ES-200 Electric Scooter Unlocker

Our streets are becoming litter with high technology joy. These forgotten scooter must be reverse engineer and given the love they deserve.

Similar projects worth following
This project is intended to share all that has been discovered from the ES-200b scooter that was found in the river by my house. Their high tech trash, becoming a tool for the everyone.The most current versions of my firmware are available on Github @ is two versions Master and Final. Master is a working version that is not being currently updated and Final is a production version that I am working to create extra features like flashing lights But it looks so much prettier. At this time I would us the Final version it has a speed increase not available on the master.

    The system that the Electisan F350 e-scooter is built on a basic STM32 platform. The motor controller is based on a the venerable STM32F103C and the display controller is a STM8. Sadly the manufacture in china locked up the firmware. The GPS tracker is based on the nRF52840 and was not locked. So the firmware is included below. The tracker is manufatured by Comodule and the FCC was so kind to include some great photos. 

Once the potting is removed there is pads exposed for the SWD nRF52 (six pins) and the SPI flash chip. (four tiny pins) ISSI IS25WP064A Pinout to be included later. On the GPS tracker there is a SARA-R412M cellular modem. That I have been told is a real pain to use.

Adobe Portable Document Format - 379.27 kB - 12/01/2019 at 22:27


JPEG Image - 1.90 MB - 12/01/2019 at 22:26


JPEG Image - 296.43 kB - 12/01/2019 at 22:26



This is the Basic Arduino Nano project to start the ES200 scooter

ino - 575.00 bytes - 12/01/2019 at 22:03



The maunfactures specs for the ES200b scooter

Adobe Portable Document Format - 143.61 kB - 11/28/2019 at 13:23


View all 6 files

  • 1 × ESP32 Adafruit Huzzah32 but any one would do.
  • 1 × DC/DC Buck Convertor LM2596 Module
  • 1 × Julet Plug Aliexpress

  • New Speed increase

    Mr. Spriggs01/09/2020 at 14:26 1 comment

    A new speed increase has been finally uncovered for the ES-200. This command has been applied to the Final version of the Scooter Unlocker for the ESP32. Happy hunting

    And a Big Thanks to Wileok for doing the hard work and finding the command.

  • Production Version

    Mr. Spriggs01/06/2020 at 13:56 0 comments

    I have branched of the GitHub library to two versions. The master branch is a stable version not being updated and Final is going to be the production version with all the extra options to make it as simple to use a possible. Hope everyone enjoys.

  • Github Repository

    Mr. Spriggs01/01/2020 at 13:44 2 comments

    So this project has been migrated to a Github repository. Hope everyone will enjoy.

  • Going to Github

    Mr. Spriggs12/30/2019 at 22:39 0 comments

    The project is getting difficult to maintain with just using Im going to migrate the project to Github. So I can share the newest versions.

  • Low Power Mode Here we come.

    Mr. Spriggs12/30/2019 at 01:35 0 comments

    Ok The Holidays are suck. Oh ya Im not here to bitch. So Ive got an updated ESP32 with bluetooth that can code select any and all known codes. So you can ride along on the fly and switch from granny mode to a whooping 13 mph with flashing headlights and all.  Just need to type in a decimal number from 0-255 on the smartphone of your choosing and test to you hearts content. Im going to put it on Hackaday. For all the cool kids in the know. If you don't read the ten thousand time I put the link in the forum. Still no luck on the speed. I think a more complex solution will be required.  Something along the lines of reprogramming the STM8 in the headstock and adding bluetooth which is cool and a pain in the ass.
       So nexts is a couple of lessons learn. The ESP32 sucks the mA hard. 100 ma running full power. So when compiling use the 80 mhz setting, set the flash to 40 mhz. And if there is a tech savvy soul to be found, kill one of the cores. Ive gotten mine down to about 50-60mA with a low power of 20mA. That not including the draw on the buck convertor. 
      My next goal is to have a low power mode. But that it won't be a problem much longer. The low power needs a way to wake it up to turn on the bluetooth radio. Im trying to decide if it will be a touch pad to wake it up like all the new kids toys or have it wake up every so often and look for a BLE connection. Or even a little mix of the two.
        Also for the nano diehards that want to build something similar to my code. You can use a HM-05 Bluetooth module and the RemoteXY website to make your own forked version. It can work I just don't have the time to do it. It will need a SoftSerial setup for the bluetooth. It should not be much more than a cut and paste job.

  • Testing on a moving scooter today.

