Acer Aspire TimelineX 3820TG mods/tweaks ONLY!

[_InKr_]

@All

I still have not found proper way to work with EC under Win7.
So I've started investigation of Acer's KBCs for BIOSes 1.17 and 1.19.

And, seems, I found where FAN speed tables (several entries) are located.
For 1.17 (W07AC114.bin) - offset 0x1c05a.
For 1.19 (W07AC115.bin) - offset 0x1c162.

Not sure if it'll work if change that speeds (maybe there is some sort of CRC used), but think - this is more preferable way to control speeds than EC.

Ok. I'd asked several BIOS modding gurus and they've told me that it seems there is no checksum here. So this is unlikely that such modification could brick the laptop. But no warranties of course. Sadly I can't try this modification by myself mainly because of warranty policy in my country (it will take 3 weeks min to get notebook back ), so I need volunteer from country with better warranty policy (RMA, etc...) to test this BIOS modding.

I can provide test version. Anybody wants to try?

Here are two reasons why you need this comparing with software fan control:
1. FAN control software itself eats battery (I've measured +0.2-0.3W for mine, it could be less for others but still is)
2. Direct read/write Embedding controller could interfere with other applications doing same thing (e.g. Battery meters) which could lead to any unexpected behavior.

[prikolchik]

I can provide test version. Anybody wants to try?

Please provide the test version with a list of changes enough to recreate the modded KBC from original. I want to know what I am flashing. 1.19 KBC. Thanks.

[_InKr_]

Please provide the test version with a list of changes enough to recreate the modded KBC from original. I want to know what I am flashing. 1.19 KBC. Thanks.

Could you send me your email in private message? Don't want to post test version here yet.

[inteks]

what is KBC ???

[Just_a_Nick]

Ok. I'd asked several BIOS modding gurus and they've told me that it seems there is no checksum here. So this is unlikely that such modification could brick the laptop. But no warranties of course. Sadly I can't try this modification by myself mainly because of warranty policy in my country (it will take 3 weeks min to get notebook back ), so I need volunteer from country with better warranty policy (RMA, etc...) to test this BIOS modding.

I can provide test version. Anybody wants to try?

Here are two reasons why you need this comparing with software fan control:
1. FAN control software itself eats battery (I've measured +0.2-0.3W for mine, it could be less for others but still is)
2. Direct read/write Embedding controller could interfere with other applications doing same thing (e.g. Battery meters) which could lead to any unexpected behavior.

Which tool did you use to disassemble the EC code?

I think you haven't only take a look at the code.

[prikolchik]

what is KBC ???

I think KBC stands for KeyBoard Controller. If you download a BIOS update v1.19, you will find a KBC folder. The firmware file in that folder is what we are all talking about.

According to the pdf included in KBC folder, flupdate.exe is a Flash Update Application for programming Nuvoton EC (Embedded Controller) flash. Basically, what KBC folder has is firmware for a micro-chip that control fans, battery, brightness levels, etc. (see first page, 2nd post of this thread)

Which tool did you use to disassemble the EC code?

I think you haven't only take a look at the code.

He did not disassemble the firmware. He just searched for the fan speeds (0xFF 0xD0 0xB6 0x9E 0x81...) in the binary file. He explains what he did right here.

Original EC firmware file W07AC115.bin (came with BIOS 1.19 update, you can download KBC folder here)

001c160: 7e7e ffd0 b69e 816f 6f6f 6fb0 ffd0 b69e  ~~.....oooo.....
001c170: 816f 6f6f 6fb0 ffd0 b69e 816f 6f6f 6fb0  .oooo......oooo.

As you can see, there seems to be THREE fan tables. I don't know why three, if there are only two fans in 3820TG.

For testing purposes, what _InKr_ did is change ALL fan speeds to max speed of 0x6f:

001c160: 7e7e 6f6f 6f6f 6f6f 6f6f 6fb0 6f6f 6f6f  ~~ooooooooo.oooo
001c170: 6f6f 6f6f 6fb0 6f6f 6f6f 6f6f 6f6f 6fb0  ooooo.ooooooooo.

Once it is confirmed that it is possible to flash to this modified EC firmware (since there could be a checksum that will not allow us to flash) and it DOES make fan rotate at maximum speed at all times, then it is possible to set different fan speeds and/or change when the fan kicks in.



We can make things a lot easier if we can somehow get the firmware source code (or at least assembly). We need to find a disassembler for our Embedded Controller firmware. I did some research, and arrived at an interesting thread here, by middleton. What he did was modify Embedded Controller firmware to swap Fn and Ctl key on IBM laptops. According to him in this post, we need to find the Embedded Controller's CPU model and then look for a disassembler for that CPU.

I could still try the hex modded EC firmware, but I would rather wait and see what middleton has to say. There just might be a more scientific way to mod the firmware.

I have already contacted middleton and asked him to help us in our noble quest.

[voltron1337]

I think you could add USB 3.0 with this

Mini PCI Express USB 3.0 Card - 2-port | StarTech.com

you would have to solder the port and replace one of the 2.0 ports on the motherboard though.

[_InKr_]

I could still try the hex modded EC firmware, but I would rather wait and see what middleton has to say. There just might be a more scientific way to mod the firmware.

I have already contacted middleton and asked him to help us in our noble quest.

Actually I've contacted him too. He was the one of experts I mentioned above .
His answer is that he can't disassembly this firmware - custom module is needed for IDA Pro .
He also found that only bootblock is protected by checksum.

I've also asked kizwan and mask89. Mask89 did similar modification for 3810. There was no checksum there.

[Sxooter]

We can make things a lot easier if we can somehow get the firmware source code (or at least assembly). We need to find a disassembler for our Embedded Controller firmware.

I think you could write a script or program to watch temp and fan speeds and intuit the temperature controlled switching points at least. Then you could program varying speeds, one set always on, one always very low, one in the middle. Just don't push the machine while it's running at medium / idle conditions, just enough to switch up one level. I'm just guessing on all this.

I did some research, and arrived at an interesting thread here, by middleton. What he did was modify Embedded Controller firmware to swap Fn and Ctl key on IBM laptops. According to him in this post, we need to find the Embedded Controller's CPU model and then look for a disassembler for that CPU.

Wow, I would pay good money ($20 or so) to switch the CTRL Fn keys on my S10. Might go have a look.

[prikolchik]

I think you could write a script or program to watch temp and fan speeds and intuit the temperature controlled switching points at least. Then you could program varying speeds, one set always on, one always very low, one in the middle. Just don't push the machine while it's running at medium / idle conditions, just enough to switch up one level. I'm just guessing on all this.

Yes, you can. But we wanted to try and see if there is a solution to modify the EC to control the fan. In addition, on Windows _InKr_ had problems reading from EC, because he kept getting garbage values. There might be a better way to work with EC on Windows, but we just haven't found it. What we could also do is add the fan as a device (with methods that poll the temperature and then change the speed according to the fan table by writing to EC) to ACPI DSDT table and mod the BIOS or simply load the modded DSDT in Windows. That way we would have ACPI way to control the fans, and as far as I know it is much easier to communicate with ACPI on Windows than it is to read/write to EC directly. It might even work with generic fan control tools!

On Linux, it is WAY easier to work with EC and fan control software can be created simply by modifying a few of the existing scripts or programs. acerhdf module comes to mind.

Actually I've contacted him too. He was the one of experts I mentioned above .
His answer is that he can't disassembly this firmware - custom module is needed for IDA Pro .
He also found that only bootblock is protected by checksum.

I've also asked kizwan and mask89. Mask89 did similar modification for 3810. There was no checksum there.

OK, I see. You should have given more information in your post about who you contacted. That way I wouldn't spend so much time on researching what has already been researched by you.

Anyway, I gave your modded EC firmware a try. Here is what happened:
1. When I press Y to flash, my fans immediately went on FULL speed and my brightness was turned off (could only see the screen by pointing light directly on it)
2. All the LEDs started blinking with about 1 second frequency.
3. The message on the screen said flash was successful, so I manually restarted the computer. When it was off, for about 5 seconds there was very weird sound coming out of the computer near the GPU fan (sounded like static, maybe computer was hissing at me? ). After restart, fans were immediately on MAX and LCD backlight was back. LEDs kept blinking.
4. I flashed back to original KBC and all was back to normal. The flashing takes about 2 seconds.

I think we should try modding each of the three fan tables separately to see what kind of effect that will have. It does not seem like you can brick your computer by changing those fan tables as my experiment has proved. It could give you a scare though

On a side note, can you give me a formula that is used to convert temperature read from EC to Celsius? I want to try and see if I can find HDD, GPU and battery temperature in the EC.