Notifications
Clear all

Managed to unseal bq30z555 using NLBA on AL12B72 battery

Page 1 / 2
torture
(@torture)
Member Moderator

So the short story is that the chip is BQ30Z555 to be precise. It can be Unsealed and cleared PF with NLBA with no problems using 20zxx plugin. Dataflash can't be read with NLBA but it can be read and edited with BqEvsw with no problems. The interesting thing is that the BqEvsw menu for this chip doesn't look like the typical for 30zxx family, but it looks exactly the same like for 20zxx family. Maybe they share the same core just like some other BQ chips.

20210622 174143
Untitled 5
Quote
Topic starter Posted : 22/06/2021 3:05 pm
torture
(@torture)
Member Moderator

After some more test it turns out than the chip is sealed with bq20zxx default password and FAS key. Very interesting.

 Untitled
ReplyQuote
Topic starter Posted : 22/06/2021 3:07 pm
DjiBattWorkshop
(@djibattworkshop)
Member Moderator

 Nice finding!

 Could you please recheck the core by running these commands

 WW 00 0001

 RBL 23

 WW 00 0002

 RBL 23

 

ReplyQuote
Posted : 22/06/2021 3:08 pm
torture
(@torture)
Member Moderator

Sealed

Untitled 4
ReplyQuote
Topic starter Posted : 22/06/2021 3:11 pm
torture
(@torture)
Member Moderator

Unsealed, FAS

Untitled 2
 Untitled 3
ReplyQuote
Topic starter Posted : 22/06/2021 3:12 pm
torture
(@torture)
Member Moderator

WW 00 0001
RBL 23 000000000012000A032201150000
WW 00 0002
RBL 23 000000000012000A032201150000

ReplyQuote
Topic starter Posted : 22/06/2021 3:14 pm
DjiBattWorkshop
(@djibattworkshop)
Member Moderator

hmm...

it looks this chip not support classic z55 Chip Detect API. Instead it uses bq20zXXX or universal bq30XXX methods.

Anyway on bqEVSW screenshots it was detected as bq30z555_v0.12 firmware.

 

ReplyQuote
Posted : 22/06/2021 3:22 pm
torture
(@torture)
Member Moderator

So i was searching trought my other batteries and i found another acer model AL12A72 again with BQ30Z555  FW v0.12  and same strory here. Can be unsealed & clear PF. And again standart 20zxx password & FAS key.

Untitled
Untitled 2
Untitled 3
 Untitled 5
ReplyQuote
Topic starter Posted : 22/06/2021 4:12 pm
torture
(@torture)
Member Moderator

BqEvsw 

 Bqevsw
ReplyQuote
Topic starter Posted : 22/06/2021 4:14 pm
torture
(@torture)
Member Moderator

Upon rechecking with BQEvsw sbs screens theoretically BQ30Z555 with FW from 0.01 to 0.14 can be unsealed and reset using this method.

ReplyQuote
Topic starter Posted : 22/06/2021 4:35 pm
DjiBattWorkshop
(@djibattworkshop)
Member Moderator

You could try to change password to something different than default, then seal the chip and retry to unseal with Nlba again.

for example

WBL 60 11335522

WBL 61 33778899

WW 00 0020

Because some battery packs could have unique keys set on the factory.

If this check will pass Ok feel free to send Pull Request to developers to add this chip in supported list.

 

ReplyQuote
Posted : 22/06/2021 10:22 pm
torture
(@torture)
Member Moderator

So it can also be unsealed if the password is non standart.

Untitled
 Untitled 2
ReplyQuote
Topic starter Posted : 23/06/2021 5:39 am
torture
(@torture)
Member Moderator

Another example.

 Untitled
ReplyQuote
Topic starter Posted : 23/06/2021 5:44 am
Nicusor
(@azzido)
Member Admin

@torture

It seems that BQ30z555 is supported by our BQ20zxxx unseal method. This is Great.

@djibattworkshop

We can add this chip in our support list. I can't believe there are so many differences between bq30z555 and bq30z55 🙂

Is your Viber still offline ?

NLBA Laptop Battery Analyzer with Chip Reset & Repair Option

ReplyQuote
Posted : 23/06/2021 11:40 am
Avinesh
(@avinesh)
New Member

@azzido Hi Can you add BQ30Z55 please 

ReplyQuote
Posted : 25/06/2021 6:08 am
Page 1 / 2
Share: