日志 - 昨天收了 一个47+ 三洋固件的电池,发现一个有趣的数据!

jackmacc

昨天 20元收了一个 47+ 电池, 是三洋的固件, 读取数据






计算 截取地址




得到数据,可以看到  04 B2 07 00
也就是


(10) Full Charge Capacity = 1612 mAh
(11) Run Time to Empty = 0 min(s)
(12) Average Time to Empty = 0 min(s)
(13) Average Time to Full = 65535 min(s)
(14) Charging Current = 2700 mA
(15) Charging Voltage = 12900 mV
(16) Battery Status = 0x7D0
(17) Cycle Count = 1202


04 B2 是 1202 的循环计数
根据经验:
0700 应该是 完全充电容量 数据是 1792
但是读取到显示数据是 1612


//........................................................


为什么会出现这种现象呢,我尝试,进行标尺放电
再次读取 这个数据变成了



(10) Full Charge Capacity = 1611 mAh
(11) Run Time to Empty = 65535 min(s)
(12) Average Time to Empty = 65535 min(s)
(13) Average Time to Full = 65535 min(s)
(14) Charging Current = 2700 mA
(15) Charging Voltage = 12900 mV
(16) Battery Status = 0x6D0
(17) Cycle Count = 1204


对应数据



04 B4  对应 1204

06 FE  对应 1611

经过这次对比我就将 06 FE
修改成 0BB8 ,就是 3000,(将完全充电容量改成 3000)
(因为修改动态数据应该是安全的,而且这个位置数据值变化了.改改没问题)

再读取一次数据

这次数据 变成



(10) Full Charge Capacity = 2700 mAh
(11) Run Time to Empty = 0 min(s)
(12) Average Time to Empty = 0 min(s)
(13) Average Time to Full = 65535 min(s)
(14) Charging Current = 2700 mA
(15) Charging Voltage = 12900 mV
(16) Battery Status = 0x7D0
(17) Cycle Count = 1204


//........................................................
得出一个规律


04 B4

06 FE 对应 1790 对应 1611 mAh  差 179


07 00 对应 1792 对应 1612 mAh  差 180


04 B4

0B B8 对应 3000 对应 2700 mah 差300

3000-1792 =1208

2700-1612=1088


27/30=0.9


1612/1792=0.89955



//........................................................
固件将  

604 , 504 的ROM 地址的数据, 完全充电容量

要乘以一个 0.9 的约数,

所以再二进制数据查找的时候,找不到,对应 的二进制数




//........................................................

总结: 将显示的数据 (完全充电容量  除以 0.9) 再,进行二进制查找

这个规律,我已经发现几个电池了.  例如 29+ ,47+  ,

这次记录一下

,当然我也不排除,修改截取地址,你能读到一个对应的值.

wangyxlish

牛。点赞技术贴！

sdbz001

点赞技术贴！

StormBolt

很牛逼，但是走火入魔了

jackmacc

电池断电后,必须再激活,固件,而激活固件是从 输出端(也就是,充电端),不光是安装电池,它就能自己激活的.所以,刚刚安装电池
也就是电池断电后,再接上电池,这时候,固件没有启动,

DJi Battery Killer ver. 0.5 Beta 2
compiled 01.02.2022
Thanks to everyone who helped in the creation and testing of this program ;)

BQ30Z55 CHIP SELECTED
----------------------------------------------------------------
ERROR: Could not write Word to 0x00
----------------------------------------------------------------
ERROR: Could not perform SMBus read 0x00
----------------------------------------------------------------
ERROR: Could not write Word to 0x00
----------------------------------------------------------------
ERROR: Could not perform SMBus read 0x00
----------------------------------------------------------------
ERROR: Could not write Word to 0x00
----------------------------------------------------------------
ERROR: Could not perform SMBus read 0x00
----------------------------------------------------------------
ERROR: Could not write Word to 0x00
----------------------------------------------------------------
ERROR: Could not perform SMBus read 0x00
----------------------------------------------------------------
ERROR: Could not write Word to 0x00
----------------------------------------------------------------
ERROR: Could not perform SMBus read 0x00
----------------------------------------------------------------
ERROR: Could not write Word to 0x00
----------------------------------------------------------------
ERROR: Could not perform SMBus read 0x00
----------------------------------------------------------------
ERROR: Could not write Word to 0x00
----------------------------------------------------------------

//........................................................

