Reverse engineering BMS Firmware / Reflashing BMS

[safetyuggs]

Checksum can message responses: 02 = OK, 04 = Global checksum (3E000) bad, 08 = Region checksum bad.

I haven't tried closing the session after we get a bad response, I'll try that now. I don't expect it'll work but worth trying

 

[liuguoqing351]

 

[liuguoqing351]

 

[LKA]

ze0 3NA0D. does this look like right place?

 

[safetyuggs]

for the Ah calculation? Yup


It multiplies SOH by the Maximum battery capacity (24kwh) to produce the remaining battery Ah

 

[DimonLipko]

Hi! Amazing project!! I hear that Kangoo/Fluence ZE BMS have unlocked V850. Can protocol is different in Renault and Nissan. But maybe full flash with bootloader from Kangoo BMS can help for reverse engineering)

In Ukraine my friend start change chip in Leaf BMS for custom, long time ago (maybe 6 year ago), and now he have more than 300 OEM chip))

 

[vvitecd]

Who has Kangoo BMS in stock? ))

 

[DimonLipko]

I have, but I am in Ukraine) Maybe I found time to try read MCU flash. I have vvdi2 programmer, need check is it supposed V850.

 

[explorer232]

Hi! Amazing project!! I hear that Kangoo/Fluence ZE BMS have unlocked V850. Can protocol is different in Renault and Nissan. But maybe full flash with bootloader from Kangoo BMS can help for reverse engineering)

In Ukraine my friend start change chip in Leaf BMS for custom, long time ago (maybe 6 year ago), and now he have more than 300 OEM chip))

Super, there is different candb in the firmware, but if hw is simmilar to nissan (probably yes) this might be helpful.

 

[DimonLipko]

Yes, hardware is the 100% the same in 1st BMS (in Kangoo 2 bms, slave don't have isolation measure parts)

 

[safetyuggs]

Trying something a little different - fault injection to disable read protection. It's not fast, but it's working.

 

[LKA]

It's not fast, but it's working.

success?

 

[explorer232]

I have, but I am in Ukraine) Maybe I found time to try read MCU flash. I have vvdi2 programmer, need check is it supposed V850.

You need only FTDI or another usb to serial interface and Renesas flash programmer app for connection to serial bootloader in the chip.
@safetyuggs can share with you pinnout for connection. I dont have any LBC for testing but its working , tested with another ecu. If there is no read lock you can dump complete flash.

 

[DimonLipko]

I have VVDI2 there are support of this MCU. I don't know is work button "Unlock")))

 

[safetyuggs]

~8kbytes / 64kbytes extracted so far (~3hrs)

I'll try automate the process today and let it run overnight

 

[safetyuggs]

I have VVDI2 there are support of this MCU. I don't know is work button "Unlock")))

View attachment 6469

The manufacturer website says the vvdi2 cannot read protected flash

 

[safetyuggs]

I've automated the tool, it's recovering approx 32bytes per minute on average. estimated 33hrs!!?!?!

This is the last step (fingers crossed) - we'll have the checksum algorithm and we can start testing custom firmwares. I'm really looking forward to removing this buggy can bridge

 

[safetyuggs]

Two down, one to go!

 

[safetyuggs]

Success!

Now we need to find all the references to the 24kwh capacity variables, GID's, Ah values and anything else involved with the accurate measurement for the CATL cells.

 

[LKA]

Now we need to find all the references to the 24kwh capacity variables, GID's, Ah values and anything else involved with the accurate measurement for the CATL cells.

can you share a full flash of bms?