Giant app USA apk

[funnel]

Can somebody with the knowledge of pulling out the apk from a rooted android phone send me the apk file in a PM. I'd like to see if there're any differences in them and if we could just use the US version to get the limit from 25 to 32km/h.

Thanks!

 

[04fuxake]

I'm pretty sure there's just some sequence you press on the RideControl unit to remove the limit. Check the other threads for the service manuallink.

 

[funnel]

I'm pretty sure there's just some sequence you press on the RideControl unit to remove the limit. Check the other threads for the service manuallink.

Yes. I know about the button sequence in the service manual but some users say it didn't work and I think it just switches from a demo mode <20 to normal 25kmh.

Still I could use a US vpn on a spare phone and try to install the app from there if nobody comes up.

How to Change Country/Region in the Google Play Store

Need to change your Google Play Store country? Here's how to change your account's Google Play Store country on an Android phone.

www.makeuseof.com

 

[aja07]

Still I could use a US vpn on a spare phone and try to install the app from there if nobody comes up.

How to Change Country/Region in the Google Play Store

Need to change your Google Play Store country? Here's how to change your account's Google Play Store country on an Android phone.

www.makeuseof.com

If you try this please let us know if it works, ta

 

[Dgedge]

I don't think it is so easy to do. For me the country information is stored in the motor inside a memory that can't be accessed by the app, like the mileage of the bike and other things. Only the service tool should be able to modify it.

Hacking the app (by someone who knows how to do it) is something very interesting anyway as it will help to learn the bluetooth communication with the bike, commands and parameters sent and read. The service tool uses bluetooth too ?

Some intersting informations here by the guy who made the software to modify parameters on shimano step motors. He can flash Giant motors but he needs the Giant toolkey so it is only for dealers: eplus

 

[funnel]

I don't think it is so easy to do. For me the country information is stored in the motor inside a memory that can't be accessed by the app, like the mileage of the bike and other things. Only the service tool should be able to modify it.

Yes, it's possible. But it's also possible that it flashes a different version of the RideOne firmware that includes some of the speed changes.

Hacking the app (by someone who knows how to do it) is something very interesting anyway as it will help to learn the bluetooth communication with the bike, commands and parameters sent and read. The service tool uses bluetooth too ?

I already know some commands for the Tuning options but they're encrypted(scrambled bytes) somehow so I can only copy them and execute the known commands. I don't know the logic behind them yet to try something new.

Some intersting informations here by the guy who made the software to modify parameters on shimano step motors. He can flash Giant motors but he needs the Giant toolkey so it is only for dealers: eplus

The site says for Giant only a speed chip is available, no direct flashing or modifying the internal settings. I'm also speculating the Giant tool key contains just a normal Nordic Semionductors BLE chip inside and the only thing to figure out are the byte commands/possibly some encryption key is needed.

 

[Dgedge]

The speed chip is for regular users.
Dealers who own the tool key can use eplus software to change speed parameter and probably modify engine map (still under development). As the guy said that it just needs the service tool key to work I am pretty sure it is more than a BLE chip

 

[funnel]

If you look here https://fccid.io/2AJPMSERVICETOOLKEY/Label/ID-Label-and-Location-3161474 it's called MA1507-Dongle. And some more googling you find this BLE USB Dongle, supporting NUS (Nordic UATR Service) - Microprogram which says "Supports NUS (Nordic UATR Service) service " that leads to their gihub page NordicPlayground/Android-nRF-UART

 

[Dgedge]

Same name and same packaging, it is not a coincidence.
But there are many BLE dongles on Amazon so why does the software need this one ? maybe a specific firmware as we can read "Programmable firmware tool for secondary development and compiling " on the description ?

 

[funnel]

If we extract the apk file with 7zip it includes also the firmware bin files for all the various rc controllers + the service tool MA1507

You can find the apk here if somebody wants to play with this RideControl for Android - APK Download

They can be disassembled with an arm disassembler with thumb instructions, RAM loading address 0x2000000.

The problem is it's really hard to see what's going on because there aren't any strings in the code.

 

[Dgedge]

Very interesting. Unfortunately I don't know how to disassemble arm binary files and won't be helpful.

Correct me if I'm wrong : The service tool key is just a MA1507 dongle on which Giant loads the firmware listed above. So this firmware is probably the key to understand the communication and commands sent by the Service tool software to adjust some advanced parameter inside the motor ?
I don't know if it is possible to buy this kind of dongle and load the MA1507 firmware on it ? It would be an entry point to start trying to communicate with the bike ?

 

[funnel]

So this firmware is probably the key to understand the communication and commands sent by the Service tool software to adjust some advanced parameter inside the motor ?

Yes, I hope so.
Unfortunately it's still hard to decode even having the bin file. Maybe someone comes along that it's skilled enough with a lot of experience to understand it.

I don't know if it is possible to buy this kind of dongle and load the MA1507 firmware on it ? It would be an entry point to start trying to communicate with the bike ?

I'm guessing the tool is not needed and can be done just from a phone. Would be nice to have the computer software they use for the service tool. I tried to google the file name from here https://fccid.io/2AJPMSERVICETOOLKEY/Users-Manual/Users-Manual-3161481 but no luck.

 

[Giantal]

If we extract the apk file with 7zip it includes also the firmware bin files for all the various rc controllers + the service tool MA1507

You can find the apk here if somebody wants to play with this RideControl for Android - APK Download

They can be disassembled with an arm disassembler with thumb instructions, RAM loading address 0x2000000.

The problem is it's really hard to see what's going on because there aren't any strings in the code.

View attachment 32279

This is Really interesting, I am looking to locate the Giant Service tool and see if its possible to derestrict via UK-US settings as well as changing the wheel circumference. The difficulty is finding the Giant Service Tool BLE key.

 

[sinder999]

Hello, did anyone get any furher on this one? i would be very interested, i'm trying to change my google play region and try a software update, but reading the above i'm not sure this works or not, i can't seem to cahnge my region at present. so if someone managed this and this didn't work please let me know and i will stop trying it.

 

[funnel]

Hello, did anyone get any furher on this one? i would be very interested, i'm trying to change my google play region and try a software update, but reading the above i'm not sure this works or not, i can't seem to cahnge my region at present. so if someone managed this and this didn't work please let me know and i will stop trying it.

No. It's not possible. I lost interest in researching this further since I'm happy with the ziptied sensor+magnet on crank hack.

 

[sinder999]

Cool, i was looking at doing that but worried about any fault codes.

 

[anfos]

No. It's not possible. I lost interest in researching this further since I'm happy with the ziptied sensor+magnet on crank hack.

Which only works on older models right?

 

[funnel]

Which only works on older models right?

Yes. I think so. I saw posts mentioning the new ones have sensors inside the frame.

Reverse engineering is not an easy task. I actually found where is the initial speed value stored in the RC one firmware. I just never tried to modifiy it since I never looked for a way to flash a custom firmware. However it's still possibile it's just an initial default value that gets overwritten when RC one gets the data from the motor controller. I don't have any motivation for researching this further since it takes too much time which I rather spend cycling.