any way this works w/ my machine? i am interested in using 42T4235 battery.

Sep 26 '21 09:09 q60

I'm unsure if the Embedded controller chip in chips.txt is really correct. The L420 / L520 had a ITE8502 EC, but not the L430/L530. I have a L530 here, which should be the same hardware, and it actually contains a Nuvoton NPCE885G EC (also according to the schematics: http://laptop-schematics.com/view/8924/ ). This would be a controller with CR16CPlus CPU (CompactRISC), which also matches the detected architecture of the EC code in the $01D4000.FL1 BIOS flash file. Firmware starts at offset 0x4081D0 in BIOS image file starting with "IN", shortly followed by the Copyright string "Copyright 1996-1999, all rights reserved Insyde Software Corp.".

There seems to be a thread a Thinkpad forum about the X210 EC, which seems to be the same model: https://forum.thinkpads.com/viewtopic.php?p=837219#p837219 There are 2 repositories with tools for EC patching and Checksum calculation for X210:

https://github.com/harrykipper/x210 https://github.com/jwise/x2100-ec

Maybe these informations are helpful for someone knowledgeable enough to patch the firmware. Some docs about battery authentication: https://www.ti.com/lit/pdf/slua346

Dec 02 '21 23:12 leecher1337

Some more information: The BIOS Check for Battery is in Section_PE32_image_CC71B046-CF07-4DAE-AEAD-7046845BCD8A_LenovoVideoInitDxe.efi_body.bin Maybe useful for reversing to know command?

  if (EcIoDxe->Command(EcIoDxe, 0x88) & 1)
  {
    v3 = EcIoDxe->Command(EcIoDxe, 0xC2);
    if ( v3 < 0 && !(v3 & 0x20) )
    {
      ((void (__fastcall *)(EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *))EfiHandle->ConOut->ClearScreen)(EfiHandle->ConOut);
      sub_2850(15i64);
      sub_2864(0i64, 0i64);
      v5 = L"This system does not support batteries that are not genuine Lenovo-made or \n"
            "\rauthorized. The system will continue to boot, but may not charge unauthorized \n"
            "\rbatteries. \n"
            "\r\n"
            "ATTENTION: Lenovo has no responsibility for the performance or safety of \n"
            "\runauthorized batteries, and provides no warranties for failures or damage \n"
            "\rarising out of their use. \n"
            "\r\n"
            "Press the ESC key to continue.";
      if ( v3 & 0x50 )
        v5 = L"The battery installed is not supported by this system and will not charge.\n"
              "\rPlease replace the battery with the correct Lenovo battery for this system. \n"
              "\rPress the ESC key to continue.";
      sub_287C(v5);

For better understanding of Command sequence, here is what EcIoDxe (Section_PE32_image_114CA60C-D965-4C13-BEF7-C4062248E1FA_EcIoDxe.efi_body.bin) does:

#define EC_OEM_DATA	0x68
#define EC_OEM_SC	0x6c

/* EC_SC input */
#define   EC_SMI_EVT	(1 << 6) // 1: SMI event pending
#define   EC_SCI_EVT	(1 << 5) // 1: SCI event pending
#define   EC_BURST	(1 << 4) // controller is in burst mode
#define   EC_CMD	(1 << 3) // 1: byte in data register is command
				 // 0: byte in data register is data
#define   EC_IBF	(1 << 1) // 1: input buffer full (data ready for ec)
#define   EC_OBF	(1 << 0) // 1: output buffer full (data ready for host)
/* EC_SC output */
#define   RD_EC		0x80 // Read Embedded Controller
#define   WR_EC		0x81 // Write Embedded Controller
#define   BE_EC		0x82 // Burst Enable Embedded Controller
#define   BD_EC 	0x83 // Burst Disable Embedded Controller
#define   QR_EC 	0x84 // Query Embedded Controller

EFI_STATUS __fastcall FlushInput(BYTE ecsc, BYTE ecdata)
{
  BYTE buf;
  EFI_STATUS ret;

  while (1)
  {
    ret = CpuIo->Io->Read(NULL, EfiCpuIoWidthUint8, ecsc, 1, &buf);
    if (!(buf & EC_OBF)) break;
    CpuIo->Io->Read(NULL, EfiCpuIoWidthUint8, ecdata, 1, &buf);
  }
  return ret;
}

EFI_STATUS __fastcall WaitReady(BYTE ecsc)
{
  int i;
  BYTE buf;
  EFI_STATUS ret;

  for(i = 33; i; i--)
  {
    ret = CpuIo->Io->Read(NULL, EfiCpuIoWidthUint8, ecsc, 1, &buf);
    if (!(buf & EC_OBF)) break;
    gBootSvc->Stall(30);
  }
  return ret;
}

EFI_STATUS __fastcall WaitForAnswer(BYTE ecsc)
{
  int i;
  BYTE buf;
  EFI_STATUS ret;

  for(i = 33; i; i--)
  {
    ret = CpuIo->Io->Read(NULL, EfiCpuIoWidthUint8, ecsc, 1, &buf);
    if (!(buf & EC_IBF)) break;
    gBootSvc->Stall(30);
  }
  return ret;
}

BYTE __fastcall EcOemRead(BYTE ecsc, BYTE ecdata, BYTE cmd)
{
  BYTE buf;

  FlushInput(ecsc, ecdata);
  WaitReady(ecsc);
  buf = RD_EC;
  CpuIo->Io->Write(NULL, EfiCpuIoWidthUint8, ecsc, 1, &buf);
  WaitForAnswer(ecsc);
  CpuIo->Io->Write(NULL, EfiCpuIoWidthUint8, ecdata, 1, &cmd);
  WaitForAnswer(ecsc);
  CpuIo->Io->Read(NULL, EfiCpuIoWidthUint8, ecdata, 1, &buf);
  return buf;
}

BYTE __fastcall Command(void *this, BYTE cmd)
{
    return EcOemRead(EC_OEM_SC, EC_OEM_DATA, cmd);
}

Dec 03 '21 01:12 leecher1337

As I'm not experienced with Firmware Reverse engineering, Ghidra and embedded stuff, I was unable to find the battery functions in the L530 firmware. I tried to find some clues in the firmware in order to find out where these battery authentication functions are, but they seem to work differently compared to X210 firmware. In X210 firmware, there are command packets for battery communication (struct BATT_REQ_QUERY, see bat_state_Queries and bat_prop_queries) that get sent via SMBUS. But in L530 firmware, I unfortunately cannot find such a mechanism. There also isn't much documentation on how the keyboard scancodes should map (to fix INS/DEL/POS1 etc. keys with 7-row keyboard). I found some tables referenced in scancode_do_trans, but I don't know how to map the values. So as I don't have the expertise, I'm dumping my ghidra DB in the hope that someone can pick it up and fix keyboard and battery.

Interestingly, there are 2 firmware images in the BIOS image: 1 starts at 0 (containing String G3HT40WW(1.14)) and one starting at 0x8000 (NB: Load address 20100 !). I guess the second one is the real one, even though, they seem somewhat similar. Would be interesting what the first one is...?

In Ghidra project, there are various parts. The Project is derived from https://github.com/jwise/x2100-ec/blob/master/notes/x2100-ec.gar by @jwise and I added the 2 firmware images from the dump:

File	Description
ec.bin	This is the second Firmware from L530. This should be worked on.
fw-top.bin	This is the first Firmware from L530. Don't know much about it.
x2100-ec.bin-patched	This is the x2100 firmware similar to L530, which I was comparing with
x2100-ec.bin	x2100 Working base, can be ignored
newec-gpe-patch.bin	New x2100 embedded controller FW? Not similar to L530 FW

Hopefully, someone can find out the inner workings. Project: x2100-ec_2021_12_20.zip Firmware: fw.zip

Dec 04 '21 21:12 leecher1337

Probably worth finding the EC command entry point and figuring out where it handles 0x88 and 0xC2. If you can replicate those results using something like https://github.com/exander77/x2100-ec-sys then you can pretty easily figure out what those entry points read, and then patch out whatever checks generate them (and whatever else refers to that memory...).

Dec 04 '21 23:12 jwise

Updated Ghidra project, see bat_authenticated function

My guess is that battery authentication routine is right before main():

                             **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                             long __ptrcall2 bat_authenticated(uint * param_1, uint *
             long              R1R0:4         <RETURN>
             uint *            R3R2:4         param_1
             uint *            R5R4:4         param_2
             undefined4        Stack[0x0]:4   param_1_00                              XREF[1]:     00031960(*)  
                             bat_authenticated                               XREF[1]:     FUN_0003161a:0003176e(c)  
        00031950 e7 01           push       $0x7, R7, ra
        00031952 bf 60 ea ff     ADDD       $0xffea,SP
        00031956 00 05 28 00     MOVD       $0x28,R1R0
        0003195a f0 61           ADDD       SP,R1R0
        0003195c 27 55           MOVD       param_1,R8R7
...

So maybe just patching it to:

        00031950 e7 01           push       $0x7, R7, ra
        00031952 10 5a           MOVW       $0x1,R0
        00031954 e7 03           popret     $0x7, R7, ra

works. Any volunteers? ;-)

Dec 05 '21 15:12 leecher1337

Patching L430/530 for a classic 7-row Keyboard

So I had a look at the Keyboard handling routines and found out where they keyboard layout table lies and how to edit it. The results are plenty tables that might become handy for you to patch your own keyboard layout.

Location of the keyboard table

In Firmware G3HT40WW(1.14) there are 4 layout tables located at offset 0x39916. They each have the following format (I don't count the prefix length byte in offset so that you have a "clean" keyboard layout offset matrix for the following tables):

Table format

Offset	Length	Description
Prefix	0x01	length of table at offset 0xa2 in bytes
0x00	0x90	Mapping table for the keys 0-144
0x90	0x12	bitfield, specify whether to map a key via following Fn Mapping-table or not
0xa2		Fn-Modifiers enabled in mask at offset 0x90, Array of 2 bytes per entry: [Keypress, Fn-Keypress]

Table 0 Unknown, maybe key table used on BIOS start screen..? Table 1 is the default table and the one we are interested in. It starts at offset 366BC Table 2 Unknown, can be selected with command 91h, C2h Table 3 Unknown

Here is the default layout:

Prefix: 54
Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   0E 05 0A 2E 36 55 16 4E  18 00 A2 A1 00 00 00 8C 
00000010   16 1E 26 25 3D 3E 46 45  1A 1E 1C A0 A3 00 00 00
00000020   15 1D 24 2D 3C 43 44 28  6A 00 04 00 00 00 00 00
00000030   0D 58 0C 2C 35 5B 14 54  66 82 02 00 00 00 88 00
00000040   1C 24 23 2B 3B 26 4B 4C  5D 00 00 9D 00 00 00 00
00000050   76 61 0E 34 33 12 64 52  10 00 08 00 A7 8A 00 00 
00000060   1A 22 21 2A 3A 41 49 5D  5A 00 06 A4 00 00 89 8D
00000070   67 8E 00 22 31 51 13 4A  20 A9 A8 A5 A6 8B 00 00
00000080   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
00000090   44 01 00 07 80 04 44 04  22 04 24 05 00 04 08 01
000000A0   00 00 C1 C1 10 B0 C3 C3  30 B1 C5 C5 30 B2 C7 C7
000000B0   10 B3 C9 C9 30 B4 06 CB  10 C2 04 CD 10 C3 0C CF
000000C0   10 C4 03 D1 10 C5 0B D3  10 C6 80 D5 10 C7 0A D7
000000D0   30 BB 01 D9 30 BC 09 DB  30 B9 78 DD 10 B8 07 DF
000000E0   30 BA 29 E1 10 B6 32 E3  10 D0 1B E5 10 D1 42 E7
000000F0   10 D2 4D E9 10 D3 00

Per default, a key in the table (assignment HW-scancode of 7-row Keyboard to keycode location in table will be shown in the following table) is roughly assigned to the specified scancode of Set 2. The EC contains the standard translation table to Set 1 and the CPU-Translation table. For details on the tables, see here. Thsi is pretty much standard stuff, EC will take care of Make and Break codes accordingly. For codes >=80, there is a mapping table at offset 35f7c which contains of 2 bytes per entry. First byte is scancode and second byte is index in function pointer table at 34e6c which specifies on how to translate the table entry into a keycode. For you to create your keyboard layout, here is a list of some important "special" keycodes that are provided by this table:

Int. Code	Set 2 Scancode	Description	Keycode
80	83	F7	80
81	E0 5A	Keypad Enter	81
82	E0 1F	Left GUI	82
83	E0 27	Right GUI	83
84	E0 2F	App	84
85	E0 37	Keyboard Power	85
86	E0 3F	System Sleep	86
87	E0 5E	System Wake	87
91	E1 14 77 E1 F0 14 F0 77	Pause	9E
92	E0 7E E0 F0 7E	Ctrl+Pause	9E
93	84	Alt+SysRq	9D
94	E0 7C	KP-*	9C
95		KP-*	9C
96	E0 4A	KP-/	9F
97		KP-/	9F
98	E0 70	Insert	A0
99		Insert	A0
9A		Insert	A0
9B	E0 71	Delete	A1
9C		Delete	A1
9D		Delete	A1
9E	E0 6C	Home	A2
9F		Home	A2
A0		Home	A2
A1	E0 69	End	A3
A2		End	A3
A3		End	A3
A4	E0 7D	PgUp	A4
A5		PgUp	A4
A6		PgUp	A4
A7	E0 7A	PgDn	A5
A8		PgDn	A5
A9		PgDn	A5
AA	E0 6B	Left	A6
AB		Left	A6
AC		Left	A6
AD	E0 75	Up	A7
AE		Up	A7
AF		Up	A7
B0	E0 72	Down	A8
B1		Down	A8
B2		Down	A8
B3	E0 74	Right	A9
B4		Right	A9
B5		Right	A9
B6	E0 41	Reply
B7	E0 49	?
B8	E0 3B	Stop
B9	E0 34	Play/Pause
BA	E0 23	Mute
BB	E0 32	Volume up
BC	E0 21	Volume down
BD	E0 48	Mail
BE	E0 10	Scan prev. Track
BF	E0 3A	WWW Home
C0	E0 38	WWW Back
C1	E0 30	WWW Forward
C2	E0 28	WWW Stop
C3	E0 20	WWW Refresh
C4	E0 18	WWW Favorites
C5	E0 2B	Calculator
C6	E0 40	My Computer
C7	E0 50	Media select

