Hi there,
I need some help reverse engineering a BMS chip from a battery for an xx30 thinkpad. The Laptop uses a challenge-response type of system to verify if a battery is genuine:
The laptop writes four bytes to 0x3C and then reads 0x3C. The battery responds with "Lenovo JapanXXXX", with the Xs corresponding to four response bytes. For example "0xDC 0x42 0x5B 0x82" to BMS => "Lenovo Japan0x9F 0x76 0x97 0x2E" from BMS.
What I know so far:
- It's an 51F51 BMS chip based on the R2J24020F group. Karosium has already figured out how to dump
...
Comment