Reverse Engineering and reprogramming the EEPROM in an APC Symmetra LX UPS to get it running again!
ฝัง
- เผยแพร่เมื่อ 21 ธ.ค. 2023
- Email: rinoasauspicioustravails@gmail.com
Etsy store at www.hillsborotools.com
Patreon: / rinoasg - แนวปฏิบัติและการใช้ชีวิต
![[004] Reverse-engineering the Milwaukee M18 Redlink Protocol](http://i.ytimg.com/vi/OGzeGUDAtac/mqdefault.jpg)
![MEYOU - กอดหมอน [OFFICIAL MV]](http://i.ytimg.com/vi/RAG4Ee8FPxA/mqdefault.jpg)
hi rinoa, I found your channel like 10+ years ago when I was like 12. You were extracting 18650s from laptop batteries to create your ebikes. I remember thinking you were the coolest person ever, and you really inspired me to follow my interests and passions even if others thought it was nerdy. I am about to complete my bachelors in computer and electrical engineering, and I just wanted to thank you for making your content. It's nice to see that you are still doing interesting stuff as always
I hope to meet you someday! Thats so cool!
@@RinoaL I remember the CA videos with the electric tricycle love that thing
The nicest TH-cam comment ever 😁
I have been inspired by jerri Elsworth
18650s. Time goes by fast. Also remember wathing that videos. I use 21700 in my flashlight. Pulled it from bosch procore battery and parkside 8ah battery from lidl.
This video is part of the very spirit that was old school TH-cam.
I basically havent changed how I make videos since I started in 2008, and got inspired to do narrative tinkering videos by Aussie50 in 2012
@@RinoaLwait, isn’t that the person who unfortunately….
@@RinoaL Aussie50 was a legend
it always warms my heart when someone defeats an anti-feature!
I was thinking the same thing xD
I have absolutley no idea why I'm watching this but here I am totally invested in it hahaha.
SAME HAHAH
Same😂
You're bored
I am from computer cience still had no idea
hahahaha the same here
Cool video!
Byte order is reversed due little Endian -> big Endian conversion. At least that's what I would guess.
I love educational videos like this, especially when showing hands on instructions for real world applications. It give a clear insight into the tools and software used.
👍
Most desktop processors are little endian for legacy reasons. Other hardware has no reason to be either or besides big endian being slightly more simple hardware implementation wise especially iirc.
@@INeedAttentionEXEor because network byte order is big endian.
I am a beginner C++ programmer. TH-cam recommended this to me. I did not understand a word. 10/10. I approve of these cool stuff.
I've had to remove a lot of EEPROMs and found the very best tool is an old school staple remover. The type that look like a big pen and have a rounded blade on the front. The fit perfectly between the legs and have just a slight bend in the blade that allows you to pry the EEPROMs up. They work great and are cheap, heck, you may even have one laying around. Great video!
A friend of mine worked at BNR/Nortel designing hardware for their switches, and he told me that when someone ordered a chip puller to the lab, what would show up was a Stanley Bostitch Staple Remover, Model G2. It was their standard issue chip puller.
The ability to generate arbitrary checksums over selected data from right within your hex editor is absolutely brilliant. I'm gonna see if I can get it added to GHex.
Thanks for defeating an anti-consumer feature and sharing the method!
Thats nice the chip is socketed. No hot air rework required.
That’s only because this pack has been rebuilt and the ewaste handler installed the socket
You were way too calm using that tablet lol. My blood would of been boiling trying to edit the hex without a stylus. kudos to you for that lol.
that and the laptop from 2002
@@dextardextar enough to make me cry
My friend just recommended your channel to me and this video kind of reminded me of when I "un-offically" worked for an independent laptop repair shop for cash under the table (the owner payed me per repair I did instead of hourly and it was often below minimum-wage), but he didn't set a fixed schedule for me. Allowing me to very flexibly get more work when I had the time and come in less when I didn't have time, like during finals. He ended up selling his business just before covid hit.
I have no idea how I got here but watched it all and was totally immersed through it. Well played Rinoa
Many thanks for the video Rinoa. I was very interested in what you were doing and you certainly opened some windows for me on interesting topics.
