Rewheel

Firmware modification tools for the Onewheel Pint, Pint X, XR and GT. Part of the R2Row ('Arturo') project.

Important

Hosted at https://autumn-bar-0505.on.fleek.co/

Note: The documentation below is for developers. If you just want to re-calibrate your board or patch some firmware, please use the address above.

Requirements

Node.js
Yarn 2+ (yarn set version stable if you have an Yarn 1.x)

Installation

Run yarn to install all dependencies from the root directory

Parts

@rewheel/common - common library that contains all of the patches + common tooling
@rewheel/cli - command line interface for patching firmware
@rewheel/web - website for patching firmware + flashing to a device

CLI

# usage
yarn patcher -i [input file] -o [output file] [...patches] --[patch-arg]

# example
yarn patcher -i firmware/dump/5046.bin -o 5046-patched.bin setAngleOffset --angleOfset 5

Website

Run yarn web:dev
Open your browser and navigate to http://localhost:5173

Firmware Operations

Dumping Firmware

Firmware is not provided for copyright reasons. Instructions for dumping your Onewheel firmware are provided here. Warning: it's not for the faint of heart.

Flashing Firmware

Instructions to flash your Onewheel are located here. Thankfully, this is significantly easier than dumping the firmware to begin with.

Generate Checksum for Firmware

# npm
npm run checksum -- -i [input file]

# or

# yarn
yarn checksum -i [input file]

The patcher uses the checksum of the firmware to set the offsets of each firmware patch.

If your firmware doesn't match a known checksum, open an issue for it. That way, we can find the offsets for that firmware revision and support more firmware.

Disclaimer

Firmware dumping uses a slightly different process on the GT because it uses a different processor. Documentation is not available just yet.
This project is not affiliated with or endorsed by Future Motion. Proceed at your own risk - this will void your warranty.

Contributing

If you're able to dump the firmware from a Onewheel that you own, you can use Ghidra to dive into the assembly and even live debug against a working Pint, Pint X, or XR. This can aid in finding more patches for the firmware.

Contributors / Thanks

lolwheel - patch development, first verifying the exploit from the research paper, Owie
beeradmoore - OWCE source / documentation on BLE services
exPHAT - colaboration on the OTA firmware stub
tire_sire - providing the initial boards to test on
sdmods - Updated un-bricking instructions
ZeeWorden Design - Rewheel logo