对我的电动滑板车进行逆向工程并使用 Rust 重写固件

对我的电动滑板车进行逆向工程并使用 Rust 重写固件
Reverse engineering my e-scooter and rewriting the firmware in Rust

原始链接: https://bensimms.moe/reverse-engineering-scooter/

此数据日志包含一系列 CAN 总线通信帧。日志反映了一个重复的循环，其中包含标准操作信号（ID 1024、1025、1028、513、515 和 528），以及通过 ID 495 传输的诊断或识别数据，该 ID 输出字符串（例如 "L.D.CR.S807.C.2.1" 和 "EG.2.2.1"）。主要观察结果包括： * **循环流量：** ID 1024、1025 和 1028 显示出连续的心跳式消息。 * **初始化/握手：** 帧 494 和 495 似乎用于辅助握手或版本信息交换。 * **系统状态：** ID 768 有周期性的更新记录（[0, 90, 100, 90, 100...]）。 * **扩展帧：** 在初始化序列之后，日志以引入包含特定负载数据的扩展 ID（1856、1857、1861）结束。总体而言，该日志呈现了一个典型的汽车或工业控制网络过程，涉及设备发现、状态报告和持续的周期性通信。

近期一篇 Hacker News 帖子详细介绍了一个令人印象深刻的项目：作者对一款电动滑板车进行了逆向工程，并使用 Rust 语言重写了其固件。通过使用 SWD 调试器和硬件分析（包括发现 USB-C 引脚上的 CAN 总线通信），作者成功替换了原厂固件。评论区的讨论呈现两极分化。许多人称赞其技术独创性，认为正是这种“不必要的卓越”让他们热衷于参与该社区。另一部分人则认为，人工智能（特别是大语言模型）现在已成为应对繁琐逆向工程的强大工具，但批评者警告称，“感觉编程”（即在不完全理解的情况下依赖人工智能）潜藏着危险，尤其是在高速运行的硬件上。讨论的很大一部分集中在博世（Bosch）等厂商“围墙花园”模式的伦理问题上。一些用户主张通过开源替代方案来对抗厂商锁定，而另一些用户则认为闭源系统对于安全是必要的，并列举了电池起火和未经授权的固件修改所带来的风险。最终，该项目堪称嵌入式工程的典范，突显了逆向工程的教育价值，以及硬件可访问性与消费者安全之间日益紧张的关系。

原文

CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]
CAN_FRAME:1025,false,[74, bd, 0, 0, 16, c, 0, 0]
CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]
CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]
CAN_FRAME:1025,false,[74, bd, 0, 0, 16, c, 0, 0]
CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]
CAN_FRAME:513,false,[0, 0, 0, 0, 0]
CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]
CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]
CAN_FRAME:1025,false,[73, bd, 0, 0, 3, c, 0, 0]
CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]
CAN_FRAME:513,false,[0, 0, 0, 0, 0]
CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]
CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]
CAN_FRAME:1025,false,[73, bd, 0, 0, 3, c, 0, 0]
CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]
CAN_FRAME:513,false,[0, 0, 0, 0, 0]
CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]
CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]
CAN_FRAME:1025,false,[72, bd, 0, 0, ef, b, 0, 0]
CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]
CAN_FRAME:513,false,[0, 0, 0, 0, 0]
CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]
CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]
CAN_FRAME:1025,false,[72, bd, 0, 0, ef, b, 0, 0]
CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]
CAN_FRAME:513,false,[0, 0, 0, 0, 0]
CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]
CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]
CAN_FRAME:1025,false,[74, bd, 0, 0, e9, b, 0, 0]
CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]
CAN_FRAME:513,false,[0, 0, 0, 0, 0]
CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]
CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]
CAN_FRAME:1025,false,[74, bd, 0, 0, e9, b, 0, 0]
CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]
CAN_FRAME:774,false,[55, 0, 0, 0, 2, 0, 0, 0]
CAN_FRAME:513,false,[0, 0, 0, 0, 0]
CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, 21, 0]
CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:768,false,[0, 5a, 64, 5a, 64, 0, 0, 0]
CAN_FRAME:494,false,[60, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:495,false,[4c, 44, 2e, 43, 52, 2e, 53, 38]
CAN_FRAME:495,false,[30, 37, 2e, 43, 2e, 32, 2e, 31]
CAN_FRAME:495,false,[45, 47, 2e, 32, 2e, 32, 2e, 31]
CAN_FRAME:495,false,[31, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:768,false,[0, 5a, 64, 5a, 64, 0, 0, 0]
CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:495,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:1856,true,[4b, 0]
CAN_FRAME:1024,false,[0, 40, 87, 4, 0, 0, 0, 0]
CAN_FRAME:1025,false,[74, bd, 0, 0, e4, b, 0, 0]
CAN_FRAME:1857,true,[4b, 0, 0, 0, 69, 99, 52, 42]
CAN_FRAME:1028,false,[20, 4e, 0, 0, 1, 0, b9, b]
CAN_FRAME:1861,true,[1, 15, 57, 20, 50, 59, 54, 34]
CAN_FRAME:774,false,[54, 0, 0, 0, 2, 0, 0, 0]
CAN_FRAME:513,false,[0, 0, 0, 0, 2]
CAN_FRAME:515,false,[0, 0, 0, 0, 0, 0, ff, 1f]
CAN_FRAME:528,false,[0, 0, 0, 0, 0, 0, 0, 0]
CAN_FRAME:768,false,[0, 5a, 64, 5a, 64, 0, 0, 0]

对我的电动滑板车进行逆向工程并使用 Rust 重写固件 Reverse engineering my e-scooter and rewriting the firmware in Rust

对我的电动滑板车进行逆向工程并使用 Rust 重写固件
Reverse engineering my e-scooter and rewriting the firmware in Rust