@loaffette I wish! The hack requires setting the BOOT1 pin high. And either by accident or forethought, Future Motion grounded that pin underneath the chip.
You have to physically disconnect it from that ground to load the firmware dumping exploit into SRAM. Sadly, we haven't found a way around that.
Now if the Bluetooth chip on the controller, the OTA mechanisms, or one of the other peripherals have access to the memory of the STM32, then we have a chance. But all of that kind of stuff is way above my head too.
I was only able to do this hack because there was a research paper documenting this exploit and someone had already tried it on the Onewheel.