Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

B S Magnet

macrumors 603
Original poster
So this is a total long shot, and it goes well beyond my limited wheelhouse of making un[der]documented things work nicely. It also means inviting those cosy with under-bonnet stuff to chime in.

The magnificent open-source utility, Charge Limiter (which does what other, more proprietary battery management utilities can do), is what I began to use a while back for setting maximum charge settings for my MacBook Pro batteries. Because of this, I’m keeping OEM batteries alive and healthy a lot longer than I’d be able to otherwise.

Across my Core iX MacBook Pro models (and, ostensibly, the same applies for Core iX MBAs and MBs), the utility worked as designed and described. As Charge Limiter’s description denotes, it alters two System Management Controller keys/parameters: BCLM (“Battery Charge Level Max”) and BFCL (“Battery Final Charge Level”).

Enter the Core 2 Duo MacBook Pro — specifically, the early A1260/A1261 2008 models. The utility runs the script, as usual, but troubles appear before setting a value:

1728789456034.png


As seen above, “ keyNotFound(code: "BCLM") ” displays because the utility cannot get a value from the SMC. The script continues to run and complete, as expected.

Of course, this override setting maps to nothing the utility that revision of the SMC is aware of, suggesting one of two things:

1) the SMC keys used with the pre-Core-iX Macs is probably different. I’d imagine it’s not too different, considering communication between MagSafe adapter and Mac behaves the same, regardless whether the MagSafe adapter is connected to a C2D MacBook or a later Core iX MacBook. Or,

2) the SMCs of pre-Core iX MacBooks simply lack anything like a BCLM/BFCL key, behaving in a more basic, “dumb”, all-or-nothing SMC key, a binary 1 or 0 — with one being “fully charged” and the other “not fully charged.”

This is where my technical knowledge trails off, as I don’t exactly know how to poll the SMC to reveal its keys/parameters (namely, to explore whether BCLM and BFCL functions happen under differently-named keys/parameters for the C2D Macs, which I have a hunch they do). Try as I have, it seems there are staggeringly few discussions elsewhere which discuss SMC keys/parameters or ho to know what a certain Mac uses for its specific SMC.

It’s 2024. Why does this matter, B S Magnet?”

I want to buy a new-in-box OEM battery for my A1261. (I know somebody who knows somebody who knows a grasshopper…) I would like to get it, but only provided I can find a way to cap the charge on it to 80 per cent, to extend the battery’s lifetime (as finding another, years from now, will likely be next-door-to-impossible). Yes, I do keep my A1261 running 24/7, as I use it daily for various dedicated tasks.

I also want to keep A1261 running on said potential Apple battery without re-dealing with the problem of battery bloat endemic to all the aftermarket trash I’ve bought, paid for, and watched fail, over and over, since 2021. Even if I wasn’t looking at an OEM battery, it could also come in useful for keeping B-grade aftermarket batteries, such as those from NewerTech, in “good health” for longer than they might otherwise.

With Charge Limiter, I could make changes to source code, to point to and to adjust the correct SMC keys/parameters specific to pre-Core iX MacBooks, to then build a version of it for my C2D Mac — if I knew how to find the C2D-specific keys.

But I don’t. So I defer to the many brilliant minds around here, if they’re up for a challenge. :)
 
Last edited:

Amethyst1

macrumors G3
Oct 28, 2015
9,766
12,153
This is where my technical knowledge trails off, as I don’t exactly know how to poll the SMC to reveal its keys/parameters (namely, to explore whether BCLM and BFCL functions happen under differently-named keys/parameters for the C2D Macs, which I have a hunch they do).
smckit has an option to check if a given SMC key is "valid". A list of all SMC keys supported by the system would be better though...
 
  • Like
Reactions: B S Magnet

B S Magnet

macrumors 603
Original poster
smckit has an option to check if a given SMC key is "valid". A list of all SMC keys supported by the system would be better though...

If only I could code my way out of a shoebox, I might have been able to write some kind of script to run through every four-character combination on a particular device — sort of like this, except this was only for the BCL* variants:

Code:
sh-3.2# smckit -k BCLA && smckit -k BCLB && smckit -k BCLC && smckit -k BCLD && smckit -k BCLE && smckit -k BCLF && smckit -k BCLG && smckit -k BCLH && smckit -k BCLI && smckit -k BCLJ && smckit -k BCLK && smckit -k BCLL && smckit -k BCLM && smckit -k BCLN && smckit -k BCLO && smckit -k BCLP && smckit -k BCLQ && smckit -k BCLR && smckit -k BCLS && smckit -k BCLT && smckit -k BCLU && smckit -k BCLV && smckit -k BCLW && smckit -k BCLX && smckit -k BCLY && smckit -k BCLZ && smckit -k BCL0 && smckit -k BCL1 && smckit -k BCL2 && smckit -k BCL3 && smckit -k BCL4 && smckit -k BCL5 && smckit -k BCL6 && smckit -k BCL7 && smckit -k BCL8 && smckit -k BCL9
BCLA is a invalid SMC key on this machine
BCLB is a invalid SMC key on this machine
BCLC is a invalid SMC key on this machine
BCLD is a invalid SMC key on this machine
BCLE is a invalid SMC key on this machine
BCLF is a invalid SMC key on this machine
BCLG is a invalid SMC key on this machine
BCLH is a invalid SMC key on this machine
BCLI is a invalid SMC key on this machine
BCLJ is a invalid SMC key on this machine
BCLK is a invalid SMC key on this machine
BCLL is a invalid SMC key on this machine
BCLM is a invalid SMC key on this machine
BCLN is a invalid SMC key on this machine
BCLO is a invalid SMC key on this machine
BCLP is a invalid SMC key on this machine
BCLQ is a invalid SMC key on this machine
BCLR is a invalid SMC key on this machine
BCLS is a invalid SMC key on this machine
BCLT is a invalid SMC key on this machine
BCLU is a invalid SMC key on this machine
BCLV is a invalid SMC key on this machine
BCLW is a invalid SMC key on this machine
BCLX is a invalid SMC key on this machine
BCLY is a invalid SMC key on this machine
BCLZ is a invalid SMC key on this machine
BCL0 is a invalid SMC key on this machine
BCL1 is a invalid SMC key on this machine
BCL2 is a invalid SMC key on this machine
BCL3 is a invalid SMC key on this machine
BCL4 is a invalid SMC key on this machine
BCL5 is a invalid SMC key on this machine
BCL6 is a invalid SMC key on this machine
BCL7 is a invalid SMC key on this machine
BCL8 is a invalid SMC key on this machine
BCL9 is a invalid SMC key on this machine
sh-3.2#

Even so, such a script wouldn’t necessarily tell the user what that four-character key represented.
 
Last edited:

f54da

macrumors 6502a
Dec 22, 2021
503
185
You can list all the smc keys by sending "SMC_CMD_READ_INDEX" to smc with the ordinal index. See smcPrintall under https://github.com/informationsea/smc/blob/master/smc.c

Also see Ionescu's talk "Smc the place to be, definitely"- youtube.com/watch?v=nSqpinjjgmg
If you have the smc firmware dump you could reverse it

Yes you won't necessarily know what it represents, but type should be integral and value of BCLM should be 100 and there are very few keys with that value which can easily narrow it down.
 
  • Like
Reactions: B S Magnet

B S Magnet

macrumors 603
Original poster
You can list all the smc keys by sending "SMC_CMD_READ_INDEX" to smc with the ordinal index. See smcPrintall under https://github.com/informationsea/smc/blob/master/smc.c

Bear in mind I don’t code.

The source code in smc.c appears to have a list of known keys under "SMCTempKeyList_t". This is a step in the right direction, although the keys in that list pertaining to power management, according to smckit, are not valid keys on the C2D Penryn MBP.

As to what I can do with the smc.c file and the makefile in the smc git repository, I don’t know how to compile this into anything I can use (i.e., it’s not something I can run a configure/make/make install, or a cmake, or an Xcode build to compile into something I can use, such as a cli command).

I apologize for not having those skills, and I’m mindful that the absence of those probably means my original question may not be something I’ll be able to figure out.

