After 15 hours the balance charge isn't still finished. And I have another pack to repair.
I'm thinking to directly discharge the high voltage cell with a 3 ohm resistor.
So during balance charge, if I can see 1 cell charging much faster, I should be able to directly detect the faulty cell...