Unlocking SBS-capable battery chip without expensive programmer - example on Mavic Pro battery

[@cucubits]

Brilliant! This is still very much up to date info in 2024. I just revived an old Mavic battery. Everything worked perfectly.

[@tomaztercic9147]

Thank you man, you are lifesaver. I restored laptop battery with this tools, and now works properly. It was only not working due to being depleted bellow 3V on one cell, due to storage

[@MapNTrowel]

Absolutely brilliant! Thanks for developing this amazing code! I can confirm this process works on Phantom 4 High Capacity batteries (as expected since it has the same chip). Note that the P4 battery must be powered on for the address to be detected (this may have been mentioned earlier in comments, but I haven't read through them all).

[@StevenPark123]

I would like to personally thank you, the raspberry pi method worked for me I was successfully able to restore my phantom 4 battery! It is charging now and seems like I got my battery back!

[@teknoy5417]

Hi..can you share how to locate the files to use on raspberry pi? just like the video that says dji firmware tools

[@davidflanagan1152]

Wow...true talent at work and willing to teach us all

[@strajkovski8767]

Thank you sir, you are a gentleman and a scholar. Your guide was very clear and descriptive, it was very easy to follow, it helped me recover a phantom 4 battery that had been neglected by the previous owner.

[@teknoy5417]

Hi, can you share where to download the files and how to add it on raspberry pi?

[@eto1842]

contact point in your video saved my day, ripped contact point on the other side by accident T_T cheap programmer is available at less than $20, but it is absolutely amazing to skipping the wait for shipment thanks for your work.

[@lmaoroflcopter]

Thank you for this, managed to recover my battery. Now to do some capacity testing to see how it copes.

[@omniauniting]

Wow, so impressed! Everyone can do things the normal way, your micro invasive surgery on the battery is so much cooler. Maybe with constant training you can even hit the contacts with the needles without having to drill the view hole. Great!

[@ungravityfpv]

you´re the king!. Huge thanks for develop this awesome tool. giving power to mortals to do something incredible!! you deserve all good! thanks!!

[@michaeldreher1372]

Thanks a lot to you and to the people who made this tool !!!

THANKS THANKS THANKS... you are so cleaver! I’ll try it soon :) I have like 25 batteries that need to be repaired

[@MrKalach]

Nice and clean! Restored my 2 P4P dead batteries 👍

[@drorhaz]

How you did that? Please help me i have that same p4p battery dead i charched it to 50% i tried everithing here.. i cant read the chip no metter what i do. Please HELP

[@kailashsuthar2509]

Super talent. How can we read and write data from phantom 4 gimbal board?

[@JefSilv]

I would like to know to

[@strajkovski8767]

Can you do a tutorial on how to clear the PF flag with arduino ?

[@niiiick-og]

What a legend! Worked perfectly for me 👍🏻

[@krisjehaes276]

Hello great video. Learned everything on how to use the tool from it! Any advice or ideas about my AIRv1 battery is appreciated. 4 Battery Lights when push button dont go on anymore. Individual cells are OK = mid-voltage, No PF issues. The BatteryStatus: ERROR_CODE: 7=Unknown Error [EC] Function error code FULLY_DISCHARGED: 0=Not fully [FD] Battery capacity is depleted FULLY_CHARGED: 0=Not fully [FC] Battery is full DISCHARGING: 1=Yes [DSG] Battery is discharging INITIALIZED: 1=Recalibrate [INIT] State of calibration/configuration REMAINING_TIME_ALARM: 0=Inactive [RTA] Remaining time to depletion alarm tripped REMAINING_CAPACITY_ALARM: 0=Inactive [RCA] Remaining capacity alarm tripped TERMINATE_DISCHARGE_ALARM: 1=Active [TDA] Battery capacity is depleted OVERTEMPERATURE_ALARM: 0=Inactive [OTA] Temperature is above pre-set limit TERMINATE_CHARGE_ALARM: 1=Active [TCA] Charging should be suspended OVER_CHARGED_ALARM: 0=Inactive [OCA] Battery is fully charged

