The ScooterHacking Custom Firmware API is available at api.cfw.sh.
Requests are formed as follow: api.cfw.sh/scooterIdentifier?parametersChain
To build your parameter chain, you can use any of the available GET parameters listed below.
Some parameters requiring more details about their working behavior will have their own table of values.
✅: live on production branch | ❌: no assignee/non-applicable | ⏳: work in progress | ⌛ : the patch is undergoing tests/dev branch only
|GET parameter||Display name||Type||Default value||Accepted values||Description||ESx||Max||1S||Pro2|
|version||Firmware version||string||DRVxxx||DRVxxx||Base version. See the below table. VALID PARAMETER REQUIRED FOR FILE DOWNLOAD.||✅||✅||✅||✅|
|output||Output file||string||zip2||See the below table.||If you want to use another output format for the custom firmware.||✅||✅||✅||✅|
|name||Filename||string||None||<any ASCII string up to 40chars>||Replaces the time-based part of the filename by any custom name.||✅||✅||✅||✅|
|version_spoofing||Version spoofing||bool||None||<any string>||Sets DRV version higher to prevent an update from overwriting it.||✅||✅||✅||✅|
|region||Scooter region||string||auto||us, eu, de||Enforces firmware region and disables S/N parsing. Also makes sure the ESC accepts S/N change requests (“auto”).||❌||✅||⏳||⏳|
|motor_power_constant||MPC||int||51575||10000→65535||Deprecated way of increasing output power. Won't be added to future patchers.||✅||✅||❌||❌|
|speed_normal_kmh||Max speed||int||(per model)||10→65||Sets Sports max speed for no region/US region.||⌛||✅||❌||❌|
|speed_normal_kmh_eu||Max speed (EU)||int||27||10→65||Sets Drive max speed for US region and Sports max speed for EU region.||❌||✅||✅||✅|
|speed_normal_kmh_de||Max speed (DE)||int||22||10→65||Sets Drive max speed for EU region and Sports max speed for DE region.||❌||✅||✅||✅|
|speed_normal_battery||Sports battery current||int||(per model)||5000→65535||Sets battery current limit for all Sports modes.||⏳||✅||✅||✅|
|speed_drive_battery||Drive battery current||int||(per model)||5000→65535||Sets battery current limit for all Drive modes.||⏳||✅||✅||✅|
|speed_eco_battery||Eco battery current||int||(per model)||5000→65535||Sets battery current limit for Eco mode.||⏳||✅||✅||✅|
|direct_power_control||Direct power control state||string||off||See the below table.||Direct Power Control changes the throttle algorithm from speed to power-based, like in a thermal-engine vehicle. No speed limit applies while using DPC.||⏳||✅||⌛||⌛|
|direct_power_control_curve||Direct power control curve type||string||flat||flat; quadratic||Sets DPC curve type.||⏳||✅||⌛||⌛|
|no_kers||No KERS||bool||None||<any string>||Disables energy recovery when the throttle is inactive. Clonk-free.||⏳||✅||✅||✅|
|wheel_speed_const||Wheel Speed Multiplier||int||8“:390; 10”: 315||200→500||Don't change if you use stock tires||✅||✅||✅||✅|
|error_raising_level||Error raising level||int||0||0→3||https://wiki.scooterhacking.org/doku.php?id=nberrorcodes||⏳||✅||✅||✅|
|no_brake_light_flash||Static brake light||bool||None||<any string>||Enforces German brake light behavior for other regions.||❌||✅||⏳||⏳|
|cruise_control_delay||Cruise control delay||int||5||0→10||How many seconds it takes for cruise control to kick in.||✅||✅||✅||✅|
|cruise_control_nobeep||No cruise control beep||bool||None||<any string>||⏳||✅||⏳||⏳|
|motor_start_speed||Motor start speed||int||5||0→10||Minimum speed in km/h before the motor will start.||✅||✅||✅||✅|
|boot_workmode||Force boot power mode||int||3||0: Drive; 1: Eco; 2: Sports; 3: Don't patch||Enforces selected power mode at boot.||⌛||✅||⌛||⌛|
|remove_charging_mode||Remove charging mode||bool||None||<any string>||ESC will ignore input from the charging line, the scooter will be rideable during charge.||✅||✅||✅||✅|
|stay_on_locked||Stay on while locked||bool||None||<any string>||Disables auto shutdown when the scooter is locked so it stays on forever.||✅||✅||✅||✅|
|no_overspeed_limit||No overspeed limit||bool||None||<any string>||Removes hard-coded speed limits (and beeping).||❌||✅||✅||✅|
|bms_uart_76800||Change ESC↔BMS baud rate to 76800||bool||None||<any string>||Only if you use the compatible open source BMS!||✅||✅||✅||✅|
Please note that all parameters might not be listed.
Current DRV firmware versions used throughout the production branch.
Ninebot ESx: DRV120 ; DRV133 ; DRV139 ; DRV150 ; DRV151(default)
Ninebot Max: DRV126
Xiaomi 1S: DRV221
Xiaomi Pro 2: DRV223
If the Version spoofing patch is in use, the version number retrieved by apps will be shifted up by 400. This requires no modification to the “version” field so make sure to only use the above values.
None/“off”: Doesn't change default firmware behavior. For all currently supported firmware versions, the throttle function forces its register value at 0, making DPC inaccessible.
“reg”: Allows switching between DPC and speed-based throttle by writing either 1 or 0 to register 0x76. The register doesn't retain its value after reboot and defaults at 0/off. For the end-user, this would mainly be intended for use within an app such as GM Free.
“dyn”: With this patch, holding the brake lever upon boot (like you'd do for error 15) enables DPC. The regular startup sequence keeps the speed-based throttle.
“on”: DPC is always on.
Defaults to “zip2” if not provided.
“bin”: Barebone final product, binary output. For devs only.
“enc”: Encoded version of the binary. The bare minimum you need to flash a Ninebot scooter, more difficult to use on Xiaomi which has a different encoding rule. Used on Ninebot IAP and Ninebot-Flasher. [missing references about encoding - separate page needed]
“zip”: CamiAlfa's DownG ZIP. Still used by BotoX and many third-party websites, but still does the job for scooters of older generations. Mostly used by Android flashing apps.
“zip2”: An alteration of the original DownG ZIP format containing parameters of the firmware and a broader selection of scooter “dev” variables to choose from. [missing references about zip2 - separate page needed]
Most apps should support both versions of DownG ZIP, but using zip2 is recommended especially on newer scooters to prevent a file from being flashed when it shouldn't - DownG ZIP only having M365 and ES/SNSC as dev variables. It also returns the actual content of the firmware in a human-readable form (params.txt), preventing mistakes from happening.
Both ZIP formats will be delivered with an archive comment consisting of the full request URL, the patcher branch and revision identifiers, as well as a copy of the human-readable parameters. This data is crucial for debugging purposes and must be kept intact!