Acer Aspire TimelineX 3820TG mods/tweaks ONLY!

Discussion in 'Acer' started by prikolchik, Mar 16, 2011.

Thread Status:
Not open for further replies.
  1. _InKr_

    _InKr_ Notebook Guru

    Reputations:
    11
    Messages:
    72
    Likes Received:
    0
    Trophy Points:
    15
    Ok. I'd asked several BIOS modding gurus and they've told me that it seems there is no checksum here. So this is unlikely that such modification could brick the laptop. But no warranties of course. Sadly I can't try this modification by myself mainly because of warranty policy in my country (it will take 3 weeks min to get notebook back :(), so I need volunteer from country with better warranty policy (RMA, etc...) to test this BIOS modding.

    I can provide test version. Anybody wants to try?

    Here are two reasons why you need this comparing with software fan control:
    1. FAN control software itself eats battery (I've measured +0.2-0.3W for mine, it could be less for others but still is)
    2. Direct read/write Embedding controller could interfere with other applications doing same thing (e.g. Battery meters) which could lead to any unexpected behavior.
     
  2. prikolchik

    prikolchik Notebook Evangelist

    Reputations:
    259
    Messages:
    362
    Likes Received:
    3
    Trophy Points:
    30
    Please provide the test version with a list of changes enough to recreate the modded KBC from original. I want to know what I am flashing. 1.19 KBC. Thanks.
     
  3. _InKr_

    _InKr_ Notebook Guru

    Reputations:
    11
    Messages:
    72
    Likes Received:
    0
    Trophy Points:
    15
    Could you send me your email in private message? Don't want to post test version here yet.
     
  4. inteks

    inteks Notebook Evangelist

    Reputations:
    168
    Messages:
    372
    Likes Received:
    0
    Trophy Points:
    30
    what is KBC ???
     
  5. Just_a_Nick

    Just_a_Nick Notebook Deity

    Reputations:
    280
    Messages:
    922
    Likes Received:
    0
    Trophy Points:
    30
    Which tool did you use to disassemble the EC code?

    I think you haven't only take a look at the code.
     
  6. prikolchik

    prikolchik Notebook Evangelist

    Reputations:
    259
    Messages:
    362
    Likes Received:
    3
    Trophy Points:
    30
    I think KBC stands for KeyBoard Controller. If you download a BIOS update v1.19, you will find a KBC folder. The firmware file in that folder is what we are all talking about.

    According to the pdf included in KBC folder, flupdate.exe is a Flash Update Application for programming Nuvoton EC (Embedded Controller) flash. Basically, what KBC folder has is firmware for a micro-chip that control fans, battery, brightness levels, etc. (see first page, 2nd post of this thread)

    He did not disassemble the firmware. He just searched for the fan speeds (0xFF 0xD0 0xB6 0x9E 0x81...) in the binary file. He explains what he did right here.

    Original EC firmware file W07AC115.bin (came with BIOS 1.19 update, you can download KBC folder here)
    Code:
    001c160: 7e7e [B]ffd0 b69e 81[/B]6f 6f6f 6fb0 [B]ffd0 b69e[/B]  ~~.....oooo.....
    001c170: [B]81[/B]6f 6f6f 6fb0 [B]ffd0 b69e 81[/B]6f 6f6f 6fb0  .oooo......oooo.
    
    As you can see, there seems to be THREE fan tables. I don't know why three, if there are only two fans in 3820TG.

    For testing purposes, what _InKr_ did is change ALL fan speeds to max speed of 0x6f:
    Code:
    001c160: 7e7e [B]6f6f 6f6f 6f[/B]6f 6f6f 6fb0 [B]6f6f 6f6f[/B]  ~~ooooooooo.oooo
    001c170: [B]6f[/B]6f 6f6f 6fb0 [B]6f6f 6f6f 6f6f 6f[/B]6f 6fb0  ooooo.ooooooooo.
    