可以看到,读不到数据
,连接笔记本,或者,充电器(特殊设备:专用充电器)
就可以读取到数据了,

(00) Manufacturer Access = 0x0018
(01) Remaining Capacity Alarm = 622 mAh
(02) Remaining Time Alarm = 10 min
(03) Battery Mode = 0x8000
(04) At Rate = 0 mA
(05) At Rate Time To Full = 65535 min(s)
(06) At Rate Time To Empty = 65535 min(s)
(07) At Rate OK = -1
(08) Temperature = 18 C
(09) Voltage = 12054 mV
(0A) Current = 0 mA
(0B) Average Current = 0 mA
(0C) Max Error = 0 %
(0D) RSOC = 0 %
(0E) ASOC = 0 %
(0F) Remaining Capacity = 0 mAh
(10) Full Charge Capacity = 1612 mAh
(11) Run Time to Empty = 0 min(s)
(12) Average Time to Empty = 0 min(s)
(13) Average Time to Full = 65535 min(s)
(14) Charging Current = 2700 mA
(15) Charging Voltage = 12900 mV
(16) Battery Status = 0x7D0
(17) Cycle Count = 1202
(18) Design Capacity = 5772 mAh
(19) Design Voltage = 11100 mV
(1A) Cpecification Info = 0x31
(1B) Manufacture Date = 0x3D69 - 2010.11.09
(1C) Serial Number = 2070
(20) Manufacturer Name = SANYO11
(21) Device Name = LNV-42T4835
(22) Device Chemistry = LION
(23) Manufacturer Data = 0x4297C7020000E70F6E0FC20F0508
(3C) Battery Cell 4 Voltage = 18707 mV
(3D) Battery Cell 3 Voltage = 0 mV
(3E) Battery Cell 2 Voltage = 65 mV
(3F) Battery Cell 1 Voltage = 15929 mV
----------------------------------------------------------------
ERROR: Could not check seal/unseal/FAS
----------------------------------------------------------------
ERROR: Could not write Word to 0x00
----------------------------------------------------------------
(00) Manufacturer Access = 0x0000
(01) Remaining Capacity Alarm = 622 mAh
(02) Remaining Time Alarm = 10 min
(03) Battery Mode = 0x8000
(04) At Rate = 0 mA
(05) At Rate Time To Full = 65535 min(s)
(06) At Rate Time To Empty = 65535 min(s)
(07) At Rate OK = -1
(08) Temperature = 17 C
(09) Voltage = 12055 mV
(0A) Current = 0 mA
(0B) Average Current = 0 mA
(0C) Max Error = 0 %
(0D) RSOC = 0 %
(0E) ASOC = 0 %
(0F) Remaining Capacity = 0 mAh
(10) Full Charge Capacity = 1612 mAh
(11) Run Time to Empty = 0 min(s)
(12) Average Time to Empty = 0 min(s)
(13) Average Time to Full = 65535 min(s)
(14) Charging Current = 0 mA
(15) Charging Voltage = 0 mV
(16) Battery Status = 0x7D0
(17) Cycle Count = 1202
(18) Design Capacity = 5772 mAh
(19) Design Voltage = 11100 mV
(1A) Cpecification Info = 0x31
(1B) Manufacture Date = 0x3D69 - 2010.11.09
(1C) Serial Number = 2070
(20) Manufacturer Name = SANYO11
(21) Device Name = LNV-42T4835
(22) Device Chemistry = LION
(23) Manufacturer Data = 0x4297C7020000E70F6D0FC20F0508
(3C) Battery Cell 4 Voltage = 18707 mV
(3D) Battery Cell 3 Voltage = 0 mV
(3E) Battery Cell 2 Voltage = 65 mV
(3F) Battery Cell 1 Voltage = 15929 mV
----------------------------------------------------------------
ERROR: Could not check seal/unseal/FAS
----------------------------------------------------------------
ERROR: Could not write Word to 0x00
----------------------------------------------------------------
(00) Manufacturer Access = 0x0000
(01) Remaining Capacity Alarm = 622 mAh
(02) Remaining Time Alarm = 10 min
(03) Battery Mode = 0x8000
(04) At Rate = 0 mA
(05) At Rate Time To Full = 65535 min(s)
(06) At Rate Time To Empty = 65535 min(s)
(07) At Rate OK = -1
(08) Temperature = 17 C
(09) Voltage = 12059 mV
(0A) Current = 0 mA
(0B) Average Current = 0 mA
(0C) Max Error = 0 %
(0D) RSOC = 0 %
(0E) ASOC = 0 %
(0F) Remaining Capacity = 0 mAh
(10) Full Charge Capacity = 1612 mAh
(11) Run Time to Empty = 0 min(s)
(12) Average Time to Empty = 0 min(s)
(13) Average Time to Full = 65535 min(s)
(14) Charging Current = 0 mA
(15) Charging Voltage = 0 mV
(16) Battery Status = 0x7D0
(17) Cycle Count = 1202
(18) Design Capacity = 5772 mAh
(19) Design Voltage = 11100 mV
(1A) Cpecification Info = 0x31
(1B) Manufacture Date = 0x3D69 - 2010.11.09
(1C) Serial Number = 2070
(20) Manufacturer Name = SANYO11
(21) Device Name = LNV-42T4835
(22) Device Chemistry = LION
(23) Manufacturer Data = 0x4297C7020000E80F6F0FC40F0508
(3C) Battery Cell 4 Voltage = 18707 mV
(3D) Battery Cell 3 Voltage = 0 mV
(3E) Battery Cell 2 Voltage = 65 mV
(3F) Battery Cell 1 Voltage = 15929 mV
----------------------------------------------------------------
ERROR: Could not check seal/unseal/FAS
----------------------------------------------------------------


以上是原始数据,从重新写入了.一次.
如果电池锁住,要用原始数据写回去.

jackmacc

不幸.  居然不能充电了.  问题待解决.估计只能用专业软件,解了.
也可能是板子的问题.

沐浴阳光雨

我有一个thinkpad e531的电池电量为0不知道用什么方法和软件激活，大佬能否指点一下？

sdbz001

朋友您好，我有一块47+三洋，修改数据后写入时报错“write block 0X4000-FILED”,请指导一下如何解决。谢谢！

wjqjames007

电池加密真的太麻烦了，以前觉得很酷，越来越觉得麻烦，换个电芯都折腾半天。现在用的松下电池，随便换电芯也不锁，太方便了。

sdbz001

另有几块电池73读取到的数值为0000，这个又如何计算71的写入值（71最大写入9999），请指导，谢谢！！