diff --git a/Security/README.md b/Security/README.md index 3f1d6dc..50a1055 100644 --- a/Security/README.md +++ b/Security/README.md @@ -25,6 +25,7 @@ Sniffing the SMBus when Reading the **OperationStatus(0x54)** register: refer to the [Calculating The CRC](../README.md#calculating-the-crc) section for more details. The register mapping: + The bits status **Red = 1**, **Green = 0** @@ -54,6 +55,7 @@ Then, the Word2 is sent after Word1 (0x3672) Once we send the command, We notice that the SS bit **SS=0** which means that the BMS is unsealed **(Fortunately the manufacturer used the default sealing keys from TI)** Now, we send the full access command according to (page 20). + The Word1 is sent first (0xffff) @@ -74,4 +76,4 @@ Once we send the command, We notice that the FAS bit **FAS=0** which means that # Useful Resources * [Quick-Start Guide for bq20zxx Family Gas Gauges](https://www.ti.com/lit/an/slua421a/slua421a.pdf). This file contains all the procedures for sealing and unsealing the BMS. * [bq20z70-V160 + bq29330, bq20z75 TRM](https://www.ti.com/lit/pdf/sluu310). -* [bq20z70-V160 + bq29330, bq20z75 Technical Reference Manual](https://www.ti.com/lit/er/sluu265a/sluu265a.pdf). \ No newline at end of file +* [bq20z70-V160 + bq29330, bq20z75 Technical Reference Manual](https://www.ti.com/lit/er/sluu265a/sluu265a.pdf).