[@krisjehaes276]

Here some other registers that might indicate the problem: OperationStatus: 0x00040206 bitfields Operational Status bits [ ResU=0][ ResT=0][EMSHT=0][ CB=0][SLPCC=0][SLPAD=0][SLCAL=0][ INIT=0] [SLEPM=0][XL=0][CALOO=0][CALOC=0][ACALM=0][ AUTH=1][ LED=0][ SDM=0][SLEEP=0][ XCHG=0][ XDSG=0][ PF=0][ SS=0][ SDV=0][ SEC=2] [ BTPI=0][SMOTH=0][ FUSE=0][ Res4=0][ PCHG=0][ CHG=1][ DSG=1][ PRES=0] ChargingStatus: 0x0808 bitfields Charging Status bits [ VCT=0][ MCHG=0][ SU=0][ IN=0][ HV=1][ MV=0][ LV=0][ PV=0] [ Res7=0][ OT=0][ HT=0][ STH=0][ RT=1][ STL=0][ LT=0][ UT=0] GaugingStatus: 0x0b1950 bitfields Gauging Status bits [ ResN=0][ ResM=0][ ResL=0][OCVFR=0][ LDMD=1][ RX=0][ QMax=1][ VDQ=1] [ NSFM=0][ ResE=0][SLPQMx=0][ QEN=1][ VOK=1][R_DIS=0][ Res9=0][ REST=1] [ CF=0][ DSG=1][ EDV=0][BAL_EN=1][ TCA=0][ TD=0][ FC=0][ FD=0] ManufacturingStatus: 0x0078 bitfields Manufacturing Status bits [CALTS=0][LT_TS=0][ ResD=0][ ResC=0][ ResB=0][ ResA=0][ LED=0][ FUSE=0] [ BBR=0][ PF=1][ LF=1][ FET=1][GAUGE=1][ DSG=0][ CHG=0][ PCHG=0]

[@mefistotelis]

@@krisjehaes276 You may want to post that on "issues" within the github project, or ask people on #hardware channel at dji-rev.com.

[@dav3yuk]

Great tutorial with the RPi. I managed to mess up my Phantom 4 Pro battery by balance charging it and disconnecting PCB from pack and now although the lights/behaviour all seem to be ok it now isn't signalling the FETs to power on although it looks like it has. I'm hoping this might be caused by PF flag. I've got a real early RPi with the 26 pin header. I assume this will do the job, if not i may be treating myself to an upgrade.

[@dav3yuk]

After sorting my issues with my install on the ancient Pi 1 Model B , I've managed to resurrect my dead battery. Clearing the PF flag sorted my problem. Thanks a lot. Drone now powers up with it again and all cell voltages are within 0.01V of each other. Flight test at low altitude next to complete a cycle on the battery.

[@icemanic400]

Where did you connect the sda and scl? I am trying to reset a PH3 battery and have found 3 different pad pairs all labeled sda scl

[@dav3yuk]

@@icemanic400 As you are using different battery, I'd check for continuity between any of them and test them as pairs. The initial command just reads so based on the response you might be able to tell if it's the correct pair. I have no idea if the PH3 battery uses same power chip as the PH4 so best of luck 🤞

[@drorhaz]

Hi like you i have the early pi model (pi2 i think?) And i have the same issue with the phantom 4 pro battery. But i have no idea where to start and how to do all this computer work. I have done the battery cells equal at 3.7v stable now i know how to connect the pins to the pi. From here im lost - what software i need on the pi? What are the commands that i need to put in and in what order? I wish if it was a good guide for this. Instad of buying expensive module and payment software..

[@teknoy5417]

@@drorhaz hi, same here..did you manage to solve?

[@ytrew9717]

fascinating, I wonder how you learn those stuffs: do you work on this field?

[@mefistotelis]

No, my superpower is just reading PDFs with understanding. Chips are always well documented, unless they're Chinese.

[@walmacsnake1983]

Wow thanks for this video and the info within. Its very educational!

[@pszczeemo]

Siemka pytanko co może być problem jeśli wsystko podłączyłem,zainstalowałem,ustawiłem etc a po wpisaniu i2cdetect -y 1 wszystko mam puste

[@honestmstk9790]

I am very thankful for and impressed by the work youve done. What would need to be changed in order for this to work on a spark battery? Im currently unable to unseal. Would the dji battery killer work if i order the cpxxx adapter? Or is it as simple as using a different default password? Thanks

[@strajkovski8767]

The u at the start of the command unseal is upper case, Unseal. I made this error and quickly realised once I went back over my commands.

[@ronaldwitteman2134]

Thanks.saved me so manny battery packs.

[@cesaralcaide62]

Hi mefistotelis! I have already recovered one of the batteries! thank you so much. But I have another one that I can't recover, it also has PF=1, and it supports the reset well, like at 16:58 of your video, but the PF is not removed. The CUV remains equal to 1, although it is well loaded

[@cesaralcaide62]

*charged well charges, 17.2 V, MA.PFStatus: 0x00000001 bitfields Permanent Fail Status bits [ ResU=0][ ResT=0][ ResS=0][ ResR=0][ ResQ=0][ DFW=0][OCECO=0][ IFC=0] [ PTC=0][ 2LVL=0][ AFEC=0][ AFER=0][ FUSE=0][THERM=0][ DFET=0][CFETF=0] [ ResF=0][ ResE=0][ ResD=0][ VIMA=0][ VIMR=0][ CD=0][ IMP=0][ CB=0] [ QIM=0][ OTF=0][ Res5=0][ OTCE=0][ Res3=0][CUDEP=0][ COV=0][ CUV=1] Reading write_word_subcommand command at addr=0xb, cmd=0x0, type=uint16, opts={'subcmd': } Query ManufacturerAccess.OperationStatus: 00 WORD=0x54 Write ManufacturerAccess: CMD=00 WORD=54 00 Raw ManufacturerAccess.OperationStatus response: 04 00 7b 50 00 d3 MA.OperationStatus: 0x00507b00 bitfields Operational Status bits [ ResU=0][ ResT=0][ ResS=0][XLSBS=0][SLEPC=0][SLEPQM=0][SLCAL=0][ INIT=0] [SLEPM=0][ SDV=1][ CALO=0][ FVS=1][ AWD=0][ AUTH=0][ SHPM=0][ SDM=0] [SLEEP=0][ XCHG=1][ XDSG=1][ PF=1][ SS=1][ CAL=0][ SEC=3] [ LED=0][ CB=0][ FUSE=0][ GPOD=0][ PCHG=0][ CHG=0][ DSG=0][ PRES=0]

[@fn9127]

Hi, great video and instructions. I had almost recovered a battery and was in the final stages of unlocking it and had connected the wires to the two outputs SCL and SDA but accidentally touched them and that is where it all ended, maybe the MSP430 shorted out or something? I saw in your video that you were casually manipulating the alligator clips, I thought it was a no brainer that nothing would happen, Where do the two outputs go, is there a circuit somewhere of the board?

[@CuriousSoulCanada]

Really good tutorial, I am impressed by your work on decoding the DJI drones guts. Got some data out but getting errors during the Unseal command, also reading errors during Monitor function and others, not consistant reading. Tried 5.6k and 2.8k to gnd on the data and clock lines, no benefit. Tried that generator command line, same thing. Phantom P4 batts. 3.3v on i2c lines. Chip is Bq30z55. Tried 6600 and 4800 baud rate. Raspberry pi 4 version B. Program spits error at lines 3000 and something. Any clues for me, please?

[@mefistotelis]

Understand the error. Put it into search engine.

[@CuriousSoulCanada]

@@mefistotelisThank you, will do that. I blew my Raspbery i2c port while trying the UARRT on a P3 battery board, now I ordered an EV2300 from Aliexpress

[@teknoy5417]

Hi, can you share where to download the files and how to add it on raspberry pi?

[@TerryDeSimone]

can "dji-firmware-tools" that you used.. that is just using the SBS protocol right? so can i do the same with a laptop battery ??