    Mr. Spriggs12/20/2019 at 22:53 0 comments

    Now that I have the bluetooth working and Im pretty sure that this code won't break the scooter. I got to tested out the controls in motion. Which it is lots of fun running around with a iPhone in my brake hand. Trying to get a scooter going as fast as I can. It starting to seem like the top speed for this motor controller is 13 mph. I found out I can make the headlight turn on/off and even flash. Make the scooter go slow as dirt. And some even make the MPH on the LCD turn on and off. Not sure what the point of that is, maybe something to do with MPH/ KPH. What the best news is that 0xFF is the fastest accelerating setting. The little wheel even squeaked off the line. 

  • Command Structure Testing

    Mr. Spriggs12/20/2019 at 13:53 0 comments

    Today I got the code working to send test commands to the scooter motor controller. This is some of the rules the command system seem to follow.

    - It looks like the commands need to be sent twice for them to take effect.

    - The keep alive command/ Kill will over write all other commands. 

    - The commands you want to keep working need to be sent repeatedly to keep working, every 10 sec is OK. 

    None of this has been tested on a running scooter. (i.e. don't want to kill my ride) So I can't  tell you if the motor is operational.

    As for the commands Ive gotten something to happen
    0x02 Causes headlight to flash and a loss of the LCD
    0x03 Causes headlight to flash and LCD is still working
    0x04 None
    0x05 Turns on Scooter 
    0x06 Causes headlight to flash and a loss of the LCD
    0x07 Causes headlight to flash, LCD is still working, MPH is lit.
    0x08 None
    0x09 Causes headlight to turn off, LCD is still working, MPH is lit.
    0x0A Causes headlight to flash and a loss of the LCD
    0x0B Causes headlight to flash and a loss of the LCD
    0x0C None
    0x0D Causes headlight to turn off, LCD is still working, MPH is lit.
    0x0E Causes headlight to flash and a loss of the LCD
    0x0F Causes headlight to flash, LCD is still working, MPH is lit.

  • Interesting Data Output

    Mr. Spriggs12/19/2019 at 17:20 0 comments

    So when I type in commands into my remote for ESP32 the motor controller spits back hex data. It easier on the eyes in decimal so here a little to look at

    Keep alive command

    19 38 20 0 44 213 0 82 0 0 80 0 0 7 0 0 255 1 153 186 0 158 0 0 0 0 0 0 32 0 2 100 17 16 16 18 255 255 255 148 127

    Turn off

    19 38 20 0 44 213 0 82 0 0 80 0 0 16 0 0 255 1 153 186 0 158 0 0 0 0 0 0 32 0 2 100 17 16 16 18 255 255 255 148 1

    Notice the highlighted numbers is on and off. Other commands seem to change the last third fourth and fifth digits. Also adds a bunch more data to the response.

    19 38 20 0 44 213 0 82 0 0 80 0 0 16 0 0 255 1 153 186 0 158 0 0 0 0 0 0 32 0 2 100 17 16 16 18 255 255 255 202 197 255 255 255 255 255 255 3 255 0 154 36 255 20 162 51 255

    The last digit in the string is the checksum Im guessing.

  • BLE Remote Commands

    Mr. Spriggs12/18/2019 at 20:47 0 comments

    The remote commands software is working. I can send commands to the motor controller from my iPhone which is pretty cool. I haven't yet figured out any interesting commands that I can figure. The keep alive command keeps stepping on the commands I send. For example I send a command to the motor controller the LCD flashes the response. But as soon a the keep alive timer send a command the last command is over written. I really need a working GPS to monitor and see how commands are sent over a long period of time. Ahh a project for another day.

  • For yous all following at home.

    Mr. Spriggs12/17/2019 at 13:23 1 comment

    So if just if anyone at home is interested in testing out the new command injection firmware it is intended for a ESP32 (i.e. Adafruit Huzzah32) The reason being is it has 2 hardware serial ports. One of the ports is sending to the scooter the commands over Serial1. The other is being used for debugging and sending commands to the ESP32 i.e. Serial 

     You can do this with an Arduino Nano but it would need to be updated with a SoftSerial command to work.

View all 17 project logs

  • 1
    How to connect an Arduino Nano to the ES-200B

    To get the ES-200b working you need to cut the exposed wires from the GPS tracker. Warning these wires have different color codes depending if you are going to cut it before or after the waterproof plug. For my scooter I cut it on the GPS tracker side. On the other side the Black and Red wires are still the same. the BTN wire is yellow and the TX is blue I believe.

       The Black is ground (GND) The red wire is the VIN 42 volt from the battery. The Blue is called the BTN and this is just to turn on the motor controller. It requires a constant 3.3v. The yellow is TX and will need to be connected to the RX of the Nano. The green is the RX line and is not required but I hooked it up anyways just in case you want some input from the motor controller.

