Hello,

I tried to get a bit further with the Makita stuff. I thought I replied last week but most likely forgot to push the add reply button.

From what I found that only 4 pads are connected; 3 signals are interesting, I investigated a Chinese BMS board, that has as little as needed connections 😉

If you look in the "open" side of the yellow connector, the numbers are:

1, 2, 3, 4, 5, 6, 7

D1 = pin 2 

D3 = pin 4

D4= pin 6

Pin 7 = GND?

Below is a snapshot from a "logic" analyzer:

After the yellow marking, the charger stops charging and reports a fault by blinking red/green.

Because this is analysed with the cheap Chinese BMS, I'm going to open a working Makita battery and probe these three pins again. See what is happening there..

Posted by: @marvin-1989

I investigated a Chinese BMS board, that has

Because this is analysed with the cheap Chinese BMS, I'm going to open a working Makita battery and probe these three pins again. See what is happening there..

Hi Marvin,

Can you please specify which chinese BMS pcb were you referring to here? The smaller one or the larger one? Many thanks

Hi, can you inform back which IC is used for the Balancer in this Makita Battery? Is the the ML 5203? 

@azzido firmware (hex) of this chip MC908JK3E send me pls and Mc908jk3e data pin connection, can you tell me which dara pin number

@berk_2 

What do you want to do with the firmware ?

Do you have hacking skils ?

MC908JK3E I'm just trying to read the data inside

I've also tried but no success to get link with NLBA1 device, see my previous posts

sorry that i'm late to the party 

@Marvin can you share the data capture file please. would like to see whats the data is in the spikes and maybe fake it.
and did you read any other channels?

i just got 2 batteries that my brother want me to fix 🙁

 Guys fixing Makita batteries is just wasting of time. There is no solution to unlock genuine bms. The only workaround is to replace whole bms for chinese replica but its quality is not the best. 

I absolutely agree.

Chinese Makita BMS with individual cells voltage monitoring costs 5-6 EUR on Aliexpress.

Fits perfectly in the genuine case and does the job.

It's not worth the time and effort trying to hack one of the most secure chips on the market used in genuine Makita packs.

As I have the version with NEC/Renesas 78K0 MCU, I would be interested in reading the firmware binary of that.

https://lv.mouser.com/datasheet/2/698/REN_r01uh0008ej0401_78k0kx2_MAH_20100715-2931144.pdf
Checked the datasheet and it does not document any way to read out the flash memory contents.

But for some earlier NEC MCU D78F083xY someone found a vulnerability to read out flash contents.
Has anyone tested whether this flash vulnerability is present in F0513 ?

https://gist.github.com/mnaberez/ea3c3feb3a1619393b997bfb5e7de35f

Posted by: @zii

As I have the version with NEC/Renesas 78K0 MCU, I would be interested in reading the firmware binary of that.

https://lv.mouser.com/datasheet/2/698/REN_r01uh0008ej0401_78k0kx2_MAH_20100715-2931144.pdf
Checked the datasheet and it does not document any way to read out the flash memory contents.

But for some earlier NEC MCU D78F083xY someone found a vulnerability to read out flash contents.
Has anyone tested whether this flash vulnerability is present in F0513 ?

https://gist.github.com/mnaberez/ea3c3feb3a1619393b997bfb5e7de35f

Very nice article. I did not try it. If someone wants to try it I would appreciate it.

@djibattworkshop The problem is that quality; no monitoring, balancing. Just a simple thermal fuse. 

If you replace that dead cells, and place this Chinese board, the cells will be dead in a short time.

Therefore, I wanted to design my own board, using the advantages of the simple Chinese board and add a 5S BMS chip like TI's of something..

I read the firmware a few years ago, but that is as far as i got. 
https://martinjansson.netlify.app/posts/makita-battery-post

You could try to read firmware from good battery and then to write it on faulty one which is locked for charging.

This method sometimes used to fix laptop batteries controllers when pack maker applied custom not documented chips.