You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Based on https://github.com/PowerCartel/PackProbe from Power Cartel http://powercartel.com/projects/packprobe/.
10
10
11
11
# Disclaimer
12
-
**I do not know how to enter full access mode, clear permanent filure or unlock any controller IC.** Unfortunally according to most datasheets, you need an unlock key.
12
+
**I do not know how to enter full access mode, clear permanent failure or unlock any controller IC.** Unfortunally according to most datasheets, you need an unlock key.
13
13
See also this [article from 2011](https://media.blackhat.com/bh-us-11/Miller/BH_US_11_Miller_Battery_Firmware_Public_WP.pdf).
14
14
Extract: *Macbook batteries ship with a default unseal password (0x36720414). This was found by reverse engineering a Macbook battery update. On Macbook batteries, the full access mode password is also hardcoded and default (0xffffffff).*
15
15
16
16
## Compile with the Arduino IDE
17
-
Download and extract the repository. In the Arduino IDE open the sketch with File -> Open... and select the src/SBMInfo folder.
17
+
Download and extract the repository. In the Arduino IDE open the sketch with File -> Open... and select the SBMInfo folder.
18
18
19
19
## Identifying the right connection
20
20
The minimal connector layout is: | GROUND | THERMISTOR (103AT) | CLOCK | DATA | VCC (11 or 14 volt) | (clock and data my be switched).
@@ -32,25 +32,52 @@ Examples:
32
32
| GROUND | BatteryPresent | THERMISTOR ? | CLOCK | DATA | VCC | - seen at HP packs.
33
33
| GROUND | GROUND | Alert ? | HostPresent | BatteryPresent | DATA | CLOCK | VCC | VCC | - seen at Dell packs.
34
34
35
-
After startup, the program scans for a connected I2C device.
36
-
You can try different pin combinations until led stops blinking and `Found I2C device attached at address: 0x0B` is printed.
37
-
If you connect clock or data with the thermistor connector, the scanning stops.<br/>
35
+
After startup, the program scans for a connected I2C device.<br/>
36
+
In version 4.0 a voltage and resistance measurement by means of 4 additional resistors is integrated **to identify the I2C pins**.
37
+
It measures voltage or resistance to ground (if voltage is zero).<br/>
38
+
**The I2c pins have around 300 kOhm to 1000 kOhm**, the thermistor 10 kOhm.
39
+
40
+
You can try different I2C pin combinations until led stops blinking and `Found I2C device attached at address: 0x0B` is printed.
41
+
If you connect clock or data with the thermistor connector or ground, the scanning stops.<br/>
38
42
After connecting, full data is printed.<br/>
39
43
Dynamic values like temperature, voltage and current are checked every 3 seconds and printed if changed.
40
44
41
45
Tested with bq20z70, bq20z451, bq2084, bq80201DBT, bq40z50.
42
46
43
47
An example schematic for a SBM module can be found in the datasheet of TI bq29311 at page 9.
|||
48
74
49
75
## German Documentation
50
76
Gibt die Daten des SMB Controllers aus.
51
77
Basiert auf https://github.com/PowerCartel/PackProbe von Power Cartel http://powercartel.com/projects/packprobe/. Hier gibt es auch weitere wertvolle Informationen.
52
78
53
79
## Finden der Anschlüsse.
80
+
In der Version 4.0 ist eine Spannungs und Widerstandsmessung mittels 4 Widerständen integriert, um die I2C Pins zu identifizieren.
54
81
Die Clock und Data Eingänge waren bei meinen Packs die Anschlüsse mit einem Widerstand von ca. 300 k bis 1 MOhm nach Masse.
55
82
Nach dem Booten sucht das Programm nach einem angeschlossenen I2C Device.
56
83
Man kann also alle möglichen Pinkombinationen von Clock und Data am Battery Pack ausprobieren.
0 commit comments