BQ8030DBT DATASHEET PDF

There is a lot to be learnt from manufactured electronic products both old and new, from printers to TV's and a lot more. Each manufacturer has their own way of making something and we can learn from their reasoning and the short cuts they take. We can also reuse some of the parts for our own projects, extending the life of the item. As with any investigations we must be very careful especially when working with electronics such as TV's and monitors where high voltages are involved or the capacity for danger of shock even when the product isn't powered i.

Author:Tukree Sasida
Country:Poland
Language:English (Spanish)
Genre:Literature
Published (Last):19 December 2011
Pages:286
PDF File Size:19.78 Mb
ePub File Size:15.32 Mb
ISBN:465-6-47394-540-2
Downloads:13455
Price:Free* [*Free Regsitration Required]
Uploader:Vom



It was such a pleasure to read this! Thanks for posting it. I've always wondered how boot ROM is loaded onto these chips in the first place. If one can overwrite the gauge chip with a custom boot ROM, wouldn't that allow loading arbitrary firmware? There wouldn't be a need to mess with the boot rom if this low-level programming access was available. Could just use it to manipulate the other parts directly :- But for all we know the boot rom could be stored in actual mask ROM on the chip, never to be changed.

Good job. I would like to ask You, maybe someone knows how to unlock charging in dell batteries with external power supply?

Maybe someone knows smbus command to unlock charge? No clue, sorry. I haven't worked on them and Dells seem to be one of those packs that have "special" firmwares based on screenshots from payware battery hacking software. Honestly if you're not hell bent on not paying a cent to anyone like I was you're probably better off finding a local re-celling business. Good luck! It is possible. Just send to manufacturrer access comand 0x in hex. Hi, I found this blog using Google after scratching my head over a few days.

My ThinkPad T battery has gone kaput. I disassembled the battery. The cells is good, each holds a charge of 3. My guess is the controller chips seem to think that it's time to declare death to my battery.

How to reset this controller chips? Is it even possible to write a new firmware to these chips so they will accept to work again?

I see a bdA and bq chip. Below is pictures of my actual battery, disassembled. The method described in the article above should work with that pack, yes. Some experience with electronics and reverse engineering binary data files is required.

The article about fuses sidebar, , September is also relevant. I can't offer any assistance beyond that. Very good job!

I have here battery from Thinkpad Edge E which is working, but have low capacity. I hope that it will be success, I never tried play with laptop batteries chips :. Hi, nice guide; I'm trying this out on some old X61 batteries I read out the eeprom and flash areas successfully, but when I do sbsreport subsequently I'm stuck with the error messages with the date at etc, as you had above. How do you reset that? Hi Victor. I try to recover my dell battery. It has bq on a board. And I have a question, how do you able to get a software from Bq before disassembling a code?

I don't understand, how do you know about 0x password and I fully not understand 0xfdc Thank you! I have no clue about the bq so keep in mind that it may not be compatible with the tool I've released.

Dell likely has their own custom firmware even if the cells used in the pack are Sanyo based on what I've seen in payware battery hacking software so this method is unlikely to work. On to the questions: It was possible to glitch the bq into clearing the first block of program flash hence ending up in the boot rom "permanently". The method is written in the article. You will not be able to recover the chip after this without an intact firmware image so I wouldn't try it if you only have one battery and also YMMV.

I had several controller boards to sacrifice so I didn't care. Once you're in the boot rom you can read the corrupted, first block missing firmware and since you're only missing initialization code at the start you can still disassemble this to extract the password s that you can then use on other batteries.

Password 3 was brute-forced as I've also written. This was done with a one-off tool that isn't included on github. From there it was guesswork to arrive at the significance of the value read from 0x73 and the final password but the correctness of this has since been confirmed by others.

Hi Viktor, You have done amazing work! Also very well presented! I'm waiting for the adapter board to try to mess around with my battery : Thank you very much for sharing it!