[@tomaszlis993]

There are tools for various battery chips, though only a few with limited scope are free. The tool I created works on standard SBS, but it also goes beyond with "ManufacturerAccess" extensions for a specific vendor and specific BMS chips. Custom drivers for more chips can be added though. Many of the commands presented in the video are not standard SBS. So the answer is "yes, but...".

[@LifeofAnatoliStar]

Hello! I have two Mavic Air 1 batteries which don't charge and I tried to connect them to Raspberry PI. i2cdetect -y 1 doesn't show any devices listed. I have went over cables many times and is correct. I checked cell voltage and they are 1.8V, 1.6V and 2.2V. Do I need to charge the individual cells first, before attempting to connect to i2c? Or shoud it work with these low voltages also? Thank you for help Anatoli

[@LifeofAnatoliStar]

Tried charging the battery and it finally showed up in i2cdetect. Unsealing Mavic Air 1 battery doesnt work!

[@fizzycherrycola]

@@LifeofAnatoliStar :}

[@chrisdrake4692]

What are the middle 2 pins for on the battery socket? Aren't they SDA and SCL already?

[@LifeofAnatoliStar]

Same question!

[@fpvrcstuff]

Fantastic Tutorial. Have you tried to re-set a Phantom 4 battery, I have one that will not charge with the oem charger , but I was able to take it apart and balance charge the batteries on my Thunder AC 6 Charger but the battery is still locked and cannot be used to power the quad copter. Can you do a Tutorial on these batteries......Thanks From Canada

[@mefistotelis]

Phantom 3/4 battery uses the same chip. I expect viewers to be able to alter the procedure for different board layout by themselves.

[@fpvrcstuff]

@@mefistotelis Ok, great I'll give it a go then...thanks

[@juaqui98]

Awesome! I nedded interface the bq8030 with a rpi0 to reset bms. I can do it only with this?

[@symik3]

Thank you for your effort, took me a few hours to get it working(a simple ADC on the I2C bus screwed over the communication). Fuck this anti-repair bullshit, ASUS sealed the battery. It is my damn property and they lock it away.

[@mefistotelis]

Absolutely. I hope all the `hardware as a service` ideas will be stopped by legislation, in all regions. DJI double encrypts all its firmware not only to deny users the access to their HW, but also to hide GPL violations.

[@briannicolleau55]

I see you're trying to restore an Asus battery, so am I. I can't get the I2C to connect to my raspberry, I double checked my raspberry with a RTC clock I had in stock and it does work so I'm sure it's on the battery side. What did you do to get connection?^ I soldered small wires directly on SMBD and SMBC on the 30z55 pins but still nothing

[@buundy]

Hi! Somehow my i2c doesnt show anything on the pi. Is there a way to test if it is a fail on the rpi side or the battery side? What do you mean by the adc problem?

[@Syclone0044]

@@mefistotelis Some rightful GPL code authors should sue DJI, they’d make a mint

[@Shinjinkun]

Hi. I was able to drill the hole and access both terminals. However, when I use the software, it doesn't detect the board. Specially, the part about putting the pins, they don't seem to stay in place. Is there anything that I am missing? Please help!

[@CauOngTroi]

Hello.... can you give me the link to read taxes instruments chip?? I need it to read battery errors and fix them for other devices, but I can't download them from the homepage. thanks

[@icyblizard]

Sir, thanks for your tutorial If the cell voltage is very low, do we need to drill a hole to charge the battery terminals, or do we use the battery charger while unlocking the chip?

[@mefistotelis]

I drilled a small hole on the side of the battery with smallest surface. Then inserted a needle, and pushed it to puncture the glue which is on the terminals. Only one terminal required such drilling - the other one has direct connection to the cells.

[@TanNguyen-cg5ll]

Thank you for your amazing work. I'm trying to use this tool to make some modifications on laptop battery but I got a problem that I cannot unseal that battery to reset PF flag. Do you have any ideas on how we can unseal BQ40z696a? Thank you.

[@teknoy5417]

Hi, can you share where to download the files and how to add it on raspberry pi?

