SLUUA65E april 2014 – june 2023 BQ28Z610
Changing the security keys requires using the change MAC command; the code to unseal the device can be sent to 0x3E, 0x3F. The order of the data is in Little Endian. To change the keys, the write operations must be sent through AltManufacturerAccess() 0x3E, 0x3F with the SecurityKey() followed by the key information. Each parameter entry must be sent in Little Endian. The 0x3E write block should end after the "0xCD". The checksum and length are a second command starting at 0x60.
Example:
Changing the Unseal key to 0x0123, 0x4567 and the Full Access key to 0x89AB, 0xCDEF:
Write block: command = 0x3E, block = 0x35 + 0x00 + 0x23 + 0x01 + 0x67 + 0x45 + 0xAB + 0x89 + 0xEF + 0xCD + 1 byte for checksum + 1 byte for data length. Note: The checksum and length are a second command starting at 0x60.
Starting address 0x3E, data block (hex) is [35 00 23 01 67 45 ab 89 EF CD], then starting address 0x60, data block (hex) is [0A 0C] (checksum followed by length) Checksum = 0x0A = ~(0x35 + 0x00 + 0x23 + 0x01 + 0x67 + 0x45 + 0xAB + 0x89 + 0xEF + 0xCD). The final checksum is the bitwise inversion of the result.
Byte0: Unseal Key LSB
Byte1: Unseal Key MSB
Byte2: Full Access Key LSB
Byte3: Full Access Key MSB
For this activity, the 2nd key must be sent within 4 s of sending the first key; otherwise, the request will not be accepted.