up resistor between SWDCLK and the memory chip. The job of this resistor is to protect the input and refuse debuging and flashing as well as prevent voltage leaks in or out which can corrupt the chip.
This resistor is black unlike the white C2 resistor you remove in the ninebot pcb (PRODB_V1.3). Both are different, however the pull up resistor behaves the SAME in terms of blocking your debug and CFW signal and data of SWDIO.
The flash.bat doesn’t work on this chinese fashboard with ST-Link V2 but st visual programmer WILL. The issue is, people bricking their dashboards is due to using the famous .bat that is designed only for the PRODB_V1.1 and PRODB_V1.3 pcbs. This is not either so its parameters are more like the m365. similar to segway but still not which will cause errors in these clones. These clones are m365 basic pcbs. The BLE 9.9.9 is just a trick of using a high version to reject BLE firmware upgrades or downgrades, which is really a hardware block (resistor). Follow me?
So tomorrow I’m trying the ST Visual Programmer flash with the resistor and if it dont work I’m removing the pull up resistor and trying again.
The sequence after removing the pull up resistor is as follows:
Disconnect 3.3v first, then SWDIO and SWDCLK, then remove ground. If you do any other sequence you can ruin the chip.
You can brick (more like burn out) your clone dashboard if you remove ground first.
Having said all this, the memory chip is exactly the same type the ninebot dashboard uses. IT CAN BE FLASHED.
However if it was flashed using VSS and so forth, using another program language, then you’ll need ST-Link Utility and ST Visual Programmer to format the chip first.
Thats why this .bat file dont work. it just overwrites some function with unknown language. thats a theory at least.
What I DO know is this black resistor that SWDCLK (clock signal for debug and flash) runs into before the memory chip, is blocking flashes simply put.
Besides voltage leak protection the pull up resistor is known for blocking fw debug and making changes, in all pcbs microcontrollers and chip boards alike. It also only allows a certain signal strength to pass. It also acts as a one way street which doesn’t allow debug to work since debug is paired with SWDIO in real time.
This isn’t hard to get. I’m making it sound more difficult than it is.
I’ll be flashing many ways tomorrow along with removing the resistor if it comes to that and reporting back here.
I successfully flashed BMS110 and DRV126. I tried flashing my BLE but it keeps showing its stuck on 9.9.9…
I have a stock Ninebot Max g30p but a clone dashboard since my oem dashboard broke.
Any way to flash BLE? I have a st-link v2. Will that work with ST-Link Utility and dump file?
You can’t flash clone ble boards, this is why they report 9.9.9 so that the app never tries to update them and you never notice that they don’t work quite as intended…
Just bought a G30LP and it will not allow me to use scooterhacking to load a customer firmware. Do you have a tutorial on how to do it with an ST link?
Yes, the tutorial for the regular max should work as well.
Hey Joey how are you brother
nope, haven’t changed. it’s recently bought scooter. i opened it and you are right. it’s not a genuine controller. thanks
i have g30d II and i want to know why my drv and bms have so high version ble is 1.1.7, drv 2.4.5 and bms 2.5.5. i want to flash it with cfw but i don’t want to brick
That sounds like the versions that clone esc’s report, have you replaced the esc/control board?
Hi joeybab3,
I’m stuck with US region and not able to revertback. I’ve tried with ninebot IAP (by changing SN), I’ve tried scooterhacking utilities, and xiaoflasher .
My scooter model is : G30 LE II
FW version is 1.7.1
The actual SN starts with N4GS (old one was N4GA).
Any idea ?? please help
Sounds like you need to downgrade your firmware. I don’t have much info on the 1.7.1 version, it seems that it was possibly a regional release.
Hey bro my region is stuck at eu and now my scooter doesn’t go above 20kph every time I tried flashing it never flashed please help
Did you update to 1.7.13? If so you will be out of luck unless you stlink
Hey Joeybab3
I have a ninebot max, from late 20 – i want to donwgrade firmware so I can flash it, but will I be able to do so without an android phone? I have acces to a windows computer if that helps?
Depends which version you have, if you have 1.6.13, or 1.7.0+ then you will need an Android phone or to borrow a friend’s phone
if I have the new version of controller v1.1, if I change the serial number, can I downgrade after that without bricking the controller?
No, you won’t be able to change the serial number anyways with the newer version but flashing the downgrade would brick it since it is meant for the older controller.
How would I know if it is a “new version of the ESC”? is it a specific serial number range or physical differences between older and new?
Thank you
Both, I’m not sure the specific range other than it was late 2021/early 2022 that they started. There are some other physical differences in the labeling as well.