[@MoppelMat]

do you know if the SHA1key for the DJI FPV battery is the same?

[@thelongranger7574]

No. There is no sha auth there ))

[@daniele89810]

@@thelongranger7574 so it can be done for the FPV? Where can I find more info?

[@azamjahangir3071]

Why we use raspberry pi pico in this project

[@edgeofdenialdeephouseradio8886]

what code you send to smb after unseal? 00 to hex 0024 and 00 to hex 0029 ? couse i cant get rid of the PF after rescan and sealing

[@minycinflight2419]

can i use cp2112 adapter run on windows as an alternative to Raspberry Pi?

[@Killertoaster3000]

i want to know too

[@DonnerGott1982]

exactly what i was looking for, thanks a lot.

[@teknoy5417]

I completed the procedure for my mavic pro battery but still not charging. Only 1 green light blinking for a couple of times.

[@Juniorbahia]

Can i do this with CP 2112 module?

[@RotorWorks]

Will this work with dji ronin MX batteries that are prone to PF fails?

[@charlieandrews976]

I am trying to fix a Spark battery - I have followed your instructions and I get exactly the same results as in your video until I go to Unseal - every time I try, the battery remains sealed - any help you can give would be very much appreciated. Thanks for a great video and for any help you can give

[@mefistotelis]

The firmware for BQ9003 is modified by DJI, it is not stock from TI. The modification includes introduction of PFF2 - another flag acting as Permanent Fail mark. ATM clearing this is not implemented in my tool.

[@charlieandrews976]

@@mefistotelis Thanks for the reply - I solved my problem with DJI Repair Tool and now all my Spark batteries are fully functional again. Does your tool work with Phantom 4 Pro batteries ?

[@johnfernando5157]

@@charlieandrews976 did u open the case and charge more than 3v first before using this method ?

[@charlieandrews976]

#John Fernando No, I did not have to open case but did have to provide 11.4V to Spark battery power pins to get the battery management system chip powered.

[@johnfernando5157]

@@charlieandrews976 I use imax b6ac and do the same thing but it always fails, may I know what charger you are using?

[@leonardovieiradesouzajunio1292]

Hello Sir. I´m having problems to access the Mavic Air 1 batteries. I have four batteries and only one is Ok (fully usual and flying). The other three are dead and I provided charge to them using a external font (directly in cells terminals). I´m using your Raspberry Pi project but the communication occurs only with the good battery. The connections for data, clock and GND are collected directly in the batteries terminal (not in the board points) Do you have any idea to help me? Thanks. Leonardo

No i2c detected?? Try pushing the battery power button a couple of times or turning on the battery I didn’t get anything in the first row 00: but once I did that it appeared :)

[@drorhaz]

Didnt work. Cant detect the i2c no metter what i do.

[@hejunlong]

Will this work on a Mavic 2 Battery? Also by any chance anyone know the unseal key for a Mavic 2 Battery? Thanks heaps

[@gottisttot9]

I Need too

[@skylurkerph]

hi mefistotelis! i came across your github schematics of a lot of dji drones and you are so impressive! i need to consult you something on values of some resistors in air2s if you have one. i dont know how i can contact you to show some reference i have. hope you find this message soon. thank you

[@mefistotelis]

You can contact me on dji-rev.com. There are also emails in the git commits from Github.

[@rogiervdheide]

Can you not connect data and clock via the battery connector itself, like how the drone connects? Without the drilling?

[@mefistotelis]

I'm sure the MSP430 has a BMS relay command, but I never cared to look at it. I actually prefer when such re-enabled batteries have a mark of tampering - I mostly buy them used. But you can extract the uC firmware from update package using the tools, and analyze it.

[@teknoy5417]

How to clear PF using adruino on my mavic pro battery?

[@willalexbombraga7807]

Good afternoon, I'm a fan of drones, but buying a new battery is very expensive, I know that the ev2300 needs a very expensive program to unlock, you could teach me how to unlock the Mavic Air 1. Thank you very much Mefistotelis.

