09-03-2012, 10:07 AM
(This post was last modified: 09-04-2012, 12:46 PM by TimeWalker.)
What could possibly be the part that is being flashed to EC? I have disassembled the wph using Phoenix tool and looked with MMTOOL, but I'm inexperienced in this matter.
I know the offset where DTS1 is written/read, I know the offset where the fan level is written and I know the value it seeks (0x3C) to enable the fan.
In theory it should be easy enough to alter this value and crank it up a little... of course if EC part of the rom can be altered at all.
Could possibly be inside:
DigitalThermalSensorSmm 77A6009E-116E-464D-8EF8-B35201A022DD_1_621
IT8518SioSmm 6E9947D6-43A4-446A-A63C-91139F2C1DB5_1_829
I know the offset where DTS1 is written/read, I know the offset where the fan level is written and I know the value it seeks (0x3C) to enable the fan.
Code:
OperationRegion (ECRM, EmbeddedControl, Zero, 0x0100)
Field (ECRM, ByteAcc, Lock, Preserve)
{
Offset (0x55),
OTPC, 8,
VGAT, 8,
CHPT, 8,
CPUT, 8,
SYST, 8, // Logic board temp
DTS1, 8, // CPU Package temp from DTS
DTS2, 8, // PCH temp from DTS
SYCS, 8,
Offset (0x5E),
HWSN, 8,
CTYP, 8,
FCNT, 1,
FTST, 1,
, 3,
FADJ, 1,
TCTL, 1,
FATO, 1,
DAC1, 8,
DAC2, 8,
FLVL, 8, // FAN0 ON/OFF
CTL1, 16,// ?????
CTL2, 16,// 0000
FANH, 8, // FAN0 RPM H Bank
FANL, 8, // FAN0 RPM L Bank
}
Could possibly be inside:
DigitalThermalSensorSmm 77A6009E-116E-464D-8EF8-B35201A022DD_1_621
IT8518SioSmm 6E9947D6-43A4-446A-A63C-91139F2C1DB5_1_829