Also see Ionescu's talk "Smc the place to be, definitely"- youtube.com/watch?v=nSqpinjjgmg

I’ve queued this and have watched his initial introduction (including its pronenance as a TI ARM Cortex processor which runs even when the system is totally powered down [!!!]). I’ll continue to watch the rest of his talk later this evening. Cheers!


If you have the smc firmware dump you could reverse it

This is on the level of the kind of thing which someone with a thorough understandings of low-level board functions, like @dosdude1 [side note to Colin: please forgive me for cc:ing you on this, especially where it might not be of any interest or curiosity], [EDIT NOTE: struck, after the following two posts happened] could have the means to do — both in terms of technical competency and in the equipment to, say, extract a firmware dump.

It‘s probably two steps beyond both my technical ability and/or firmware/EFI/SPI-ROM/SMC-type dumping equipment I lack.


Yes you won't necessarily know what it represents, but type should be integral and value of BCLM should be 100 and there are very few keys with that value which can easily narrow it down.

I expect a full list of valid keys for the C2D MBP probably lacks full documentation one would need to know what all the verified-to-exist keys signify (several, especially temperature sensor keys, seem to be reasonably documented by others, including the smc repo’s mention of reverse-engineering/decompiling iStat Menus). That’s something to explore once the bridge can be crossed to get there.

I can now verify, thanks to smckit polling, how both BCLM and BFCL are not valid keys for the C2D MBP’s SMC and, thus, their functions are either designated as alternately named keys (yet to be determined), or they don’t have any kind of analogue whatsoever (as the ability to set battery charging parameters to anything other than, conjectured, “charged / not-charged” may not yet have been implemented for that SMC revision and didn’t appear as keys until the SMC revision used with Core iX Sandy Bridge-and-later models — once Intel had revised the CPU for more advanced polling and configuring, à la Intel Power Gadget).
 
Last edited:

f54da

macrumors 6502a
Dec 22, 2021
503
185
>The source code in smc.c appears to have a list of known keys under "SMCTempKeyList_t".
That's only a list of temperature keys. The set of available smc keys varies by model, and the only way to know specific for yours is to query the smc to dump all keys as that code does


>I don’t know how to compile this into anything I can use
Don't you just run make, then you have a CLI tool output into the same directory?

>This is on the level of the kind of thing which someone with a thorough understandings of low-level board functions, li
I don't think you have to dump it directly from board, you could also take the firmware update blob and put that through ghidra I think. Not sure if they are encrypted or not though.
 
  • Like
Reactions: B S Magnet

B S Magnet

macrumors 603
Original poster
>The source code in smc.c appears to have a list of known keys under "SMCTempKeyList_t".
That's only a list of temperature keys. The set of available smc keys varies by model, and the only way to know specific for yours is to query the smc to dump all keys as that code does

Got it. Keep reading.

>I don’t know how to compile this into anything I can use
Don't you just run make, then you have a CLI tool output into the same directory?

Hello I am le dumb and I hadn’t paused to think no configuring would be needed. I learnt something minor, but new tonight. Thank you.

That output (unannotated, obviously):