[@arthurwilliams3479]

Hi can I ask for your help in doing this same hack to a DJI Ronin 1 battery? I'll pay for your time

[@maurodrone793]

Ola vc sabe se iste procedimento le todos os modelos de bateria da DJI

[@tooniis1403]

Does it have to be resealed in the end or can it be left unsealed?

[@cesaralcaide62]

An innocent question, sorry if it is obvious and does not make sense: the pins at the ends of the main battery connector, 10 pins, are not the ones the drone and the charger use to communicate?, and those would not work for I2c SDA and SCL instead of the ones you get with pins? Thank you

[@mefistotelis]

DJI always wanted to have their own "features" - and therefore communication messages - added to batteries. In newer ones, they manged to modify TIs firmware to do that, so they did accepted I2C (SMBus) as the battery protocol available on connectors. But for older drones - like this Mavic or the Phantoms - DJI had no ability to modify BMS firmware, so they've added extra uC. In these drones there's UART at the connector, and it talks to uC which when necessary communicates to BMS.

[@cesaralcaide62]

I don't understand you well, sorry. So the communication between the battery and (drone + charger), through those two wires on the extreme sides of the connector, have a different protocol incompatible with I2c? Thanks for answering

[@cesaralcaide62]

www.mouser.com/datasheet/2/405/sluu516-96312.pdf - I found this information, but it seems that something is missing, the specific PCB does not appear, and the schematic at least lacks test points.

[@mefistotelis]

Shouldn't be hard to check on the web whether UART and I2C is the same thing. Charger is just a constant voltage power supply, no communication capabilities.

[@cesaralcaide62]

ok, thanks@@mefistotelis

[@nikivan]

I've got to the point where 'i2cdetect -y 1' command executes successfully, but I am getting hundreds of devices listed, from 03 to 77 all are listed. In your case, only two devices were listed. So, how do I find the correct one? Any hints?

[@nikivan]

This has been resolved. The reason was a bad I2C connection. The needle method didn't work for me and I was only able to connect to the battery interface after soldering the wires. Two batteries were revived and working well. I am getting about 20 min flight time with each. Thanks for posting the detailed instructions.

[@drorhaz]

In my case no detection in -y 1 but there is detection in -Y 2 I DONT UNDERSTAND WHY?????

[@DrNasirHayat]

You save my day! great video

[@stephenkurilla5210]

how do you modify the tool to add a bq34z100 chip?

[@zakey9662]

Respect!

[@emtecict5593]

can this tool unlock bq30z55 without known SHA-1 key?

[@flinkiklug6666]

Hello, amazing video, I will try to remove the error from my battery. If it will work I would like to make a video about it in German. That would be grade

[@massimilianogilli1164]

Can it fix not charging battery with LED1 blinking?

[@teknoy5417]

Did you solved yours?

[@massimilianogilli1164]

@@teknoy5417 No i had to give up first because it didnt work at all for me, second because i've read that this "recovered" battery can drop dead immediately making the mavic fall

[@agusbahagia5122]

Hello, I hv a friend crack opened my MP1 batt, disconnected the pack, charged to 11v and reconnect it coz in other YT video said it may works. Well it didn’t. Then I bought a Pi-4b and followed this procedure to clear the PF flag and did it successfully (many thanks to @mefistotelis) but my battery is still dead. I sill have flags as follows: At MA.OperationStatus: FVS, XCHG, XDCG At MA.ChargingStatus: MV, STH At MA.Gauging.Status: LDMD, QEN, VOK, RU, DSG, RESTDO At MA.ManufacturingStatus: PF, FET, GAUGE Any idea what to do next?

[@teknoy5417]

Did you manage to solve your issue?

[@agusbahagia5122]

@@teknoy5417 No, sorry… Sold the Pi4B in a good price then I sent the battery for repair at non official service.

[@michalaron4784]

Hello, how to run this script when not have Raspbery Pi?

[@flinkiklug6666]

I don't get it running, I have also a Pi but some linkt on Github did not work, now I have a problem, could someone help me?

