Exploring the Embedded Controller

@DHowett Great writeup and tools! And really great job RE the firmware. What is your RE tool of choice? My go to tool lately is Ghidra.

EC flash from 0x3C000 to 0x3D000 is for factory tooling to write a mix of status and some info to.

The power button is RGW, so that is why you dont get blue.
We are going to post the EC source soon. So you should get a lot of questions answered.

Some of the commands are for factory use like 3E02 is used to remap some of the keyboard keys so that we can complete keyboard functional testing in the OS during manufacturing by having them emit normal scan codes.

The laptop has 2 power buttons. There is one on the mainboard in the upper right corner. If you hold it for about 10 seconds it will perform a battery disconnect sequence to safely put the battery into ship mode. The main power button does not do this.

If you hold the main power button for about 20 seconds it will reboot the EC as you noted.

If you have any questions I am happy to answer them.

16 Likes