Thread | Brutkey

1.3.6.1.4.1.61513
@xssfox@cloudisland.nz

So DCS (deep cell systems) sells Lithium batteries that are basically a drop in replacement for lead acids. They are really good and have built in BMS system.

Because they have a BMS, the BMS already knows all the details you'd want about your battery. These are exposed via bluetooth so don't need an external battery monitor to see battery state.

Screenshot of DCS website showing a 12v 110Ah lithium battery for sale.

screenshot of the android app showing the BMS state like voltage, current, and percentage.

1.3.6.1.4.1.61513
@xssfox@cloudisland.nz

Bluetooth is done over BLE and no auth or pairing is done.

There is a little hamburger menu for some reason opens up an text input for "password".

Without knowing the password. It would be impossible to go any further.

android screenshot showing input password box.

1.3.6.1.4.1.61513
@xssfox@cloudisland.nz

after starting from 0, I worked my way up. 1, 2, 3,... 9998, 9999. Jackpot.

I kid, I just used apk2gold to decompile the app and searched for "password".

Two passwords exist. 9999 and 736263.

Screenshot of decompiled code showing the two passcodes in plain.

1.3.6.1.4.1.61513
@xssfox@cloudisland.nz

The 736263 passcode seems to allow setting the device name.

9999 is more scary and seems to set a lot of the BMS parameters. I'm not sure if these are sanity checked by the BMS but I don't think it would be hard to put the BMS into an unsafe state with this control.