Hi Viktor, I received the adapter yesterday and managed to patch capacity and cycle counts in my battery. The problem with my battery is that I installed 4. There're values in the first bytes of the eeprom that looks like and and I would like to try to adjust them, but I need to figure out where is the checksum and how to recalculate it.

I would be easier to do having several eeprom dumps. Can you share your eeprom dump? I was just wandering is it possible to communicate with the battery using internal laptops i2c SMBus? Linux has userspace utilities i2c-tools. The EC manages the bus by itself and only provides an abstracted interface that's accessible to drivers. It might be technically possible but ECs are similar to battery controllers in that you'd have to find and reverse engineer this functionality on each and every one of them and I don't see EC i2c bus drivers in the linux kernel tree.

I could be wrong though but that's my understanding Hello how are you. Congratulations on the post. When replacing the cells, the cali bration data and the serial number were lost. I am programmer and I have done things in electronica, I have eeprom programmers, I would be grateful if you could tell me how to recover the firmware data.

There really isn't a way for them to go away unless your data flash area is corrupted but then the whole pack would just stop working. I can't help with individual cases I'm afraid. Do you think if it can be hacked?

With this tool? Or I have I2C analyzer. Thanks in advance. Hi Viktor, interesting article and good job carried out! You mentioned about series cases with that kind of batteries where they failure to work after reaching cycles of charges.

It was just an assumption. After you make possible to modify dinamic area of eeprom, Did you play around with that counter value? You mentioned that you just reset it, but if you set it to for example and making 5 to 10 discharge cycles it become possible to confirm or not a manuf. Can you do this trick and share us the output Hello, Glad you found it interesting!

I didn't do anything like that, no. That particular pack was fairly weird in that it was basically two batteries in one and the firmware "bank-switched" between a 4cell and a 4cell flat-cell which had an obscure model number which I forgot pack. I was pretty much joking about the the conspiracy stuff ;- If anything it's way more likely that cycles is about where this whole bank-switching business catches up with the amount of cleverness they had to put into the firmware to make this pack work.

I no longer own the machine or the battery so I can't do any more experiments on it unfortunately. But how to do this using SMBusb? Thanks for replies. I recharged the original cells externally and cleared the fail condition, no re-celling. It sounds like you're talking about the calibration values in the static area. The controller should then re-learn the actual capacity in a charge cycle or three. If you want to re-cell with different capacity cells than what the pack was designed for THEN you'd need to poke at the static calibration.

That area is checksum protected and I haven't really looked into it. Have you encountered with 4s delay while brute force the unknownhalf of password. It's not clear in the disassembly any related code for delays.

Or Sanyo doesn't implement this technique? Me now trying to get into bq20z90 controller but chip is sealed. Default unseal key found on TI support page seems to be changed by pack manufacturer.

How do you think is it good idea? And have you ever deal with sealed bq20z90 with ti firmware? Are their bqStudio and EV able to unseal their own sealed micros? I was able to run bruteforce loops on the bq without needing to add any delay.

ENZIM BROMELIN PADA NANAS PDF

BQ8030DBT, BQC-36, BQEB930

Users browsing this forum: Google [Bot] and 3 guests. The only available for me are v or v any concern? Now the T61 shows that the battery can't be charged due to normal wear and of course can't be used. I have checked all the fuses and they are OK. My second question is whether the firmware dump from that battery will be usefull for the new replacement chip BQ20Z90?

MARKETING WARFARE AL RIES JACK TROUT PDF

Battery EEPROM Works

It was such a pleasure to read this! Thanks for posting it. I've always wondered how boot ROM is loaded onto these chips in the first place. If one can overwrite the gauge chip with a custom boot ROM, wouldn't that allow loading arbitrary firmware? There wouldn't be a need to mess with the boot rom if this low-level programming access was available. Could just use it to manipulate the other parts directly :- But for all we know the boot rom could be stored in actual mask ROM on the chip, never to be changed.

SISTEM IMUN DAN HEMATOLOGI PDF

Inside Manufactured Products

Log In New customer? Start here. Order History. Manufacturer: Texas Instruments.

Related Articles