North America: contact me on reddit at u/venutech

Europe: contact user #efsfed8756 on discord

Mail to

Shipping instructions

08-21-20 - RLOD issue resolved. Firmware update for ESC, XR Battery and remote. Joined forces with efsfed and jonataubert; with our powers combined... We are Captain Boosted!

08-13-20 - Made a diagnostics ESC, turned my V2 into a live diagnostics board, cracked SPI flash with help of debug data, can now copy original ESC odometer during stealth upgrades, started a couple discord channels, found how to extract and upgrade the remote firmware, still finishing up the Leaf (but holy crap, its going to be awesome), bought a bunch of boosted board parts and decks, but dont have time to put them together cause I need to find a way to keep these XR batteries balanced.

07-25-20 - Still short on sleep and time. I made a custom XR battery pack, repaired a ton of batteries, found out how to upgrade all V2 and V3 boards to have hyper mode, discovered what causes lost ride modes, confirmed all V2 and V3 ESCs are exactly the same circuits, and I'm finishing up my leaf with a solid way to connect it to my controller and add the ability to change pulley teeth.

06-28-20 - Holy shit, where do I begin? RLOD fix, balancing, modding, Leaf device, UM232H modules, CAN bus decoders, firmware discovery and ESP32s boards.

05-27-20 - I've made a working Boosted Board Odometer and battery tracker. It works like the boosted app did, in that it takes the odometer readings from the ESC motor revolution count. I've been posting most of my updates on reddit/BoostedBoards

-Never leave it in storage at 0% charge
-Never leave it in hot or cold storage
-Wait at least 30 min after a ride before plugging it in to charge
-Wait at least 10 min after charging before going for a ride
-When taking it out of storage, charge it for a minimum of 14 consecutive days
-Error codes need to be taken seriously and you should never ride while one is flashing
-When the battery says 0%, do not throttle at all
-If the power drops out, stop your ride and check your board
-If the controller is beeping, stop your ride and check your board
-At a stoplight, reach down and feel the motor/battery sidewall temperature; if its uncomfortably hot then stand in the shade (~1hr for climatization, but ANGTFD)
-For batteries with FW <v2.5.1, you need to charge it even if its green/yellow for 2-3 weeks, once per year simply because there is nothing to indicate when it is critically off balance
-For batteries with FW v2.5.1, charge it until its green
-FW v2.5.1 will begin the balance routine when Δ >100mV and max cell voltage is 3.950V
-FW <v2.5.1 does not have a balance routine and just needs to be left plugged in
Repairing an XR battery yourself

ESC Firmware change log
-2.1.9 : added XR battery support
-2.3.3 : added hyper mode
-2.7.x : added beams support
Remote firmware change log
-2.3.3 : added hypermode and beams support (Serial R2820+, check firmware here or with the lightblue for android or iPhone/iOS)
Battery firmware change log
-2.x.x : introduced permanent lockout (RLOD) at delta 0.5V
-2.5.1 : removed RLOD due to imbalance, improved balance routine

-Max and min voltage cutoff is 3.9v (or 3.95v) and 3.0v, respectively
-0% is when the lowest cell reaches <3.0v
-100% is when Δ <100mV and average cell voltage during charge is 3.950V for FW v2.5.1. The voltage drop brings the min cell voltage down to ~3.915v when the charging cuts out via software. It will continue to balance by periodically charging the pack and draining alternating cells.
-100% is when the average cell voltage is 3.925v during charge on FW <v2.5.1. The voltage drop brings the min cell voltage down to ~3.90v when the charging cuts out via software. It will continue to balance by periodically charging the pack and draining alternating cells.
-RLOD can be tripped when difference in min/max cell voltage is >0.5v on FW <v2.5.1
-RLOD will not be tripped because of typical imbalance on FW v2.5.1
-RLOD will be tripped if cell voltage is less than 2.5V on FW v2.5.1
-30%, 40%, 50% and 60% SoC have an average cell voltage of about 3.4, 3.5, 3.6 and 3.7 V, respectively
-Voltage spike during charge is ~0.035v per cell
-Voltage drop during load is ~0.035v per cell

-FW v2.5.1 can exceed a Δ >1V without RLOD (I didn't test more than that, but 1V is more than enough because you'd need to actively be trying to get your board off balance by more than 1V and I cant see a way to do that since power cuts out when a cell is <3.0v and full charge is 3.9v, there isnt a possibility for Δ >1V in a real life scenario)

Early Experiments:
I'm using an Arduino Mega 2560 because I have a couple lying on my desk, also, it has 3.3v and accepts as low as 2.7v for logic. I'm just making notes in the event that I forget.
download the frser-duino mega1280 branch
$sudo git clone --recursive git://github.com/urjaman/frser-duino -b arduino-mega-1280
open directory
$cd frser-duino
make it happen
$sudo make u2 && sudo make flash-u2
Edit the Makefile :change the mcu from 1280 to 2560 and use this for the AVRDUDE settings a couple lines below
$sudo nano Makefile
change to the following, leave everything else for avrdude as is
avrdude -p m2560 -c wiring
I'm on version 6.something of avrdue, btw