       So the first step is to hook up a Buck convertor to the Red (VIN) and black wires (GND) this will step down the relatively high voltage from the battery to something the Arduino can use. Because the battery is 42v you will need a special Buck Convertor that can handle all that voltage. I used an LM2596 based convertor board from amazon. A XL7015 type break out might be a better choice. Make sure to adjust the voltage below 5v.  Now connect the Arduino ground to the buck convertor and the buck's + to the Arduino's VIN

       Next connect the yellow TX of the tracker to the Arduino's RX pin. Now connect the Blue (BTN) wire to pin number 5 on the arduino or more simply to the Arduino 3.3v out. Last upload the included arduino .ino file to the nano and away you go. 

      If you cant get a hold of buck convertor right away its OK to connect the arduino to a USB battery. That will do the trick. 

View all instructions

Enjoy this project?



Roger wrote 05/22/2021 at 03:51 point

Hi there, am trying to open this link to the Nano Version. Is it still available?

  Are you sure? yes | no

spamaval8r wrote 05/24/2021 at 16:09 point

Hey man, did u manage to access the code or get it somehow?

  Are you sure? yes | no

Roger wrote 05/24/2021 at 17:34 point

Yes, got it off Github in the end, have you got it working? 

  Are you sure? yes | no

nateclapp wrote 04/21/2021 at 19:13 point

So in my case the Green wire on GPS side of Juliet plug was RX to scooter (connect to TX of Nano) and Yellow was TX from scooter which is not needed.  For those following along, essentially what is going on is nano is sending a 6 group hex code down the RX line every half second to keep the scooter awake and control parameters.  Depending on what that hex code is, it controls top speed, acceleration, headlight on/off, waking up controller, mph/kph display etc.   I use A6 12 02 E5 FF 60.   Not sure what the first 3 blocks do, so just leave them alone.  4th block does a bunch of stuff for headlight on/off, acceleration, etc, The FF is for max rolling speed.  Initially I was using E4 there but regenerative braking starts at 24.3mph.  at FF it never kicks in and you can freewheel pretty fast down hills.  the last block is crcc or error checking on the other five, so change any of those and you will have to recalculate that.  if you use E5 for max speed, use DD as last block.

  Are you sure? yes | no

spamaval8r wrote 05/24/2021 at 16:09 point

Hey man, can you send me the code? Maybe post it on Pastebin or something because the link to the code isnt available anymore. Please man🤙🏼

  Are you sure? yes | no

Terrance wrote 03/17/2021 at 23:17 point

Newbie here, having an issue with the code. When I run the code on the arduino app, it says no serial 1 not declared. . Thoughts? Thank you

  Are you sure? yes | no

mmy26 wrote 05/21/2021 at 20:33 point

удалить Serial (1) везде

  Are you sure? yes | no

spamaval8r wrote 05/24/2021 at 16:09 point

Hey man, can you send me the code? Maybe post it on Pastebin or something because the link to the code isnt available anymore. Please man🤙🏼

  Are you sure? yes | no

bastler2117 wrote 11/16/2020 at 15:48 point


Can you make someday a unlocker or Open Source Firmware for the Okai ES400 and

ES400B too?

  Are you sure? yes | no

atdrob1 wrote 09/17/2020 at 00:01 point

Hey!. So i followed your steps and scooter still doesnt turn on. Any help would be appreciated

  Are you sure? yes | no

Andy Morris wrote 08/11/2020 at 00:58 point

How did you get the dashboard out of the head of the post?  I have a similar es200b and nothing happens when I plug in the charger.  No display on the dashboard, maybe its dead or something.  Anyone know where I can get a replacement dashboard?

  Are you sure? yes | no

cddamiao wrote 02/23/2020 at 15:33 point

Hi, is it possible to put this sistem to work without the GPS module? thank´s ;)

  Are you sure? yes | no

Fgoogie102 wrote 01/31/2020 at 17:29 point

Hello everyone, its great that I found this site albeit would have been much better to have done so last year😝. Im really "green" when it comes to online forums and community help spots such as this as well with scooter hacking in general, but fantastic to see that there are such experienced, resourceful, and generous folks out here helping those like myself. 

I'd like to make a tiny gesture of gratitude to the developers/testers that have made such great progress.

If there is any part from an Okai/Electisan ES200B, from dash to ESC or strucural hard components, it would be my pleasure to donate whatever is needed from my now dismantled unit to further your work. One thing which will be difficult for me to provide is the original wires/assemblies because I repurposed a majority of them for something else I was working on. I will check back periodically to see if there are any requests. Thanks, and please keep up the awesome work!!

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates