CMD     DIR     DATA    Description
------------------------------------------------------
0x00    r       word    ManufacturerAccess
0x01    rw      word    RemainingCapacityAlarm
0x02    rw      word    RemainingTimeAlarm
0x03    rw      word    BatteryMode
0x04    rw      word    AtRate
0x05    r       word    AtRateTimeToFull
0x06    r       word    AtRateTimeToEmpty
0x07    r       word    AtRateOK
0x08    r       word    Temperature
0x09    r       word    Voltage
0x0A    r       word    Current
0x0B    r       word    AverageCurrent
0x0C    r       word    MaxError
0x0D    r       word    RelativeStateOfCharge
0x0E    r       word    AbsoluteStateOfCharge
0x0F    r       word    RemainingCapacity
0x10    r       word    FullChargeCapacity
0x11    r       word    RunTimeToEmpty
0x12    r       word    AverageTimeToEmpty
0x13    r       word    AverageTimeToFull
0x14    r       word    ChargingCurrent
0x15    r       word    ChargingVoltage
0x16    r       word    BatteryStatus (AlarmWarning)
0x17    r       word    CycleCount
0x18    r       word    DesignCapacity
0x19    r       word    DesignVoltage
0x1A    r       word    SpecificationInfo
0x1B    r       word    ManufactureDate
0x1C    r       word    SerialNumber
...
0x20    r       block   ManufacturerName
0x21    r       block   DeviceName
0x22    r       block   DeviceChemistry
0x23    r       block   ManufacturerData (DAT:0126,DAT:0129,DAT:0120,DAT:0123,RAM:100...RAM:107,ROM:FEEC,ROM:FEED) (424344f30000be0fd00fb80f0470)
...
0x2F    r       block   OptionalMfgFunction5 (barcode DAT:019D)
0x30    r       block   (DAT:02AB...DAT:032B) 10 bytes
0x31    r       block   (DAT:0547...DAT:0571) 16 bytes
0x32    r       block   (DAT:0583...DAT:05C9) 16 bytes
0x33    r       block   (RAM:169,RAM16A,0x00,...) 24 bytes
...
0x3B    r       word    (DAT:01A1) (0c9e)
0x3C    r       block   OptionalMfgFunction4 "IBM Corporation"+(RAM:3F2,RAM:3F4,RAM:3F3,RAM:3F5) 19 bytes
0x3D    rw      word    OptionalMfgFunction3 (DAT:01F7)
0x3E    rw      word    OptionalMfgFunction2 (DAT:00F2) (0000)
0x3F    rw      word    OptionalMfgFunction1 (DAT:0221) (5158)
0x40    r       word    (DAT:0189) (0015)
0x41    r       word    (DAT:00F4) (1000)
...
0xFF    w       word    ???
 -c ff -w cdab
 -c dd -w cdab -> run bootloader

Bootloader commands:
CMD     DIR     DATA    Description
------------------------------------------------------
0xA0    w       word    erase block (ba: 1800; bb: 1000; ...)
0xA1    w       word    clear status register (password cdab)
0xA2    w       word    reset (password cdab)
0xA3    w       block   write 16 bytes starting from ADDR
0xA4    w       word    set ADDR
0xA5    r       word    read status register
0xDD    w       word    ???
0xFF    w       word    unlock cmd (password cdab)