Code:
sh-3.2# ./smc -l
  #KEY  [ui32]  6 (bytes 00 00 01 06)
  +LKS  [flag]  (bytes 07)
  ACEN  [ui8 ]  1 (bytes 01)
  ACFP  [flag]  (bytes 01)
  ACID  [ch8*]  (bytes 85 3d e4 17 50 05 10 9b)
  ACIN  [flag]  (bytes 01)
  ACOW  [flag]  (bytes 00)
  AL!   [ui8 ]  0 (bytes 00)
  ALA0  [{ala]  (bytes 1c 36 00 00 02 18)
  ALA1  [{ala]  (bytes 0f b9 00 f1 02 82)
  ALA2  [{ala]  (bytes 07 33 01 ca 02 dc)
  ALA3  [{ala]  (bytes 02 f4 02 6c 03 26)
  ALA4  [{ala]  (bytes 01 37 02 d9 04 00)
  ALA5  [{ala]  (bytes 00 92 00 4c 04 00)
  ALAT  [{alt]  (bytes 00 2c 03 08)
  ALI0  [{ali]  (bytes 01 00 07)
  ALI1  [{ali]  (bytes 01 00 07)
  ALRV  [ui16]  0 (bytes 00 00)
  ALSC  [{alc]  (bytes 01 92 00 96 05 46 00 0c 00 01 01 5e 1d 03 02 06)
  ALSF  [fp1f]  (bytes 05 1f)
  ALSL  [ui16]  5 (bytes 00 05)
  ALT0  [ui16]  0 (bytes 00 00)
  ALT1  [ui16]  0 (bytes 00 00)
  ALTH  [{alr]  (bytes 00 21 00 70 02 7b 00 14 00 41)
  ALV0  [{alv]  (bytes 01 00 0f 80 00 00)
  ALV1  [{alv]  (bytes 01 00 05 40 00 00)
  AUPO  [ui8 ]  0 (bytes 00)
  B0AC  [si16]  (bytes 00 00)
  B0AP  [flag]  (bytes 01)
  B0AV  [ui16]  15 (bytes 2f 0f)
  B0Al  [ui16]  255 (bytes ff ff)
  B0Am  [ui8 ]  16 (bytes 10)
  B0As  [ui8 ]  0 (bytes 00)
  B0At  [ui16]  96 (bytes 09 60)
  B0Az  [ui8 ]  0 (bytes 00)
  B0BI  [ui8 ]  17 (bytes 11)
  B0FC  [ui16]  132 (bytes 0a 84)
  B0LI  [ui16]  248 (bytes 11 f8)
  B0RI  [ui16]  0 (bytes 00 00)
  B0RM  [ui16]  130 (bytes 0a 82)
  B0St  [ui16]  224 (bytes 40 e0)
  B2DR  [ui8 ]  0 (bytes 00)
  B4PS  [ui16]  0 (bytes 00 00)
  B4PW  [ui8 ]  0 (bytes 00)
  BATP  [flag]  (bytes 00)
  BBAD  [flag]  (bytes 00)
  BBIN  [flag]  (bytes 01)
  BC1V  [ui16]  25 (bytes 0f 19)
  BC2V  [ui16]  22 (bytes 11 16)
  BC3V  [ui16]  224 (bytes 0e e0)
  BCCT  [ui8 ]  3 (bytes 03)
  BIGE  [ui8 ]  255 (bytes ff)
  BISE  [ui8 ]  0 (bytes 00)
  BNum  [ui8 ]  1 (bytes 01)
  BRSC  [ui16]  100 (bytes 00 64)
  BSAC  [ui8 ]  55 (bytes 37)
  BSDC  [ui8 ]  0 (bytes 00)
  BSIn  [ui8 ]  66 (bytes 42)
  CLK!  [ui8 ]  0 (bytes 00)
  CLKC  [{clc]  (bytes 00 00 0e 10 00 00 0e 10 19 8c)
  CLKH  [{clh]  (bytes 00 00 70 80 00 01 19 40)
  CLKS  [fp1f]  (bytes 19 8c)
  CLKT  [ui32]  228 (bytes 00 01 33 e4)
  CRCB  [ui32]  99 (bytes 69 b5 06 63)
  CRCU  [ui32]  87 (bytes 8c 11 e3 57)
  DPLM  [{lim]  (bytes 00 00 00)
  EPCA  [ui32]  0 (bytes 00 00 f0 00)
  EPCF  [flag]  (bytes 01)
  EPCI  [ui32]  0 (bytes 02 60 07 00)
  EPCV  [ui16]  1 (bytes 00 01)
