Ninebot ESX How to Downgrade/Flash Back to Stock Firmware

January 15th, 2021





Ninebot sometimes puts out updates for their scooters that can have undesirable effects on their end-users.

To that end, it may be desirable to return to the pre-update experience.

Sometimes it may also be beneficial to flash stock firmware on the device after flashing custom firmware.

For the Max/G30/SNSC 2.0+ Series, follow this guide instead.

Use the links below to easily navigate to your preferred app/os:

OS:

App:

Firmware files should never be downloaded from untrusted sources. Always download directly from ScooterHacking.

For the ESX, I recommend DRV 1.5.1, BMS 1.4.9, and BLE 1.0.7 or 1.0.9 (1.0.9 has an additional security step to connect but all flashing apps support that now).

Always keep a copy of these handy just in case.

NOTE: If you have a bricked controller or a failed flash, you will need to STLink your ESC.

Windows

There are two main apps that allow the flashing of firmware to a Ninebot ESX on windows: Ninebot IAP, and Ninebot Flasher.

Both require BLE/Bluetooth 4.0+.

Ninebot IAP

Ninebot IAP is a tool developed by ScooterHacking.

It can be downloaded here.

Below is how to use Ninebot IAP to downgrade firmware for the Ninebot ESX series of scooters.

Open Ninebot IAP and click “Start Scan”.

Scanning for an ESX.

Scanning for an ESX.

Select your scooter from the list of BLE devices.

Scanning for an ESX.

Scanning for an ESX.

If no options come up, you may not have BLE support on your device.

Press “Connect” and wait for version numbers to appear in the upper right-hand box labeled “Installed firmware”.

If no version numbers appear but IAP says you are connected, you may have a clone dashboard that is unable to support flashing.

Colored non-zero version numbers show a successful connection.

Colored non-zero version numbers show a successful connection.

From here download a stock DRV firmware file in the .bin.enc format from files.scooterhacking.org.

If you are unsure which file to use, I always flash DRV1.5.1 as it is known to be reliable.

Back in Ninebot IAP, click “Select File” and then open the .bin.enc file you downloaded.

It will freeze for a moment but then should say something along the lines of “Target Selected: DRV, Loaded DRV 1.5.1 (ESx)”.

Click “Flash!” and you should see it start flashing and going up in percentage.

Flashing in progress.

Flashing in progress.

After the progress gets to 100%, you should see “Update OK” in the box.

after getting to updating 100% IAP should tell you the flash was successful.

after getting to updating 100% IAP should tell you the flash was successful.

This means the flash was successful.

To confirm disconnect from the scooter up at the top and then select it and connect again and confirm the version was downgraded.

The version no longer says 5.5.1 and now says 1.5.1 for the DRV.

The version no longer says 5.5.1 and now says 1.5.1 for the DRV.

Ninebot Flasher

Ninebot Flasher is an app available on the Windows store.

It can be downloaded here.

Below is how to use Ninebot Flasher to downgrade firmware for the Ninebot ESX series of scooters.

Once installed press “Start Scan” and select your scooter from the list of options.

If no options come up, you may not have BLE support on your device.

 

Select the device you wish to connect to.

Select the device you wish to connect to.

Press connect once you have made your selection.

A successful connection is shown by the serial number in the console.

A successful connection is shown by the serial number in the console.

You should see your device name along with “Connected” at the top, and the ESC Serial Number shown in the box.

If you don’t see this info, your device may be on rental firmware or the dashboard may be a clone dashboard.

From here download a stock DRV firmware file in the .bin.enc format from files.scooterhacking.org.

If you are unsure which file to use, I always flash DRV1.5.1 as it is known to be reliable.

Back in Ninebot Flasher, select “OpenFile” and then open the .bin.enc file you downloaded.

It will freeze for a moment but then should say something along the lines of “Loaded DRV 1.5.1 (ESx)”.

A successful file load. It should not say "Bad File".

A successful file load. It should not say “Bad File”.

Next, press “Flash”.

You should see “Check File OK” and “Lock OK” followed by a brief pause.

It will begin flashing and showing the percentage as it completes.

Flashing in progress.

Flashing in progress.

This process will take a few minutes, but once the flash has completed, it should say “Update OK”.

Successful flash.

Successful flash.

To confirm that it has successfully downgraded, press “Version” in the top toolbar.

Some info related to the scooter will print out, but the number you are interested in is “Drv Ver:”

It should be the version you installed, in my case 1.5.1.

Checking the version on the DRV.

Checking the version on the DRV.

Android

Android has a good selection of apps able to flash firmware.

Scooterhacking Utility

Scooterhacking Utility is an Android app developed by ScooterHacking.

It is currently in beta, and you can download it here.

Once installed, open the app and select your scooter from the list.

Select the device you want to flash from the list.

Make sure that the app has successfully connected and doesn’t show “0.0.0” for the version numbers.

A successful connection is shown by the non-zero version numbers.

If the version numbers are shown and the connection was successful, scroll down to the “Flash” section and click “Load Original”.

Clicking “Load original” brings up a list of available firmware types.

From here, click on “DRV”(another term for ESC/Control Board).

Choosing “DRV” will flash the ESC or Control board.

In the list of version options, I usually use DRV151 as I trust it to be stable and not have issues.

You can choose any of the ones you want but in general, choose 1.5.1 or the latest version available.

Here I’m looking to flash 1.5.1, so I select it from the list.

Lastly, click the “Flash” button and allow the process to complete while waiting near the scooter.

Confirm the file is the right one you want to flash before flashing.

The flash should complete shortly and your device will beep a few times after to indicate its rebooted.

