Talking To Laptop Batteries With The ESP8266

May 28, 2018 by Tom Nardi 20 Comments

It’s not something you often give a lot of thought to, but the modern consumer laptop battery is a pretty advanced piece of technology. Not only does it pack several dozen watt-hours of energy into a relatively small and lightweight package, but it features integrated diagnostic capability to make sure all those temperamental lithium cells are kept in check. Widely available and extremely cheap thanks to the economies of scale (unless you try to get them from the OEM, anyway), they’re a very compelling option for powering your projects.

Of course, it also helps if, like [teliot] you have a bunch of the things lying around. For reasons we won’t get into, he’s got a whole mess of Acer AL12x32 battery packs which he wanted to use for something other than collecting dust. He had the idea of hooking one up to a solar panel and using it as a power supply for some ESP8266 projects but wanted to be able to talk to the battery for status and diagnostic information. After studying the Smart Battery System (SBS) protocol the batteries use, he was able to come up with some code that lets him pull 37 separate fields of information from the pack’s onboard electronics using his ESP8266.

It took some fiddling with a multimeter to figure out which pin did what on the eight pin interface of the battery. Two of the pins need to be shorted to enable the dual 12 VDC pins to kick in. Technically that’s all you really need to do if you want to utilize the battery in a low-tech sort of way. But to actually get some information from the battery, [teliot] had to identify the two pins which are for the System Management Bus (SMBus) interface where the SBS data lives.

Once he knew which pins to talk to the battery on, the rest was fairly easy. SBS is well documented, and the SMBus interface is very similar to I2C. Like all the cool kids are doing these days, his code publishes the battery info to MQTT where he can plot it and get finely grained info on the performance of his solar power system.

This isn’t the first time we’ve seen a hacker wrangle laptop batteries through SMBus, but it’s always nice to get multiple perspectives on a topic. If you plan on making this kind of thing part of your standard bag of tricks, you might even want to take the time to build a dedicated SMBus scanner.

[via /r/esp8266]

Unlocking Thinkpad Batteries

February 11, 2016 by Brian Benchoff 66 Comments

A few months ago, [Matt] realized he needed another battery for his Thinkpad X230T. The original battery would barely last 10 minutes, and he wanted a battery that would last an entire plane flight. When his new battery arrived, he installed it only to find a disturbing message displayed during startup: “The system does not support batteries that are not genuine Lenovo-made or authorized.” The battery was chipped, and now [Matt] had to figure out a way around this.

Most recent laptop batteries have an integrated controller that implements the Smart Battery Specification (SBS) over the SMBus, an I2C-like protocol with data and clock pins right on the battery connector. After connecting a USBee logic analyser to the relevant pins, [Matt] found the battery didn’t report itself correctly to the Thinkpad’s battery controller.

With the problem clearly defined, [Matt] had a few options open to him. The first was opening both batteries, and replacing the cells in the old (genuine) battery with the cells in the newer (not genuine) battery. If you’ve ever taken apart a laptop battery, you’ll know this is the worst choice. There are fiddly bits of plastic and glue, and if you’re lucky enough to get the battery apart in a reasonably clean matter, you’re not going to get it back together again. The second option was modifying the firmware on the non-genuine battery. [Charlie Miller] has done a bit of research on this, but none of the standard SBS commands would work on the non-genuine battery, meaning [Matt] would need to take the battery apart to see what’s inside. The third option is an embedded controller that taps into the SMBus on the charger connector, but according to [Matt], adding extra electronics to a laptop isn’t ideal. The last option is modifying the Thinkpad’s embedded controller firmware. This last option is the one he went with.

There’s an exceptionally large community dedicated to Thinkpad firmware hacks, reverse engineering, and generally turning Thinkpads into the best machines they can be. With the schematics for his laptop in hand, [Matt] found the embedded controller responsible for battery charging, and after taking a few educated guesses had some success. He ran into problems, though, when he discovered some strangely encrypted code in the software image. A few Russian developers had run into the same problem, and by wiring up a JTAG to the embedded controller chip, this dev had a fully decrypted Flash image of whatever was on this chip.

[Matt]’s next steps are taking the encrypted image and building new firmware for the embedded controller that will allow him to charge is off-brand, and probably every other battery on the planet. As far as interesting mods go, this is right at the top, soon to be overshadowed by a few dozen comments complaining about DRM in batteries.