Ninebot Kickscooter MAX G2
| Property |
Value |
| Model |
scooter |
| Hardware ID |
131 (0x83) |
| Server ID |
537 |
| Commands |
121 |
| Default timeout |
500 ms |
| Default retry |
2 |
Default command types
| Type |
Value |
cmd_read |
1 (0x01) |
cmd_readACK |
4 (0x04) |
cmd_write |
2 (0x02) |
cmd_writeACK |
5 (0x05) |
cmd_writeNR |
3 (0x03) |
Command reference
System commands
| Name |
Cmd |
Index |
Ops |
Data |
Description |
iapBegin |
7 (0x07) |
0 |
cmd 7 |
— |
|
iapWrite |
8 (0x08) |
0 |
cmd 8 |
— |
|
iapCRC |
9 (0x09) |
0 |
cmd 9 |
— |
|
firmwareReset |
10 (0x0A) |
0 |
cmd 10 |
0B |
resp idx: 0 |
ble
| Name |
Index |
Ops |
Data |
Resp Index |
rAccState |
77 (0x4D) |
read |
2B |
77 |
openAcc |
30 (0x1E) |
writeNR |
1B |
30 |
openAcc_timout |
30 (0x1E) |
writeNR |
1B |
30 |
setTurnSound |
31 (0x1F) |
writeNR |
2B |
31 |
readTurnSound |
31 (0x1F) |
read |
2B |
31 |
rAlarm |
27 (0x1B) |
read |
2B |
27 |
setAlarm |
27 (0x1B) |
writeNR |
— |
27 |
rLock |
28 (0x1C) |
read |
2B |
28 |
setLock |
28 (0x1C) |
writeNR |
— |
28 |
rPwd |
29 (0x1D) |
read |
2B |
29 |
setPwd |
29 (0x1D) |
writeNR |
— |
— |
rStateBool |
82 (0x52) |
read |
2B |
— |
wStartBond |
30 (0x1E) |
cmd 110 (0x6E) |
— |
— |
triggerHidBond |
14 (0x0E) |
cmd 110 (0x6E) |
— |
— |
resetHID |
13 (0x0D) |
cmd 110 (0x6E) |
— |
— |
clearHIDBond |
9 (0x09) |
cmd 110 (0x6E) |
— |
— |
clearAllHIDBond |
12 (0x0C) |
cmd 110 (0x6E) |
— |
— |
setHIDRSSI |
2 (0x02) |
cmd 110 (0x6E) |
— |
— |
getHIDRSSI |
11 (0x0B) |
cmd 110 (0x6E) |
— |
— |
rHidBool |
80 (0x50) |
read |
2B |
— |
clearAllKeys |
0 |
cmd 128 (0x80) |
— |
0 |
openFindMyPairBroadcast |
0 |
cmd 122 (0x7A) |
— |
0 |
unbondFindMy |
0 |
cmd 123 (0x7B) |
— |
0 |
rFindMyPairBroadcast |
32 (0x20) |
read |
2B |
32 |
rFindMyBondStatus |
23 (0x17) |
read |
2B |
23 |
rFindMyLocationStatus |
33 (0x21) |
read |
2B |
33 |
rUUID |
120 (0x78) |
read |
16B |
120 |
setUUID |
0 |
cmd 124 (0x7C) |
— |
0 |
rPN |
96 (0x60) |
read |
14B |
96 |
rPPID |
0 |
cmd 96 (0x60) |
14B |
0 |
unbondFindMy |
0 |
cmd 123 (0x7B) |
— |
0 |
bms
| Name |
Index |
Ops |
Data |
Resp Index |
rBatteryInfo |
49 (0x31) |
read |
0x18 |
49 |
rBmsSn |
16 (0x10) |
read |
14B |
16 |
rMaxPower |
63 (0x3F) |
read |
2B |
63 |
setMaxPower |
63 (0x3F) |
write |
— |
63 |
rVerDC |
23 (0x17) |
read |
4B |
— |
queryCtrVol |
51 (0x33) |
read |
4B |
51 |
queryBmsPrdDate |
32 (0x20) |
read |
2B |
32 |
queryBmsLoop |
27 (0x1B) |
read |
4B |
27 |
rBatterySN |
16 (0x10) |
read |
14B |
— |
rBatteryInfo |
49 (0x31) |
read |
10B |
— |
rVerDC |
23 (0x17) |
read |
4B |
— |
rBMSCur |
51 (0x33) |
read |
2B |
— |
rBMSVolt |
52 (0x34) |
read |
2B |
— |
rBmsMoreInfo |
139 (0x8B) |
read |
2B |
139 |
rBmsRemainCapacity |
138 (0x8A) |
read |
2B |
138 |
rBmsManufactureDate |
32 (0x20) |
read |
2B |
32 |
rBmsEnergyThroughput |
128 (0x80) |
read |
4B |
128 |
rBmsCapacityThroughput |
130 (0x82) |
read |
4B |
130 |
rBmsCycleCount |
27 (0x1B) |
read |
2B |
27 |
rBmsDeepDischargeCount |
