Battery firmware lockout: Difference between revisions

Line 47:

There are ways of tackling battery firmware lockout:

*Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers.

*Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers. Some compatible third-party battery packs don't have lockout mechanism, making it possible for the user to replace cells in the pack and cycle charge to calibrate its meter. However, the exact makes and models aren't well-known.

*Extracting the BMS code: Certain logic analyzers can extract the code from communications to and from the BMS chip. Users or repair technicians can use this way to extract the "unseal" password, then reset the "permanent fail" flag and recalibrate the battery's capacity.

*Acquiring the unlock password: Some of the battery models' BMS code has been leaked, some of them are publicized<ref>{{Cite web |last=@davext |date=25 Jun 2024 |title=unbrick-dji |url=https://github.com/davext/unbrick-dji/blob/main/src/main.cpp |url-status=live |archive-url=https://web.archive.org/web/20250914163205/https://github.com/davext/unbrick-dji/blob/main/src/main.cpp |archive-date=14 Sep 2025 |access-date=14 Sep 2025 |website=[Github]}}</ref>. For others, it might be possible to purchase it in the grey market, however, there's a risk of scam as some of the passwords can be as expensive as the pack itself, and there's no guarantee of working.

*Resetting the BMS: Some specialized hardware and software can be used to clear the PF flag, reviving the battery without the need of knowing the battery's parameters. Most of the users ~~won~~'t modify the battery ~~pack~~ after repairing<ref>{{Cite web |date=2019-08-15 |title=Reset-BQ20xx |url=https://github.com/otofoto/Reset-BQ20xx |url-status=live |archive-url=https://web.archive.org/web/20220923061011/https://github.com/otofoto/Reset-BQ20xx |archive-date=2022-09-23 |access-date=2025-09-13 |website=[[Github]]}}</ref>.

*Resetting the BMS: Some specialized hardware and software can be used to clear the PF flag, reviving the battery without the need of knowing the battery's parameters. Most of the users don't have a need for modify the battery's parameters after repairing<ref>{{Cite web |date=2019-08-15 |title=Reset-BQ20xx |url=https://github.com/otofoto/Reset-BQ20xx |url-status=live |archive-url=https://web.archive.org/web/20220923061011/https://github.com/otofoto/Reset-BQ20xx |archive-date=2022-09-23 |access-date=2025-09-13 |website=[[Github]]}}</ref>.

*Install a custom (or OEM) BMS chip: Buying a brand new BMS chip and write own program. The main challenge is the knowledge of the working mechanism of the battery and its BMS. Different battery chemistries have different voltage and current characteristics, using the wrong data may cause incorrect capacity reading at best, or battery/device malfunction at worst.

@@ Line 47: / Line 47: @@
 There are ways of tackling battery firmware lockout:
-*Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers.
+*Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers. Some compatible third-party battery packs don't have lockout mechanism, making it possible for the user to replace cells in the pack and cycle charge to calibrate its meter. However, the exact makes and models aren't well-known.
 *Extracting the BMS code: Certain logic analyzers can extract the code from communications to and from the BMS chip. Users or repair technicians can use this way to extract the "unseal" password, then reset the "permanent fail" flag and recalibrate the battery's capacity.
 *Acquiring the unlock password: Some of the battery models' BMS code has been leaked, some of them are publicized<ref>{{Cite web |last=@davext |date=25 Jun 2024 |title=unbrick-dji |url=https://github.com/davext/unbrick-dji/blob/main/src/main.cpp |url-status=live |archive-url=https://web.archive.org/web/20250914163205/https://github.com/davext/unbrick-dji/blob/main/src/main.cpp |archive-date=14 Sep 2025 |access-date=14 Sep 2025 |website=[Github]}}</ref>. For others, it might be possible to purchase it in the grey market, however, there's a risk of scam as some of the passwords can be as expensive as the pack itself, and there's no guarantee of working.
-*Resetting the BMS: Some specialized hardware and software can be used to clear the PF flag, reviving the battery without the need of knowing the battery's parameters. Most of the users won't modify the battery pack after repairing<ref>{{Cite web |date=2019-08-15 |title=Reset-BQ20xx |url=https://github.com/otofoto/Reset-BQ20xx |url-status=live |archive-url=https://web.archive.org/web/20220923061011/https://github.com/otofoto/Reset-BQ20xx |archive-date=2022-09-23 |access-date=2025-09-13 |website=[[Github]]}}</ref>.
+*Resetting the BMS: Some specialized hardware and software can be used to clear the PF flag, reviving the battery without the need of knowing the battery's parameters. Most of the users don't have a need for modify the battery's parameters after repairing<ref>{{Cite web |date=2019-08-15 |title=Reset-BQ20xx |url=https://github.com/otofoto/Reset-BQ20xx |url-status=live |archive-url=https://web.archive.org/web/20220923061011/https://github.com/otofoto/Reset-BQ20xx |archive-date=2022-09-23 |access-date=2025-09-13 |website=[[Github]]}}</ref>.
 *Install a custom (or OEM) BMS chip: Buying a brand new BMS chip and write own program. The main challenge is the knowledge of the working mechanism of the battery and its BMS. Different battery chemistries have different voltage and current characteristics, using the wrong data may cause incorrect capacity reading at best, or battery/device malfunction at worst.