Considering how popular the iPhone is, there’s always going to be some counterfeits out there. I’ve been out buying various iPhone batteries to build a database of each generation’s characteristics, but one model has eluded me so far: the iPhone 5S. The iPhone 5C’s battery that I bought appears to be genuine (but with its own issues), but none of the iPhone 5S batteries I’ve bought so far (4 of them at the time of writing this blog post) were genuine. All of these fakes look like a genuine battery at first glance, but all of them share a few common traits.
Battery teardown
-
- Label with parameters listed
-
- Other side of label
The fake battery sports the usual iPhone battery information, complete with some dot-matrix printed data and a data-matrix barcode. It’s labeled with a capacity of 1560 mAh and 3.8 volts nominal voltage.
Comparison between real and fake iPhone 5S battery
The connector itself has two points for soldering the connector to provide durability. However, with the fake batteries, they are not soldered down. The two spots on the ends of the connectors are dark with a small point visible inside it (that point is the reinforcement pin on the connector). If this connector is installed in an iPhone, it will probably not come out without either damaging the battery’s connector, or worse, leave the plastic connector piece inside the phone, requiring tweezers to remove.
Connector lifted off with a hobby knife
iPhone 5S and 5C battery pinout
Removing the black protective tape reveals an iPhone 4 battery fuel gauge board. The connector is soldered to this board, with four solder points visible.
iPhone 4 battery PCB with soldered-on flat flex connector
Pulling out the PCB reveals another characteristic of these fake batteries: the positive terminal is cut short, with another metal section being clumsily spot-welded to the stub on the cell.
Note how the battery tab is poorly welded to the PCB.
Battery fuel gauge data
The battery fuel gauge requires proper programming to accurately indicate the battery’s charge status. Because of this, each iPhone battery generation has its own specific configuration.
The fake iPhone battery retains the programming for the iPhone 4’s battery, which is a designed capacity of 1420 mAh, using a bq27541 fuel gauge running version 1.25 firmware. The data inside it is often that of a used/recycled battery as well.
This data can be (partially) read out directly from the iPhone with a tool such as iBackupBot, but more data can be read if the battery is read with another tool. I have the EV2400 from Texas Instruments to read this out on a PC, but this data can be read out with a USB-to-TTL serial port, a logic gate (a logic inverter) and a small MOSFET transistor.
I created a small tool that uses this circuit to interface with the fuel gauge and read out its data. Check it out here.
Using my tool, this is the report for one of these fake batteries. Note how it is identified as an iPhone 4 battery. Don’t be fooled by the calculated state of health. It’s not accurate for this battery as the fuel gauge still thinks it’s still inside an iPhone 4 battery pack.
**** START OF HDQ BATTERY LOG REPORT **** HDQ Gas Gauge Readout Tool version 0.9 by Jason Gin Date: 9/30/2014 Time: 0:52:24 Serial port: COM26 Battery Identification ======================== DEVICE_TYPE = 0x0541, FW_VERSION = 0x0125, DESIGN_CAPACITY = 1420 mAh Battery's configuration matches that of a standard iPhone 4 battery. Basic Battery Information =========================== Device = bq27541 v.1.25, hardware rev. 0x00B5, data-flash rev. 0x0000 Voltage = 3804 mV Current = 0 mA Power = 0 mW State of charge = 45% Reported state of health = 0% Calculated state of health = 99.3% Cycle count = 14 times Time to empty = N/A (not discharging) Temperature = 27.9 °C (80.3 °F) (3009 raw) Designed capacity = 1420 mAh Heavy load capacity = 628/1410 mAh Light load capacity = 673/1455 mAh Advanced Battery Information ============================== Capacity discharged = 0 mAh Depth of discharge at last OCV update = ~778 mAh (8768 raw) Maximum load current = -200 mA Impedance Track chemistry ID = 0x0163 Reset count = 11 times Flags = 0x0180 Flag interpretation: * Fast charging allowed * Good OCV measurement taken * Not discharging Control Status = 0x6219 Control Status interpretation: * SEALED security state * SLEEP power mode * Constant-power gauging * Qmax update voltage NOT OK (Or in relax mode) * Impedance Track enabled Pack Configuration = 0x8931 Pack Configuration interpretation: * No-load reserve capacity compensation enabled * IWAKE, RSNS1, RSNS0 = 0x1 * SLEEP mode enabled * Remaining Capacity is forced to Full Charge Capacity at end of charge * Temperature sensor: External thermistor Device name length = 7 bytes Device name: bq27541 **** END OF HDQ BATTERY LOG REPORT ****
Rip It Apart - Jason's electronics blog-thingy 
hi! i have seen your interest about batteries and ic gauge control and i can give you some notice about ipad 3 battery (A1389 model). can you give me an email so i can write to you?