[@ghost-nq6px]

is there a way to do this with an arduino? it has sdl and sda pins

[@Syclone0044]

KZbin “CircuitSchools” just did a video on this with Arduino Nano for Mavic Air 1 batteries

[@teknoy5417]

@@Syclone0044 I saw that video but I am not sure where to get code for Mavic Pro using Adruino

[@drorhaz]

Success !!!!! Phantom 4 pro battery.

[@teknoy5417]

Hi, can you share where to download files and how to use it on raspberry pi?

[@daniele89810]

Can this be done for a DJI FPV?

[@josuedanielmartinezsanchez4540]

could it work for laptop batteries? Thanks in advance

[@voodoo2110]

Hello, I am applying Unseal command, but SEC=3 still.. Someone allready wrote "BQ40z307 Unseal do not work"

[@SzyxYank]

yes, mee to, i dont know why, mavic mini 1 battery

[@voodoo2110]

@@SzyxYank there is free windows application named "dji battery killer". App allows to unseal, reset errors and lot of modifications.. App connects to battery via hid USB to i2c bridge (cp2112)

[@SzyxYank]

@@voodoo2110 ohh thank you for reply, I have problem with authentication, I am replaced cells, and now i have error AUTH_ONGOING, in battery killer I dont see that option

[@voodoo2110]

@@SzyxYank I have also replaced cells in mini-1 battery and faced with problem: battery is not charging, but it was possible to power on drone, with error message. I've sent battery eeprom backup to one guy, he changed something and now battery works fine. Unfortunately I don't know what exactly he changed in my eeprom backup..

[@SzyxYank]

@@voodoo2110 the same, in dji app is 30074 error,

[@derbrandy6536]

Hi, I'm trying to get a battery from the DJI Ronin running again with your video. It is the same chip installed. unfortunately I get an error message when reading the chip. Can you help me please? I don't know what to do anymore. The batteries can no longer be bought and I would not like to throw the part away. Thanks a lot.

[@hansgruber4123]

+1

[@mefistotelis]

Some DJI batteries try to short the SMBus comm when it's not used. Sometimes you can manipulate the battery so it stops the pull up - pressing button, connecting to charger etc. If not - some people just sewer connection on the SMBus paths, and later solder over the discontinuity when they're done.

[@jakevinas9209]

what about if you have only arduino uno

[@skysurfhf]

@mefistotelis Where is the code from unlock cell withe raspberry pi ? This also work for laptops battery's? Thanks 👍 ⭐

[@mjyanimations1062]

Is this possible with an arduino?

[@tomaszlis993]

You would have to seriously refactor the code to make it work with minipython. Probably would be easier to program the Arduino as SMBus relay and use it from PC.

[@Syclone0044]

@@tomaszlis993 CircuitSchools just did one with Arduino for Mavic Air 1. Python Software on their website and KZbin channel. Uses Arduino Nano, very cheap like $10.

[@marbasfpv4639]

Too bad no one has made a video about reviving the DJI FPV batteries.

[@nurcahyono7581]

Does the chip code apply to the bq30z55 phantom 3 series, because the chip is the same, it doesn't mean the password is the same, is it possible to see the bq30z55 password for the phantom 3 series?

[@adellsady2164]

Can you help me please

[@carloshernanibroker]

👏👏👏

[@adellsady2164]

Woow do you know I search every thing how to hack micro chip program

[@BFTL]

risky drilling🥶🥶😅

[@rafal3035]

witam prosze o kontakt

[@YT-ls5cq]

👍

[@adellsady2164]

How to hack unlock 1n36h chip program

[@Oiii615]

Can anyone tell me what is the point of doing this? I don't know anything and baffled. I am not a geek either? Be gentle with me.

[@Syclone0044]

DJI drone batteries self destruct when stored too long, like 1yr+. This tool allows resetting the self destruct, bringing battery back from the dead.

[@irishguy200007]

What the hell is this about?