Way to go. Hats off to Rinoa
Awesome work! This gives me confidence to procure a similar second hand Symmetra and be able to refurbish it myself.
Interesting video. Great to watch you still tinkering all these years later. ♥
Finding the exact problem and fixing it is pretty incredible.
You know its weird - I don't have that much time for TH-cam these days so I haven't watched your videos for a while. I was just thinking about you the other day and YT serves me up one of your videos. I remember watching you back in 2014 when you were making e-bike batteries and when you were in California. Glad to see you are still doing OK for yourself.
Very well rounded individual. A delightful chore watching you problem solve!
Good job, well done on extending the life of this unit. It will be interesting to see how it performs when the new batteries arrive.
This is such amazing and useful content! You're doing a public service keeping all of these out of a landfill.
Looking forward to the full release of whatever it is you come up with.
I love messing around with, and bringing new life to, old electronics and computers. Just found your channel, this is really cool
This was awesome!! Thank you for creating content!
Awesome work, thanks fo sharing this process!
That's one seriously cool hack - and a nice workspace! I'm picking up CuriousMarc and Usagi Electric vibes. Keri on! :)
Now that is a high compliment
Great IT work, enjoyed watching it and thank you.
That tape trick is amazing!
You had an even better way. Your brilliant.
Very cool video!
nicely and patiently done.
Wow, great project. You are amazing. Thanks for sharing! ⭐♥
The shortest 20 minutes of my life. How did I just sit through it like it was a movie!? 😂😂
Thank you!!! ❤
Same here but still don't know what she doin lol
@@mohitashliya8750 exactly! Hahaha
I really enjoyed this video. Thanks for posting and for all of the explanations.
Im glad you enjoyed!
This is awesome because printers have the same issue with counters and how many cleaning cycles you have done. I have yet to try this method. Thank you for posting this!
To be able to figure out what the data represents in hex, and changing it is truly a reverse engineering moment, good job!
This is the first rinoa video that went not only over my head but wayyyyy over my head. Sheesh
This is incredible and awesome, thank you!
Thanks for the video
Very cool to see these getting fixed! I would love a massive battery system like that at my house so I could weather power outages.
SICK old school Toughbook Rinoa!!
This was cool stuff. Critical knowledge that makes you valuable!
I want that laptop so bad. Pure 2000s beauty. Awesome work! I love a good reverse engineering challenge
This looks like such a cool project! I hope you get around to making a full video on this, one of these days. Happy to have found your channel!
I really wish more modern electronics had such easy ways to reprogram them like EEPROMs were. A lot of times I'm lost on what to do with a device because it uses some proprietary firmware I have no access to.
I do hope I'll learn to handle these too... Some day.
I have the full video mostly filmed, now is the waiting game of seeing how the batteries degrade.
Interesting! The larger Symetra PX 250kva 3-phase 480v units don’t have any “smarts” in the battery packs at all. I also learned to never buy refurbished battery modules, had one short to the case and blew a 1/4” hole in the side of the module because the refurb place decided they knew better than APC and didn’t replace some of the internal spacer safety bits. And a safety note to others: these battery packs have many 12v batteries wired in series which provides some rather spicy DC voltages, with just a single fuse for the module!
this is amazing. thank you
Love It, hope to see more !
Hi, thanks Rinoa for the honest troubleshooting tutorial. I can do it by myself now. Sigh…❤
Oh, I was able to use Labview software to bring different platforms together and build a portable Bluetooth link with high frequency self seeking dish antenna one person can move and operate for the Navy.
incredible fasinating, thanks for documenting and sharing
Thank you, greetings from Turkey.
I really want to get in to systems integration and I absolutely love this video, thank you very much for sharing.
now that is some cool stuff !!!!!
this is amazing! i now know what my calling is. thank you!! ive been doing something similar at my job and was wondering what it was other than being a handyman
man that cf-c1 is gorgeous
I just found your channel officially subscribed !!!❤❤❤❤❤ love it
Oh, this is beyond me dear. I admire you for knowing all these complex things.
really cool video thanks for making it
I was searching for your channel for about a month couldn't find you under your battery bike or any of your old titles from a few years ago. and you randomly show up in my feed nice.