LikeLike
Hi Matteo,
Thanks for the offer to help! I can be reached at my personal email, ginbot86@gmail.com.
Thanks,
Jason
LikeLike
Hello! I found that the battery on iphone 5s board bred 3 i2c bus contact. at the pictures I have noted these contacts. you tried to get battery data on i2c bus? you have any information about this? Thank you for watching.
https://yadi.sk/i/B77pKVPIsoPD5
LikeLike
The I2C test pads were used for factory programming of the fuel gauge. Because the gauge has already been set to use HDQ for communication, the test pads are unusable (the process of configuring the gauge to use HDQ is irreversible).
Jason
LikeLike
the second time to fill in the firmware can not be? Thanks for the quick response
LikeLike
Yes, even reflashing the firmware won’t restore I2C access. There was an old tool from TI that can temporarily force I2C communication when in ROM mode (bootloader mode), but it will still go back to HDQ once the firmware is reprogrammed.
Jason
LikeLike
I purchased a programmer from TI – EV2300. I managed to connect the battery from the iPhone 5s using the HDQ protocol, but it didn’t work out using the I2C protocol. Tell me, is it possible to unblock the I2C protocol via the HDQ protocol in order to re-record new parameters and reuse the controller? If so, which team should I send? If not, then it turns out that this controller can no longer be used and the programmer will not help in this?
Thank you in advance for your reply and I’m sorry that I have such English. I am writing through Google Translate. (I am Андрей Бородин from Google Plus)
LikeLike
I believe the tool I mentioned can (I think it was the bq28z560 EVSW), but I never recorded what the commands were unfortunately.
LikeLike
You read this article? http://www.ti.com/lit/an/slua467b/slua467b.pdf
LikeLike
Yes I have. I’ve gotten more use from their HDQ documentation as I already have the official hardware for I2C access (my HDQ Utility currently doesn’t support it, however).
Jason
LikeLike
Hello. Do you know where we can get an original iPhone 5S battery ? I have replaced my iPhone’s battery with a new one that i supposed original but as you show it is not. Thanks.
LikeLike
iFixit might be your best bet, but I myself have not tried them before for replacement batteries. Generally it’s been a lot more difficult to find genuine replacement iPhone batteries lately.
Jason
LikeLike
Interesting to see that genuine battery reports through HDQ as 1550mAh even the package printed as 1560mAh.
I bought one from eBay, looks genuine but probably not genuine, and HDQ reports its capacity as 1560mAh, (DEVICE_TYPE = 0x0545, FW_VERSION = 0x0310, DESIGN_CAPACITY = 1560 mAh) thus doesn’t recognise it as iPhone 5S battery. LOL.
I also bought another ‘gold wrapper 2680mAh’ one so definitely not genuine but it has all the correct HDQ results and it runs okay so far. Of course it is not 2680mAh 🙂
LikeLike
Pingback: All about iPhone Batteries, and why you don't want 0 cycle | A One Mobiles and Repairs
I called into an Apple store in Westquay shopping centre in Southampton on Wednesday to purchase a new battery for my IPhone 5s at a cost of £79 after waiting an hour I was told by an assistant and then the manager that they would not replace my battery because the battery in my phone was fake I could not believe why that adopted such an attatude. A day wasted as I had travelled down from Portsmouth because no Apple store in Pompey has anyone else had this experience. Not happy RM.
LikeLike
Sorry to hear about your bad experience with Apple support. Was the battery indeed original (the phone had never been previously serviced for battery issues)?
It seems like this level of service is more common for Apple, especially nowadays. Check out Louis Rossmann’s YouTube channel – he does a lot of videos on repairing Apple devices and the shenanigans Apple is up to seems to only get worse as time goes on.
LikeLike
This was very interesting- even if I’m only finding this page in 2018… I was originally just looking for the pinout to try to hack some data out of an old (run over) phone, but I’ve also used a 5s and 4 battery to power a raspberry pi because the form factor is basically the same as the pi zero. To that end, I’ve been wondering what the maximum safe discharge rate is of one of these type batteries. I see 200mA noted, but I presume that to mean the maximum that has been delivered during regular phone use? I’ve tested these batteries at 1A discharge rate (prior to a project that uses some small steppers) and they seem to do okay. Do you have any info on this?
LikeLike
I probably wouldn’t go past about 2C discharge rate (so a few amps at most). The -200 mA you saw was a default value that the gas gauge registers as the maximum recorded load current.
LikeLike