How to STLink Ninebot Max/G30 ESC – Fixes Bricked or Updated Controllers
February 23rd, 2022
Sometimes when updating a Ninebot Max G30/G30E/G30D/G30P/whatever other models Ninebot comes out with, the update may fail.
This can happen even without trying to flash CFW or Custom Firmware.
In the case of a bricked ESC/Controller/Control Board, STLinking can save the controller from needing to be replaced in some instances.
This guide will also be useful if you updated it to DRV 1.7.0 or DRV 1.6.13 or any future versions where Ninebot restricts the downgrading of the firmware.
This is also the only fix for DRV 1.8.3/1.7.13 or DRV 1.8.7. Anyone promising you a fix over Bluetooth is probably attempting to scam you.
For this process you will need:
- Windows computer
- STLink (Decent quality clones will work)
- Tools to disassemble the scooter and access the ESC
- Dupont male/female jumper cables
This process can be dangerous if done incorrectly so take caution when performing these steps and make sure you use a computer you are comfortable possibly destroying.
If you short a battery line you could end up blowing up your STLink, Computer, ESC, and more, or even cause a fire.
Identify Which ESC Generation You Have
Check out the difference between the Ninebot Max ESC Generations and use the steps below depending on which one you have.
There are 3 different board layouts.
These versions are based on the AT32 MCU rather than the STM32.
A Gen 1 ESC has bullet connectors and a silver metallic housing. The G30D has 3 capacitors and a different location for the debug pins.
A Gen 1 ESC has bullet connectors and a silver metallic housing. Newer units may have writing as shown in this image.
Click the image above to go to the guide that corresponds to your model.
Accessing the Debug Pins
Accessing the ESC
Start by removing the 18 Security Torx T-15 screws on the bottom.
The locations of the 18 screws.
Using an M4 Allen/Hex wrench or bit, remove the two screws holding the ESC in place.
The ESC after being removed.
Carefully unplug each of the connectors.
You may need to scrape more rubber potting compound away from some of the connectors in order to unplug them.
Accessing The Pins
Carefully scrape away the potting compound, making sure not to remove any of the small surface mount components.
Be very careful not to damage any of the smaller SMD components.
ScooterHacking Reflasher
A new option recently was published by the team at ScooterHacking for STLinking ESCs.
You can download it here.
STM32 Utility
Download STM32 STLink Utility from the ST website.
Scroll down and click “Get Software” and enter your email to receive a download link.
Install it and open it.
You will also need the full dump file from ScooterHacking.
You can download it directly here: https://files.scooterhacking.org/firmware/max/DRV/esc126_fulldump.bin
A note on downloading firmware: Always ensure you get it from a reputable source.
Always download from ScooterHacking whenever possible, DO NOT TRUST ANYONE TO GIVE YOU FIRMWARE.
I do not host firmware files for this reason.
Flashing
Connect the STLink to the ESC according to the diagram below.
The BMS port red and black wires can also be connected to provide power instead of using the BMS connector and ground point.
The pinout for the STLink for the data pins.
Before connecting pins, make sure the battery is unplugged and the onboard capacitor has no energy by either shorting the capacitor leads or pressing the dashboard power button a few times while it is plugged in but not connected to battery.
Connect your STLink to the pins as shown, you can choose either location for 5v and GND.
- Open the STM32 ST-Link utility and connect to the ESC using the plug at the top
- Press Target->Connect from the top menu
No error messages about “Unable to connect to target” should display.
- Press “Open File” and open esc126_fulldump.bin which you downloaded above from “Software”.
At this point, a red LED should light up on the board.
- From the top menu, press Target->Program & verify or ctrl+p.
Once it completes, check the log for error messages.
After that, it should be ready to use again!
- Filed to:
- Electric Scooters,
- Ninebot,
- STLink
Comments
Thank you. Your instructions saved my scooter.
Happy to hear it!
Good morning
I followed your process by soldering the 3 wires and connecting the 5v
then when switching to STM32 there is an error message displayed
16:44:45 : Can not connect to target!
If you’re trying to connect to an STM32W1xx device, please select Normal or HotPlug mode from Target->Settings menu.
If you’re trying to connect to a low frequency application , please select a lower SWD Frequency mode from Target->Settings menu.
16:44:46 : No target connected
Hard to say without it in front of me unfortunately, but I can see if there’s any other troubleshooting steps I can think of.
What do you mean when you say “when switching to stm32”?
Does the ESC light up when you plug in the STLink?
