BM2 Custom Firmware

[FREESCALE009]

A much better way is to upload a different firmware to the BM2 CC2541 module board -- https://github.com/FREESCALE009/bm2-cc2541

[adrianmihalko]

This sounds great. Can you upload an example to how to get data for example from Esphome?

[FREESCALE009]

updated the repository with a test esp32 code to receive the advertisements

[FREESCALE009]

updated the code to include a read out of the Accelerometer sensor. Yes, the battery monitor has an accelerometer to probably detect the engine movement - or to probably put the CC2541 in power saving mode if engine is not running.

[KrystianD]

Hard to say if this is a "much better way", as it involves dissembling the unit, requires having CC programmer, while all we (I?) need is to have voltage readings :) The only difference from the user perspective is lack of (damn) encryption, but other than that it does the same thing. With a possibility to extend the integration to fetch the history as well.

Apart from all above - great project @FREESCALE009!

[FREESCALE009]

It would better for example if the battery monitor would just simply advertise the voltage data instead of the app connecting to it. Would you be able to verify if the excess bytes from your decrypted voltage data is "accelerometer" data ? One thing to note that there is a motion sensor attached to the CC2541 chip (pins P0.5, P0.4, and P0.1) on the BM2 board. I think that one is used to detect engine RPM ?

[zonalimitatore]

No. I think it's used to detect when you're moving the car. From that, start the minutes counter,ecc...

[KrystianD]

@FREESCALE009 I don't have now access to the installed unit, but this is how it looks in the original Chinese code:

@zonalimitatore seems to be right, there is just some counter.

[FREESCALE009]

im now guessing the computation part is done on the bm2 side - that is voltage detection and vibration detection.

[zonalimitatore]

I wish the source of BM2, to understand where the programmer have been inserted the "lock" with another software. I've paid, to have an item, but without a full function.

[dezanche]

I like the idea of uploading a completely known firmware, not only to bypass the encryption (which thankfully has been solved), but also because not controlling the software you use on any device exposes you to all sorts of risks.
I bought a BM6 because of the lower current draw (2mA, confirmed by measurement) than the BM2 (I recall 20mA, but now I see as low as 1mA in some ads). This was before I knew the extent of the privacy breaches in the smartphone apps used to read the data from both sensors.
2 questions:

• what is the current draw of the BM2 with FREESCALE009's FW?
• has anyone opened the BM6 to see what chip it uses?