They called it a battery firmware update, but they meant the pages of settings you can change in flash. I was able to dump raw memory from the chip, but I could never figure out which generic microcontroller the battery controller had been built on top of (at least I assumed it had been built that way), so running code was a nonstarter.