[@jackevans2386]

@ mefistotelis - There's a much easier way using EV2300 or EV2400 and TI's FREE Battery Management Studio software. SDA and SCK are available on the battery connector. No need to drill. Why are you drilling ? Sheesh ! All you need is the original DJI 'Unseal' and 'Unseal_Full_Access' Keys. Let me know when you're ready to test and I'll give them to you. You helped me once with info on hacking a Phanton 3 Pro. I've just recently hacked the keys for the BQ9003 DJI modded chip. In BM Studio I use the BQ40z50 target. The target may not be perfect but does everything I need it to do. ie Unseal, Unseal Full Access, Save firmware, Load Firmware, Save new Keys to battery etc etc.

[@mefistotelis]

Sure, feel free to share the 2-word keys DJI uses with BQ9003. The python tool does allow to provide them via command line (default are 0xffffffff,0x36720414). Also, share which drone that is - in newer chips DJI introduced PFF2 which is not cleared by the TI "clear PF" command, it's surprising you didn't encountered that.

[@jackevans2386]

@@mefistotelis "The python tool does allow to provide them via command line" I thought I'd discovered something new. If you already have the DJI original keys, then no need to post them here. I'm working with Mavic 2 Pro batteries only. I also use dji Battery Killer software which does handle both PF and PF2. What one can't handle the other usually can. Edit: I'm familiar with TI's (default 0xffffffff,0x36720414) keys , but I'm referring to DJI's keys. So your python tool displays these then ?

[@SzyxYank]

@@jackevans2386 ​ @mefistotelis thank you friends, it is possible to set AUTH=0, currently is AUTH-ONGOING, and charging disablet, how to repair this?

[@josephtruncale]

@Jack Evans, did you ever share the unseal keys for the BQ9003? I'm assuming thats the same chip for the Spark and I'm having trouble unsealing it.

[@krisjehaes276]

@@SzyxYank Did you manage to solve this? I have the same issue on a DJI AIR1 battery.... THANKS: Reading simple command at addr=0xb, cmd=0x54, type=uint32_blk, opts={'subcmd': None} Raw OperationStatus response: 04 06 02 04 00 86 OperationStatus: 0x00040206 bitfields Operational Status bits [ ResU=0][ ResT=0][EMSHT=0][ CB=0][SLPCC=0][SLPAD=0][SLCAL=0][ INIT=0] [SLEPM=0][ XL=0][CALOO=0][CALOC=0][ACALM=0][ AUTH=1][ LED=0][ SDM=0] [SLEEP=0][ XCHG=0][ XDSG=0][ PF=0][ SS=0][SDV=0][ SEC=2][ BTPI=0][SMOTH=0][ FUSE=0][ Res4=0][ PCHG=0][CHG=1][DSG=1][ PRES=0]

[@zxEvAxz]

hi how can i contact you?

[@mefistotelis]

Not a good sign if you didn't even read description.

[@VOLTS-tc3bz]

I2cdetect sees 0b but is not able to communicate... ./comm_sbs_bqctrl.py -v --dev_address 0x0b read BatteryStatus Opening smbus:1 Error: No module named 'smbus2' Traceback (most recent call last): File "/home/kivialune/dji/./comm_sbs_bqctrl.py", line 7182, in main() File "/home/kivialune/dji/./comm_sbs_bqctrl.py", line 7153, in main smbus_open(po.bus, po) File "/home/kivialune/dji/./comm_sbs_bqctrl.py", line 5536, in smbus_open import smbus2 ModuleNotFoundError: No module named 'smbus2'

[@drorhaz]

Same here i cant know how to detect the correct i2c address and how to enter it to the code line for detection??

[@Syclone0044]

“pip install smbus2”

[@arva1kes]

It seems it does not work with spark batteries. It won't autodetect chip, but if I set it to eithe SBS or BQ40z307 it will communicate just fine. It does not show any error on unsealing , but it remains on level 3 (sealed). Using orangepi and i2c. Raw ManufacturerAccess.OperationStatus response: 04 80 73 00 00 bf

[@AnandakrishnaSudhakaran]

Does this work with pico zero w ?

[@TerryDeSimone]

?

[@AnandakrishnaSudhakaran]

@@TerryDeSimone can i use this code on pico zero w board?