    Once it is confirmed that it is possible to flash to this modified EC firmware (since there could be a checksum that will not allow us to flash) and it DOES make fan rotate at maximum speed at all times, then it is possible to set different fan speeds and/or change when the fan kicks in.



    We can make things a lot easier if we can somehow get the firmware source code (or at least assembly). We need to find a disassembler for our Embedded Controller firmware. I did some research, and arrived at an interesting thread here, by middleton. What he did was modify Embedded Controller firmware to swap Fn and Ctl key on IBM laptops. According to him in this post, we need to find the Embedded Controller's CPU model and then look for a disassembler for that CPU.

    I could still try the hex modded EC firmware, but I would rather wait and see what middleton has to say. There just might be a more scientific way to mod the firmware.

    I have already contacted middleton and asked him to help us in our noble quest.
     
  7. voltron1337

    voltron1337 Notebook Geek

    Reputations:
    26
    Messages:
    84
    Likes Received:
    0
    Trophy Points:
    15
  8. _InKr_

    _InKr_ Notebook Guru

    Reputations:
    11
    Messages:
    72
    Likes Received:
    0
    Trophy Points:
    15
    Actually I've contacted him too. He was the one of experts I mentioned above :).
    His answer is that he can't disassembly this firmware - custom module is needed for IDA Pro :(.
    He also found that only bootblock is protected by checksum.

    I've also asked kizwan and mask89. Mask89 did similar modification for 3810. There was no checksum there.
     
  9. Sxooter

    Sxooter Notebook Virtuoso

    Reputations:
    747
    Messages:
    3,784
    Likes Received:
    8
    Trophy Points:
    106
    I think you could write a script or program to watch temp and fan speeds and intuit the temperature controlled switching points at least. Then you could program varying speeds, one set always on, one always very low, one in the middle. Just don't push the machine while it's running at medium / idle conditions, just enough to switch up one level. I'm just guessing on all this.

    Wow, I would pay good money ($20 or so) to switch the CTRL Fn keys on my S10. Might go have a look.
     
  10. prikolchik

    prikolchik Notebook Evangelist

    Reputations:
    259
    Messages:
    362
    Likes Received:
    3
    Trophy Points:
    30
    Yes, you can. But we wanted to try and see if there is a solution to modify the EC to control the fan. In addition, on Windows _InKr_ had problems reading from EC, because he kept getting garbage values. There might be a better way to work with EC on Windows, but we just haven't found it. What we could also do is add the fan as a device (with methods that poll the temperature and then change the speed according to the fan table by writing to EC) to ACPI DSDT table and mod the BIOS or simply load the modded DSDT in Windows. That way we would have ACPI way to control the fans, and as far as I know it is much easier to communicate with ACPI on Windows than it is to read/write to EC directly. It might even work with generic fan control tools!

    On Linux, it is WAY easier to work with EC and fan control software can be created simply by modifying a few of the existing scripts or programs. acerhdf module comes to mind.

    OK, I see. You should have given more information in your post about who you contacted. That way I wouldn't spend so much time on researching what has already been researched by you.

    Anyway, I gave your modded EC firmware a try. Here is what happened:
    1. When I press Y to flash, my fans immediately went on FULL speed and my brightness was turned off (could only see the screen by pointing light directly on it)
    2. All the LEDs started blinking with about 1 second frequency.
    3. The message on the screen said flash was successful, so I manually restarted the computer. When it was off, for about 5 seconds there was very weird sound coming out of the computer near the GPU fan (sounded like static, maybe computer was hissing at me? :D ). After restart, fans were immediately on MAX and LCD backlight was back. LEDs kept blinking.
    4. I flashed back to original KBC and all was back to normal. The flashing takes about 2 seconds.

    I think we should try modding each of the three fan tables separately to see what kind of effect that will have. It does not seem like you can brick your computer by changing those fan tables as my experiment has proved. It could give you a scare though :D

    On a side note, can you give me a formula that is used to convert temperature read from EC to Celsius? I want to try and see if I can find HDD, GPU and battery temperature in the EC.
     
Loading...
Thread Status:
Not open for further replies.

Share This Page