MCLR gets tied to ground. Both are on the debug headder so I could probably bridge those to groung on the arduino (I could do that but then I'd need to desolder MCLR or readFlash to check if the battery was flashed)

==========================================================
Alright, after speaking with u/Jonataubert, I have been informed that the data lines on the batt mobo are pulled up to high (i thnk he said 10k to 3.3v).
Essentially, using an arduino with 5v logic and a volt reduction circuit will give messy results, if any. If I had an arduino with 3.3v logic, maybe this method would fly. I think the Arduino Due and Arduino mini might have 3.3v logic.
I've given up and will use an FT323H device when I get it and post the results.
==========================================================
Back in the game with a UM232H!
Cells are already balanced to 4.2v (Instrument error, real value was probably closer to 3.4 v)
Full pack voltage is 44.4
Hooked up wires as in diagram
Read, verify, erase, reset =GOLD!
Removed wires, plugged in to charge, everything looks good
Unplugged BMS, restarted battery, RLOD, redid process
Firmware v2.5.1
Took it for a solid 10 km ride, charged and balanced to 3.90 V
Sealed with extra strength caulking, with some advice from a pro handyman
Returning battery to donor

Second battery has dead cells, cell #11 was at 0.5v, the rest around 2v
Battery level lights show 1 flashing
Read, verify, erase, reset=RLOD, not able to charge before or after flashing
Found out I can just plug in the charger instead of holding the button
Using a Nitecore battery charger
Broke my Nitecore battery charger
Using a Yihua 853D to charge the cells with an analog ampmeter
Going cell by cell, bringing them each to a nominal voltage
Charging each cell at around 500 mA, never going higher than that
Balanced levels so far: 3.47, 3.48, 3.44, 3.44, 3.55, 3.46, 2.xx, 2.xx, 2.xx, 2.xx, 3.80, 3.88, 3.57
Tested again in order: 3.42, 3.46, 3.44, 3.42, 3.54, 3.45, 3.43, 3.46, 3.41, 3.20, 3.79, 3.88, 3.56
Battery level lights show 2+1flashing, still RLOD without flashing
Bent three pins in the BMS connector, somehow, straightened them before jamming things together
Read flash(dump0), verify, Erase, RLOD
Balance charge lowest cell: 3.37, 3.88
Read flash(dump1), verify, Erase, RLOD
Balance charge lowest cell: 3.38, 3.88
Read flash(dump2), verify, Erase, RLOD
Balance charge lowest cell: 3.39, 3.88
Read flash(dump3), verify, Erase,...
Power on, OK
Read flash(dump4), verify, OK
Connected to board and powered on, RLOD
Charge lowest cell, read flash(dump5), verify, Erase, RLOD, charge more, read flash(dump6), verify, Erase, OK
Charge battery to 100% [2 minutes from 50%-full]
Connected to charger second time, RLOD after a couple seconds
Charge lowest cell, read flash(dump7), verify, Erase, OK
Despite saying 100%, cells remain unbalanced (one cell is at 3.90, the rest are close to 3.4)
Firmware v2.1.7
BMS was not fuly plugged in and RLODed
Read flash(dump8), verify, Erase, OK
[Read Cells: unbalanced] - When balanced to 3.90, continue >>
[Read Cells: unbalanced] - When balanced to 3.90, continue >>
Seal, done
Repaired XR batteries undergo stringent testing which includes riding in real life from 100% to 0%. For my route thats more than 16km (about 10 miles).
Upon return I check for consistency in the cells. Take any note of possible differences/similarities wrt firmware.
If a cell exhibits any characteristics different from the other cells, further testing is performed and consider replacing the problematic cell.
I've also successfully replaced a full set of 26 cells to 26 Sony VTC6 cells. Same range since they have the same capacity as LG HG2s.
I've now got all kinds of crazy equipment, doing all kinds of mad science tests, I'm always wearing safety goggles, a 3M 100p gasmask and a red triple 8 skate helmet with a shredlight so I can see what I'm soldering at 1:50 am (current time).

Primary Power light indicates severity of issue and the battery charge level lights indicate the location of the issue.
On, connected to ESC
On, not connected to ESC
On, charging
On, pairing mode
Not responding to button=Burnt fuse
Overheating? General error?
Charger issue
Battery charging issue
Possible Battery and ESC Overheating
Motor Overheating
Battery issue
Battery check failure
Battery communication error with ESC
RLOD: Battery Lockout. BMS issue (cell imbalance, temperature issue, current issue, etc)
ESC firmware needs to be updated to use XR batteries. SR is okay.