Sorry, noob here. What do you meen by;
Warning
If you have a max with the new version of the ESC (SN late 21-22), this will brick your controller.
Do not proceed until this has been fixed if you have a new ESC.
I just bought a new G30 and it has 1.7.0 firmware on it. It looks to be a version 2 motor. I want to take advantage of a bit more torque cuz I’m >220lbs.
Do I need to take out the ESC and confirm its version?
Thank you
It would be best to take the bottom cover off to check. If you attempt this process otherwise it will brick.
Were you able to get it fixed? I have the same issue
Not sure who you are replying to here?
Good day
ninebot G30ii
I did exactly as described. Now my scooter does not want to turn on. anymore. Bought it two days ago.
any help will be greatly appreciated
When you say it doesn’t turn on anymore, what exactly happens, any beeping/lights at all?
is there an way to do it with the ninebot api on windows?
No DRV 1.7.0 must be done with ScooterHacking Utility, future versions must be done with an stlink.
I brought a brand new G30P and it already had the new firmware on it, so scoothacking utility prompted me to downgrad the firmware. I said yes and it seemed to flash ok, but then it could no longer connect to the scooter and my scooter was bricked. š I would not do this process for new scooters.
Interesting, that’s the first I’ve heard of that happening. Could you provide a bit more detail into what you mean by bricked? If it’s behaving weirdly but still has Bluetooth or some functionality you may be able to fix it without stlinking.
I have a less herd of brand of shared escooter brands called SPIN I was told it’s a snsc2.0 I tried to flash using SHU but after it connects after I press flash nothing happens the screen don’t upload the flashing loading bar it just stays on the same setup options screen
Well assuming you got that rental scooter legally it’s still going to have rental firmware on it so it will need to be STlinked.
I’m guessing I Ned to ST link to the BMS to downgrade the BMS to allow for custom firmware install? The BMS is the only thing left of the old rental equipment. My dash shows BLE 9.9.9 although it seems to take the flash of BLE 110. I didn’t get an error code on the app or on the dash. The app said success but when I reboot it shows BLE 9.9.9.
My DRV shows 2.4.5 and my BMS shows 2.5.5; can’t download any other DRV usin Bluetooth from ScooterHack Util
Well if you have clone equipment then you will need to get rid of it if you want to be able to experiment with flashing anything… As for the other versions, assuming the clone hardware isn’t just reporting fake versions to prevent updating since it can’t then those don’t look like the SNSC 2.0 versions I’m used to so if you are trying to do that for an SNSC 2.2+ then it will not work with retail firmware.
Hey guys.. hoping you can help me out here. I havace a former LYFT which I’ve replaced the ESC and dash using unit’s I got from Amazon. It’s a XBOT (clone) G30 ESC and dash. I managed to flash BLE 110 onto the dash, but after reboot it still shows BLE 9.9.9 in my info list. I’m unable to install SHFW,. It gives me an error code 10 whenever I try flashing the SHFW or when trying to flash DRV versions from the server.
Any ideas?
Thanks
Will this work with Lyft BMS battery installed to flash BMS to stock.
You cannot remove rental versions without an STLink
I hope someone figures out 1.8.3 downgrade. I’m lazy and don’t want to st link.
Is there any way to downgrade Ninebot Max DRV 1.7.0 without STLink using Windows`?
No, you must use an android for the time being
Crvena lampica ,prva od pokazivaca baterije..blinka non stop..nema veze jel punjaÄ upljen il ne..isto sve..ne pokazuje koliko idem na sat,i nmž se prebaciti u S mode……ka mislim da sam sve metoze resetovanja probao al,ne rade..svi pokuÅ”aji preko apl dowgrade i scoterhacking da vratim na staru verziju i orginalni su neuspjeli..IMA LI IKO RIJESENJE ..(da ga ne rastavljam po moguÄnosti)?? TEK SAM KUPIO XIAOMI-PRO2…i oma belaj..unabrijed hvala
With the 5.8.5 update I now cannot downgrade the firmware of my Ninebot F30, if you know how then please make a tutorial on that aswell. Thanks!
I don’t have an F-series and do not currently know of any ways to get around this, sorry.
What is BLE??
Bluetooth low energy
I got an error. Flashing Failed! Update Failed Reason Page index error.
The flashing starts and then atfer 2 or 3% its stops an says this error.
Ik have the latest app and rebooted step and phone.
I did this and now the Ninebot Max won’t stay on or connect via Bluetooth. Have you had anyone else with this experience? Not sure what to do.
It’s possible the flash failed. It’s very rare (1/100+ flashes) but it can happen even with OEM updates. You may need to STlink to put the old firmware back.