Thanks for your reply! (Can’t seem to reply on that same thread). I rechecked all my connections and even tried another esc that I have. I was able to connect to that one fine. Idk what happened, I connected fine the first time but after flashing it with the regulat drv 126 it refuses to connect again. I saw something on some german forum about having to short a capacitor and then hit connect at the same time? But no idea which to short and if it will even wrok. Looks like i’m going to have to just buy a new one 🙁
I accidentally broke replies a bit back, still working on getting them working…
Shorting the capacitor should only really be done as a precaution against sending all that energy back through somewhere it shouldn’t go before attempting flashing but it wont affect the connection.
Definitely play with the timing a bit more if you can, only plug in ground right when you are ready to hit connect for example, or unplug/replug the stlink and then immediately hit connect
My G30 also has same problem. I’m pretty much sure I didn’t any misstake but…
Anyway thank you for your effort.
I accidently flashed the non-full dump drv and now I cannot recconect to target with the st link. Any way to fix this or is it permabricked?
It should still be able to be flashed through stlink, just make sure your connections are solid.
Hi, I followed this method and finaly I can downgrade an original G3o controller, I used the ScooterHacking Reflashig utility.
But now I’m interested on the possibility to using STLINK STM32 utility to upload directly a file cooked and downladed from the https://max.cfw.sh/#
Is this possible?
The reason is as follow, I put a aftermark controller and upgrades my battery to a 13s 48V, but I think a Mosfet was broken, if I put the original a error apperars as the voltage is incorrect, and I prefer to upload the .bin file directly to the controller before mounting on the scooter.
The other possibility are get out the 48V battery, put again the original36V connect all anb by Bluetooth upload a new firmware.
I hope I explained, sorry my English.
Thanks
Once STLinked you regain the ability to reflash firmware over bluetooth again, just make sure its compatible with the controller revision you are trying to use it on.
Hi,
I get “Error code 23 – BMS has default S/N”
Model: Ninebot MAX G30 MAX (GEN 1)
BLE version is 1.1.3
DRV version is 1.5.4 (STM32F)
BMS version is 1.3.4
BMS Serial number: 3GA0016A10001 (Battery has the default number)
Link: https://joeybabcock.me/wiki/index.php?title=Ninebot_Max_Error_Code_23&mobileaction=toggle_view_desktop
According to the link above, I should use an app like Ninebot Flasher or Ninebot IAP, but it doesn’t work for me.
Do I have to use stlink with the programs above or should I just run them straight on?
How can i change BMS Serial numbers of the battery?
Which program do i have to use?
Please help me!
I’m not sure, the last time I experienced this issue I used Ninebot Flasher and the ctrl + alt + a menu to change the BMS SN and it just worked.
I know there are some guides out there on solving 22/23 with an STLink by changing parts of the memory around.
Thanks! I’ll give the serial connection a go and report back.
Steve
Do you have a diagram for the ESC with 3 condensators? I am not sure where to connect the STLink on my controller.
I do not as that is the g30d board which is unavailable in my region (USA), I know rollerplausch has some guides I will see if I can find a link for you
Hi Joey,
Impressive work you are doing here!
I have a retired rental SNSC2.0 and I’ve been following this guide to convert it back to personal use. https://www.scooterhacking.org/forum/viewtopic.php?f=26&t=266
I think I’ve been able to successfully flash the original rental dash via STLink, it seems to except the program and doesn’t flash error 32 anymore (iot module missing) After flashing the dash I moved onto the ESC. I get the STlink to connect to target, and am able to program/verify DRV126. But after reinstalling the ESC and powering the scooter up I am left with error 10 on the dash. I’ve tried two ESCs with the same result. ESCs were originally version 1.7.3.2. I’ve tried two methods described by Unicycle Santa, and yourself on recovering bricked units. The ESC are rev1 units with single capacitor in the silver case.
Secondly, I haven’t been able to get the BMS to flash either. I can connect via STVP and view program memory, but I cannot view the data memory, therefore I cannot create a back up and move onto the flashing.
Lastly, when viewing the scooter on the SHU or XiaoFlasher the only version number that gets populated is the DRV, no battery or BLE info. I also cannot flash any components using Bluetooth at this point.
Any insight on where I should concetrate my efforts would be much appreciated!
thanks,
Steve
Error 10 can mean quite a few things, from unflashed dash to unflashed esc to a cable issue: https://joeybabcock.me/wiki/Ninebot_Max_Error_Code_10
I would just attempt to flash without the backup unless you intend to use the scooter for rental operations again and do not have a segway discovery rep who can assist with getting rental firmware back on it.
I would use serial/UART to readout the versions with IAP one at a time to determine which is causing the issue, if you have a working retail or working rental unit, try swapping the parts one by one.
