Reverse engineering BMS Firmware / Reflashing BMS

[explorer232]

This is from stock 3NA0D firmware. First line is x axis (temperature range ) + 10 rows data (Address 0x3e1e0) Y axis is (0x3e1bc) Size 5x11, there is 5 tables. Data offsets readed from the firmware. Tables are hardcoded. Different location, size in each firmware. SOC in first line is a bit crazy but these tables are hardcoded, not some "standard" format.

 

[ginetto]

This is from stock 3NA0D firmware. First line is x axis (temperature range ) + 10 rows data (Address 0x3e1e0) Y axis is (0x3e1bc) Size 5x11, there is 5 tables. Data offsets readed from the firmware. Tables are hardcoded. Different location, size in each firmware. SOC in first line is a bit crazy but these tables are hardcoded, not some "standard" format.

gosh! was simpler than I was reading! sometimes I'm able to loose myself :/ I was confused by colour table of SOC as there where a relation with colour and colour does not mean anything in this case.

 

[dfj]

I spent yesterday reverse engineering the .KWP protocol the nissan firmwares come in. Attached is a small command line tool to covert the kwp into a raw binary flash file. This puts us one more step closer to being able to update your BMS using a genuine nissan firmware (or a CATL patched firmware) without a $6000 set of hardware. Just need a log of a bms update to fill in the last missing pieces...

Also! Gen1 BMS's are missing a bunch of CAN commands that Gen2 and 30kwh firmwares have, including re-writing serial numbers etc... Response packet lengths are also different between models which explains why that PDF of the LBC CAN frames is completely wrong compared to the data I'm getting from my BMS's

Tried this tool on another kwp file (not BMS related), but it outputted an empty file. Could you share the code/check out my file? Adding support for my kwp file

 

[safetyuggs]

Post your KWP here

 

[dfj]

Post your KWP here

I sent to PM. Can repost here too if u want

 

[safetyuggs]

Looks like it works fine to me?

 

[dfj]

View attachment 6946

Looks like it works fine to me?

Strange. I used wine in x64 and also tried it in powershell on arm windows. Maybe compatibility layers cause issues?

 

[dfj]

Strange. I used wine in x64 and ran it in powershell on arm windows. Maybe compatibility layers cause issues?

Have you considered if this util could be published in ie. github? Would allow users to compile themselves / debug.

 

[safetyuggs]

not sure, it's coded for windows, requires windows msc runtime files if run on windows, probably won't work on other OS's.

I don't have time for github right now but I've attached the source, it shouldn't need too many changes to be compiled on other os's. It's all pretty generic STDIO stuff

 

[dfj]

not sure, it's coded for windows, requires windows msc runtime files if run on windows, probably won't work on other OS's.

I don't have time for github right now but I've attached the source, it shouldn't need too many changes to be compiled on other os's. It's all pretty generic STDIO stuff

Ok, thanks! I'll check/adapt for universal use and maybe post it on GitHub

 

[dfj]

Ok, thanks! I'll check/adapt for universal use and maybe post it on GitHub

Here's extractor in python:

 

[Titus]

Hi, can anyone compile this app to work on windows? I have a lot of OBD2s to test, I have vagcom 704, k commander, delphi autocom… I haven't been able to use this app on Android yet because my tablet has an android 13 operating system and it doesn't seem to work properly although my bluetooth obd2s do work… Thanks

 

[safetyuggs]

this app ONLY works on windows, does not work with vagcom, k commander, delphi whatever... Please read the thread?

 

[Titus]

this app ONLY works on windows, does not work with vagcom, k commander, delphi whatever... Please read the thread?

Hello, please excuse my ignorance. I wanted to write in the other post about the Android app, it was my mistake. I hope you forgive me and that someone can help me. Regards.

 

[safetyuggs]

could you please explain what is not working on your windows machine