Please note that the Int. Code is used only internally. Codes >9B are sent through another mapping table at offset 34e88. So as a user, the Keycode column is significant, because it incorporates said mapping table. The codes are only valid up to A9, because at AA, there starts another table for the NumLock assignments which can be found at offset 35f4a:

Keycode	No-NL-Key	No-NL Scancode	NL-Key	NL Scancode
AA	7	3D	KP-7 / Home	6C
AB	8	3E	KP-8 / Up	75
AC	9	46	KP-9 / PgUp	7D
AD	U	3C	KP-4 / Left	6B
AE	I	43	KP-5	73
AF	O	44	KP-6 / Right	74
B0	J	3B	KP-1 / End	69
B1	K	42	KP-2 / Down	72
B2	L	4B	KP-3 / PgDn	7A
B3	M	3A	KP-0 / Ins	70
B4	.>	49	KP-. / Del	71
B5	/?	4A	KP-/	9F
B6	;:	4C	KP-+	79
B7	0 )	45	KP-*	7C
B8	P	4D	KP--	7B
B9	ENTER	5A	KP Enter	81
BA	- _	4E	KP--	7B
BB	[{	54	KP Enter	81
BC	/?	4A	KP-+	79
BD	;:	4C	KP--	7B
BE	0 )	45	KP-/	9F
BF	P	4D	KP-*	7C

Now in case that there is a "special" command needed that cannot be covered by a scancode above or if there is a FN-Key combination, the key cannot be identified by 1 byte in the first table. In this case, a bit is set in the long bitfield at offset 0x90 in the key table. Each bit corresponds to a key, so bit 1 is the first key from the table, bit 2 the second, etc. So the bit is determined by: scancode_table[0x90+(offset>>3)], i.e. to set a bit in this table: scancode_table[0x90+(offset>>3)]|=(1<<(offset&7)) If this bit is set, the number in the first table isn't the scancode but an index into the table at offset A2. As written, a table entry in the table at A2 consists of 2 bytes:

Scancode for normal keypress
Scancode for FN + key combination

Now there is a special handling in this table for keycodes >C0. If a code is >C0, the specified entry minus C0 is an index into the same table at A2 which then specifies a "command" code, as I call it. Command codes are identified by the first entry & 0x1F being 0x10 and the second being the command. The "commands" are the following (table not complete, if you feel like it, please complete empty/unknown entries):

Break Command codes:

Command	Description	Set 2 Scancode
B0	Mute	E0 F0 23
B1	Vol Down	E0 F0 21
B2	Vol Up	E0 F0 32
B3	Mic Shut
B4	ThinkVantage
B7	Stop	E0 F0 3B
B8	Play/Pause	E0 F0 34
B9	Scan prev. track	E0 F0 15
BA	Scan next track	E0 F0 4D
BD	Num Lock	F0 77
D1	SysReq	F0 84 F0 11
D2	ScrLk	F0 7E

Make Command codes:

Command	Description	Set 2 Scancode
B0	Mute	E0 23
B1	Vol Down	E0 21
B2	Vol Up	E0 32
B3	Mic Shut
B4	Thinkvantage
B5	?
B7	Stop	E0 3B
B8	Play/Pause	E0 34
B9	Scan prev. track	E0 15
BA	Scan next track	E0 4D
BB	Brightness down
BC	Brightness up
BD	Num Lock	77
C2	?
C3	Screen Lock
C4	Sleep
C5	WiFi on/off
C6	Lenovo Settings
C7	Switch video mode
C8	?
CC	?
D0	CtrlBrk	14 E0 7E E0 F0 7E F0 14
D1	SysReq	11 84
D2	ScrLk	7E
D3	Pause	E1 14 77 E1 F0 14 F0 77

Current layout

So analyzing the current layout and checking a 7-row keyboard gives us the following layout:

Key	Offset	Keycode	Hw-Code	Scancode Set2 Make	Fn Mapping
` ~	0	0E	00 10	0e
1 !	10	16	00 11	16
2 @	11	1E	01 11	1e
3 #	12	26	02 11	26
4 $	13	25	03 11	25
5 %	3	2E	03 10	2e
6 ^	4	36	04 10	36
7 &	14	3D	04 11	3d
`8 *`	15	3E	05 11	3e
9 (	16	46	06 11	46
0 )	17	45	07 11	45
`- _`	7	4E	07 10	4e
= +	5	55	05 10	55
Backspace	38	66	08 13	66
Tab	30	0D	00 13	0d
Q	20	15	00 12	15
W	21	1D	01 12	1d
E	22	24	02 12	24
R	23	2D	03 12	2d
T	33	2C	03 13	2c
Y	34	35	04 13	35
U	24	3C	04 12	3c
I	25	43	05 12	43
O	26	44	06 12	44
P	27	28	07 12	4d	Y
[ {	37	54	07 13	54
] }	35	5B	05 13	5b
\ \|	51	61	01 15	5d
CapsLock	31	58	01 13	58
A	40	1C	00 14	1c
S	41	24	01 14	1b	Y
D	42	23	02 14	23
F	43	2B	03 14	2b
G	53	34	03 15	34
H	54	33	04 15	33
J	44	3B	04 14	3b
K	45	26	05 14	42	Y
L	46	4B	06 14	4b
; :	47	4C	07 14	4c
' "	57	52	07 15	52
non-US-1	67	5D	07 16	0
Enter	68	5A	08 16	5a
LShift	3E	88	0E 13	12
Z	60	1A	00 16	1a
X	61	22	01 16	22
C	62	21	02 16	21
V	63	2A	03 16	2a
B	73	22	03 17	32	Y
N	74	31	04 17	31
M	64	3A	04 16	3a
, <	65	41	05 16	41
. >	66	49	06 16	49
/ ?	77	4A	07 17	4a
RShift	6E	89	0E 16	59
LCtrl	0F	8C	0F 10	14
LAlt	5D	8A	0D 15	11
space	78	20	08 17	29	Y
RAlt	7D	8B	0D 17	e0-11
RCtrl	6F	8D	0F 16	e0-14
Insert	09	A0	09 10	E0 70
Delete	0A	A1	0A 10	E0 71
Home	0C	A2	0C 10	E0 6C
End	1C	A3	0C 11	E9 69
PgUp	0B	A4	0B 10	E0 7D
PgDn	1B	A5	0B 11	E0 7A
Left	7C	A6	0C 17	e0-6b
Up	5C	A7	0C 15	e0-75
Down	7A	A8	0A 17	e0-72
Right	79	A9	09 17	e0-74
Esc	50	76	00 15	76
F1	01	05	01 10	05
F2	02	0A	02 10	06	Y
F3	32	0C	02 13	04	Y
F4	52	0E	02 15	0c	Y
F5	58	10	08 15	03	Y
F6	55	12	05 15	0b	Y
F7	36	14	06 13	83	Y
F8	06	16	06 10	0a	Y
F9	08	18	08 10	01	Y
F10	18	1A	08 11	09	Y
F11	1A	1C	0A 11	78	Y
F12	19	1E	09 11	07	Y
WWW-Back	6B		0B 16	E0 38
WWw-Fwd	7B		0B 17	E0 30
PrtScr	1D		0D 11	E0 7C
ScrLock	2D		0D 12	7E
Pause	6C		0C 16	E1 14 77 E1 F0 14 F0 77
Vol Up	2A	04	0A 12	E0 32	Y
Vol Down	3A	02	0A 13	E0 21	Y
Mute	4A	00	0A 14	E0 23	Y
ThinkVantage	5A	08	0A 15		Y
Mic Shut	6A	06	0A 16		Y
Left GUI(WIN)	39	82	09 13	E0 1F
Right GUI (Menu)	4B		0B 14	E0 27

You may have noticed that offset is just Hw-Code byte2 << 4 | byte1 If you want to watch for HW key codes i.e. to implement another keyboard, use watch -n 2 with: dd if=/sys/kernel/debug/ec/ec0/ram bs=1 count=8 skip=68382 2>/dev/null | hexdump -C

Looking at the FN-Table that gets referenced by the keys in the table above when "Fn Mapping" is Y:

Mapping	Normal	Descr	FN	Descr
0	C1	-> Mapping 1	C1	-> Mapping 01
1	10	Command	B0	Mute
2	C3	-> Mapping 3	C3	-> Mapping 03
3	30	Command	B1	Volume Down
4	C5	-> Mapping 5	C5	-> Mapping 05
5	30	Command	B2	Volume Up
6	C7	-> Mapping 7	C7	-> Mapping 07
7	10	Command	B3	Mic Shut
8	C9	-> Mapping 9	C9	-> Mapping 09
9	30	Command	B4	ThinkVantage
0A	06	F2	CB	-> Mapping 0B
0B	10	Command	C2
0C	04	F3	CD	-> Mapping 0D
0D	10	Command	C3	Screen Lock
0E	0C	F4	CF	-> Mapping 0F
0F	10	Command	C4	Sleep
10	03	F5	D1	-> Mapping 11
11	10	Command	C5	WIFI on/off
12	0B	F6	D3	-> Mapping 13
13	10	Command	C6	Lenovo settings
14	80	F7 via transtbl.	D5	-> Mapping 15
15	10	Command	C7	Switch video mode
16	0A	F8	D7	-> Mapping 17
17	30	Command	BB	Brightness down
18	01	F9	D9	-> Mapping 19
19	30	Command	BC	Brightness up
1A	09	F10	DB	-> Mapping 1B
1B	30	Command	B9	Scan prev. Track
1C	78	F11	DD	-> Mapping 1D
1D	10	Command	B8	Play/Pause
1E	07	F12	DF	-> Mapping 1F
1F	30	Command	BA	Scan next track
20	29	Space	E1	-> Mapping 21
21	10	Command	B6	Enable keyboard backlight?
22	32	B	E3	-> Mapping 23
23	10	Command	D0	Ctrl+Break
24	1B	S	E5	-> Mapping 25
25	10	Command	D1	SysReq
26	42	K	E7	-> Mapping 27
27	10	Command	D2	ScrollLock
28	4D	P	E9	-> Mapping 29
29	10	Command	D3	Pause

Patching the keyboard layout

Now that we know how the table is composed, we can re-assign the keys to the classic 7-row keyboard layout by moving some function keys around and fixing some wrong table entries (i.e. Pos1, Home, Del, PgUp, ...) also enabling NumLock. However, there is a problem with the WW-Forward and WWW-Back keys, because their entry in the internal Mapping table cannot be reached due to the key ranges assigned mentioned above. However, we see that Pause and Ctrl+Break are already mapped via the "Special" Tables for Fn, so the key codes 91 and 92 aren't really used. Therefore, we update the table at offset 35f7c at the entry for 91 to use WWW-Fwd and WWW-Back instead: These 2 entries are at offset 35f9e. Each entry consists of a Scancode and an Index to a function pointer. 01 is index for the function that just generates the E0 Make-code. So we change the table as follows:

Int. Code	Old Scanc.	Old FuncID	New Scanc.	New FuncID
91	00	04	38	01
92	01	04	30	01

After creating these 2 Keycodes, we can update the Keyboard layout table:

Key	Offset	Keycode	Fn Mapping	New Keycode	New Fn Mapping
WWW-Back	6B	00	N	91
WWw-Fwd	7B	00	N	92
PrtScr	1D	00	N	24	Y
ScrLock	2D	00	N	0C	Y
Pause	6C	00	N	22	Y
Right GUI (Menu)	4B	9D	N	84
7 &	14	3D	N	AA
8 *	15	3E	N	AB
9 (	16	46	N	AC
0 )	17	45	N	BE
U	24	3C	N	AD
I	25	43	N	AE
O	26	44	N	AF
P	27	28	Y	BF	N
S	41	24	Y	1B	N
J	44	3B	N	B0
K	45	26	Y	B1	N
L	46	4B	N	B2
; :	47	4C	N	BD
B	73	22	Y	32	N
M	64	3A	N	B3
. >	66	49	N	B4
/ ?	77	4A	N	BC
space	78	20	Y	29	N
Insert	09	00	N	A0
Delete	0A	A2	N	A1
Home	0C	00	N	18	Y
End	1C	A3	N	16	Y
PgUp	0B	A1	N	20	Y
PgDn	1B	A0	N	A5
Left	7C	A6	N	1A	Y
Up	5C	A7	N	26	Y
Down	7A	A8	N	1C	Y
Right	79	A9	N	1E	Y
F3	32	0C	Y	04	N
F8	06	16	Y	0A	N
F9	08	18	Y	01	N
F10	18	1A	Y	09	N
F11	1A	1C	Y	78	N
F12	19	1E	Y	07	N

And the FN-Table:

Mapping	Normal	FN	New Key	New FN
0B	10	C2		C3
0C	04	CD	E7
0D	10	C3		BD
16	0A	D7	A3
18	01	D9	A2
1A	09	DB	A6
1C	78	DD	A8
1E	07	DF	A9
20	29	E1	A4
22	32	E3	E9
24	1B	E5	9D
26	42	E7	A7	E8
28	4D	E9	10	B7

This finally leads us to the new keyboard layout

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   0E 05 0A 2E 36 55 0A 4E  01 A0 A1 20 18 00 00 8C
00000010   16 1E 26 25 AA AB AC BE  09 07 78 A5 16 24 00 00
00000020   15 1D 24 2D AD AE AF BF  6A 00 04 00 00 0C 00 00
00000030   0D 58 04 2C 35 5B 14 54  66 82 02 00 00 00 88 00
00000040   1C 1B 23 2B B0 B1 B2 BD  5D 00 00 84 00 00 00 00
00000050   76 61 0E 34 33 12 64 52  10 00 08 00 26 8A 00 00
00000060   1A 22 21 2A B3 41 B4 5D  5A 00 06 91 22 00 89 8D
00000070   67 8E 00 32 31 51 13 BC  29 1E 1C 92 1A 8B 00 00
00000080   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00                   
00000090   04 18 00 30 00 24 40 04  00 04 24 15 00 14 00 16
000000A0   00 00 C1 C1 10 B0 C3 C3  30 B1 C5 C5 30 B2 C7 C7
000000B0   10 B3 C9 C9 30 B4 06 CB  10 C3 E7 CD 10 BD 0C CF
000000C0   10 C4 03 D1 10 C5 0B D3  10 C6 80 D5 10 C7 A3 D7
000000D0   30 BB A2 D9 30 BC A6 DB  30 B9 A8 DD 10 B8 A9 DF
000000E0   30 BA A4 E1 10 B6 E9 E3  10 D0 9D E5 10 D1 A7 E8
000000F0   10 D2 10 B7 10 D3 00

You can try it out by compiling https://github.com/exander77/x2100-ec-sys and loading it with write support: modprobe x2100_ec_sys write_support=1

Then verify that you have the correct firmware and the original table in place: dd if=/sys/kernel/debug/ec/ec0/ram bs=1 count=247 skip=$[0x366BD] 2>/dev/null | hexdump -C

If it is the correct table from the top of this document, then you can patch the attached scancode.map in its place:

dd if=scancode.map of=/sys/kernel/debug/ec/ec0/ram bs=1 seek=$[0x366BD]

and assign the WWW-Keys accordingly:

echo -ne "\x38\x01\x30\x01" | dd of=/sys/kernel/debug/ec/ec0/ram bs=1 seek=$[0x35f9e]

Keyboard map should be in place until you remove battery and power, to make it permanent, you need to reflash bios with patched EC firmware.

Have fun.

Dec 12 '21 01:12 leecher1337

Oh wow, wait, does the EC hotpatch stuff work out of the box without having to first patch the EC firmware? That's crazy, if so. And a serious security problem.

Anyway, this would be good news for you, since it means you can try hotpatching what you suspect to be the battery authentication routine without worrying about bricking your machine.

Dec 12 '21 02:12 jwise

Yes, hotpatching works out of the box :-) Anyway, I do have a genuine battery, just wrong "model", so It's not "just" the auth check to patch, I shall have a look at the battery state machine later.

Dec 12 '21 02:12 leecher1337

Well, someone particularly daring could probably use this to write software for the EC that overwrites the flash descriptor, and therefore would allow you to me_cleaner the machine...

Dec 12 '21 02:12 jwise

When updating EC firmware, is this just a matter of Checksumming new firmware with checksum.c and placing it in the previously dumped BIOS firmware image with dd and flashing it back with flashrom or are there any other checksums to consider?

Dec 12 '21 02:12 leecher1337

I would like to ask if it is possible that someone with an programmer that is capable to do recovery can test if updating the EC Firmware would cause problems possibly with some checksums, or if it is enough to just apply the patched EC firmware to the BIOS image and reflash via flashrom. This would be very helpful. In order to carry out the test, I'd request you to do a harmless patch of the EC keyboard map, which doesn't have an effect on the proper operation of the keyboard, but shows if changing EC firmware would cause some CRC error to go off.

The EC firmware is divided into 2 parts. The first part is the loader that loads attached real firmware image to address 20100. As only the loader-Part of the firmware is checksummed, it is not necessary needed to recalculate the checksum of the loader part.

So for testing, the following steps should be carried out.

Flash most recent stock firmware with EC Firmware version Firmware G3HT40WW(1.14)
Dump BIOS with:

flashrom -p internal -r current-bios.bin --ifd -i bios
Check BIOS image so verify that we are patching the correct region

dd if=current-bios.bin bs=1 count=16 skip=$[0x41E5BD] 2>/dev/null | hexdump -C

This should result in the first row of the keyboard map:

00000000 0e 05 0a 2e 36 55 16 4e 18 00 a2 a1 00 00 00 8c |....6U.N........|

Patch an empty key mapping at offset C for test purposes:

cp current-bios.bin new-bios.bin
echo -ne "\x18" | dd conv=notrunc of=new-bios.bin bs=1 seek=$[0x41E5C9]

Flash back BIOS to machine

flashrom -p internal -w new-bios.bin --ifd -i bios
Shutdown machine, remove power connection and battery for at least 30 seconds so that embedded controller is forced to reinitialize
Power up machine, install and load https://github.com/exander77/x2100-ec-sys

modprobe x2100_ec_sys
Check memory region if the byte at offset C has changed:

dd if=/sys/kernel/debug/ec/ec0/ram bs=1 count=16 skip=$[0x366BD] 2>/dev/null | hexdump -C

Output should now read:

00000000 0e 05 0a 2e 36 55 16 4e 18 00 a2 a1 18 00 00 8c |....6U.N........|

I would be very grateful if someone can check this so that I can permanently install the 7-row keyboard firmware fix then. Thank you very much in advance!

Dec 17 '21 11:12 leecher1337

I can test this! Can you give me a test patch that swaps some keys around (e.g. Z and X) for a visible effect rather than having to check the memory?

write software for the EC that overwrites the flash descriptor, and therefore would allow you to me_cleaner the machine

No need for that when 1vyrain exists. (Note: DO NOT use disable bits in me_cleaner like -S, that fails to boot, only do the cleaning)

Dec 17 '21 13:12 valpackett

@unrelentingtech Thank you for your help! Sure, we can change something significant too, so to swap Z and X:

Flash most recent stock firmware with EC Firmware version Firmware G3HT40WW(1.14)
Create file named layout with the following contents:

00000000:00000fff fd
00400000:007fffff bios
00400000:0041ffff ec
00001000:003fffff me

Then read ec firmware with:

flashrom -p internal -l layout -r current-bios.bin -i ec

Check BIOS image to verify that we are patching the correct region

dd if=current-bios.bin bs=1 count=16 skip=$[0x41E61D] 2>/dev/null | hexdump -C

This should result in the 6th row of the keyboard map:

1a 22 21 2a 3a 41 49 5d 5a 00 06 a4 00 00 89 8d |."!*:AI]Z.......|

Swap Z and X at offset 60:

cp current-bios.bin new-bios.bin
echo -ne "\x22\x1a" | dd conv=notrunc of=new-bios.bin bs=1 seek=$[0x41E61D]

Flash back BIOS to machine

flashrom -p internal -l layout -w new-bios.bin -i ec

In case it doesn't load the new EC fw, maybe we need to change FW version in header, but I will give instructions for this just in case that it doesn't work that way.

Dec 17 '21 15:12 leecher1337

Yes, it worked! \o/

i don't like flashrom's region handling / padded format, here's how i patched the whole rom with ifdtool

% ifdtool -x ~/l430.updated.rom
% cp flashregion_1_bios.bin bios_swapped.bin
% echo -ne "\x22\x1a" | dd conv=notrunc of=bios_swapped.bin bs=1 seek=$[0x41E61D-0x400000]
% ifdtool -O l430.kbtest.rom -i bios:bios_swapped.bin ~/l430.updated.rom

BTW, I don't think there's even a way for it to "not load" anything. Looks like this EC does not have its own flash, it's all always loaded from the main SPI flash: first, flashing the stock 2.04 bios also reverts the EC version to 1.13 (as shown by the setup screen), and also there is no "flashing the EC" step after any update (just flashed from stock to 2.76 from the official bootable ISO, that seems equivalent to what my manual updates did).

Dec 18 '21 20:12 valpackett

Thank you very much for testing, this is indeed good news!

As far as I understand, you only did ifdtool splitting because of your personal preference (i.e. to have clean offsets for patching the firmware), so the method oulined by me would still work, I guess? Basically I'd do it that way to not have a dependency on ifdtool (the same could also be accomplished by just using plain dd on the flashrom file, I guess).

The keyboard patch documentation may also be usable for non-7-row keyboard users, i.e. to enable numlock functionality on their keyboards.

Battery authentication is another interesting topic with this firmware, as OP asked for it, but there are so many weird state machines in there all sending undocumented commands to the Battery controller, I fear I'm unable to understand all this stuff, I guess someone more experienced needs to have a look at it. ACPI tables also don't really enlighten me regarding all the memory locations on the communication interface to the EC.

Well, at least we have a keyboard fix, will try it out myself soon.

Dec 18 '21 21:12 leecher1337

you only did ifdtool splitting because of your personal preference

Yes, mostly because I do the modifications on my desktop, while flashrom is on a raspberry pi.

Battery authentication is another interesting topic with this firmware

Indeed. Is there any info from other machines with a similar EC that have already been patched?

Dec 18 '21 21:12 valpackett

Now took a closer look

echo -ne "\x0c\x60\x02" | dd of=/sys/kernel/debug/ec/ec0/ram bs=1 seek=$[0x1004a]

Should temporarily enable the battery. Will try to make a patch so that it permanently accepts any battery tomorrow (will need to modify some code of the state machine)

Dec 19 '21 00:12 leecher1337

Patching Thinkpad L430/L530 battery check

The Problem

The xx30 Series of Thinkpads unfortunately incorporate some kind of battery check that makes it impossible to use an aftermarket and/or xx20 series battery, even though i.e. T420 battery will perfectly fit into L530 and also works. The reason is some kind of challenge/response battery athentication mechanism in the embedded controller. This was discovered by Dr. Matthew Chapman for his X230T Thinkpad and very well documented in his blog. Unfortunately, the Thinkpad L430 and L530 series use a different embededd controller (Nuvoton NPCE885G), so work had to be done to also patch this type of controller.

The authentication routine

The authentication routine for battery authentication as pretty similar to the one that is described by ZMatt. Mainly just the order of steps is different. In Firmware G3HT40WW(1.14) the state machine routine is at 288ac. The state of the state machine including various flags is a 3 byte array at 1004a. The first 2 bytes can be seen as a little endian word, the 3rd as a byte. However, to avoid confusion, I will address each byte seperately in my description, so "byte 1" is at 1004a, "byte 2" is at 1004b, etc. The lower 5 bits of the first word are indicating the state of the autentication state machine which I partly will describe here, the other bits are various flags.

State	Description
1	Init
2	Wait for challenge to be constructed. The state machine for challenge construction and validation is at `3161a`. Start write command 0x27 (with 17-byte challenge)
3	check success, retry if necessary
4	start read command 0x28
5	check success, retry if necessary
6	start write command 0x3c (with 4-byte challenge)
7	check success, retry if necessary
8	start read command 0x3c
9	check success, retry if necessary. Challenge is validated at state machine in `3161a`. If it succeeds, bit 0x40 in byte 2 of our 3 byte array at `1004a` is set.
12	validate battery response

There are more states, but they are not interesting to us for our purpose. The 4byte challenge, that gets written in Step 6, seems to be partly composed of current system date in bytes 3 and 4. The system date can be set by BIOS with the following 91h commands:

Command	Description
5Dh xx	Set current day
5Eh xx	Set current month
5Fh xx	Set current year

If there is a failure in communicating with the Battery via SMbus, there is a error recovery handler at 282c0 which resets the state machine back to state 1 and saves the prvious state in 1004a byte 2.

If communication fails 5 times in a row, there is a failure handler at 286d4 that clears some bits of 1004a byte 2 (described later):

The state changes are:

States	Description
2, 4	Clear bit 6 in byte 2
6, 8	Clear bit 5, 7 in byte 2
19,21,23	Reset state machine to 0

In States 2-8, it sets bit 4 in 1004a byte 3 to indicate failure.

1004a Byte 2 flags (Bit numbers are zero-based, little endian):

Bit	Description
7	?
6	Battery authenticated
5	Allow charging of battery?
0-4	Previous state machine state on retry

1004a Byte 3 flags:

Bit	Description
5-7	Ununsed
4	Battery auth comm. failed, handler at `286d4` got executed
3	State 4 success, 17byte challenge read, check authentication
2	State 2 success
1	Current date has been set by BIOS with call to 91h 5Fh
0	State 12 check performed

Now let's have a look at the state transition in each 3 described bytes when inserting a battery that doesn't support authentication.

State	Byte 1	Byte 2	Byte 3
Battery in	00	22	13
Battery removed	00	02	02
Battery inserted	01	06	02
	02	26	02
	01	22	02
	02	22	02
	01	22	02
	00	22	13

So battery gets plugged in, state machine starts at 1, progresses to State 2, cryptographic challenge got prepared, 0x027 command is sent and then fails. It retries 5 times and then it finally sets error flag in byte 3 and resets state machine back to 0.

Writing a patch for the authentication routine

Judging from the states above, we want to

Go to state 12 in byte 1 (0x0C)
Have bit 5 and 6 enabled in byte 2 (0x60).
Ensure that state 12 runs, so bit 0 cleard in byte 3, but keep BIOS date/time set enabled (0x02)

So we can simply write these bytes to the state machine field and have a temporary patch for an inserted battery. But as swapping the battery etc. would reset back to the not-authenticated state, having a permanent patch would be more desirable. In order to do this, we have to skip from state 2 to state 12 and ensure that Bits 5 and 6 in byte 2 get set. Byte 3 doesn't interest us, as we can just skip over the check in state 12. So the following patch should be enough:

Address	Old instruction	Old instr. bytes	New instr.	New instr. bytes	State	Comment
28a72	BReq 0002915e	00 18 ec 06	BR *0x00028ac6	e0 18 54 00	2	Do net send battery auth challenge
28ade	ORW 0x03, R0	30 26	ORW 0x0C, R0	c0 26	2	Skip directly to state 12
28c68	BRfs 0002915	80 18 f6 04	BR 00028cc2	e0 18 5a 00	12	Always execute step (ignore byte 3 bit 0) and do not go back to state 6
28cea	TBITB $0x06,*0x1(R1R0)	60 7b 01 00	SBITB $0x06,*0x1(R1R0)	60 73 01 00	12	Set battery authenticated bit
	BRfc 00028d26	9c 11	SBITB $0x05,*0x1(R1R0)	50 73 01 00	12	Set battery charging enable bit
			BR *0x28d1e	e0 18 2c 00	12	Now go on to code where both bits were enabled

The addresses are based on RAM offset of firmware. If you want to calculate the address in firmware image, use the following calculation:

Op	Offset	Description
	400000	Offset of EC firmware in BIOS image
+	8000	Offset of code that gets loaded at memory location 20100
-	20100	Memory location of code

So the offset to add to the addresses above is 3e7f00 when patching firmware images.

Patching the authentication routine

You MUST ensure that you have the correct EC firmware version in use!! Firmware version must be: G3HT40WW(1.14) If unsure, you can check i.e. in BIOS.

Hotpatch memory at runtime

The easiest method is to just modify the state of the state machine at runtime.

Advantage: Minimal invasive, just change EC memory

Disadvantage: It only lasts as long as the battery is inserted in the machine and there is enough power so the EC doesn't shut down

How to patch:

Compile x2100-ec-sys kernel module
If already installed, remove kernel module and reload it with write support:

rmmod x2100-ec-sys
modprobe x2100_ec_sys write_support=1

Ensure that battery is already inserted.
echo -ne "\x0c\x60\x02" | dd of=/sys/kernel/debug/ec/ec0/ram bs=1 seek=$[0x1004a]

Now battery should become ready and if not full start to charge.

Hotpatch firmware code

Advantage: No permanent changes to EC firmware, if it causes bad side effects, you just need to remove battery and power to reset EC back to stock firmware. Unlike memory hotpatch, also survives battery pack change.

Disadvantage: It only lasts as long as there is enough power so the EC doesn't shut down

How to patch:

Compile x2100-ec-sys kernel module
If already installed, remove kernel module and reload it with write support:

rmmod x2100-ec-sys
modprobe x2100_ec_sys write_support=1

Patch the code from down to up so that it doesn't accidentally get jumped to while you are still patching, if it is still active during patching:

echo -ne "\x60\x73\x01\x00\x50\x73\x01\x00\xe0\x18\x2c\x00" | dd of=/sys/kernel/debug/ec/ec0/ram bs=1 seek=$((0x28cea))
echo -ne "\xe0\x18\x5a\x00" | dd of=/sys/kernel/debug/ec/ec0/ram bs=1 seek=$((0x28c68))
echo -ne "\xc0" | dd of=/sys/kernel/debug/ec/ec0/ram bs=1 seek=$((0x28ade))
echo -ne "\xe0\x18\x54\x00" | dd of=/sys/kernel/debug/ec/ec0/ram bs=1 seek=$((0x28a72))

If a battery is already inserted, kick off that state machine to rerun:

echo -ne "\x02" | dd of=/sys/kernel/debug/ec/ec0/ram bs=1 seek=$((0x1004a))

Now battery should become ready and if not full start to charge. Swapping the battery also works.

Permanently patch firmware

Advantage: Survives even power-off and battery removal, so loads again on EC-reinitialization

Disadvantage: You have to re-flash your EC firmware. If something goes wrong, you may end up with a bricked machine. Do this at your own risk. If something goes wrong, do not complain!

How to patch:

Flash most recent stock firmware with EC Firmware version G3HT40WW(1.14) so that you are at the current Firmware level and verify that stock FW works and is OK.
Create file named layout with the following contents:

00000000:00000fff fd
00400000:007fffff bios
00400000:0041ffff ec
00001000:003fffff me

Then read ec firmware with:

flashrom -p internal -l layout -r current-bios.bin -i ec

Check BIOS image to verify that we are patching the correct region

dd if=current-bios.bin bs=1 count=16 skip=$((0x3e7f00+0x28cea)) 2>/dev/null | hexdump -C

This should result in the following original code:

60 7b 01 00 9c 11 72 5d 22 5f 20 55 20 4c 20 61 |{....r]"_ U L a| `

Apply patches to image

echo -ne "\x60\x73\x01\x00\x50\x73\x01\x00\xe0\x18\x2c\x00" | dd conv=notrunc of=current-bios.bin bs=1 seek=$((0x3e7f00+0x28cea))
echo -ne "\xe0\x18\x5a\x00" | dd conv=notrunc of=current-bios.bin bs=1 seek=$((0x3e7f00+0x28c68))
echo -ne "\xc0" | dd conv=notrunc of=current-bios.bin bs=1 seek=$((0x3e7f00+0x28ade))
echo -ne "\xe0\x18\x54\x00" | dd conv=notrunc of=current-bios.bin bs=1 seek=$((0x3e7f00+0x28a72))

Flash back BIOS to machine

flashrom -p internal -l layout -w new-bios.bin -i ec
Power down machine, force reload of EC firmware by removing battery and AC power for 30 seconds

This has not been tested yet, but should work.

Good luck!

Dec 19 '21 17:12 leecher1337

You need to recompute the EC checksum before you flash it. Otherwise the machine won't boot.

Dynamically patching possibly-live code can be tricky. In my x2100 EC patch set I have some tools to build patches and to build a "safe" patch loader that operates atomically. If I remember in the morning I'll try to write more about it...

Dec 20 '21 09:12 jwise

You need to recompute the EC checksum before you flash it. Otherwise the machine won't boot.

No, I already explained that:

The EC firmware is divided into 2 parts. The first part is the loader that loads attached real firmware image to address 20100. As only the loader-Part of the firmware is checksummed, it is not necessary to recalculate the checksum of the loader part. It will remain the same, when just changing the data that gets loaded. That was the whole point of the test to check whether there is some other hidden checksum in it, but as @unrelentingtech was able to patch it without issues, there doesn't seem to be a second check.

Dynamically patching possibly-live code can be tricky. In my x2100 EC patch set I have some tools to build patches and to build a "safe" patch loader that operates atomically. If I remember in the morning I'll try to write more about it...

I just wrote my own using just bash, dd and hexdump that verifies old contents and allows hot-patching and image patching of files and sequences, I will upload it to a seperate repo soon so that you can also check, if I missed something.

Dec 20 '21 09:12 leecher1337

@unrelentingtech How did you flash the firmware on the L530? I tried flashrom -p internal -l layout -w new-bios.bin -i ec and this resulted in:

Found Winbond flash chip "W25Q64.V" (8192 kB, SPI), mapped at physical address 0x00000000ff800000.
Enabling flash write... SPI Configuration is locked down.

Reading old flash chip contents... Transaction error!
FAILED

Maybe this is due to a different flash chip than yours, could it be...?

Dec 23 '21 18:12 leecher1337

@unrelentingtech How did you flash the firmware on the L530?

With a raspberry pi and a chip clip.

You can only do internal with the 1vyrain "jailbreak" (see that thread where I was summoned from :D) on early enough firmware (2.54 or lower)

Dec 23 '21 19:12 valpackett

As 1vyrain FAQ states:

The mod is fully compatible with EC modifications, but it must be flashed before you use 1vyrain to update your BIOS.

I guess I have to find out how thinkpad-ec modifies the .FL1 files and then patch these to flash with Lenovo FW upgrade program instead of flashrom? It looks to me as the modifications just need to be carried out in the .FL1 file without any additional steps, as EC Firmware is not encrypted on L430 models. I thought that there are some UEFI checksums or stuff like that to consider, but I only find call of mec-tools which are for the encrypted firmware and L430 firmware is not encrypted and doesn't even need to be checksummed, as checksum of loader remains the same. So could it be that it's just patching .FL1 file (FW starts at offset 0x4001d0 in .FL1 file)? Would you be able to try it out?

Dec 23 '21 20:12 leecher1337

The "flashed before" thing is mostly meant for those other models that have internal flash on the EC, or whatever they have. In our case this only means that flashing the pre-baked firmware image that comes on the 1vyrain ISO (for now only on a test version for L430!) will overwrite the EC region.

But I'm not saying to use that image! You can just run the jailbreak and then use flashrom from the command line with your own stuff.

Maybe we can eventually get them to include the EC modifications in their image...

Dec 24 '21 09:12 valpackett

@unrelentingtech Shit, I modified .FL1 file with patched EC Firmware and did:

dosflash /sd /sn /ipf ec /file G3ET94WW\$01D4000.FL1

to update EC firmware. This command is based on what the official Windows update program does: winflash32 /silent /vcpu /sn /sd /v /exit /ipf bios ec /shutdown /file

So I was under the assumption that it can detect EC firmware location within FL1 file, but seems that it didn't. Any hints on how to recover? Seems I need to find someone with a chip clip and RaspPi...? I guess, that it's basically https://github.com/bibanon/Coreboot-ThinkPads/wiki/Hardware-Flashing-with-Raspberry-Pi with a different wiring for the respective BIOS chip Maybe you can guide me through the process of writing back a working BIOS+EC FW so that I don't make another mistake, as you seem to have a working setup for that. First I'd like to know where the chip is located on the board. I guess it's a WinBond W25Q64 and it looks like that

Dec 26 '21 21:12 leecher1337

The chip is.. not in the most convenient location. I've had to modify the bottom case for easy access:

Also my Pi reboots every time I connect the chip clip, but otherwise it's just standard external flashing.

upd: also the pinout seems standardized for all SOIC-8 flash chips

Dec 26 '21 22:12 valpackett

Thanks for the fast reply! Seems that it will take 1-2 weeks until I can visit someone with a chip clip to try it out.

However I'm very curious what went wrong with flashing. My assumption is that the dosflash utility flashed the start of the FL1 BIOS image to the EC area (as i.e. on other models, it flashes FL2 files which directly only contain EC ROM), as only Power button lights up as soon as I plug in power cord. But on the other hand, why does original flash utility call contain "bios" AND "ec" region as parameters, if it doesn't know the layout of the flash file. I also found code to validate EC images in the flasher that seems to only run for certain machine types (those with seperate FL2, supposedly), and which would warn if image if bogus.

If I understand currectly, the EC always loads its code from BIOS chip, so it's not possible that I bricked the EC, right?

For reproducability, here is what I did: I put this .img onto a stick (dd if=patched.l430.img of=/dev/sdX...) and then modified autoexec.bat to also contain the /sn parameter (als FL1 states these informations are not used anymore and original Flasher update routine also uses this parameter): patched.l430.zip It is worth to mention that in BIOS USB Menu UEFI booting from removable media has to be turned on, even though Legacy Boot has to be used to boot the stick, otherwise, it won't boot. If you dare, you can try it out and analyse what went wrong, but I don't know if there is a risk associated with it, even though you have an external flasher.

Dec 26 '21 23:12 leecher1337

On the L430 there is no EC flash, no "EC region" on the IFD level (EC FW is embedded in the bios) – so no flash tools should ever "know" about "it". Of course these vendor tools get reused between various models, so I'm not surprised that there is functionality that has undefined behavior on some models.

It has probably done something really stupid, I am curious now :) so I will run it soon and dump the result.

