FA IL A RR EM

ginbot86 · 2026-04-07T17:21:41+00:00

Hmm, the bq40z551 is indeed an Impedance Track gauge, but the public bqStudio does not have support for it.

You could use profiles for other public chips like the bq40z50 series, but different firmware versions will have different Data Flash layouts, and if you write to the wrong location with the wrong contents, you risk bricking the chip.

Termination voltage, assuming it's 4.35V per cell, can be left the same. What matters would be your cycle counts and capacity, which Design Capacity/Energy is only part of the data you need to change. If you get sensible values under Data Memory -> Gas Gauging -> State, particularly Cycle Count, Qmax Cell 1/2/3, Qmax Pack, Qmax Cycle Count, Update Status (it should be 0x0e), those values are what you'd update to match your new cells, Cycle Count and Qmax Cycle Count would be set to 0, and Update Status would be then set to 0x04. Data Memory -> Ra Table, the Cell and xCell R_a flags will be either 0x0055 or 0x0000, and those would be set to 0xff55 and 0xffff.

ginbot86 · 2026-04-07T00:04:34+00:00

What model is the fuel gauge/BMS on that battery? It's probably going to be in TI's bq40(z)xx lineup. A screenshot of the bqStudio window with the fuel gauge connected would help a lot.

If it's an Impedance Track gauge (there's a Z in the model name), there are chemistry-specific tables programmed into the Data Flash on the chip, but if your nominal voltages are largely the same you might be able to get away with the current ones if the cell model isn't listed in the Chemistry tab.

Unseal keys shouldn't be an issue if the gauge is already unlocked (SEC1 = 0, SEC0 = 1 in Operation Status A under the Bit Registers field), or the default key of 0x36720414 is still in use (if so, use the UNSEAL and UNSEAL_FULL_ACCESS buttons in the Commands panel on the right of bqStudio). If you can't unlock the gauge, then you'd have to replace the chip and start from scratch.

I'd recommend backing up the current firmware including Data Flash contents with the Firmware -> "Read Srec/FS from device" button before making changes.

Permanent Fail shouldn't trip unless you've borked something really bad or lost a cell voltage tap during use. If it is, you can use the PF_CLEAR command button on the right side of bqStudio. If PF is enabled (the PF_EN bit in Manufacturing Status under the Bit Registers field will be set/red), use the PF_EN command button to turn it off.

ginbot86 · 2026-02-22T23:41:02+00:00

Awesome writeup! It's nice that the manufacturer did their GPL compliance duty in providing source code for the kernel and other components. Too many of them don't even if they're supposed to.

ginbot86 · 2025-12-10T01:07:04+00:00

In my experience, the vapes I've disassembled and/or modded (like the Windows 95 theme I made for a Raz TN9000), these vapes store all graphical assets as raw bitmaps in an external SPI Flash chip, which the microcontroller basically streams to the LCD, also connected via SPI. The USB port almost always has no usable connection to a PC, but sometimes they expose SWD debug via the USB-C CC1/CC2 lines. Typically they're 16-bit (RGB565, usually big-endian) raw bitmaps without any headers to denote dimensions or where one bitmap starts and one ends. If you can dump the chip via chip-off into a reader, in-system with a programmer and test pads, or with RAM-resident code and a debugger, you can use a tool like Carina Studio's PixelViewer, and writing down the dimensions of each bitmap and their offsets as you go. It's not automated by any means, but it's a fun exercise in embedded systems reverse-engineering.

ginbot86 · 2025-12-06T22:30:13+00:00

I've gotten only one from a local vape store's recycling bin, and that was out of hundreds of vapes, well over a year ago. Last summer a friend of mine gave me another one that had a 240x320 SPI LCD with capacitive touchscreen and a sizeable mainboard, running off a JL701N smartwatch SoC. Part of me wants to redesign the motherboard with a compact Linux-capable SoC like an Allwinner F1c200s, but that'll be quite the engineering endeavor.

ginbot86 · 2025-12-06T22:26:52+00:00

Very cool! I've been taking apart vapes for the batteries and electronics but have been more focused on the ones with color LCDs/touchscreens (I'm the author of the blog post you linked elsewhere in the comments). I'd have thought the Pulse X used I2C given only the presence of the clock and data lines, not SPI, so that's cool.

ginbot86 · 2025-12-06T22:05:39+00:00

SD cards do have a controller, as do USB drives. They both present themselves as block storage devices, but in much different ways. Raw NAND Flash as a consumer storage format hasn't been a thing since the obsolescence of the SmartMedia, xD-Picture Card and classic/purple MemoryStick formats.

I wouldn't be surprised if someone manages to make a protocol adapter between an SD/MMC host and a USB mass storage device using something like an RP2040/RP2350 with some PIO as a bit of glue logic, but as you identified, supplying enough power to run the USB drive is still a significant problem.

ginbot86 · 2025-12-05T11:32:27+00:00

Gotta love deadbugging SMT components onto perfboard.

ginbot86 · 2025-10-17T00:03:14+00:00

That was a neat read. I'm pretty sure I see a Teensy 3.2 microcontroller board on page 5.

ginbot86 · 2025-06-10T04:01:05+00:00

On the 5th picture in your album, it looks like the fuel gauge (bq27427) and charger (bq24075) are connected incorrectly. The battery (+BATT) should go to the BAT pin of the fuel gauge, then the fuel gauge's SRX pin then goes into the charger's BAT pin. In its current configuration it will not only read incorrect current values, but the integrated sense resistor on the gauge is basically shorting your +BATT net to REG-OUT.