133 (0x85) |
read |
2B |
133 |
rBmsExtremeUseTime |
136 (0x88) |
read |
4B |
136 |
rBmsExtremeChargeTime |
134 (0x86) |
read |
4B |
134 |
rBmsDate |
32 (0x20) |
read |
2B |
— |
rBmsInfoLowFrequence |
16 (0x10) |
read |
0x12 |
— |
rBmsInfoLowFrequence2 |
27 (0x1B) |
read |
4B |
— |
rBmsInfoHighFrequence |
49 (0x31) |
read |
8B |
— |
rBmsTemp |
53 (0x35) |
read |
2B |
— |
rBmsTemp2 |
82 (0x52) |
read |
2B |
— |
rBmsTemp3 |
83 (0x53) |
read |
2B |
— |
rBmsCellVol |
64 (0x40) |
read |
0x14 |
— |
ctrl
| Name |
Index |
Ops |
Data |
Resp Index |
rActDate |
105 (0x69) |
read |
2B |
105 |
active |
0 |
cmd 87 (0x57) |
— |
— |
rCtrlV |
26 (0x1A) |
read |
2B |
26 |
rCPUId |
218 (0xDA) |
read |
12B |
218 |
rBmsV |
103 (0x67) |
read |
2B |
103 |
rBleV |
104 (0x68) |
read |
2B |
104 |
rBool |
29 (0x1D) |
read |
2B |
29 |
closeAcc |
121 (0x79) |
writeNR |
1B |
121 |
turnOff |
121 (0x79) |
writeNR |
1B |
121 |
lock |
112 (0x70) |
write |
1B |
112 |
unlock |
113 (0x71) |
writeNR |
1B |
— |
rSN |
16 (0x10) |
read |
14B |
16 |
rBodyTemp |
62 (0x3E) |
read |
2B |
62 |
rLeftMileage |
37 (0x25) |
read |
2B |
37 |
rBattery |
34 (0x22) |
read |
2B |
34 |
rMileage |
41 (0x29) |
read |
4B |
41 |
setCruice |
240 (0xF0) |
writeNR |
1B |
240 |
readCruice |
240 (0xF0) |
read |
2B |
240 |
readDecMode |
123 (0x7B) |
read |
2B |
123 |
setDecMode |
123 (0x7B) |
writeNR |
— |
— |
rFunBool |
125 (0x7D) |
read |
2B |
125 |
setFunBool |
125 (0x7D) |
writeNR |
— |
— |
rFunDisplayBool |
35 (0x23) |
read |
2B |
35 |
rSpeed |
38 (0x26) |
read |
2B |
38 |
rEbsStrength |
115 (0x73) |
read |
2B |
115 |
wEbsStrength |
115 (0x73) |
writeNR |
— |
— |
rPedestrianMode |
119 (0x77) |
read |
2B |
119 |
wPedestrianMode |
119 (0x77) |
writeNR |
0B |
— |
rStartSpeed |
126 (0x7E) |
read |
2B |
126 |
wStartSpeed |
126 (0x7E) |
writeNR |
— |
— |
rAccMode |
122 (0x7A) |
read |
2B |
122 |
setAccMode |
122 (0x7A) |
writeNR |
— |
122 |
rMaxSpeed |
100 (0x64) |
read |
2B |
100 |
rGearValue |
241 (0xF1) |
read |
2B |
241 |
setGearValue |
241 (0xF1) |
writeNR |
— |
241 |
rRaceMode |
242 (0xF2) |
read |
2B |
— |
setRaceMode |
242 (0xF2) |
writeNR |
— |
— |
rTcs |
243 (0xF3) |
read |
2B |
243 |
setTcs |
243 (0xF3) |
writeNR |
— |
243 |
rRand |
228 (0xE4) |
read |
6B |
228 |
rFlag |
231 (0xE7) |
read |
2B |
231 |
queryInfo |
176 (0xB0) |
read |
6B |
176 |
queryVolume |
245 (0xF5) |
read |
2B |
245 |
setVolume |
245 (0xF5) |
writeNR |
— |
— |
queryErrAlermCode |
176 (0xB0) |
read |
4B |
176 |
querySigRidTime |
59 (0x3B) |
read |
2B |
59 |
querySigRidMil |
47 (0x2F) |
read |
2B |
47 |
rErrorCode |
27 (0x1B) |
read |
2B |
— |
rWarnCode |
28 (0x1C) |
read |
2B |
— |
rSingleMileage |
183 (0xB7) |
read |
2B |
— |
rRunningTime |
58 (0x3A) |
read |
2B |
— |
rOnceRunningTime |
59 (0x3B) |
read |
2B |
— |
rGearMode |
117 (0x75) |
read |
2B |
117 |
setMaxSpeed |
144 (0x90) |
writeNR |
— |
144 |
setMaxSpeed2 |
70 (0x46) |
writeNR |
— |
70 |
rEncryptionFlag |
145 (0x91) |
read |
2B |
145 |