Dec 27 '21 01:12 valpackett

@q60 In the meantime, until we analyzed the reason for BIOS Update failure, you can use the hot-patching feature to solve your battery problem. This should be pretty risk-free. I made a repository with a bootable ISO to apply the patches in memory:

https://github.com/leecher1337/thinkpad-Lx30-ec/releases/tag/20211227

Dec 27 '21 01:12 leecher1337

So here's what that did (on top of a clean 2.76 FW):

Relatively long diff of the whole SPI flash

@@ -11337,9 +11337,12 @@
 │00032c00│ 0e 1c 02 c8 f0 00 02 00 ┊ ff 40 00 0e 1c 03 c8 f0 │•••××0•0┊×@0•••××│
 │00032c10│ 00 2a 00 00 48 00 0e 1d ┊ 00 c8 f0 00 02 00 ff 40 │0*00H0••┊0××0•0×@│
 │00032c20│ 00 0e 1d 01 c8 f0 00 2a ┊ 00 00 48 00 0e 1d 02 c8 │0•••××0*┊00H0•••×│
-│00032c30│ f0 00 02 00 ff 40 00 0e ┊ 1d 03 dc f0 00 2a 00 00 │×0•0×@0•┊••××0*00│
-│00032c40│ 48 00 0e 1e 01 dc f0 00 ┊ 02 00 ff 40 00 0e 1e 02 │H0•••××0┊•0×@0•••│
-│00032c50│ ff ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │××××××××┊××××××××│
+│00032c30│ f0 00 02 00 ff 40 00 0e ┊ 1d 03 c8 f0 00 2a 00 00 │×0•0×@0•┊••××0*00│
+│00032c40│ 48 00 0e 1e 01 c8 f0 00 ┊ 02 00 ff 40 00 0e 1e 02 │H0•••××0┊•0×@0•••│
+│00032c50│ c8 f0 00 2a 00 00 48 00 ┊ 0e 1e 03 c8 f0 00 02 00 │××0*00H0┊•••××0•0│
+│00032c60│ ff 40 00 0e 1f 01 dc f0 ┊ 00 2a 00 00 48 00 0e 1f │×@0•••××┊0*00H0••│
+│00032c70│ 02 dc f0 00 02 00 ff 40 ┊ 00 0e 1f 03 ff ff ff ff │•××0•0×@┊0•••××××│
+│00032c80│ ff ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │××××××××┊××××××××│
 │*       │                         ┊                         │        ┊        │
 │00034000│ 0c 78 fc ff 00 00 00 00 ┊ ff ff ff ff ff ff ff ff │_x××0000┊××××××××│
 │00034010│ ff 1f 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │×•000000┊00000000│
@@ -13283,13 +13286,13 @@
 │0003c010│ ff 1f 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │×•000000┊00000000│
 │0003c020│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 10 00 00 00 │00000000┊0000•000│
 │0003c030│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
-│0003c040│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 f0 ff ff ff │00000000┊0000××××│
+│0003c040│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 ff │00000000┊0000000×│
 │0003c050│ ff ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │××××××××┊××××××××│
 │*       │                         ┊                         │        ┊        │
 │0003c090│ 00 01 02 03 04 05 06 07 ┊ 08 09 0a 0b 0c 0d 0e 0f │0•••••••┊•__•__••│
-│0003c0a0│ 10 11 12 13 14 15 16 17 ┊ 18 19 1a 1b 1c 1d 1e ff │••••••••┊•••••••×│
-│0003c0b0│ ff ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │××××××××┊××××××××│
-│*       │                         ┊                         │        ┊        │
+│0003c0a0│ 10 11 12 13 14 15 16 17 ┊ 18 19 1a 1b 1c 1d 1e 1f │••••••••┊••••••••│
+│0003c0b0│ 20 ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │ ×××××××┊××××××××│
+│0003c0c0│ ff ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │××××××××┊××××××××│
 │0003c0d0│ 80 1f 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │×•000000┊00000000│
 │0003c0e0│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 ff │00000000┊0000000×│
 │0003c0f0│ a1 10 0e 01 00 ae ee b8 ┊ 0f 38 01 00 00 00 00 00 │×•••0×××┊•8•00000│
@@ -13747,8 +13750,27 @@
 │0003dea0│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
 │*       │                         ┊                         │        ┊        │
 │0003ded0│ 00 00 ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │00××××××┊××××××××│
-│0003dee0│ ff ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │××××××××┊××××××××│
+│0003dee0│ a3 20 0e 1f 00 00 01 02 ┊ 03 04 05 06 07 08 09 0a │× ••00••┊••••••__│
+│0003def0│ 0b 0c 0d 0e 0f 06 06 06 ┊ 06 06 06 00 00 00 00 01 │•__•••••┊•••0000•│
+│0003df00│ 80 2f 01 04 04 01 01 00 ┊ 00 00 00 00 00 00 00 00 │×/•••••0┊00000000│
+│0003df10│ 00 00 00 00 00 00 00 00 ┊ 00 04 01 01 10 00 01 00 │00000000┊0••••0•0│
+│0003df20│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 ff │00000000┊0000000×│
+│0003df30│ 81 42 36 5e 27 00 68 00 ┊ 00 00 00 00 00 00 00 00 │×B6^'0h0┊00000000│
+│0003df40│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
 │*       │                         ┊                         │        ┊        │
+│0003df70│ 00 00 ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │00××××××┊××××××××│
+│0003df80│ 82 4a 00 01 02 03 04 05 ┊ 06 07 08 09 0a 0b 0c 0d │×J0•••••┊•••__•__│
+│0003df90│ 0e 0f 06 06 06 06 06 06 ┊ 00 00 00 00 00 00 00 00 │••••••••┊00000000│
+│0003dfa0│ 01 01 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │••000000┊00000000│
+│0003dfb0│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
+│0003dfc0│ 00 00 00 00 00 00 00 00 ┊ 00 00 ff ff ff ff ff ff │00000000┊00××××××│
+│0003dfd0│ a3 30 0e 20 00 36 5e 27 ┊ 00 d0 00 00 00 00 00 00 │×0• 06^'┊0×000000│
+│0003dfe0│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
+│*       │                         ┊                         │        ┊        │
+│0003e000│ 80 17 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │×•000000┊00000000│
+│0003e010│ 00 00 00 00 00 00 00 ff ┊ ff ff ff ff ff ff ff ff │0000000×┊××××××××│
+│0003e020│ ff ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │××××××××┊××××××××│
+│*       │                         ┊                         │        ┊        │
 │00040000│ ff 78 ff ff 00 00 00 00 ┊ ff ff ff ff ff ff ff ff │×x××0000┊××××××××│
 │00040010│ ff ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │××××××××┊××××××××│
 │*       │                         ┊                         │        ┊        │
@@ -81597,13 +81619,13 @@
 │00410940│ 00 18 1e 07 70 5d 00 5f ┊ 04 55 24 4c 04 61 34 4c │0•••p]0_┊•U$L•a4L│
 │00410950│ 24 00 01 00 4a 00 14 90 ┊ 81 49 b1 22 1f 00 04 90 │$0•0J0•×┊×I×"•0•×│
 │00410960│ b0 22 e0 ff 10 27 04 d0 ┊ e0 18 f6 06 00 c0 a2 8b │×"××•'•×┊×•×•0×××│
-│00410970│ 00 50 00 18 ec 06 70 5d ┊ 00 5f 02 55 22 4c 02 61 │0P0•×•p]┊0_•U"L•a│
+│00410970│ 00 50 e0 18 54 00 70 5d ┊ 00 5f 02 55 22 4c 02 61 │0P×•T0p]┊0_•U"L•a│
 │00410980│ 32 4c 22 00 01 00 4e 00 ┊ 00 c0 84 8e 72 59 ff c0 │2L"0•0N0┊0×××rY××│
 │00410990│ 15 fe 00 01 10 58 00 01 ┊ 72 5d 22 5f 20 55 20 4c │•×0••X0•┊r]"_ U L│
 │004109a0│ 20 61 30 4c 20 00 01 00 ┊ 4e 00 10 01 b5 58 11 00 │ a0L 0•0┊N0••×X•0│
 │004109b0│ b4 58 27 00 b3 58 16 00 ┊ 72 59 ff c0 cd 96 8f 60 │×X'0×X•0┊rY×××××`│
 │004109c0│ 00 50 00 18 9c 06 70 5d ┊ 00 5f 02 55 22 4c 02 61 │0P0•×•p]┊0_•U"L•a│
-│004109d0│ 32 4c 22 00 01 00 4a 00 ┊ 02 90 b0 22 e0 ff 30 26 │2L"0•0J0┊•××"××0&│
+│004109d0│ 32 4c 22 00 01 00 4a 00 ┊ 02 90 b0 22 e0 ff c0 26 │2L"0•0J0┊•××"×××&│
 │004109e0│ e0 18 7c 06 70 5d 00 5f ┊ 02 55 22 4c 02 61 32 4c │×•|•p]0_┊•U"L•a2L│
 │004109f0│ 22 00 01 00 4a 00 b0 58 ┊ 20 00 02 f3 1e 01 72 59 │"0•0J0×X┊ 0•×••rY│
 │00410a00│ ff c0 a3 fd 0f f0 72 5d ┊ 22 5f 20 55 20 4c 20 61 │××××•×r]┊"_ U L a│
@@ -81628,7 +81650,7 @@
 │00410b30│ 30 05 70 5d 00 5f 02 55 ┊ 22 4c 02 61 32 4c 22 00 │0•p]0_•U┊"L•a2L"0│
 │00410b40│ 01 00 4a 00 02 90 b0 22 ┊ e0 ff b0 26 09 00 e0 18 │•0J0•××"┊×××&_0×•│
 │00410b50│ 0e 05 72 5d 22 5f 20 55 ┊ 20 4c 20 61 30 4c 20 00 │••r]"_ U┊ L a0L 0│
-│00410b60│ 01 00 4a 00 30 7b 02 00 ┊ 80 18 f6 04 20 55 22 4c │•0J00{•0┊×•×• U"L│
+│00410b60│ 01 00 4a 00 30 7b 02 00 ┊ e0 18 5a 00 20 55 22 4c │•0J00{•0┊×•Z0 U"L│
 │00410b70│ 02 61 32 4c 22 00 01 00 ┊ 6e 00 02 b1 00 50 12 12 │•a2L"0•0┊n0•×0P••│
 │00410b80│ 72 59 ff c0 cd f3 00 50 ┊ 1d 11 70 5d 00 5f 02 55 │rY××××0P┊••p]0_•U│
 │00410b90│ 22 4c 02 61 32 4c 22 00 ┊ 01 00 4a 00 02 90 b0 22 │"L•a2L"0┊•0J0•××"│
@@ -81636,8 +81658,8 @@
 │00410bb0│ 34 4c 24 00 01 00 6e 00 ┊ 04 b1 10 30 04 f1 e0 18 │4L$0•0n0┊•×•0•××•│
 │00410bc0│ a0 04 72 5d 22 5f 20 55 ┊ 20 4c 20 61 30 4c 20 00 │×•r]"_ U┊ L a0L 0│
 │00410bd0│ 01 00 6e 00 00 83 01 00 ┊ 72 5d 22 5f 20 55 20 4c │•0n00×•0┊r]"_ U L│
-│00410be0│ 20 61 30 4c 20 00 01 00 ┊ 4a 00 60 7b 01 00 9c 11 │ a0L 0•0┊J0`{•0×•│
-│00410bf0│ 72 5d 22 5f 20 55 20 4c ┊ 20 61 30 4c 20 00 01 00 │r]"_ U L┊ a0L 0•0│
