OBI
BUCHAR

🔋 BUCHARƯv MAKITA BMS UNLOCKER (OBI)

Vyvinuto pro komunitu nadơencƯ do náƙadí a elektroniky Built for the tool & electronics enthusiast community
UltimĂĄtnĂ­ nĂĄpověda pro ĂșplnĂ©ho laika · diagnostika a odemykĂĄnĂ­ bateriĂ­ Makita LXT pƙes ESP32 · makita.znouze.eu The ultimate guide for absolute beginners · Makita LXT battery diagnostics & unlocking via ESP32 · makita.znouze.eu

🔎 Co to je a co to umí🔎 What it is and what it does

BUCHARĆŻv MAKITA BMS UNLOCKER (OBI) je malĂ© zaƙízenĂ­ postavenĂ© na čipu ESP32, kterĂ© se pƙipojĂ­ na datovĂ© kontakty baterie Makita LXT (18V / 14,4V) a pƙečte z jejĂ­ vnitƙnĂ­ elektroniky (BMS) diagnostickĂĄ data. Ta ti pak ukĂĄĆŸe na webovĂ© strĂĄnce v prohlĂ­ĆŸeči — v počítači i v mobilu.

UmĂ­ pƙečíst: napětĂ­ jednotlivĂœch člĂĄnkĆŻ, celkovĂ© napětĂ­ paketu, teploty, počet nabĂ­jecĂ­ch cyklĆŻ, odhad stavu nabitĂ­, chybovĂ© a ochrannĂ© kĂłdy, stav zĂĄmku a zdravĂ­ baterie. U starĆĄĂ­ch „zamčenĂœch“ bateriĂ­ (nabĂ­ječka je odmĂ­tĂĄ nabĂ­jet) umĂ­ bezpečně opravit vnitƙnĂ­ stav a odemknout je.

Pro koho to je: pro kutily, kteƙí chtějĂ­ zachrĂĄnit „mrtvĂ©â€œ Makita baterie (často stačí vyměnit 1–2 člĂĄnky a odemknout), diagnostikovat opotƙebenĂ­ nebo si jen prohlĂ©dnout, co baterie o sobě vĂ­.

BUCHAR's MAKITA BMS UNLOCKER (OBI) is a small ESP32-based device that connects to the data contacts of a Makita LXT battery (18V / 14.4V) and reads diagnostic data from its internal electronics (BMS). It then shows the data in a web page in your browser — on a computer or phone.

It reads: individual cell voltages, total pack voltage, temperatures, charge cycle count, estimated state of charge, error and protection codes, lock state and battery health. On older “locked” batteries (the charger refuses to charge them) it can safely repair the internal state and unlock them.

Who it's for: hobbyists who want to save “dead” Makita batteries (often you just replace 1–2 cells and unlock), diagnose wear, or simply inspect what the battery knows about itself.

⚠ Bezpečnost — čti jako prvnĂ­âš ïž Safety — read this first

LithiovĂ© baterie jsou nebezpečnĂ©. Zkrat, propĂ­chnutĂ­ nebo pƙebitĂ­ mĆŻĆŸe zpĆŻsobit poĆŸĂĄr nebo vĂœbuch. Nikdy nezkratuj kontakty, nepracuj s poĆĄkozenĂœmi/nafouklĂœmi člĂĄnky a měƙ opatrně.
  • ZĂĄpisy do baterie (odemknutĂ­, zĂĄmek) upravujĂ­ jejĂ­ paměƄ. Jsou vratnĂ©, ale opotƙebovĂĄvajĂ­ paměƄ — nedělej je zbytečně často.
  • PrvnĂ­ ostrĂœ test dělej na baterii, o kterou nepƙijdeĆĄ — sekvence pro zĂĄpis pochĂĄzĂ­ z reverznĂ­ho inĆŸenĂœrstvĂ­.
  • Na vzĂĄcnĂœch revizĂ­ch desky nemusĂ­ jĂ­t odemknout zpět. NĂĄstroj to nezakrĂœvĂĄ — nesliuje 100% Ășspěơnost.
  • Desky s čipem MC908JK3E nemajĂ­ ochranu člĂĄnkĆŻ — i kdyby ĆĄly odemknout, pouĆŸĂ­vat by se neměly.
  • GND (zem) ESP32 musĂ­ bĂœt spojenĂĄ se zĂĄpornĂœm pĂłlem baterie, jinak komunikace nefunguje.
Lithium batteries are dangerous. A short circuit, puncture or overcharge can cause fire or explosion. Never short the contacts, don't work with damaged/swollen cells, and measure carefully.
  • Writes to the battery (unlock, lock) modify its memory. They are reversible but wear the memory — don't do them needlessly often.
  • Do your first real test on a battery you can afford to lose — the write sequence comes from reverse engineering.
  • On rare board revisions it may not be possible to unlock again. The tool doesn't hide this — it doesn't promise 100% success.
  • Boards with the MC908JK3E chip have no cell protection — even if they can be unlocked, they should not be used.
  • The ESP32 GND must be connected to the battery negative terminal, otherwise communication won't work.