Controller was on the desk not connected to the baterry.
Or you mean connected to a battery after stlink upgrade was done ?
Usually STLink alone shouldn’t cause it to get super hot… hard to say for sure unfortunately.
If you are able to solder definitely try that next time and use a magnifying glass to confirm connections are not shorting
Hello i tried to downgrade (flash) g30E II max with st link. First time i broke stlink because i shorted GND in to 3.3v pin acidentally. Later i ordered new st link and tried flash flashed with error because of shaky hands, but next attempt was sucessfull. I connected controller to my scooter its Beep one time (dashboard was blank, auto lights on for 1 sec). Second time controller behave like dead. Tried reflash 3 rd time but 5v and gnd cable start get very hot after 10 sec and controller lights doesent blink like before. so my question is.
1. Do i damaged (Shorted) board when shorted 1st STLINK ?
2. Damaged board when 1 st atempt flash failed and 2nd reflash did not helped ?
Im just curious where i did mistake, maybe you know.
I wanted to downgrade controller by myself because in my coutnry for this job asking 80 EUR. with no guarantee.
1. It’s hard to say the extent of the damage, sometimes shorting will only break the STLink, sometimes nothing, once I broke an esc, stlink, laptop, and charger all at once.
2. Similar to the first one it’s hard to say without it in front of me but that definitely sounds not ideal, you aren’t doing this stlink procedure with the battery connected right?
I got it to work!. Connected the 5v rail of the STLink to the red wire of the plug going to the dash screen and connected ground to the third solder pad next to the data lines. I had the wrong STLink software which was a head ache. I needed an older version to the one on the link in this thread. Bit of googling and I found it. Once it connected I had to enable write access and it allowed me to dump the data. Once that was done I had some scary red error code on the dash, however once I uploaded a CFW using the NinebotIAP app I was done. I successful;ly downgraded from 1.8.7 and can now illegally ride at 33KPH in Queensland Australia!
Oh perfect! Do you know what the issue was with the linked software? I can update it if there is something off about it.
The error was likely error 27 which you can also fix by just changing the serial number back to what it was before.
Hi Joey, thanks for the detailed guide. I cannot seem to get the STLink device to connect to the ESC. I’ve connected the data lines as described but I’m a bit confused regarding powering the ESC. Could you provide a bit more detail on exactly which connectors I need to plug in to power it up? Also, Do I need to pull power / ground from the STLink device? Thanks again for any help you can offer.
Yes, sorry seems that one of my images got removed showing where 5v and gnd go… I will work on it hopefully today/tomorrow and add those images!
It s just a simple USB cable or do I have to buy something special to make connection?
You need an STLink which is a small usb dongle and some jumper cables
I recently got a ninebot g30 mad and changed the region to German without knowing that i can’t change it back to US, im on the latest updat and im not able to STlink it and i dont know where to take it to fix it, would changing the motherboards fix this?
I just got a new ninebot g30 max and i changed the region to Germany, and i cant change it back to US, i dont know how to STlink it or anyone that can do that, would changing the motherboard fix this?
I just got a new ninebot g30 max and i changed the region to Germany, and i cant change it back to US, i dont know how to STlink it or anyone that can do that, would changing the motherboard fix this?
I just got a new ninebot g30 max and i changed the region to Germany, and i cant change it back to US, i dont know how to STlink it or anyone that can do that, would changing the motherboard fix this?
It may, that is what happens when you update the firmware unfortunately. Someone may make a way to revert using an stlink but for now you are likely stuck on that version.
help Im stuck in 22kmh
Sounds like you are on DRV 1.8.8 and a german serial, you will need to stlink to remove that version and allow it to change regions
Any idea if a Flipper Zero can be used instead of an ST-Link? I have a Flipper, but not an ST-Link.
I don’t think so but STlink clones can be had for about $1-2
i tried the process but it says “cannot connect to target!”
I’ve double checked the connections and still no luck. when I put the controller back in the scooter I get error 10.
Hello Joey,
After doing some research, reading your solution as well as the comments on it by others, I’ve realized I may be in a pickle with my Max G30LP. I had previously made some minor adjustments using the SH ultility and everything worked fine. Last week I put the scooter up for sale and someone who came to see it (and apparently had no intention of buying it) connnected their Segway app to it. Unbenowest to me at the time, this can cause problems. And problems indeed started immediately after that. It is now stuck in riding mode “D” and cannot be changed. I’ve tried flashing it with various SH cfw as well as attempting a DRV downgrade. It will not allow me to flash the ESC at all and gives me the following message:
“Flashing failed! Update failed! Reason: Data format error. Power cycling your phone & vehicle might help.”
