This is an old revision of the document!
Table of Contents
ScooterHacking Custom Firmware API documentation
The ScooterHacking Custom Firmware API is available at api.cfw.sh.
Requests are formed as follow: api.cfw.sh/scooterIdentifier?parametersChain
Scooter models table
DRV versions table
Current DRV firmware versions used throughout the production branch.
Ninebot ESx: DRV120 ; DRV133 ; DRV139 ; DRV150 ; DRV151(default)
Ninebot Max: DRV126
Xiaomi 1S: DRV221
Xiaomi Pro 1: DRV155
Xiaomi Pro 2: DRV223 (default), DRV224
If the Version spoofing patch is in use, the version number retrieved by apps will be shifted up by 400. This requires no modification to the “version” field so make sure to only use the above values.
Direct power control state table
Case sensitive.
None/“off”: Doesn't change default firmware behavior. For all currently supported firmware versions, the throttle function forces its register value at 0, making DPC inaccessible.
“reg”: Allows switching between DPC and speed-based throttle by writing either 1 or 0 to register 0x76. The register doesn't retain its value after reboot and defaults at 0/off. For the end-user, this would mainly be intended for use within an app such as GM Free.
“dyn”: With this patch, holding the brake lever upon boot (like you'd do for error 15) enables DPC. The regular startup sequence keeps the speed-based throttle.
“on”: DPC is always on.
Output file formats table
Case sensitive.
Defaults to “zip2” if not provided.
“bin”: Barebone final product, binary output. For devs only.
“enc”: Encoded version of the binary. The bare minimum you need to flash a Ninebot scooter, more difficult to use on Xiaomi which has a different encoding rule. Used on Ninebot IAP and Ninebot-Flasher. [missing references about encoding - separate page needed]
“zip”: CamiAlfa's DownG ZIP. Still used by BotoX and many third-party websites, but still does the job for scooters of older generations. Mostly used by Android flashing apps.
“zip2”: An alteration of the original DownG ZIP format containing parameters of the firmware and a broader selection of scooter “dev” variables to choose from. [missing references about zip2 - separate page needed]
Most apps should support both versions of DownG ZIP, but using zip2 is recommended especially on newer scooters to prevent a file from being flashed when it shouldn't - DownG ZIP only having M365 and ES/SNSC as dev variables. It also returns the actual content of the firmware in a human-readable form (params.txt), preventing mistakes from happening.
Both ZIP formats will be delivered with an archive comment consisting of the full request URL, the patcher branch and revision identifiers, as well as a copy of the human-readable parameters. This data is crucial for debugging purposes and must be kept intact!
DRV versions table
Current DRV firmware versions used throughout the production branch.
Ninebot ESx: DRV120 ; DRV133 ; DRV139 ; DRV150 ; DRV151(default)
Ninebot Max: DRV126
Xiaomi 1S: DRV221
Xiaomi Pro 2: DRV223
If the Version spoofing patch is in use, the version number retrieved by apps will be shifted up by 400. This requires no modification to the “version” field so make sure to only use the above values.
Direct power control state table
Case sensitive.
None/“off”: Doesn't change default firmware behavior. For all currently supported firmware versions, the throttle function forces its register value at 0, making DPC inaccessible.
“reg”: Allows switching between DPC and speed-based throttle by writing either 1 or 0 to register 0x76. The register doesn't retain its value after reboot and defaults at 0/off. For the end-user, this would mainly be intended for use within an app such as GM Free.
“dyn”: With this patch, holding the brake lever upon boot (like you'd do for error 15) enables DPC. The regular startup sequence keeps the speed-based throttle.
“on”: DPC is always on.
Output file formats table
Case sensitive.
Defaults to “zip2” if not provided.
“bin”: Barebone final product, binary output. For devs only.
“enc”: Encoded version of the binary. The bare minimum you need to flash a Ninebot scooter, more difficult to use on Xiaomi which has a different encoding rule. Used on Ninebot IAP and Ninebot-Flasher. [missing references about encoding - separate page needed]
“zip”: CamiAlfa's DownG ZIP. Still used by BotoX and many third-party websites, but still does the job for scooters of older generations. Mostly used by Android flashing apps.
“zip2”: An alteration of the original DownG ZIP format containing parameters of the firmware and a broader selection of scooter “dev” variables to choose from. [missing references about zip2 - separate page needed]
Most apps should support both versions of DownG ZIP, but using zip2 is recommended especially on newer scooters to prevent a file from being flashed when it shouldn't - DownG ZIP only having M365 and ES/SNSC as dev variables. It also returns the actual content of the firmware in a human-readable form (params.txt), preventing mistakes from happening.
Both ZIP formats will be delivered with an archive comment consisting of the full request URL, the patcher branch and revision identifiers, as well as a copy of the human-readable parameters. This data is crucial for debugging purposes and must be kept intact!
DRV versions table
Current DRV firmware versions used throughout the production branch.
Ninebot ESx: DRV120 ; DRV133 ; DRV139 ; DRV150 ; DRV151(default)
Ninebot Max: DRV126
Xiaomi 1S: DRV221
Xiaomi Pro 1: DRV155
Xiaomi Pro 2: DRV223 (default), DRV224
If the Version spoofing patch is in use, the version number retrieved by apps will be shifted up by 400. This requires no modification to the “version” field so make sure to only use the above values.
Direct power control state table
Case sensitive.
None/“off”: Doesn't change default firmware behavior. For all currently supported firmware versions, the throttle function forces its register value at 0, making DPC inaccessible.
“reg”: Allows switching between DPC and speed-based throttle by writing either 1 or 0 to register 0x76. The register doesn't retain its value after reboot and defaults at 0/off. For the end-user, this would mainly be intended for use within an app such as GM Free.
“dyn”: With this patch, holding the brake lever upon boot (like you'd do for error 15) enables DPC. The regular startup sequence keeps the speed-based throttle.
“on”: DPC is always on.
Output file formats table
Case sensitive.
Defaults to “zip2” if not provided.
“bin”: Barebone final product, binary output. For devs only.
“enc”: Encoded version of the binary. The bare minimum you need to flash a Ninebot scooter, more difficult to use on Xiaomi which has a different encoding rule. Used on Ninebot IAP and Ninebot-Flasher. [missing references about encoding - separate page needed]
“zip”: CamiAlfa's DownG ZIP. Still used by BotoX and many third-party websites, but still does the job for scooters of older generations. Mostly used by Android flashing apps.
“zip2”: An alteration of the original DownG ZIP format containing parameters of the firmware and a broader selection of scooter “dev” variables to choose from. [missing references about zip2 - separate page needed]
Most apps should support both versions of DownG ZIP, but using zip2 is recommended especially on newer scooters to prevent a file from being flashed when it shouldn't - DownG ZIP only having M365 and ES/SNSC as dev variables. It also returns the actual content of the firmware in a human-readable form (params.txt), preventing mistakes from happening.
Both ZIP formats will be delivered with an archive comment consisting of the full request URL, the patcher branch and revision identifiers, as well as a copy of the human-readable parameters. This data is crucial for debugging purposes and must be kept intact!