omarkmekkawy / reverse_engineering_bq20z70_laptop_bms Goto Github PK
View Code? Open in Web Editor NEWReverse engineering BQ20z70 Laptop BMS
Reverse engineering BQ20z70 Laptop BMS
Hi,
I have same bq20z70 controller on my battery and it works fine but i want to "unseal" it and as you might know i need password for it.Could you please sniff i2c bus while unlocking via ti tool?I need bus address and password.
I have tried this tutorial but it is for bq20z90
http://www.karosium.com/2016/08/hacking-bq8030-with-sanyo-firmware.html
Here is some info about my battery:
root@raspberrypi:/home/pi# smbusb_sbsreport
SMBusb Firmware Version: 1.0.1
-------------------------------------------------
Manufacturer Name: Sony Corp.
Device Name: CFSOTX
Device Chemistry: LION
Serial Number: 4096
Manufacture Date: 2012.09.18
Manufacturer Access: 0000
Remaining Capacity Alarm: 420 mAh(/10mWh)
Remaining Time Alarm: 10 min
Battery Mode: 6001
At Rate: 0 mAh(/10mWh)
At Rate Time To Full: 65535 min
At Rate Time To Empty: 65535 min
At Rate OK: 1
Temperature: 27.45 degC
Voltage: 11249 mV
Current: 0 mA
Average Current: 0 mA
Max Error: 1 %
Relative State Of Charge 63 %
Absolute State Of Charge 58 %
Remaining Capacity: 2419 mAh(/10mWh)
Full Charge Capacity: 3847 mAh(/10mWh)
Run Time To Empty: 65535 min
Average Time To Empty: 65535 min
Average Time To Full: 65535 min
Charging Current: 2750 mA
Charging Voltage: 12600 mV
Battery Status: 00c0
Cycle Count: 14
Design Capacity: 4200 mAh(/10mWh)
Design Voltage: 11100 mV
Specification Info: 0021
Manufacturer Data: 60 01 a7 00 d6 00 00
root@raspberrypi:/home/pi#
As you can see i can read all information with cypress logic analyzer and karosiums tool.
Here is my unseal process but no luck so far:
root@raspberrypi:/home/pi# smbusb_scan -w 0x16 -b 0x70
------------------------------------
smbusb_scan
------------------------------------
Success. SMBusb Firmware Version: 1.0.1
Scanning for command writability..
Scan range: 70 - ff
Skipping: None
------------------------------------
[70] ACK, Byte writable, Word writable, Block writable
[71] ACK, Byte writable, Word writable
[77] ACK, Byte writable, Word writable
[78] ACK, Byte writable, Word writable, Block writable
root@raspberrypi:/home/pi# smbusb_comm -a 16 -c 77 -r 2
0000
root@raspberrypi:/home/pi# smbusb_comm -a 16 -c 71 -w 0214
root@raspberrypi:/home/pi# smbusb_comm -a 16 -c 77 -r 2
0000
root@raspberrypi:/home/pi# smbusb_comm -a 16 -c 71 -w f000
root@raspberrypi:/home/pi# smbusb_comm -a 16 -c 70 -w 0517
root@raspberrypi:/home/pi# smbusb_bq8030flasher -p prg.bin -e eep.bin
------------------------------------
smbusb_bq8030flasher
------------------------------------
SMBusb Firmware Version: 1.0.1
PEC is ENABLED
Error communicating with the Boot ROM.
Chip is running firmware
Note that there's no universal way to enter the Boot ROM on a programmed chip.
The command(s) and password(s) vary by make and model of the pack.
Great work!Thanks in advance!
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.