XiaoFlasher

XiaoFlasher is an android app that can be used to flash and configure many models of scooters on the go.

It can be downloaded here.

This app is full of ads and it is much more recommended to use Scooterhacking Utility as shown above.

Open Xiaoflasher and scan for devices.

Scanning for devices.

Scanning for devices.

Click on the name of your scooter to connect.

XiaoFlasher is pretty buggy so sometimes after connecting the app will immediately disconnect.

You can fix it by clicking the plug icon next to “Status: DISCONNECTED” a few times until version numbers show up next to ESC, BLE, and BMS versions.

Sometimes you will need to reconnect a few times for the connection to establish.

Sometimes you will need to reconnect a few times for the connection to establish.

Once the status says “CONNECTED”, you can scroll down to the section labeled “Default – Official Firmware” and select a version.

I usually use 1.5.1 as it is stable and very proven by the community.

Click the button corresponding to the version you want to install and you should see information populate the section under “Selected File”.

The information for DRV 1.5.1 is displayed.

The information for DRV 1.5.1 is displayed.

From here hit the button labeled “Flash Selected zip File”.

Flashing in progress.

Flashing in progress.

Make sure it gets to 100% and then disconnect and reconnect to check the version has successfully downgraded.

iOS

Unfortunately, there are no apps currently available to flash firmware to ESX scooters on iOS.

In this case, you will need to purchase a cheap android phone or use a windows device.


Comments

12 thoughts on "Ninebot ESX How to Downgrade/Flash Back to Stock Firmware"

  1. AJ says:

    Hi Joey,

    First I want to compliment you with your great tutorials.
    I’m sure I’m off topick here (althaugh I used this to downgrade the firmware), but let’s try anyway.
    I found a Ninebot ES2 (I think, complete noob regarding this stuff) and I like to play with broken stuff I find/get to see if I can get it back to life again.
    So I noticed the display was dead and after some reading, I bought a new controlboard. And yes, I had a display again, but bound to another user and when I use the trottel it doesn’t drive.
    What did I do with the hope it would move:
    Changed the serial, so now I’m the owner
    Did a hard restet (I’m a noob)
    Flashe the darn thing back to stockfirmware 1.5.1 as you suggested.
    It’s a non foldable, so I suspect ita a formal rental one since it’s not foldable like you mentioned in one of your tut’s.
    No errorcodes on the display, except when I do the reset and hold the breake and throttle and not releasing them imediately, then It’s shows error 14.

    Do you have any suggestion of what I might have missed (could it be locked somehow)?

    hoping for a response, I wish you a nice day

    Rgrds,

    AJ.

    1. joeybab3 says:

      Glad you’ve found use out of the tutorials! Just to clarify what is the issue you are currently experiencing with the unit? When you boot up the unit with the throttle pressed at all it will show error 14 (the brake will cause error 15) that is completely normal and you don’t need to worry. When you boot it up just make sure the throttle is not pressed so the error code is not shown.

  2. Allen says:

    Hey, Joey. Thanks for making this tutorial. I’d like to pick your brain on my situation. Some neighbors gave me and my son a Es1 scooter that would not turn on. After some initial research and confirming the battery was fine, we ordered a dashboard as well as a control board online and installed them. The scooter powered up just fine, no errors. I used the ios segway app to connect to it (I did notice it was “bound”). I used the app to update the firmware (I know, I probably shouldn’t have). We were able to ride the scooter with no issues for a little while.

    The next day, however, we turned it on and receievd the error 10 (dashboard). It won’t ride and we can’t do a hard reset. We have reseated the connections several times and even used the original dashboard controller with the new control board. Same error. I then used your tutorial to connect BLE to the scooter with Ninebot IAP. It sees it and connects, but does not show Installed Firmware or Serial info(upon reading). Therefore flashing your suggest firmware is not going through. I’m really at a loss at to what to try next, it just keeps showing Error 10 and will also not connect to any ios app anymore. Thoughts?

    1. joeybab3 says:

      It’s likely you got a clone esc, those are notoriously hit or miss, with some only riding for a few miles.
      Googling error 10 you can see that it is shown when the esc and the dashboard are unable to communicate. That can either be because the dashboard isn’t communicating with the esc or the esc can’t communicate with the dashboard.

      In this case if you tried another dashboard we can say that the issue is likely caused by the esc.

      Without being there I can’t say whether the ESC is salvageable with an stlink or something of that nature or whether you will need an entirely new one but it’s likely that the esc broke when you tried to update.

  3. Fey says:

    i cant connect to BLE. how ti fix??TQ

    1. joeybab3 says:

      Make sure the computer/device you are using to flash has BLE support and the dashboard on your scooter is OEM

  4. ALIKHAN says:

    Ninebot F20A
    IPhone 11

  5. Central Florida E-Bikes says:

    I’m getting a bms error code 21 after doing firmware update. Tried flashing to the recommended settings above on the scooter hacking utility app and I’m still getting the same error code and bms shows 0.0.0 after the flash completes

  6. Central Florida E-Bikes says:

    I’m getting a bms error code 21 after doing firmware update. Tried flashing to the recommended settings above on the scooter hacking utility app and I’m still getting the same error code and bms shows 0.0.0 after the flash completes.

    1. joeybab3 says:

      Check the BMS connector and make sure the light is still blinking blue

  7. Peter says:

    Hello
    I do the steps and all software options stops at Lock ok. No progress after that
    I need to update Drv from red to green
    Please help!

    1. joeybab3 says:

      Do you have a non-folding/rental model? If so you may need to replace the dashboard.

Leave a Reply

Your email address will not be published. Required fields are marked *