  EPMA  [ch8*]  (bytes 00 00 e0 80)
  EPMI  [ui8 ]  0 (bytes 00)
  EPUA  [ui32]  0 (bytes 00 00 e0 00)
  EPUF  [flag]  (bytes 01)
  EPUI  [ui32]  4 (bytes 02 60 00 04)
  EPUV  [ui16]  1 (bytes 00 01)
  EVCT  [ui16]  8 (bytes 08 08)
  EVMD  [ui32]  0 (bytes 00 00 00 00)
  EVRD  [ch8*]  (bytes f6 06 03 00 00 00 1e 4c 22 0a 00 00 80 00 1e 1f 25 07 00 0b 24 00 1e 1f 25 08 00 0f 5b 00 1e 1f)
  F0Ac  [fpe2]  4962 (bytes 4d 8b)
  F0ID  [{fds]  (bytes 00 01 0c 00 4c 65 66 74 20 73 69 64 65 20 20 00)
  F0Mn  [fpe2]  2000 (bytes 1f 40)
  F0Mt  [ui16]  208 (bytes 07 d0)
  F0Mx  [fpe2]  6000 (bytes 5d c0)
  F0Sf  [fpe2]  0 (bytes 00 00)
  F0Tg  [fpe2]  4964 (bytes 4d 90)
  F1Ac  [fpe2]  3032 (bytes 2f 60)
  F1ID  [{fds]  (bytes 00 01 0e 00 52 69 67 68 74 20 73 69 64 65 20 00)
  F1Mn  [fpe2]  2000 (bytes 1f 40)
  F1Mt  [ui16]  32 (bytes e5 20)
  F1Mx  [fpe2]  6000 (bytes 5d c0)
  F1Sf  [fpe2]  0 (bytes 00 00)
  F1Tg  [fpe2]  3038 (bytes 2f 78)
  FGTg  [ui16]  0 (bytes 00 00)
  FNum  [ui8 ]  2 (bytes 02)
  FPhz  [si16]  (bytes 00 00)
  FS!   [ui16]  3 (bytes 00 03)
  GURT  [flag]  (bytes 00)
  HBWK  [flag]  (bytes 00)
  HDBS  [ui8 ]  1 (bytes 01)
  HDST  [ui16]  0 (bytes 00 00 00 00)
  HDSW  [ui32]  2 (bytes 00 02 00 02)
  IC0C  [fp6a]  (bytes 05 6f)
  IC0c  [ui16]  0 (bytes 40 00)
  ID0R  [fp3d]  (bytes 1b b7)
  ID0r  [ui16]  128 (bytes 36 80)
  IG0C  [fp6a]  (bytes 0e 19)
  IG0c  [ui16]  192 (bytes 25 c0)
  IG1C  [fp6a]  (bytes 06 45)
  IG1c  [ui16]  128 (bytes 28 80)
  IN0R  [fp6a]  (bytes 00 fd)
  IN0r  [ui16]  0 (bytes 04 00)
  IN1R  [fp6a]  (bytes 03 7a)
  IN1r  [ui16]  192 (bytes 1d c0)
  IN2R  [fp6a]  (bytes 00 74)
  IN2r  [ui16]  64 (bytes 04 40)
  IP0R  [fp4c]  (bytes 00 71)
  IP0r  [ui16]  64 (bytes 00 40)
  LAcN  [ui8 ]  0 (bytes 00)
  LAtN  [ui16]  0 (bytes 00 00)
  LCCN  [ui8 ]  249 (bytes f9)
  LCCQ  [ui8 ]  251 (bytes fb)
  LCKA  [ui8 ]  68 (bytes 44)
  LCSA  [ui8 ]  162 (bytes a2)
  LCTN  [ui8 ]  209 (bytes d1)
  LCTQ  [ui8 ]  140 (bytes 8c)
  LDSP  [flag]  (bytes 00)
  LKSB  [{lkb]  (bytes 00 00)
  LS!   [ui8 ]  0 (bytes 00)
  LSCF  [{lsc]  (bytes 04 7e 01 90 80 00 02 02 00 18)
  LSDD  [{lsd]  (bytes 00 02 00 03 00 03 00 19)
  LSDU  [{lsd]  (bytes 00 03 00 02 00 14 00 03)
  LSFD  [{lsf]  (bytes 00 00 00 04 00 80)
  LSFU  [{lsf]  (bytes 17 70 00 19 00 12)
  LSLB  [{pwm]  (bytes ff ff)
  LSLF  [{pwm]  (bytes 00 00)
  LSLN  [{pwm]  (bytes 4e 20)
  LSOF  [flag]  (bytes 00)
  LSOO  [flag]  (bytes 00)
  LSPV  [{pwm]  (bytes 03 20)