+│00410be0│ 20 61 30 4c 20 00 01 00 ┊ 4a 00 60 73 01 00 50 73 │ a0L 0•0┊J0`s•0Ps│
+│00410bf0│ 01 00 e0 18 2c 00 20 4c ┊ 20 61 30 4c 20 00 01 00 │•0×•,0 L┊ a0L 0•0│
 │00410c00│ 4a 00 50 7b 01 00 8c 10 ┊ 20 55 22 4c 02 61 32 4c │J0P{•0×•┊ U"L•a2L│
 │00410c10│ 22 00 01 00 4a 00 02 90 ┊ 10 49 00 50 05 10 10 00 │"0•0J0•×┊•I0P•••0│
 │00410c20│ 00 71 84 04 e4 10 10 00 ┊ 00 b1 84 04 72 5d 22 5f │0q×•×••0┊0××•r]"_│
@@ -85004,8 +85026,8 @@
 │0041de60│ 4a 9f 4c 79 45 7c 4d 7b ┊ 5a 81 4e 7b 54 81 4a 79 │J×LyE|M{┊Z×N{T×Jy│
 │0041de70│ 4c 7b 45 9f 4d 7c 00 00 ┊ 00 00 00 00 83 00 5a 01 │L{E×M|00┊0000×0Z•│
 │0041de80│ 1f 01 27 01 2f 01 37 01 ┊ 3f 01 5e 01 02 05 04 05 │••'•/•7•┊?•^•••••│
-│0041de90│ 08 05 08 06 10 05 10 06 ┊ 40 05 20 05 00 00 00 04 │••••••••┊@• •000•│
-│0041dea0│ 01 04 84 00 7c 01 7c 03 ┊ 4a 01 4a 02 70 01 70 02 │••×0|•|•┊J•J•p•p•│
+│0041de90│ 08 05 08 06 10 05 10 06 ┊ 40 05 20 05 00 00 38 01 │••••••••┊@• •008•│
+│0041dea0│ 30 01 84 00 7c 01 7c 03 ┊ 4a 01 4a 02 70 01 70 02 │0•×0|•|•┊J•J•p•p•│
 │0041deb0│ 70 03 71 01 71 02 71 03 ┊ 6c 01 6c 02 6c 03 69 01 │p•q•q•q•┊l•l•l•i•│
 │0041dec0│ 69 02 69 03 7d 01 7d 02 ┊ 7d 03 7a 01 7a 02 7a 03 │i•i•}•}•┊}•z•z•z•│
 │0041ded0│ 6b 01 6b 02 6b 03 75 01 ┊ 75 02 75 03 72 01 72 02 │k•k•k•u•┊u•u•r•r•│
@@ -85119,22 +85141,22 @@
 │0041e590│ 2d 36 36 36 36 36 36 36 ┊ 2a 36 36 36 36 36 36 36 │-6666666┊*6666666│
 │0041e5a0│ 36 36 36 36 36 36 36 36 ┊ 36 00 00 00 00 00 00 00 │66666666┊60000000│
 │0041e5b0│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 54 0e 05 0a │00000000┊0000T••_│
-│0041e5c0│ 2e 36 55 16 4e 18 00 a2 ┊ a1 00 00 00 8c 16 1e 26 │.6U•N•0×┊×000×••&│
-│0041e5d0│ 25 3d 3e 46 45 1a 1e 1c ┊ a0 a3 00 00 00 15 1d 24 │%=>FE•••┊××000••$│
-│0041e5e0│ 2d 3c 43 44 28 6a 00 04 ┊ 00 00 00 00 00 0d 58 0c │-<CD(j0•┊00000_X_│
-│0041e5f0│ 2c 35 5b 14 54 66 82 02 ┊ 00 00 00 88 00 1c 24 23 │,5[•Tf×•┊000×0•$#│
-│0041e600│ 2b 3b 26 4b 4c 5d 00 00 ┊ 9d 00 00 00 00 76 61 0e │+;&KL]00┊×0000va•│
-│0041e610│ 34 33 12 64 52 10 00 08 ┊ 00 a7 8a 00 00 1a 22 21 │43•dR•0•┊0××00•"!│
-│0041e620│ 2a 3a 41 49 5d 5a 00 06 ┊ a4 00 00 89 8d 67 8e 00 │*:AI]Z0•┊×00××g×0│
-│0041e630│ 22 31 51 13 4a 20 a9 a8 ┊ a5 a6 8b 00 00 00 00 00 │"1Q•J ××┊×××00000│
-│0041e640│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 44 01 00 │00000000┊00000D•0│
-│0041e650│ 07 80 04 44 04 22 04 24 ┊ 05 00 04 08 01 00 00 c1 │•×•D•"•$┊•0•••00×│
+│0041e5c0│ 2e 36 55 0a 4e 01 a0 a1 ┊ 20 18 00 00 8c 16 1e 26 │.6U_N•××┊ •00×••&│
+│0041e5d0│ 25 aa ab ac be 09 07 78 ┊ a5 16 24 00 00 15 1d 24 │%××××_•x┊×•$00••$│
+│0041e5e0│ 2d ad ae af bf 6a 00 04 ┊ 00 00 0c 00 00 0d 58 04 │-××××j0•┊00_00_X•│
+│0041e5f0│ 2c 35 5b 14 54 66 82 02 ┊ 00 00 00 88 00 1c 1b 23 │,5[•Tf×•┊000×0••#│
+│0041e600│ 2b b0 b1 b2 bd 5d 00 00 ┊ 84 00 00 00 00 76 61 0e │+××××]00┊×0000va•│
+│0041e610│ 34 33 12 64 52 10 00 08 ┊ 00 26 8a 00 00 1a 22 21 │43•dR•0•┊0&×00•"!│
+│0041e620│ 2a b3 41 b4 5d 5a 00 06 ┊ 91 22 00 89 8d 67 8e 00 │*×A×]Z0•┊×"0××g×0│
+│0041e630│ 32 31 51 13 bc 29 1e 1c ┊ 92 1a 8b 00 00 00 00 00 │21Q•×)••┊×•×00000│
+│0041e640│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 04 18 00 │00000000┊00000••0│
+│0041e650│ 30 00 24 40 04 00 04 24 ┊ 15 00 14 00 16 00 00 c1 │00$@•0•$┊•0•0•00×│
 │0041e660│ c1 10 b0 c3 c3 30 b1 c5 ┊ c5 30 b2 c7 c7 10 b3 c9 │×•×××0××┊×0×××•××│
-│0041e670│ c9 30 b4 06 cb 10 c2 04 ┊ cd 10 c3 0c cf 10 c4 03 │×0×•×•×•┊×•×_×•×•│
-│0041e680│ d1 10 c5 0b d3 10 c6 80 ┊ d5 10 c7 0a d7 30 bb 01 │×•×•×•××┊×•×_×0×•│
-│0041e690│ d9 30 bc 09 db 30 b9 78 ┊ dd 10 b8 07 df 30 ba 29 │×0×_×0×x┊×•×•×0×)│
-│0041e6a0│ e1 10 b6 32 e3 10 d0 1b ┊ e5 10 d1 42 e7 10 d2 4d │×•×2×•×•┊×•×B×•×M│
-│0041e6b0│ e9 10 d3 00 5c 0e 05 1e ┊ 2e 36 55 2a 4e 01 a0 a1 │×•×0\•••┊.6U*N•××│
+│0041e670│ c9 30 b4 06 cb 10 c3 e7 ┊ cd 10 bd 0c cf 10 c4 03 │×0×•×•××┊×•×_×•×•│
+│0041e680│ d1 10 c5 0b d3 10 c6 80 ┊ d5 10 c7 a3 d7 30 bb a2 │×•×•×•××┊×•×××0××│
+│0041e690│ d9 30 bc a6 db 30 b9 a8 ┊ dd 10 b8 a9 df 30 ba a4 │×0×××0××┊×•×××0××│
+│0041e6a0│ e1 10 b6 e9 e3 10 d0 9d ┊ e5 10 d1 a7 e8 10 d2 10 │×•×××•××┊×•×××•×•│
+│0041e6b0│ b7 10 d3 00 5c 0e 05 1e ┊ 2e 36 55 2a 4e 01 a0 a1 │×•×0\•••┊.6U*N•××│
 │0041e6c0│ 0c 1a 00 00 8c 16 1e 26 ┊ 25 aa ab ac 45 09 2c 78 │_•00×••&┊%×××E_,x│
 │0041e6d0│ a5 18 00 00 00 15 1d 24 ┊ 2d ad ae af 4d 00 00 06 │×•000••$┊-×××M00•│
 │0041e6e0│ 00 00 1c 00 00 0d 58 20 ┊ 2c 35 5b 28 54 66 82 04 │00•00_X ┊,5[(Tf×•│
@@ -212465,7 +212487,7 @@
 │006f15a0│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 ff │00000000┊0000000×│
 │006f15b0│ 00 e3 5d 1e 00 0e 00 0f ┊ 00 07 00 00 00 00 00 00 │0×]•0•0•┊0•000000│
 │006f15c0│ 00 00 60 01 00 00 00 00 ┊ 00 00 00 00 01 ff 00 e3 │00`•0000┊0000•×0×│
-│006f15d0│ cd 0d 00 0e 00 10 00 07 ┊ 00 00 00 01 e3 cc 0d 00 │×_0•0•0•┊000•××_0│
+│006f15d0│ cd 0d 00 0e 00 10 00 07 ┊ 00 00 00 01 83 cc 0d 00 │×_0•0•0•┊000•××_0│
 │006f15e0│ 0f 00 11 00 07 00 00 00 ┊ 00 e3 c3 0e 00 0b 00 12 │•0•0•000┊0××•0•0•│
 │006f15f0│ 00 07 00 00 00 0b 00 e3 ┊ 0b 14 00 10 00 13 00 03 │0•000•0×┊••0•0•0•│
 │006f1600│ 00 00 00 18 d0 f9 da 00 ┊ 00 00 00 e3 2d 14 00 11 │000•×××0┊000×-•0•│
@@ -212482,7 +212504,7 @@
 │006f16b0│ 00 1b 00 07 00 00 00 ff ┊ ff ff ff 00 00 00 00 e3 │0•0•000×┊×××0000×│
 │006f16c0│ a0 2a 00 13 00 1c 00 07 ┊ 00 00 00 00 00 00 00 00 │×*0•0•0•┊00000000│
 │006f16d0│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
-│006f16e0│ 00 00 00 00 00 00 00 00 ┊ 00 e3 85 5c 00 14 00 1d │00000000┊0××\0•0•│
+│006f16e0│ 00 00 00 00 00 00 00 00 ┊ 00 83 85 5c 00 14 00 1d │00000000┊0××\0•0•│
 │006f16f0│ 00 07 00 00 00 09 00 00 ┊ 00 60 00 00 00 0a 00 00 │0•000_00┊0`000_00│
 │006f1700│ 00 00 01 00 00 00 00 00 ┊ 00 00 10 00 00 06 00 00 │00•00000┊00•00•00│
 │006f1710│ 00 36 3a 00 00 05 00 00 ┊ 00 00 02 00 00 03 00 00 │06:00•00┊00•00•00│
@@ -212566,7 +212588,7 @@
 │006f1bf0│ 75 00 6e 00 63 00 68 00 ┊ 69 00 6e 00 67 00 20 00 │u0n0c0h0┊i0n0g0 0│
 │006f1c00│ 74 00 68 00 65 00 20 00 ┊ 72 00 65 00 63 00 6f 00 │t0h0e0 0┊r0e0c0o0│
 │006f1c10│ 76 00 65 00 72 00 79 00 ┊ 20 00 75 00 74 00 69 00 │v0e0r0y0┊ 0u0t0i0│
-│006f1c20│ 6c 00 69 00 74 00 79 00 ┊ 00 00 e3 84 3c 00 0f 00 │l0i0t0y0┊00××<0•0│
+│006f1c20│ 6c 00 69 00 74 00 79 00 ┊ 00 00 83 84 3c 00 0f 00 │l0i0t0y0┊00××<0•0│
 │006f1c30│ 28 00 07 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │(0•00000┊00000000│
 │006f1c40│ 00 00 01 00 00 01 00 00 ┊ 00 00 00 00 00 00 00 00 │00•00•00┊00000000│
 │006f1c50│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
@@ -212846,10 +212868,10 @@
 │006f2f90│ 00 6f 00 74 00 20 00 49 ┊ 00 6e 00 73 00 74 00 61 │0o0t0 0I┊0n0s0t0a│
 │006f2fa0│ 00 6c 00 6c 00 65 00 64 ┊ 00 00 00 00 00 00 80 00 │0l0l0e0d┊000000×0│
 │006f2fb0│ 00 00 00 00 00 00 00 18 ┊ c2 61 ca 00 00 00 00 00 │0000000•┊×a×00000│
-│006f2fc0│ 00 00 00 00 00 00 00 a0 ┊ c9 44 c9 e3 28 2a 00 0b │0000000×┊×D××(*0•│
+│006f2fc0│ 00 00 00 00 00 00 00 a0 ┊ c9 44 c9 83 28 2a 00 0b │0000000×┊×D××(*0•│
 │006f2fd0│ 00 54 00 07 00 00 00 02 ┊ 01 0c 00 d0 41 03 0a 00 │0T0•000•┊•_0×A•_0│
 │006f2fe0│ 00 00 00 01 01 06 00 00 ┊ 02 02 03 08 00 00 01 01 │000•••00┊••••00••│
-│006f2ff0│ 80 7f ff 04 00 e3 34 3a ┊ 00 0b 00 55 00 07 00 00 │×•×•0×4:┊0•0U0•00│
+│006f2ff0│ 80 7f ff 04 00 83 34 3a ┊ 00 0b 00 55 00 07 00 00 │×•×•0×4:┊0•0U0•00│
 │006f3000│ 00 02 01 0c 00 d0 41 03 ┊ 0a 00 00 00 00 01 01 06 │0••_0×A•┊_0000•••│
 │006f3010│ 00 00 1f 02 01 0c 00 d0 ┊ 41 05 0a 00 00 00 00 02 │00•••_0×┊A•_0000•│
 │006f3020│ 01 0c 00 d0 41 03 03 00 ┊ 00 00 00 7f ff 04 00 e3 │•_0×A••0┊000•×•0×│
@@ -213051,19 +213073,19 @@
 │006f3dd0│ 22 00 00 00 00 46 65 00 ┊ 00 95 7e 00 00 83 5d 0d │"0000Fe0┊0×~00×]_│
 │006f3de0│ 00 34 00 5b 00 07 00 00 ┊ 00 00 83 b7 22 00 0b 00 │040[0•00┊00××"0•0│
 │006f3df0│ 5c 00 07 00 00 00 02 01 ┊ 0c 00 d0 41 03 0a 00 00 │\0•000••┊_0×A•_00│
-│006f3e00│ 00 00 01 01 06 00 00 02 ┊ 7f ff 04 00 e3 7b 0e 00 │00•••00•┊•×•0×{•0│
-│006f3e10│ 0b 00 5d 00 07 00 00 00 ┊ 08 00 e3 5f 06 01 35 00 │•0]0•000┊•0×_••50│
+│006f3e00│ 00 00 01 01 06 00 00 02 ┊ 7f ff 04 00 83 7b 0e 00 │00•••00•┊•×•0×{•0│
