Egret GT e-scooter reverse engineered, firmware rewritten in Rust
Original: Reverse engineering my e-scooter and rewriting the firmware in Rust
Why This Matters
Shows real security and privacy gaps in consumer e-scooters that manufacturers don't disclose.
Developer Ben Simms reverse engineered the hardware and firmware of an Egret GT e-scooter, discovering undisclosed data telemetry, a PIN bypass, and a hidden CAN bus on the USB-C port. He then wrote custom display firmware in Rust using an ESP32-C6 and two CAN transceivers.
Ben Simms bought an Egret GT e-scooter—marketed with a 100km range and a 320x480 LCD HUD—and set about taking it apart, technically speaking. His first target was the companion app, where Bluetooth handler analysis revealed that metrics like motor current, battery voltage, and time in each driving mode are silently transmitted to the manufacturer, tied to the scooter's ID. The app also never clearly discloses this. He also found that holding the 'down' button during power-on triggers a firmware update mode, which can be exited into normal driving without entering the PIN—a security gap that annoyed him enough to keep digging.
The manufacturer's USB-C port is described as phone-charging only, but oscilloscope probing of the pins revealed two lines carrying CAN bus traffic—a decidedly non-compliant use of the connector. To sniff it, Simms built a logger using an ESP32-C6, an SN65HVD230 transceiver for async receive, and an MCP2515 for transmission (the SN65HVD230 alone caused bus errors when transmitting). With both transceivers running, he logged all CAN messages and began reverse engineering the communication protocol between the scooter's components—display, controller, and button panel—with the goal of writing replacement firmware for the display unit in Rust.