🛒 Co koupit (kusovník)🛒 What to buy (bill of materials)

SoučástkaPart DetailDetail
MikrokontrolĂ©rMicrocontrollerESP32-C3 SuperMini (doporučeno, malĂœ)(recommended, tiny) neboor ESP32 DevKit / Mini
RezistoryResistors4× 4,7 kΩ (pull-up dat, aktivace tranzistoru)(data pull-up, transistor drive)
TranzistorTransistorNPN BC547 neboor N-MOSFET 2N7000 (pin ENABLE)(ENABLE pin)
KonektorConnector3D-tiĆĄtěnĂœ adaptĂ©r nebo plochĂ© svorky na kontakty baterie3D-printed adapter or flat clamps for the battery contacts
NapĂĄjenĂ­PowerUSB neboor 5V step-down z bateriefrom the battery
PoznĂĄmka: celkovĂĄ cena součástek je pĂĄr desĂ­tek korun. NejdraĆŸĆĄĂ­ je čas na sestavenĂ­ a odladěnĂ­.Note: the total parts cost is a couple of dollars. The most expensive part is the time to build and debug it.

🔌 Zapojení🔌 Wiring

SignĂĄlSignal ESP32 DevKit / Mini ESP32-C3 SuperMini PoznĂĄmkaNote
DATA (1-Wire)GPIO4GPIO3pull-up 4,7 kΩ na 3,3 V4.7 kΩ pull-up to 3.3 V
ENABLEGPIO5GPIO4bĂĄze NPN pƙes 4,7 kΩNPN base via 4.7 kΩ
GNDGNDGNDspojit se zĂĄpornĂœm pĂłlem baterie (B−)connect to battery negative (B−)
Piny se v kĂłdu neměnĂ­ — vybĂ­rajĂ­ se automaticky podle zvolenĂ©ho typu desky pƙi flashovĂĄnĂ­.The pins are not changed in code — they are selected automatically by the board type you choose when flashing.

⚡ Nahrání firmwaru (flashování)⚡ Uploading firmware (flashing)

NejjednoduĆĄĆĄĂ­ cesta: na makita.znouze.eu klikni na „NahrĂĄt firmware“, vyber typ desky a pƙipoj ESP32 pƙes USB. VĆĄe proběhne pƙímo v prohlĂ­ĆŸeči (Chrome nebo Edge na počítači).

Pokročilá cesta pƙes PlatformIO:

pio run -e esp32-c3-supermini
pio run -e esp32-c3-supermini -t uploadfs   # web rozhranĂ­
pio run -e esp32-c3-supermini -t upload -t monitor

Easiest way: on makita.znouze.eu click “Upload firmware”, pick your board type and connect the ESP32 via USB. Everything runs right in the browser (Chrome or Edge on a computer).

Advanced way via PlatformIO:

pio run -e esp32-c3-supermini
pio run -e esp32-c3-supermini -t uploadfs   # web interface
pio run -e esp32-c3-supermini -t upload -t monitor
FlashovĂĄnĂ­ z prohlĂ­ĆŸeče vyĆŸaduje HTTPS a prohlĂ­ĆŸeč Chrome/Edge na počítači. Firefox a Safari Web Serial nepodporujĂ­.Browser flashing requires HTTPS and Chrome/Edge on a computer. Firefox and Safari don't support Web Serial.

🌐 Pƙipojení k zaƙízení🌐 Connecting to the device

MĂĄĆĄ tƙi moĆŸnosti:

  1. Wi-Fi (makita.local): je-li ESP32 ve tvĂ© sĂ­ti, otevƙi http://makita.local — plnĂ© rozhranĂ­ s ĆŸivĂœmi grafy.
  2. AP reĆŸim: pƙipoj se na Wi-Fi sĂ­Ć„ MAKITA-OBI (heslo makita1234) a otevƙi http://192.168.4.1.
  3. ĆœivĂ© USB: na makita.znouze.eu klikni „Pƙipojit pƙes USB“ a čti data bez Wi-Fi.

You have three options:

  1. Wi-Fi (makita.local): if the ESP32 is on your network, open http://makita.local — full interface with live charts.
  2. AP mode: connect to the Wi-Fi network MAKITA-OBI (password makita1234) and open http://192.168.4.1.
  3. Live USB: on makita.znouze.eu click “Connect via USB” and read data without Wi-Fi.

📊 Čtení dat📊 Reading data

Po kliknutĂ­ na Skenovat proběhne trojitĂ© ověƙenĂ­ pƙítomnosti (proti „duchĆŻm“ — faleĆĄnĂ© detekci) a pƙečtou se statickĂĄ i dynamickĂĄ data:

  • StatickĂĄ: model, typ desky, ƙídicĂ­ čip, ROM ID, datum vĂœroby, kapacita, cykly, zĂĄmek, zdravĂ­ (0–4), čítače overdischarge/overload.
  • DynamickĂĄ: napětĂ­ paketu, napětĂ­ jednotlivĂœch člĂĄnkĆŻ, odhad SOC, teploty, rozptyl člĂĄnkĆŻ.
KdyĆŸ je rozptyl mezi člĂĄnky ≄ 0,30 V, nĂĄstroj upozornĂ­, ĆŸe jde spĂ­ĆĄ o prasklou/ulomenou balancovacĂ­ tabulku (fyzickĂĄ zĂĄvada) neĆŸ o degradaci člĂĄnku.

After clicking Scan, a triple presence check runs (against “ghosts” — false detection) and static and dynamic data are read:

  • Static: model, board type, controller chip, ROM ID, manufacture date, capacity, cycles, lock, health (0–4), overdischarge/overload counters.
  • Dynamic: pack voltage, individual cell voltages, SOC estimate, temperatures, cell spread.
When the spread between cells is ≄ 0.30 V, the tool warns that it's more likely a cracked/broken balance tab (a physical fault) than cell degradation.

🔓 OdemykĂĄnĂ­ zamčenĂ© baterie🔓 Unlocking a locked battery

NabĂ­ječka Makita reĂĄlně kontroluje jen tƙi věci: jeden „zĂĄmkovĂœâ€œ pĆŻlbajt (nybble 34) a dva kontrolnĂ­ součty (CS0 a CS2). OdemknutĂ­ tedy znamenĂĄ: vynulovat zĂĄmkovĂœ pĆŻlbajt, pƙepočítat součty a bezpečně zapsat zpět. Historie, cykly ani identita baterie se neměnĂ­.

  1. Klikni na Odemknout (aktivnĂ­ jen u zamčenĂ© baterie).
  2. NĂĄstroj pƙečte rĂĄmec, opravĂ­ jej, zapĂ­ĆĄe (chrĂĄněnĂœ zĂĄpis) a ověƙí.
  3. Na zĂĄvěr poĆĄle DA04 (vymazĂĄnĂ­ internĂ­ho chybovĂ©ho registru).
Po Ășspěchu zkus baterii vloĆŸit do nabĂ­ječky. Pokud se pƙedtĂ­m měnily člĂĄnky, nejdƙív ověƙ jejich napětĂ­ a sprĂĄvnĂ© poƙadĂ­.

The Makita charger really checks only three things: one “lock” nybble (nybble 34) and two checksums (CS0 and CS2). Unlocking therefore means: zero the lock nybble, recalculate the checksums and safely write it back. The battery's history, cycles and identity are left unchanged.

  1. Click Unlock (only active on a locked battery).
  2. The tool reads the frame, repairs it, writes it (protected write) and verifies.
  3. Finally it sends DA04 (clearing the internal error register).
On success, try inserting the battery into the charger. If cells were replaced first, verify their voltage and correct order beforehand.