+│006f3e10│ 0b 00 5d 00 07 00 00 00 ┊ 08 00 83 5f 06 01 35 00 │•0]0•000┊•0×_••50│
 │006f3e20│ 5e 00 07 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │^0•00000┊00000000│
 │006f3e30│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
 │*       │                         ┊                         │        ┊        │
-│006f3f20│ e3 57 10 00 36 00 5f 00 ┊ 03 00 00 00 01 00 00 00 │×W•060_0┊•000•000│
+│006f3f20│ 83 57 10 00 36 00 5f 00 ┊ 03 00 00 00 01 00 00 00 │×W•060_0┊•000•000│
 │006f3f30│ e1 69 16 00 37 00 3f 3e ┊ ec 3a 42 53 4b 4e b4 65 │×i•070?>┊×:BSKN×e│
 │006f3f40│ b9 69 9b 73 76 ba e2 94 ┊ 20 00 60 00 53 00 79 00 │×i×sv×××┊ 0`0S0y0│
 │006f3f50│ 73 00 74 00 65 00 6d 00 ┊ 53 00 65 00 63 00 75 00 │s0t0e0m0┊S0e0c0u0│
 │006f3f60│ 72 00 65 00 00 00 e3 31 ┊ 34 00 37 00 60 00 03 00 │r0e000×1┊4070`0•0│
 │006f3f70│ 00 00 01 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00•00000┊00000000│
 │006f3f80│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
-│006f3f90│ 00 00 00 00 00 00 00 00 ┊ 00 00 e3 3c 10 00 32 00 │00000000┊00×<•020│
+│006f3f90│ 00 00 00 00 00 00 00 00 ┊ 00 00 83 3c 10 00 32 00 │00000000┊00×<•020│
 │006f3fa0│ 59 00 07 00 00 00 1e 04 ┊ 00 00 e3 65 f4 0b 33 00 │Y0•000••┊00×e×•30│
 │006f3fb0│ 5a 00 03 00 00 00 77 67 ┊ 14 00 44 43 14 08 20 22 │Z0•000wg┊•0DC•• "│
 │006f3fc0│ 02 0a 8d 55 00 00 00 00 ┊ 00 00 00 00 00 00 05 00 │•_×U0000┊000000•0│
@@ -213238,8 +213260,8 @@
 │006f4ba0│ 16 00 39 00 d9 d2 0f 20 ┊ f0 27 55 40 97 7c 8b 3b │•090××• ┊×'U@×|×;│
 │006f4bb0│ 60 0d 79 c4 e2 91 26 00 ┊ 63 00 4d 00 72 00 63 00 │`_y×××&0┊c0M0r0c0│
 │006f4bc0│ 53 00 63 00 72 00 61 00 ┊ 6d 00 62 00 6c 00 65 00 │S0c0r0a0┊m0b0l0e0│
-│006f4bd0│ 72 00 56 00 61 00 72 00 ┊ 00 00 e3 36 14 00 39 00 │r0V0a0r0┊00×6•090│
-│006f4be0│ 63 00 03 00 00 00 3e 84 ┊ 00 00 7f d6 00 00 e3 d5 │c0•000>×┊00•×00××│
+│006f4bd0│ 72 00 56 00 61 00 72 00 ┊ 00 00 83 36 14 00 39 00 │r0V0a0r0┊00×6•090│
+│006f4be0│ 63 00 03 00 00 00 3e 84 ┊ 00 00 7f d6 00 00 83 d5 │c0•000>×┊00•×00××│
 │006f4bf0│ 78 02 2a 00 50 00 07 00 ┊ 00 00 38 00 2e 00 30 00 │x•*0P0•0┊0080.000│
 │006f4c00│ 2e 00 30 00 2e 00 33 00 ┊ 30 00 00 00 b3 cb 31 00 │.000.030┊0000××10│
 │006f4c10│ 32 00 30 00 2e 00 30 00 ┊ 20 00 4d 00 48 00 7a 00 │2000.000┊ 0M0H0z0│
@@ -213280,25 +213302,25 @@
 │006f4e40│ 2e 00 30 00 00 00 00 00 ┊ 00 00 90 cb 44 c9 00 00 │.0000000┊00××D×00│
 │006f4e50│ 00 00 30 00 2e 00 30 00 ┊ 00 00 00 00 00 00 00 00 │0000.000┊00000000│
 │006f4e60│ 00 00 40 62 b7 cb 83 5c ┊ 0d 00 34 00 5b 00 07 00 │00@b×××\┊_040[0•0│
-│006f4e70│ 00 00 01 e3 f9 14 00 15 ┊ 00 1e 00 03 00 00 00 98 │00•××•0•┊0•0•000×│
+│006f4e70│ 00 00 01 83 f9 14 00 15 ┊ 00 1e 00 03 00 00 00 98 │00•××•0•┊0•0•000×│
 │006f4e80│ 81 cb d9 00 00 00 00 e1 ┊ c1 16 00 3a 00 bd fe 3c │×××0000×┊×•0:0××<│
 │006f4e90│ 2a e8 27 0a 4d 8b 79 d6 ┊ 88 c2 a3 e1 c0 e2 e5 10 │*×'_M×y×┊×××××××•│
 │006f4ea0│ 00 64 00 53 00 6d 00 73 ┊ 00 74 00 00 00 e3 50 1c │0d0S0m0s┊0t000×P•│
 │006f4eb0│ 00 3a 00 64 00 03 00 00 ┊ 00 f8 22 00 db 00 00 00 │0:0d0•00┊0×"0×000│
 │006f4ec0│ 00 00 23 00 db 00 00 00 ┊ 00 e3 0b 14 00 0b 00 16 │00#0×000┊0×••0•0•│
-│006f4ed0│ 00 07 00 00 00 b2 00 00 ┊ 00 07 00 00 00 e3 5d 0d │0•000×00┊0•000×]_│
-│006f4ee0│ 00 34 00 5b 00 07 00 00 ┊ 00 00 e3 07 3c 00 31 00 │040[0•00┊00×•<010│
+│006f4ed0│ 00 07 00 00 00 b2 00 00 ┊ 00 07 00 00 00 83 5d 0d │0•000×00┊0•000×]_│
+│006f4ee0│ 00 34 00 5b 00 07 00 00 ┊ 00 00 83 07 3c 00 31 00 │040[0•00┊00×•<010│
 │006f4ef0│ 58 00 07 00 00 00 ff ff ┊ ff ff 00 00 00 00 98 82 │X0•000××┊××0000××│
 │006f4f00│ d4 ca 00 00 00 00 f8 c2 ┊ 23 d6 00 00 00 00 89 8c │××0000××┊#×0000××│
 │006f4f10│ f5 fe 4b f7 a8 4a a9 a5 ┊ 03 b5 ab 82 23 2d 07 00 │××K××J××┊•×××#-•0│
-│006f4f20│ 00 00 00 00 00 00 e3 b7 ┊ 22 00 0b 00 5c 00 07 00 │000000××┊"0•0\0•0│
+│006f4f20│ 00 00 00 00 00 00 83 b7 ┊ 22 00 0b 00 5c 00 07 00 │000000××┊"0•0\0•0│
 │006f4f30│ 00 00 02 01 0c 00 d0 41 ┊ 03 0a 00 00 00 00 01 01 │00••_0×A┊•_0000••│
 │006f4f40│ 06 00 00 02 7f ff 04 00 ┊ e3 83 48 00 23 00 2d 00 │•00••×•0┊××H0#0-0│
 │006f4f50│ 03 00 00 00 4e 00 6f 00 ┊ 74 00 20 00 49 00 6e 00 │•000N0o0┊t0 0I0n0│
 │006f4f60│ 73 00 74 00 61 00 6c 00 ┊ 6c 00 65 00 64 00 00 00 │s0t0a0l0┊l0e0d000│
 │006f4f70│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 05 01 00 00 │00000000┊0000••00│
 │006f4f80│ 00 00 00 00 05 01 00 00 ┊ 00 00 00 00 ac 29 3a d6 │0000••00┊0000×):×│
-│006f4f90│ e3 34 48 00 29 00 2d 00 ┊ 03 00 00 00 4e 00 6f 00 │×4H0)0-0┊•000N0o0│
+│006f4f90│ 83 34 48 00 29 00 2d 00 ┊ 03 00 00 00 4e 00 6f 00 │×4H0)0-0┊•000N0o0│
 │006f4fa0│ 74 00 20 00 49 00 6e 00 ┊ 73 00 74 00 61 00 6c 00 │t0 0I0n0┊s0t0a0l0│
 │006f4fb0│ 6c 00 65 00 64 00 00 00 ┊ 00 00 00 00 0f 00 00 00 │l0e0d000┊0000•000│
 │006f4fc0│ 00 00 00 00 04 00 00 00 ┊ 00 00 00 00 47 00 c0 f5 │0000•000┊0000G0××│
@@ -213307,25 +213329,25 @@
 │006f4ff0│ 73 00 74 00 61 00 6c 00 ┊ 6c 00 65 00 64 00 00 00 │s0t0a0l0┊l0e0d000│
 │006f5000│ 00 00 00 00 04 00 00 00 ┊ 00 00 00 00 52 08 0f d6 │0000•000┊0000R••×│
 │006f5010│ 00 00 00 00 00 b6 02 d6 ┊ 00 00 00 00 43 23 3a d6 │00000×•×┊0000C#:×│
-│006f5020│ e3 2a 48 00 24 00 2d 00 ┊ 03 00 00 00 4e 00 6f 00 │×*H0$0-0┊•000N0o0│
+│006f5020│ 83 2a 48 00 24 00 2d 00 ┊ 03 00 00 00 4e 00 6f 00 │×*H0$0-0┊•000N0o0│
 │006f5030│ 74 00 20 00 49 00 6e 00 ┊ 73 00 74 00 61 00 6c 00 │t0 0I0n0┊s0t0a0l0│
 │006f5040│ 6c 00 65 00 64 00 00 00 ┊ 00 00 00 00 47 00 c0 f5 │l0e0d000┊0000G0××│
 │006f5050│ 0e d6 00 00 03 88 43 d6 ┊ 00 00 00 00 47 00 c0 f5 │•×00•×C×┊0000G0××│
-│006f5060│ 0e d6 00 00 00 00 0f d6 ┊ e3 b2 48 00 2e 00 2d 00 │•×0000•×┊××H0.0-0│
+│006f5060│ 0e d6 00 00 00 00 0f d6 ┊ 83 b2 48 00 2e 00 2d 00 │•×0000•×┊××H0.0-0│
 │006f5070│ 03 00 00 00 4b 00 49 00 ┊ 4e 00 47 00 53 00 54 00 │•000K0I0┊N0G0S0T0│
 │006f5080│ 4f 00 4e 00 20 00 53 00 ┊ 41 00 34 00 30 00 30 00 │O0N0 0S0┊A0400000│
 │006f5090│ 20 00 2d 00 20 00 32 00 ┊ 34 00 30 00 2e 00 30 00 │ 0-0 020┊4000.000│
 │006f50a0│ 20 00 47 00 42 00 00 00 ┊ 00 00 00 00 ea b8 7f c8 │ 0G0B000┊0000××•×│
-│006f50b0│ e3 3a 48 00 2f 00 2d 00 ┊ 03 00 00 00 50 00 4c 00 │×:H0/0-0┊•000P0L0│
+│006f50b0│ 83 3a 48 00 2f 00 2d 00 ┊ 03 00 00 00 50 00 4c 00 │×:H0/0-0┊•000P0L0│
 │006f50c0│ 44 00 53 00 20 00 44 00 ┊ 56 00 44 00 2d 00 52 00 │D0S0 0D0┊V0D0-0R0│
 │006f50d0│ 57 00 20 00 44 00 53 00 ┊ 20 00 2d 00 20 00 41 00 │W0 0D0S0┊ 0-0 0A0│
 │006f50e0│ 54 00 41 00 50 00 49 00 ┊ 00 00 00 00 00 50 d8 c9 │T0A0P0I0┊00000P××│
-│006f50f0│ 00 00 00 00 97 b6 7f c8 ┊ e3 fc 48 00 25 00 2d 00 │0000××•×┊××H0%0-0│
+│006f50f0│ 00 00 00 00 97 b6 7f c8 ┊ 83 fc 48 00 25 00 2d 00 │0000××•×┊××H0%0-0│
 │006f5100│ 03 00 00 00 4e 00 6f 00 ┊ 74 00 20 00 49 00 6e 00 │•000N0o0┊t0 0I0n0│
 │006f5110│ 73 00 74 00 61 00 6c 00 ┊ 6c 00 65 00 64 00 00 00 │s0t0a0l0┊l0e0d000│
 │006f5120│ 00 00 00 00 04 00 00 00 ┊ 00 00 00 00 0e 86 43 d6 │0000•000┊0000•×C×│
 │006f5130│ 00 00 00 00 47 00 c0 f5 ┊ 0e d6 00 00 00 00 0f d6 │0000G0××┊•×0000•×│
-│006f5140│ e3 15 48 00 1b 00 2d 00 ┊ 03 00 00 00 4e 00 6f 00 │×•H0•0-0┊•000N0o0│
+│006f5140│ 83 15 48 00 1b 00 2d 00 ┊ 03 00 00 00 4e 00 6f 00 │×•H0•0-0┊•000N0o0│
 │006f5150│ 74 00 20 00 49 00 6e 00 ┊ 73 00 74 00 61 00 6c 00 │t0 0I0n0┊s0t0a0l0│
 │006f5160│ 6c 00 65 00 64 00 00 00 ┊ 00 00 00 00 30 00 00 00 │l0e0d000┊00000000│
 │006f5170│ 00 00 00 00 52 08 0f d6 ┊ 00 00 00 00 04 00 00 00 │0000R••×┊0000•000│
@@ -213334,12 +213356,240 @@
 │006f51a0│ 73 00 74 00 61 00 6c 00 ┊ 6c 00 65 00 64 00 00 00 │s0t0a0l0┊l0e0d000│
 │006f51b0│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 10 c0 e7 d9 │00000000┊0000•×××│
 │006f51c0│ 00 00 00 00 f8 b6 02 d6 ┊ 00 00 00 00 43 23 3a d6 │0000××•×┊0000C#:×│
-│006f51d0│ e3 4f 48 00 30 00 2d 00 ┊ 03 00 00 00 4e 00 6f 00 │×OH000-0┊•000N0o0│
+│006f51d0│ 83 4f 48 00 30 00 2d 00 ┊ 03 00 00 00 4e 00 6f 00 │×OH000-0┊•000N0o0│
 │006f51e0│ 74 00 20 00 49 00 6e 00 ┊ 73 00 74 00 61 00 6c 00 │t0 0I0n0┊s0t0a0l0│
 │006f51f0│ 6c 00 65 00 64 00 00 00 ┊ 00 00 00 00 d0 c7 44 c9 │l0e0d000┊0000××D×│
 │006f5200│ 00 00 00 00 98 c7 44 c9 ┊ 00 00 00 00 18 3c eb c9 │0000××D×┊0000•<××│
