BMS Dash 1.2.0

Password-protected BMS support

Packs whose Bluetooth module asks for a password now connect directly — no
more opening the Xiaoxiang app first to unlock communication.

Enter the 6-character password when prompted. It is remembered per pack (in
the Android keystore, not in plain settings) so reconnects are automatic, and
a rejected password re-prompts instead of failing silently.

Important

This is untested on real locked hardware. The protocol was derived from
packet captures rather than from a pack I own. If yours unlocks but then
shows no data, please open an issue — that symptom points at one specific
known-missing step (the vendor's root handshake), which was left out on
purpose because it is factory-level access.

Unprotected packs are unaffected: the unlock path stays completely closed
unless a password is set for that device.

Safety

The unlock frames talk to the Bluetooth module, not the BMS controller. They
write no register, no EEPROM and no factory mode, so the app still only ever
writes register 0xE1 (volatile MOSFET on/off). Commands that would overwrite
the stored password or escalate to the vendor root key are deliberately not
implemented.

Install

Download bms-dash-1.2.0.apk below. You may need to allow installing from
unknown sources.