🔒 ZĂĄměrnĂ© zamčenĂ­ (anti-theft)🔒 Deliberate lock (anti-theft)

ZrcadlovĂĄ funkce k odemknutĂ­: zapĂ­ĆĄe nenulovĂœ zĂĄmkovĂœ pĆŻlbajt s platnĂœmi součty, takĆŸe nabĂ­ječka baterii odmĂ­tne nabĂ­jet. PouĆŸĂ­vĂĄ stejnĂœ mechanismus jako odemknutĂ­, takĆŸe tvĆŻj vlastnĂ­ nĂĄstroj ji spolehlivě vrĂĄtĂ­ zpět. HodĂ­ se jako imobilizĂ©r proti krĂĄdeĆŸi.

VyĆŸaduje dvojĂ­ potvrzenĂ­. ZĂĄpisy opotƙebovĂĄvajĂ­ paměƄ BMS — nepouĆŸĂ­vej často/automatizovaně. Na vzĂĄcnĂœch revizĂ­ch desky nemusĂ­ jĂ­t odemknout zpět.

The mirror function of unlocking: it writes a non-zero lock nybble with valid checksums, so the charger refuses to charge the battery. It uses the same mechanism as unlocking, so your own tool reliably reverses it. Useful as an anti-theft immobilizer.

Requires double confirmation. Writes wear the BMS memory — don't use it often/automatically. On rare board revisions it may not be possible to unlock again.

đŸ’Ÿ Do jakĂ© paměti se to zapisuje?đŸ’Ÿ What memory does it write to?

Data (tzv. rĂĄmec) jsou uloĆŸena v internĂ­ flash/data-flash paměti pƙímo v mikrokontrolĂ©ru BMS — ne v samostatnĂ© vyměnitelnĂ© EEPROM. Napƙ. BL1830 mĂĄ čip MC68HC908JK3E se 4 KB internĂ­ zabezpečenĂ© FLASH (chrĂĄněnĂ© heslem).

PraktickĂœ dĆŻsledek: samostatnou EEPROM koupit a pƙepĂĄjet nejde. Co ale koupit lze (levně, AliExpress/eBay), jsou celĂ© nĂĄhradnĂ­ BMS desky — některĂ© „bez zĂĄmku“, pouĆŸitelnĂ© opakovaně.
ModelƘídicĂ­ čipController chipPaměƄMemory
BL1850B / BL1860BLIPW015 (STM32L051)internĂ­ data-flash MCUinternal MCU data-flash
BL1460ALIPW014 (STM32L051)internĂ­ data-flash MCUinternal MCU data-flash
BL1830 (starơíolder)MC68HC908JK3E4 KB interní zabezpečená FLASH4 KB internal secured FLASH

The data (the “frame”) is stored in the internal flash/data-flash of the BMS microcontroller itself — not in a separate replaceable EEPROM. For example, the BL1830 uses the MC68HC908JK3E chip with 4 KB of internal secured FLASH (password-protected).

Practical consequence: you can't buy and resolder a separate EEPROM. What you can buy (cheaply, AliExpress/eBay) are complete replacement BMS boards — some “without lock”, reusable many times.

🧬 F0513 — čtení a záloha🧬 F0513 — reading & backup

Baterie typu 5 (deska F0513 / Renesas RL78) majĂ­ vlastnĂ­ sadu čtecĂ­ch pƙíkazĆŻ. NĂĄstroj bezpečně pƙečte napětĂ­ člĂĄnkĆŻ a teplotu (jen čtenĂ­, ĆŸĂĄdnĂœ zĂĄpis).

Backdoor dump celĂ© paměti (pƙepnutĂ­ RL78 do UART reĆŸimu) je ve firmwaru kompilačně vypnutĂœ. PƙesnĂ© byty vstupnĂ­ sekvence nejsou ověƙenĂ© a poslat je naslepo mĆŻĆŸe baterii nevratně zablokovat. Zapni to teprve po ověƙenĂ­ z dĆŻvěryhodnĂ©ho zdroje — a i pak jen jako čtenĂ­.

Type 5 batteries (F0513 / Renesas RL78 board) have their own set of read commands. The tool safely reads cell voltages and temperature (read-only, no writing).

The full-memory backdoor dump (switching the RL78 into UART mode) is disabled at compile time in the firmware. The exact entry bytes are unverified, and sending them blindly can permanently brick the battery. Enable it only after verifying from a trustworthy source — and even then read-only.