  LSRB  [flag]  (bytes 00)
  LSSB  [{lso]  (bytes 00 00)
  LSSE  [flag]  (bytes 01)
  LSSS  [{lso]  (bytes 00 00)
  LSSV  [ui16]  255 (bytes ff ff)
  LSUP  [ui8 ]  0 (bytes 00)
  MACA  [ui32]  0 (bytes 00 00 00 00)
  MACM  [flag]  (bytes 01)
  MACR  [ch8*]  (bytes 63 68 38 2a 90 00 1e 4c 22 0a 00 00 80 00 1e 1f 25 07 00 0b 24 00 1e 1f 25 08 00 0f 5b 00 1e 1f)
  MOCF  [ui16]  0 (bytes 85 00)
  MOCN  [ui16]  248 (bytes 80 f8)
  MOHD  [ui8 ]  20 (bytes 14)
  MOHT  [sp78]  (bytes 01 c0)
  MOLD  [ui8 ]  20 (bytes 14)
  MOLT  [sp78]  (bytes 00 60)
  MOST  [ui16]  3 (bytes 80 03)
  MOVX  [sp78]  (bytes 00 07)
  MOVY  [sp78]  (bytes ff f6)
  MOVZ  [sp78]  (bytes 00 fc)
  MO_X  [sp78]  (bytes 00 09)
  MO_Y  [sp78]  (bytes ff f7)
  MO_Z  [sp78]  (bytes 00 fc)
  MSAL  [ui8 ]  0 (bytes 00)
  MSAR  [ui16]  0 (bytes 00 00)
  MSAc  [fp88]  (bytes 00 00)
  MSAg  [fp88]  (bytes 00 00)
  MSAm  [fp88]  (bytes 00 00)
  MSBC  [ui16]  0 (bytes 00 00)
  MSBP  [ui16]  227 (bytes 29 e3)
  MSBc  [ui16]  9 (bytes 00 09)
  MSBp  [ui16]  227 (bytes 29 e3)
  MSC0  [ui16]  199 (bytes 36 c7)
  MSC1  [ui16]  135 (bytes 17 87)
  MSC2  [ui16]  0 (bytes 00 00)
  MSC3  [ui16]  0 (bytes 00 00)
  MSCP  [ui16]  8 (bytes 00 08)
  MSCR  [ui16]  1 (bytes 00 01)
  MSCS  [ui8 ]  0 (bytes 00)
  MSCT  [ui8 ]  4 (bytes 04)
  MSCa  [ui16]  0 (bytes 04 00)
  MSCb  [ui16]  0 (bytes 04 00)
  MSCc  [ui16]  0 (bytes 04 00)
  MSCd  [ui16]  79 (bytes 01 4f)
  MSCl  [ui16]  8 (bytes 00 08)
  MSCm  [ui16]  8 (bytes 00 08)
  MSCn  [ui16]  8 (bytes 00 08)
  MSCo  [ui16]  154 (bytes 2e 9a)
  MSDW  [flag]  (bytes 00)
  MSLD  [ui8 ]  0 (bytes 00)
  MSPA  [fp6a]  (bytes 00 00)
  MSPS  [{msp]  (bytes 00)
  MSPZ  [ui8 ]  34 (bytes 22)
  MSSD  [si8 ]  (bytes 80)
  MSSE  [ui16]  0 (bytes 00 00)
  MSSF  [ui32]  0 (bytes 00 00 00 00)
  MSSP  [si8 ]  (bytes 05)
  MSSS  [{mss]  (bytes 01)
  MSTC  [ui16]  0 (bytes 00 00)
  MSTM  [ui8 ]  1 (bytes 01)
  MSTc  [ui8 ]  0 (bytes 00)
  MSTg  [ui8 ]  0 (bytes 00)
  MSTm  [ui8 ]  0 (bytes 00)
  MSWR  [ui8 ]  0 (bytes 00)
  NATJ  [ui8 ]  2 (bytes 02)
  NATi  [ui16]  29 (bytes 00 1d)
  NTOK  [ui8 ]  0 (bytes 00)
  ONMI  [ui8 ]  0 (bytes 00)
  PC0C  [fp88]  (bytes 0a db)
  PD0R  [fp88]  (bytes 18 d4)
  PG0C  [fp88]  (bytes 04 03)
  PG1C  [fp88]  (bytes 02 d1)
  PHPC  [fp88]  (bytes 11 2a)
  PN0R  [fp88]  (bytes 00 44)
  PN1R  [fp88]  (bytes 01 58)
  PN2R  [fp88]  (bytes 00 ae)
  PP0R  [fp88]  (bytes 00 42)
  PTHC  [fp88]  (bytes 2e 9a)