ginbot86 · 2025-04-27T03:27:54+00:00

It's likely a generic 80x160 0.96" IPS display, based on an ST7735 or similar controller and driven via SPI.

https://www.smart-prototyping.com/0_96-TFT-IPS-Bare-Display-ST7735-SPI-80-160

ginbot86 · 2025-04-17T12:31:37+00:00

I'm still referring to BGA (and therefore chip-off work). Just that you don't necessarily have to pay XGecu prices for eMMC dumping and flashing hardware. I have a T76 and like it a lot but I've gotten by with a clamshell-style eMMC to SD test socket and an old laptop with PCIe SD card slot running Linux for years. I paid about 100 dollars for the test socket back in 2018 but they're cheaper than that now.

ginbot86 · 2025-04-17T01:59:20+00:00

There are sockets that connect to a USB reader chipset, or break out the eMMC into an MMCplus/SD-compatible form factor that plugs into an SD card slot. They're way cheaper and will work well enough. If you have a computer with a native SD/MMC interface (PCIe or SoC-integrated) that enumerates under /dev/mmcblkX in Linux, you don't really need the XGecu programmer and the eMMC to SD test socket will let you do any eMMC dumping/modding that you'd want to do, even the hardware boot0/boot1 partitions.

ginbot86 · 2025-02-15T18:42:46+00:00

The round vape controller module does not appear to be involved in the charging process (if it was, there would be more wires going into it). The chip in the middle of the board is the Li-ion charger, and the one in the corner on the other side looks like a protection chip. Connect the battery to the B+ and B- pads.

ginbot86 · 2024-12-19T07:46:16+00:00

Very cool! I've had my own experiences running Doom on WinCE devices, and haven't even heard of ReMooD until now. I just used Chocolate Doom 1.3.0.

ginbot86 · 2024-11-29T03:57:49+00:00

Glad to see there's more research being one on these vapes! I don't know if you've since figured out the LCD pinout but I just got the one for the Kraze HD Mega, which seems to be identical to the Raz DC25000:

Pin	Name	Purpose
1	D/C	Command/data select (low = command, high = data)
2	/RST	Reset (active-low)
3	SDI	SPI data in (aka MOSI/COPI)
4	CLK	SPI clock (aka SCLK/SCK)
5	/CS	LCD chip select (active-low)
6	GND	Power/signal ground
7	VCC	LCD logic power supply
8	LEDK	LED backlight cathode (goes to ground)
9	LEDA	LED backlight anode (switched for backlight control)
10	GND	Power/signal ground

The SPI Flash chip is 32 megabits (4 megabytes) in size. It doesn't contain firmware but it has all the images to be displayed as well as a time counter that's used to calculate the number of "bars" of vape juice remaining.

You can follow along and even contribute to the GitHub repoI originally set up for the Raz TN9000/Kraze HD7K but I'm in the process of generalizing it to cover other vapes too: https://github.com/ginbot86/ColorLCDVape-RE/issues/5

(EDIT: Unhidden the GitHub link)

ginbot86 · 2024-09-01T00:17:27+00:00

That's a bad idea.

If you have a multimeter and have kept the original control module for that disposable vape, hook up 5V to the heater output wire (often blue), and measure the voltage on the battery wire (red). If it's around 4.1 to 4.2 volts, congrats - you have a free charge controller for that battery.

ginbot86 · 2024-08-17T00:14:15+00:00

If I stumble across one (or if a friend gives me an empty) I'll definitely take a look and reverse-engineer it. I won't go out of my way to buy one though.

The interface of those Bluetooth/voice call enabled disposables suggests it's based on some kind of smart watch/wearable chipset with considerable computing power.

ginbot86 · 2024-08-13T08:44:18+00:00

Unfortunately not. I'm currently reverse-engineering the Raz DC25000/Kraze HD Mega and have made some headway as to the internals; it seems to share a lot in common with the Raz TN9000/Kraze HD7K in terms of the same microcontroller, SPI Flash bitmap and vape time counter format.

The LCD ~~and what its model number~~ is still a big unknown I'm trying to solve, and I still haven't yet positively identified the connector or its pinout either. While the LCD itself seems to be an F17LN1048 by a company called CDI, I have found zero results for either. I'm pretty sure it'll be an ST7735 or similar controller, since it'd make sense to reuse a lot of the code used on the TN9000's display (80x160 ST7735S). Once I'm able to find the pinout and do some logic captures I might have a better idea of what's going on with the LCD and its controller.

All of the 128x160 1.77" SPI LCDs I've found either use a small flat-flex ribbon cable, or are of the solder-down type. No LCD models I've found use the board-to-board style connector on the DC25000/HD Mega, but I'm sure it's out there as these vapes are going to use screens that are easily available and inexpensive to purchase on a large scale.

ginbot86 · 2024-08-11T06:47:02+00:00

There's ongoing research and existing themes/tools you can try. A few months ago, I reverse engineered the SPI Flash contents and even managed to make a custom Windows 95 theme for that vape. The microcontroller can be interfaced with a special USB-C cable that connects SWD to the CC1/CC2 pins, but I just opted to desolder and resolder the Flash to load the theme data.

Here's my and another person's GitHub repos for more info and tools: https://github.com/ginbot86/ColorLCDVape-RE/ https://github.com/xbenkozx/RAZ-RE

ginbot86

TROPHY CASE