Thats funny
Great video, this is very good information.
wonderful content
Good videos, very unlikely that i need that information but i like to have it now. Thank you!
This is so cool
What a cool project!
Very clever!
Very coo tinkering!
I've no idea who you are.. I had no idea what this video was about.. but I decided to click and watch. I saw you messing with APC, suddenly I was invested. Then, as an IT Manager.. the moment you switched to the dark mode on the tablet while reading the chip.. I was doubly invested 😂 My kinda human!
Yeah I'm sold, you got a sub and like
Well thank you!
Great video. I've often wondered how hard it would be to fix the battery error on a real UPS. Now I know it's way above my level of knowledge:) 8:25, "a piece of bailing wire would also work" This is great. reminds me of the scene in William Gibson's Count Zero where Bobby sees the bar owner Jammer fixing a flat screen TV with a straightened out paper clip.
the content i needed
great video. thank you so much
That is really cool thank you for sharing
looks easy peasy. Good thing APC made things simple and used the 9366 for scratch pad memory. while I don't have lot of interest in using microchip devices. I can be easily bribed. Seeing what microcontroller is being used, board layout, and a disassembly of the code would make interesting reading over a cup of coffee. I know that's beyond the scope of this video but I like looking at other peoples work. I'm sure you do as well. Happy modding...Oh and have a Merry Christmas too.
Well done
Very nice save for those battery modules! It's great to see someone who cares and has the patience and wherewithal to make a fix like this. Worth it to change the date! Not only for its own sake, but persevering through the checksum and making that work was surely educational. Glad to see the successful self-test there at the end.
I'm not very familiar with larger APC UPS systems, so this may be a non-issue. However, do you fear that APC will somehow make a software update to the UPS controller so that it will no longer be possible to reset the batteries? I hope not but in today's world one has to consider these possibilities. I don't fear that on the projects I've worked on because they are all secure process control networks and nothing gets updated without lots of prerequisite paperwork.
I've had to do some minor reverse engineering on older PLC to module interfaces; such as where we can't get another identical external device, and have to understand how to make the system work with a different interface. It's very rewarding when it works out! But, I always tell people it's never a 100% sure thing it can be done, until one reaches that "aha" moment and the picture gets clearer. I bet you had a few of those "aha" moments on this one!
Very enjoyable video, again glad to see this and high respect for your skills.
Unlikely they’d be able to update to break this with a non encrypted EEPROM
@@NicholasAndre1 Agree, and hopefully they don't find a way! 🙂
Is not my house who gonna get burnt to ashes for deactivate safety locks...
@@eduardoanonimo3031 Clueless, you are.
Wow, a most interesting step-by-step UPS EEPROM with checksum validation video. 😎 Thank you. Merry Christmas.
Great job and very interesting. Countless hours of research and scouring through forums has paid off. Please be careful around those charged batteries, 130VDC hurts as much or more than 130VAC. Cant wait to see the full production.
Thanks and dont worry, Ive worked with 300V EV batteries so this is a little easier
Dead wrong. Those packs will feel like 50-60V AC, that DC voltage is nothing compared to what will actually get you in the field.
LOL, oh, the joys of working on APC UPS's. I have many I own or support and it's good to see someone taking the time to delve into the dark side of them and their programming. It has been a long-known issue of APC's and cooking batteries (way to high float voltages and dumb battery management).
Those units have been rebuilt as you said as APC used to use 12V7ah cells a lot and those have 12V9ah's. Sadly, those batteries now are selling for big prices here in Australia which is seeing many UPS's just getting sent to scrappers. I used to buy those 9's for $26 AUD each but now has gone to over $50. For a roughly 2 year life cycle, fark that.
I now pull the batteries and their PITA metal frames that seize inplace after cells cook/swell and ditch them. I now use bigger external packs as 100ah & 120ah are way better value as well as have way better surge capacity for when needed. Fitting extra stiffening supply capacitors inside the old battery bays with a soft-charge diode and resistor setup does help the in-rush current needs.