📇 PodporovanĂ© modely a desky📇 Supported models and boards

Rodina / deskaFamily / board PƙíkladyExamples PoznámkaNote
STANDARD (0xF1, „new family“)BL1830B, BL1840B, BL1850B-D, BL1860B, BL1460Aplná podpora (čtení, diagnostika, odemykání)full support (read, diagnostics, unlock)
STANDARD (0x50, starĆĄĂ­older)BL1815N, BL1840 (bez Bno B)čtenĂ­; některĂĄ pole chybĂ­ (očekĂĄvanĂ©)read; some fields absent (expected)
F0513 (typ 5, RL78type 5, RL78)LIPW017 a pƙíbuznĂ©and relatedčtenĂ­ napětĂ­/teploty, read-onlyvoltage/temp read, read-only
NeznačkovĂ© / neznĂĄmĂ©Aftermarket / unknown—fallback reĆŸim — ukĂĄĆŸe, co jde pƙečístfallback mode — shows whatever can be read
40V XGT ƙada nenĂ­ podporovĂĄna (jinĂœ konektor a protokol). 36V (10 člĂĄnkĆŻ) je detekovĂĄno, ale čtenĂ­ napětĂ­ zatĂ­m nenĂ­ ověƙenĂ©.The 40V XGT series is not supported (different connector and protocol). 36V (10 cells) is detected, but voltage reading is not yet verified.

đŸ› ïž ƘeĆĄenĂ­ problĂ©mĆŻđŸ› ïž Troubleshooting

ProblémProblemƘeƥeníFix
Baterie neodpovĂ­dĂĄBattery not respondingZkontroluj GND na B−, pull-up 4,7 kΩ na DATA, sprĂĄvnĂœ pin dle typu desky.Check GND to B−, 4.7 kΩ pull-up on DATA, correct pin for the board type.
makita.local nefungujemakita.local doesn't workPouĆŸij IP z routeru, nebo AP reĆŸim (192.168.4.1).Use the IP from your router, or AP mode (192.168.4.1).
FlashovĂĄnĂ­ nejdeFlashing failsMusĂ­ bĂœt HTTPS a Chrome/Edge na PC. Zkontroluj USB kabel (datovĂœ, ne jen nabĂ­jecĂ­).Needs HTTPS and Chrome/Edge on PC. Check the USB cable (data, not charge-only).
Po odemčenĂ­ stĂĄle nenabĂ­jĂ­Still won't charge after unlockZkontroluj napětĂ­ a poƙadĂ­ člĂĄnkĆŻ; některĂ© revize nemajĂ­ znĂĄmou opravu.Check cell voltage and order; some revisions have no known fix.
Model nerozpoznĂĄnModel not recognizedFallback reĆŸim ukĂĄĆŸe syrovĂĄ data; mĆŻĆŸe jĂ­t o neznačkovou desku bez protokolu.Fallback mode shows raw data; may be an aftermarket board with no protocol.

📚 Slovníček📚 Glossary

BMSBattery Management System — elektronika v baterii, která hlídá články.Battery Management System — the electronics in the battery that watches the cells.
1-WireJednovodičovĂĄ sběrnice, po kterĂ© se komunikuje s BMS.Single-wire bus used to talk to the BMS.
RĂĄmecFrame32bajtovĂœ blok dat uloĆŸenĂœ v BMS (identita, zdravĂ­, zĂĄmek, součty).32-byte data block stored in the BMS (identity, health, lock, checksums).
NybblePĆŻlbajt (4 bity). ZĂĄmek baterie je jeden konkrĂ©tnĂ­ nybble (č. 34).Half a byte (4 bits). The battery lock is one specific nybble (no. 34).
SOC / SOHStav nabitĂ­ / stav zdravĂ­ baterie.State of Charge / State of Health.
mDNSUmoĆŸĆˆuje adresu makita.local mĂ­sto IP.Enables the makita.local address instead of an IP.

🔗 Zdroje a poděkování🔗 Sources & credits

Projekt stavĂ­ na veƙejnĂ©m reverznĂ­m inĆŸenĂœrstvĂ­ komunity. VlastnĂ­ implementace, inspirovĂĄno těmito projekty:

The project builds on the community's public reverse engineering. Original implementation, inspired by these projects:

Licence: reference urtziDV je nekomerčnĂ­ (CC BY-NC-SA). KĂłd tohoto projektu je vlastnĂ­ pƙepis, ale pƙi pƙípadnĂ© monetizaci se tĂ©to licenci vyhni.License: the urtziDV reference is non-commercial (CC BY-NC-SA). This project's code is an original rewrite, but avoid that license if you ever monetize.