Status Legend:
= Warning = Failure = Lockout
SoC Legend: ||||
Charger | Battery | Deck | ESC | Motors

SR Error Codes

Battery communication error with ESC
Check foreverboosted.co

Source Code for Arduino Mega 2650. Download the MCP_CAN_lib, get a MCP2515 CAN bus decoder module and any kind of Arduino, and check your XR battery health on a serial monitor. I'll post instructions for the pins, but for now go see BeamBreak's XR Health Check if you havent already. Video demonstation w/OLED

ESC and Battery

Controler

I got my Boosted Board V2 Dual with both XR and SR batteries in 2018. I've changed a number of belts and did some maintenance with the bearings and pulleys. The simplicity of the construction brings me alot of joy when I work with it, more so when I ride. The Boosted company is unfortunately dead, however they created a culture of high tech, good support, great communication and good times all the time around these LM vehicles. This culture is alive and strong.
I was riding near SQ1 and going about 25km/h past the bus station and my board stopped dead; the road was smooth, there weren't any rocks, I was going down a decline and I was throttling maybe 50%. I stopped to look around and analyze the belt and pulleys, the road, I even thought to look around to see if anyone was pranking me with a bluetooth scrambler. I remembered the video of those two guys who tried to hack his board after something similar happened to him in Australia. Wired Article, Defcon Video
I wanted to continue that research using my own board now that these products are not offically supported. I've come a long way in doing research on these boards. They're great and they always impress me. To this day, Boosted Boards are still the market standard. ie. "oh look at this flex"

While I had it open I cleaned things up. Here I added a water seal around the button. There are larger holes where liquids can get to the battery, but I did it anyways because I just felt it needed it. Used a balloon as a rubber seal and glued it with that clear rubbery stuff with the chinese writing on it. I pay $3 for it locally.
I damaged the piezo speaker, but I was alrady thinking of replacing it with a small vibrating motor. I'm sure the vibrator will be more noticable than the sound of the beeps. The vibrator is from some old Blackberry phone parts.

I read a post on r/BoostedBoards about packet sniffing in order to send a signal to the ESC, so I installed the latest Kali Live onto USB and booted up my Surface Pro 4, but I didn't get a signal from the controller. I probably did something wrong using bettercap since I didn't get a signal from a number of other devices in the area and I actually couldn't connect to them.

Using LightBlue, I was able to get the required BLE information. I've reverse engineered the logicboard and found that the firmware can be extraced so that I can update any remote to be compatible with hyper mode and beams.

×

1 / 4

2 / 4

3 / 4

4 / 4

5 / 4

6 / 4

7 / 4

8 / 4

9 / 4

10 / 4

11 / 4

12 / 4

13 / 4

❮ ❯

Deconstructing My Board

The board was dirty up in places of the circuitry and shit. Kindof lacking on the sealing, but I'll address that later. The mainboard was luckily fully coated with latex. I was pleasantly surprised with that. Hey, Samsung and crApple, thats how you waterproof something! So dirty I wish I could be doing this outside with a hose.

Have you ever seen that episode where Kramer makes salad in the shower? I was careful not to let water in the crevices and dried everything right away.

Deconstructing the Android App

I decompiled the Android app, looking for goodies. I found some pictures and values used in odometer conversion. Things are written in smali and koltin. I have a small sense of whats going on here and there, but I really cannot make sense of the overall picture. I hope someone else can take a crack at it and find out about the OTA updates and how they work.

Deconstructing My Controller

After reading the twitter post about getting a debug dump from the XR battery I wanted to see if I could get a similar debug port on the controller. There isn't a debug port, but there is a port for programming. Not really useful unless I have a firmware file. So I wanted to continue digging to see if I can get more insight. I checked some pics of some one else who took their controller apart. Great pics, but I wanted to know the types of ICs. On further inspection, in order to see all the traces I had to remove piezo speaker and I also removed the battery to play it safe.

Saveboosted.com: Documentation and error codes
Foreverboosted.co: Repair and documentation
Dustinlieu.com/boosted-checker: Bluetooth info checker
Beambreak.org: Reverse engineering and tutorials
BoostLERW: Open source apk
V3 Motor teardown: Repair and upgrade video
d1nkyy's GitHub: Reeverse engineering
Lambertofmtl's GitHub: Reeverse engineering XR Battery
Jonataubert's GitHub: RLOD FIX via Flashrom
FatDaddy's Boosted Knowledge Base
Boosted Legacy Discord Invitation
Boosted Boards SubReddit

Accessories

Motor cable
Battery cable extension
Accessory cable
3D Printable risers and bashguards
3D printed skid plates
3D printed motor caps
Chop sticks
More risers
More bashguards