The big bit advice I can give here to you and others, these systems are not for the beginners. The packs you are playing with are 10S (10x cells in Series, 120VDC). What is to be noted is working on higher DC voltages is way more dangerous and lethal. APC's have been known for 96VDC packs but when installed, hook-up internall in series with another for 192VDC which is more common for us on decent mains voltages. The mains side in your case is American lower 110VAC and a lot lower than the 240VAC we use.
I once was asked by a client to replace an on-board fuse on a power supply that they had blown by miswiring the lock connected to it (access control system). I tried to explain to them that the slow-blow soldiered-direct fuse had a purpose, and that it was to protect them from a fire, that the semiconductors on the board had been over-driven by the current spike it was subjected to and therefore were potential fire hazards if the fuse was replaced. They didn't see it that way and had an electrician replace the fuse anyway (I had refused to do it) instead of the board (my recommendation). 30 days later we were asked to trouble shoot the access control panel, which was now damaged beyond repair, the on-board over-current MOVs blown off. This is an example of those who think they are trying to out-smart "the man" from a built in fail element they didn't fully understand. Those high-current inverter semiconductors inside the APC system will fail, it is a virtual certainty, and I'm sure you can trick the built in EOL timers in the EEPROMs to allow the device to continue to run, which to you and your followers might seem really smart and impressive, but at the same time you are forgetting the whole point of the APC stack and that is to have a RELYABLE power source in the event of an emergency power loss scenario. If you trick the device into bypassing this reliability and safety feature you are essentially making the device a potentially dangerous fail-box, when your client needed a UPS to protect their servers in the event of an emergency. You have saved money at the expense of potential failure and danger, to me that is dabbling in arrogant foolishness.
Youve misunderstood this situation. This is exactly what all the resellers do which are the only common way to get these now since APC is price gouging with them
You are amazing!
Very interesting video, thank's 👍
LOL, that Tape trick was genius.
I hope we all go very good all the time forward 😊
I was so much bored until I found this video by coincidence. WOW! You know a lot.
I’m working on more videos like this. Just a matter of tinkering
Great video! You are very lucky that APC didn't do some form of encryption, like HP does on some of its ink cartridges. This reminds me of how I used to hack alarm pin codes (customer and administrator) for one of the technicians of a local alarm company, so the panel could be re-used. Thanks!
This device was designed in 2007 or so, and I imagine APC has implemented encryption by now tbh
@@RinoaL It is a shame how DRM has gotten out of control. So much E-Waste because of that. I am just curious, did those battery modules you pulled and fixed: Were they meant to be replaced by the end user as complete modules for some rediculous price? It looks like they have QTY10 12V 7AH AGM batteries with F2 terminals. I have to applaud your efforts and success for reverse engineerign that system. KUDOS! Happy Holidays as well.
New batteries are $240 on amazon, but APC wants you to buy a new pack for $1,800. The rebuilders sell their remanufactured packs for $900
great job!
I think you are good hearted, I'm subscribing.
Have a good day 😊
Panasonic Toughbook running 7. Love it!
That computer is quite old, amazing it's still trucking along
Funny enough this battery system is of a similar age.
Super reliable APC model. APC technical support will still help troubleshoot a Symmetra LX, even if it is 15 years old.
I love how 2000ish this video feels
Awesome!!!!
Great video
I do a lot of EEPROM work. Once I know what I need to do to make something work, I usually make a Windows Forms application which I can open the binary file with, make the needed changes, and save as a new file. Ten minutes writing code will help you to avoid mistakes and shave hours off your work if you have a lot of these to do.
brilliant and oddly helpful
nice work
I have a few of these i have to maintain the same way. The fun part is when the intelligence modules start having leaking filter caps.
nice video
Nice to see that there's a way around manufacturer imposed limitations.
After all batteries are wear items, but they are often charged a bit too hard (a bit too high voltage) making them fail faster than they have to to make them charge faster. Personally I prefer to keep the charging voltage between 13.6 and 14.4 volts for a 12V nominal battery.
Love it!!!!!!!!!!!!!!
OMGOSH. You're amazing.
also: very much a Tig vibe. Don't change a thing.
I dont know what that means but I hope its a compliment!
@@RinoaLIt is! Tig Notaro is awesome.
Keep going in explain vidios it's helpful thanks
that panasonic laptop looks so cool im envious haha