  RBr   [ch8*]  (bytes 00 00 00 00 00 00 00 00)
  REV   [{rev]  (bytes 01 28 0f 00 00 03)
  RMde  [char]  (bytes 41)
  RPlt  [ch8*]  (bytes 6d 38 38 00 00 00 00 00)
  RSvn  [ui32]  0 (bytes 00 00 00 00)
  RVBF  [{rev]  (bytes 01 28 0f 00 00 01)
  RVUF  [{rev]  (bytes 01 28 0f 00 00 01)
  SAS!  [ui32]  0 (bytes 00 00 00 00)
  SCIA  [ui16]  248 (bytes 03 f8)
  SCIL  [ui8 ]  (bytes 00)
  SDRd  [ui16]  0 (bytes 00 00)
  SIS!  [ui16]  0 (bytes 00 00)
  SIT!  [ui16]  0 (bytes 00 00)
  SM0x  [ui16]  0 (bytes 7f 00)
  SM0y  [ui16]  0 (bytes 7e 00)
  SM0z  [ui16]  192 (bytes 4d c0)
  SPH0  [ui16]  27 (bytes 14 1b)
  SPHS  [ui8 ]  1 (bytes 01)
  SPHT  [ui8 ]  0 (bytes 00)
  SPHZ  [ui8 ]  (bytes 00)
  SPS!  [ui16]  0 (bytes 00 00)
  TALP  [sp78]  (bytes 21 10)
  TB0T  [sp78]  (bytes 1e 19)
  TC0D  [sp78]  (bytes 2e 60)
  TC0P  [sp78]  (bytes 28 e0)
  TG0D  [sp78]  (bytes 38 80)
  TG0H  [sp78]  (bytes 2b 20)
  TG0V  [sp78]  (bytes 2b 74)
  TGTV  [sp78]  (bytes 3a c0)
  TTF0  [sp78]  (bytes 46 00)
  TW0P  [sp78]  (bytes 22 80)
  Th0H  [sp78]  (bytes 2d 20)
  Th1H  [sp78]  (bytes 25 20)
  Th2H  [sp78]  (bytes 25 c0)
  Tm0P  [sp78]  (bytes 26 c0)
  Ts0P  [sp78]  (bytes 20 20)
  UPRC  [ui16]  68 (bytes 08 44)
  VC0C  [fp2e]  (bytes 42 5e)
  VC0c  [ui16]  128 (bytes 56 80)
  VG0C  [fp2e]  (bytes 48 df)
  VG0c  [ui16]  64 (bytes 58 40)
  VG1C  [fp2e]  (bytes 73 33)
  VP0R  [fp4c]  (bytes cb 44)
  VP0r  [ui16]  64 (bytes a4 40)
  zDBG  [ui8 ]  (bytes 01)

This will help me to try out different ideas, including running the smc command with a partial charge, without the battery plugged in, and comparing with the values on a later system. Cheers!

>This is on the level of the kind of thing which someone with a thorough understandings of low-level board functions, li
I don't think you have to dump it directly from board, you could also take the firmware update blob and put that through ghidra I think. Not sure if they are encrypted or not though.

Understood. Again, thank you.
 

f54da

macrumors 6502a
Dec 22, 2021
503
185
Hm I don't see any other values other than BRSC with value 100, and BRSC is known to be current charge level

I don't see any other values at first glance that would work, unless by happenstance they exist but they are "hidden" (see the ionescu talk for how you can "cast a spell" to read from the hidden ones).
 
  • Like
Reactions: B S Magnet
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.