The detail that jumped out at me: the lockout. A single failed handshake attempt against the Leaf's Lithium Battery Controller costs a 10-second timeout, and the challenge itself renews every 10 milliseconds across 16 lines. Reverse-engineering a moving target like that from raw bus captures takes real patience.
The maker, Dala's EV Repair, worked from hex logs on the CAN bus, where a diagnostic tool talks at ID 0x79B and the battery controller answers at ID 0x7BB. The maths behind the challenge and response turned out to combine masked bitwise rotation with sum and product operations, finished off with cyclic XOR hashing, and it was implemented in C++. That code now lives in an open source project called Battery-Emulator, whose interface can run the handshake over a local network.
The results are hard to argue with. LeafSpy readings taken before and after the change show one pack reported at 39.39 percent state of health with a 48 mV spread, rising to a reported 100.00 percent with only a 9 mV spread. On the 30 kWh packs the slides point to OEM software calibration as the fault, and in my view this tooling is exactly the right answer to that kind of problem.
There is a phone side too: the Leaf BMS Tool app, which grew out of the MyNissanLEAF forum. It handles degradation resets and flashing over OBD without any mail-in service in the middle. The BMS itself keeps watch on cell voltage, temperature and state of health. Hardware CAN bridges were also weighed against software flashing, with the limitations of each laid out, and that comparison feels like the open question here: for a given car, which route wins?
Project by Dala's EV Repair. Watch it on their YouTube channel: