# Berger LFP BLE Command Catalog

Status: decompiled from Berger LFP Android app `1.0.3`. Entries are based on
the bundled uni-app JavaScript code, not live BLE captures.

## GATT Surface

| UUID | Direction | Purpose |
| --- | --- | --- |
| `0000ff00-0000-1000-8000-00805f9b34fb` | service | Main JBD/BMS service |
| `0000ff01-0000-1000-8000-00805f9b34fb` | notify/read | BMS response frames |
| `0000ff02-0000-1000-8000-00805f9b34fb` | write no response | BMS command frames |

## Frame Format

Read command:

```text
DD A5 <command:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
```

Write command:

```text
DD 5A <command:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
```

Checksum:

```text
sum = command + length + sum(payload)
checksum = ((sum ^ 0xFFFF) + 1) & 0xFFFF
```

Responses observed in the parser:

```text
DD <command:8-bit> <status:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
```

## Commands In App

| Name | Frame / payload | Meaning |
| --- | --- | --- |
| Read base data | `DD A5 03 00 FF FD 77` | Pack voltage/current/SOC/capacity/MOS/temps |
| Read cell voltages | `DD A5 04 00 FF FC 77` | Per-cell voltage list |
| Read hardware version | `DD A5 05 00 FF FB 77` | ASCII hardware version |
| Enter factory mode | `DD 5A 00 02 56 78 FF 30 77` | Factory/settings mode |
| Exit factory mode | `DD 5D 01 02 28 28 FF AD 77` | Exit factory/settings mode |
| Read BMS model | `DD A5 FA 03 00 B0 04 FE 4F 77` | New-style FA parameter `0xB0`, length `4` |
| Read battery model | `DD A5 FA 03 00 9E 0C FE 59 77` | New-style FA parameter `0x9E`, length `12` |
| Read full-charge capacity | `DD A5 FA 03 00 70 01 FE 92 77` | New-style FA parameter `0x70`, length `1` |
| Read barcode, new version | `DD A5 FA 03 00 58 10 FE 95 77` | New-style FA parameter `0x58`, length `16` |
| Read manufacturer, new version | `DD A5 FA 03 00 38 10 FE B5 77` | New-style FA parameter `0x38`, length `16` |
| Read barcode, old version | `DD A5 A2 00 FF 5E 77` | Old-style barcode |
| Read manufacturer, old version | `DD A5 A0 00 FF 60 77` | Old-style manufacturer |
| Set charge/discharge MOS | `DD 5A E1 02 00 <mode> <checksum> 77` | Mode `0..3`, see below |
| Set BLE name | `FF AA 07 <len> <ascii> <check8>` | Alternate name command frame |

## MOS Control Mode

The Android app writes command `0xE1` with payload `00 <mode>`.

| Mode | Meaning inferred from app logic |
| ---: | --- |
| `0` | charge on, discharge on |
| `1` | charge off, discharge on |
| `2` | charge on, discharge off |
| `3` | charge off, discharge off |

The app response handler treats command `0xE1` status `0` as success.

## Scan Hints

The app scans using only the service filter `ff00`. It also derives a MAC-like
address from advertising data on iOS and reverses byte order when the derived
address ends in `A5`, `A4`, `12`, `52`, or `00`.

The desktop utility treats service `ff00` as the strong match and device names
containing `JBD`, `BMS`, or `BERGER` as soft hints.