Just out of curiosity, I tried changing the region and the S/N. This also wouldn’t work. BTW, the DRV in my scooter is 1.8.7.
Does this mean the ESC is bricked and will require ST Linking? If so will it be less hassle (although more $) to buy a new ESC and replace it the old one?
Many thanks for your work on this and appreciate your help in advance.
Cheers,
Nick in Vancouver, BC
I wouldn’t say that the ESC is ‘bricked’ per-say but you are stuck with that version unless you stlink to downgrade… Replacing the esc will fix it but only if the new one you buy does not also have a DRV version that has downgrade protection. There is unfortunately no way to tell that without having it in front of you.
I have a ninebot max g30p
Hello! I have a scooter with a plastic black controller running firmware 1.7.0 and I can’t downgrade the firmware to 1.2.6. Tell me, are there any solutions? I tried through the Ninebot IAP program, but it gives me an error that Frame format error
Your only option is to use an android device and the ScooterHacking Utility app, then once connected use the upper right hand 3 dot menu to click “Attempt Downgrade Exploit” and it should be able to downgrade for you. You should not attempt to flash CFW on this other than SHFW as the new black plastic ESC’s do not support it.
so I bought a scooter off the street and guess what Error 32. now reading about this makes me wanna track this guys down. I am not very technical so what is the easy route? can I buy a new controller and put it in?
Error 32 is a rental-only error code. Not sure what you mean by you “bought a scooter off the street” but I don’t provide assistance for stolen scooters for obvious reasons.
I accidentally upgraded my Ninebot Max G30LP to DRV 1.8.something, which is why I looked at this guide. I took apart my scooter as you described and found the ESC, but could not find the 3 pins shown in your picture.
After looking around your wiki, I am wondering if the 3 pins are either on the back side of the board. Also, I am wondering if my board is an AT32 instead of STM32, and if that will require me to use ScooterHacking ReFlasher instead.
What’s the esc look like? Does it have a black plastic housing or a shiny metal one?
If it’s the open shiny metal one but it has 3 capacitors then it will need to be removed from the housing which requires scraping the waterproofing compound off to expose the back of the PCB.
I have the official St link V2 and I can get the red light to come on but I cannot get the STM32 ST-link utlity to connect to the target. Any idea, Also, what other settings/frequency are supposed to be selected?
Just the default settings and the chip you’re attempting to flash. Some STLinks (I’d estimate 30% of the clones) I was just completely unable to get to connect.
I connected the 5v and all other wires but the little red light doesn’t turn on and the st-link software says it can’t connect to target. Any ideas?
Which connection are you using for 5v?
I connect the st-rink 5v and controller +, the st-rink circuit is short and doesn’t work, what should I do?
for the new controller version(v1.1), how do we identify pins?
I’m not sure, I have not been able to find a max with the new controller to experiment with yet.
Hey bud
do you know if we can also use Raspberry Pi instead of st-link? there’re some tuturial for programming STM with RP, have you tried it?
It should be possible, I have not tried it though
Hey Joey,
thanks
I found this https://www.scooterhacking.org/forum/viewtopic.php?f=6&t=45&p=228
is it possible to write FW using Raspberry Pi instead of st-link?
hi all
I mistakenly flashed BLE firmware instead of DRV, how to restore the old DRV firmware?
controller similar to yours
I try to connect via ST-LINK, it doesn’t work 🙁
Thanks
Might need to try a different STlink, send a pic of your connections and I’ll see if I can notice anything wrong
So you said only 1/3 st links worked for you, which one did work?
There is no distinguishing markings on them, that’s part of the issue they are all knockoffs and its just luck of the draw…
For the LE version
Do I need to use different software?
No the regular versions should work fine
Hi Joey,
I’m having issues with my st link, the board lights turn on but I get a error could not connect to target. The application also freezes up a bit. Any idea what could be the issue?
It could be the STLink you are using, I had to buy like 3 different ones before one of them worked.
Some of them worked fine with ESC’s but not batteries, some not at all.
Hi Joey,
I’m soon gonna be following your guide on this st link downgrade and your guide on the serial number change. Will both work exactly the same on the Ninebot G30LE or will I need to do some things different? Thanks in advance.
There are slightly different controllers for the LE/LP series but as long as it looks visually pretty similar to the controller shown then it should work fine.
If you have a controller that looks completely different then it will not be able to be flashed.
Hey Joey, nice guide, but can you answer, how do you connect wires to that 3 connectors on the controller, via dupont connectors or something else?
Thank you!
Solder them or hold them, I used Dupont connectors for a while but eventually made my own pogo pin rig