I have a newer TENWAYS CGO600 New Edition with the small color display (3-button control on the left side). The bike is locked to 25 km/h and I’ve been trying to figure out if there’s any way to change/remove the speed limit.

I connected to the bike with nRF Connect and found that the display exposes a Nordic Secure DFU service (FE59), so I tried testing firmware-related options. I also tried uploading an SW102 DFU ZIP file through nRF Connect, but it disconnects/reboots and nothing changes.

From what I’ve read, the newer color displays seem much harder to modify than the older SW102 versions.

Things I already tried:

- nRF Connect scanning/services

- DFU mode attempts

- SW102 hacked ZIP upload

- button combinations on startup

- reconnecting through BLE

Has anyone successfully modified/unlocked the newer CGO600 New Edition displays/controllers? Or are these newer models fully signed/locked now?

Any info, firmware research, BLE characteristics, or reverse engineering tips would help a lot.