-│006f5210│ 00 00 00 00 00 00 00 00 ┊ ff ff ff ff ff ff ff ff │00000000┊××××××××│
-│006f5220│ ff ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │××××××××┊××××××××│
+│006f5210│ 00 00 00 00 00 00 00 00 ┊ 83 3b 10 00 32 00 59 00 │00000000┊×;•020Y0│
+│006f5220│ 07 00 00 00 1f 04 00 00 ┊ 83 53 14 00 39 00 63 00 │•000••00┊×S•090c0│
+│006f5230│ 03 00 00 00 dc 5c 00 00 ┊ 3e 84 00 00 83 06 78 02 │•000×\00┊>×00×•x•│
+│006f5240│ 2a 00 50 00 07 00 00 00 ┊ 38 00 2e 00 30 00 2e 00 │*0P0•000┊80.000.0│
+│006f5250│ 30 00 2e 00 33 00 30 00 ┊ 00 00 b3 cb 31 00 32 00 │00.03000┊00××1020│
+│006f5260│ 30 00 2e 00 30 00 20 00 ┊ 4d 00 48 00 7a 00 00 00 │00.000 0┊M0H0z000│
+│006f5270│ 31 00 30 00 30 00 2e 00 ┊ 30 00 20 00 4d 00 48 00 │100000.0┊00 0M0H0│
+│006f5280│ 7a 00 00 00 31 00 30 00 ┊ 30 00 2e 00 30 00 20 00 │z0001000┊00.000 0│
+│006f5290│ 4d 00 48 00 7a 00 00 00 ┊ 31 00 32 00 30 00 2e 00 │M0H0z000┊102000.0│
+│006f52a0│ 36 00 36 00 20 00 4d 00 ┊ 48 00 7a 00 31 00 32 00 │6060 0M0┊H0z01020│
+│006f52b0│ 30 00 2e 00 30 00 20 00 ┊ 4d 00 48 00 7a 00 00 00 │00.000 0┊M0H0z000│
+│006f52c0│ 31 00 30 00 30 00 2e 00 ┊ 30 00 20 00 4d 00 48 00 │100000.0┊00 0M0H0│
+│006f52d0│ 7a 00 00 00 31 00 32 00 ┊ 30 00 2e 00 30 00 20 00 │z0001020┊00.000 0│
+│006f52e0│ 4d 00 48 00 7a 00 00 00 ┊ 31 00 30 00 30 00 2e 00 │M0H0z000┊100000.0│
+│006f52f0│ 30 00 20 00 4d 00 48 00 ┊ 7a 00 00 00 31 00 30 00 │00 0M0H0┊z0001000│
+│006f5300│ 30 00 2e 00 30 00 20 00 ┊ 4d 00 48 00 7a 00 00 00 │00.000 0┊M0H0z000│
+│006f5310│ 31 00 31 00 39 00 2e 00 ┊ 33 00 34 00 20 00 4d 00 │101090.0┊3040 0M0│
+│006f5320│ 48 00 7a 00 31 00 32 00 ┊ 30 00 2e 00 30 00 20 00 │H0z01020┊00.000 0│
+│006f5330│ 4d 00 48 00 7a 00 00 00 ┊ 31 00 30 00 30 00 2e 00 │M0H0z000┊100000.0│
+│006f5340│ 30 00 20 00 4d 00 48 00 ┊ 7a 00 00 00 30 00 2e 00 │00 0M0H0┊z00000.0│
+│006f5350│ 35 00 30 00 00 00 00 00 ┊ 90 cb 44 c9 00 00 00 00 │50000000┊××D×0000│
+│006f5360│ 30 00 2e 00 35 00 30 00 ┊ 00 00 00 00 00 00 00 00 │00.05000┊00000000│
+│006f5370│ 02 c1 7f c8 30 00 2e 00 ┊ 35 00 30 00 00 00 00 00 │•×•×00.0┊50000000│
+│006f5380│ 20 cc 44 c9 00 00 00 00 ┊ 30 00 2e 00 35 00 30 00 │ ×D×0000┊00.05000│
+│006f5390│ 00 00 44 c9 00 00 00 00 ┊ 18 e5 57 cd 30 00 2e 00 │00D×0000┊•×W×00.0│
+│006f53a0│ 35 00 30 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │50000000┊00000000│
+│006f53b0│ 30 00 2e 00 35 00 30 00 ┊ 00 00 44 c9 00 00 00 00 │00.05000┊00D×0000│
+│006f53c0│ 90 cb 44 c9 31 00 32 00 ┊ 30 00 2e 00 30 00 20 00 │××D×1020┊00.000 0│
+│006f53d0│ 4d 00 48 00 7a 00 00 00 ┊ 31 00 30 00 30 00 2e 00 │M0H0z000┊100000.0│
+│006f53e0│ 30 00 20 00 4d 00 48 00 ┊ 7a 00 00 00 31 00 30 00 │00 0M0H0┊z0001000│
+│006f53f0│ 30 00 2e 00 30 00 20 00 ┊ 4d 00 48 00 7a 00 00 00 │00.000 0┊M0H0z000│
+│006f5400│ 31 00 31 00 39 00 2e 00 ┊ 39 00 30 00 20 00 4d 00 │101090.0┊9000 0M0│
+│006f5410│ 48 00 7a 00 31 00 32 00 ┊ 30 00 2e 00 30 00 20 00 │H0z01020┊00.000 0│
+│006f5420│ 4d 00 48 00 7a 00 00 00 ┊ 31 00 30 00 30 00 2e 00 │M0H0z000┊100000.0│
+│006f5430│ 30 00 20 00 4d 00 48 00 ┊ 7a 00 00 00 30 00 2e 00 │00 0M0H0┊z00000.0│
+│006f5440│ 35 00 30 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │50000000┊00000000│
+│006f5450│ 30 00 2e 00 35 00 30 00 ┊ 00 00 00 00 00 00 00 00 │00.05000┊00000000│
+│006f5460│ 8e 3c 46 d6 30 00 2e 00 ┊ 30 00 00 00 00 00 00 00 │×<F×00.0┊00000000│
+│006f5470│ 07 d3 71 cc 00 00 00 00 ┊ 30 00 2e 00 35 00 30 00 │•×q×0000┊00.05000│
+│006f5480│ 00 00 44 c9 00 00 00 00 ┊ 20 cc 44 c9 30 00 2e 00 │00D×0000┊ ×D×00.0│
+│006f5490│ 30 00 00 00 00 00 00 00 ┊ 90 cb 44 c9 00 00 00 00 │00000000┊××D×0000│
+│006f54a0│ 30 00 2e 00 30 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00.00000┊00000000│
+│006f54b0│ 40 52 b7 cb 83 83 3c 00 ┊ 0f 00 28 00 07 00 00 00 │@R××××<0┊•0(0•000│
+│006f54c0│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 01 00 00 01 │00000000┊0000•00•│
+│006f54d0│ 00 00 00 00 00 00 01 00 ┊ 00 00 00 00 00 00 00 00 │000000•0┊00000000│
+│006f54e0│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
+│006f54f0│ 83 5c 0d 00 34 00 5b 00 ┊ 07 00 00 00 01 83 5d 0d │×\_040[0┊•000•×]_│
+│006f5500│ 00 34 00 5b 00 07 00 00 ┊ 00 00 83 17 3c 00 31 00 │040[0•00┊00×•<010│
+│006f5510│ 58 00 07 00 00 00 ff ff ┊ ff ff 00 00 00 00 98 72 │X0•000××┊××0000×r│
+│006f5520│ d4 ca 00 00 00 00 f8 c2 ┊ 23 d6 00 00 00 00 89 8c │××0000××┊#×0000××│
+│006f5530│ f5 fe 4b f7 a8 4a a9 a5 ┊ 03 b5 ab 82 23 2d 07 00 │××K××J××┊•×××#-•0│
+│006f5540│ 00 00 00 00 00 00 83 b7 ┊ 22 00 0b 00 5c 00 07 00 │000000××┊"0•0\0•0│
+│006f5550│ 00 00 02 01 0c 00 d0 41 ┊ 03 0a 00 00 00 00 01 01 │00••_0×A┊•_0000••│
+│006f5560│ 06 00 00 02 7f ff 04 00 ┊ e3 b4 48 00 29 00 2d 00 │•00••×•0┊××H0)0-0│
+│006f5570│ 03 00 00 00 4e 00 6f 00 ┊ 74 00 20 00 49 00 6e 00 │•000N0o0┊t0 0I0n0│
+│006f5580│ 73 00 74 00 61 00 6c 00 ┊ 6c 00 65 00 64 00 00 00 │s0t0a0l0┊l0e0d000│
+│006f5590│ 00 00 00 00 00 01 80 c8 ┊ 00 00 00 00 00 01 80 c8 │00000•××┊00000•××│
+│006f55a0│ 00 00 00 00 00 e0 eb c9 ┊ 00 00 00 00 97 b6 7f c8 │00000×××┊0000××•×│
+│006f55b0│ e3 06 48 00 24 00 2d 00 ┊ 03 00 00 00 4e 00 6f 00 │×•H0$0-0┊•000N0o0│
+│006f55c0│ 74 00 20 00 49 00 6e 00 ┊ 73 00 74 00 61 00 6c 00 │t0 0I0n0┊s0t0a0l0│
+│006f55d0│ 6c 00 65 00 64 00 00 00 ┊ 00 00 00 00 04 00 00 00 │l0e0d000┊0000•000│
+│006f55e0│ 00 00 00 00 03 88 43 d6 ┊ 00 00 00 00 47 00 c0 f5 │0000•×C×┊0000G0××│
+│006f55f0│ 0e d6 00 00 00 00 0f d6 ┊ e3 81 48 00 2e 00 2d 00 │•×0000•×┊××H0.0-0│
+│006f5600│ 03 00 00 00 4b 00 49 00 ┊ 4e 00 47 00 53 00 54 00 │•000K0I0┊N0G0S0T0│
+│006f5610│ 4f 00 4e 00 20 00 53 00 ┊ 41 00 34 00 30 00 30 00 │O0N0 0S0┊A0400000│
+│006f5620│ 20 00 2d 00 20 00 32 00 ┊ 34 00 30 00 2e 00 30 00 │ 0-0 020┊4000.000│
+│006f5630│ 20 00 47 00 42 00 00 00 ┊ 00 00 00 00 c0 eb 96 d9 │ 0G0B000┊0000××××│
+│006f5640│ e3 b5 48 00 2f 00 2d 00 ┊ 03 00 00 00 50 00 4c 00 │××H0/0-0┊•000P0L0│
+│006f5650│ 44 00 53 00 20 00 44 00 ┊ 56 00 44 00 2d 00 52 00 │D0S0 0D0┊V0D0-0R0│
+│006f5660│ 57 00 20 00 44 00 53 00 ┊ 20 00 2d 00 20 00 41 00 │W0 0D0S0┊ 0-0 0A0│
+│006f5670│ 54 00 41 00 50 00 49 00 ┊ 00 00 00 00 00 00 00 00 │T0A0P0I0┊00000000│
+│006f5680│ 00 00 00 00 0a 00 00 00 ┊ e3 8f 48 00 25 00 2d 00 │0000_000┊××H0%0-0│
+│006f5690│ 03 00 00 00 4e 00 6f 00 ┊ 74 00 20 00 49 00 6e 00 │•000N0o0┊t0 0I0n0│
+│006f56a0│ 73 00 74 00 61 00 6c 00 ┊ 6c 00 65 00 64 00 00 00 │s0t0a0l0┊l0e0d000│
+│006f56b0│ 00 00 00 00 0f 00 00 00 ┊ 00 00 00 00 0e 86 43 d6 │0000•000┊0000•×C×│
+│006f56c0│ 00 00 00 00 47 00 c0 f5 ┊ 0e d6 00 00 00 00 7f c8 │0000G0××┊•×0000•×│
+│006f56d0│ e3 41 48 00 1b 00 2d 00 ┊ 03 00 00 00 4e 00 6f 00 │×AH0•0-0┊•000N0o0│
+│006f56e0│ 74 00 20 00 49 00 6e 00 ┊ 73 00 74 00 61 00 6c 00 │t0 0I0n0┊s0t0a0l0│
+│006f56f0│ 6c 00 65 00 64 00 00 00 ┊ 00 00 00 00 04 00 00 00 │l0e0d000┊0000•000│
+│006f5700│ 00 00 00 00 52 08 0f d6 ┊ 00 00 00 00 04 00 00 00 │0000R••×┊0000•000│
+│006f5710│ 00 00 00 00 07 08 0f d6 ┊ e3 ec 48 00 30 00 2d 00 │0000•••×┊××H000-0│
+│006f5720│ 03 00 00 00 4e 00 6f 00 ┊ 74 00 20 00 49 00 6e 00 │•000N0o0┊t0 0I0n0│
+│006f5730│ 73 00 74 00 61 00 6c 00 ┊ 6c 00 65 00 64 00 00 00 │s0t0a0l0┊l0e0d000│
+│006f5740│ 00 00 00 00 00 c4 44 c9 ┊ 00 00 00 00 c8 c3 44 c9 │00000×D×┊0000××D×│
+│006f5750│ 00 00 00 00 18 fe 32 ca ┊ 00 00 00 00 00 00 00 00 │0000•×2×┊00000000│
+│006f5760│ e3 84 3c 00 0f 00 28 00 ┊ 07 00 00 00 00 00 00 00 │××<0•0(0┊•0000000│
+│006f5770│ 00 00 00 00 00 00 00 00 ┊ 01 00 00 01 00 00 00 00 │00000000┊•00•0000│
+│006f5780│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
+│006f5790│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 83 3a 10 00 │00000000┊0000×:•0│
+│006f57a0│ 32 00 59 00 07 00 00 00 ┊ 20 04 00 00 83 5c 0d 00 │20Y0•000┊ •00×\_0│
+│006f57b0│ 34 00 5b 00 07 00 00 00 ┊ 01 83 5d 0d 00 34 00 5b │40[0•000┊•×]_040[│
+│006f57c0│ 00 07 00 00 00 00 83 c4 ┊ 3c 00 31 00 58 00 07 00 │0•0000××┊<010X0•0│
+│006f57d0│ 00 00 ff ff ff ff 00 00 ┊ 00 00 18 45 d4 ca 00 00 │00××××00┊00•E××00│
+│006f57e0│ 00 00 f8 c2 23 d6 00 00 ┊ 00 00 89 8c f5 fe 4b f7 │00××#×00┊00××××K×│
+│006f57f0│ a8 4a a9 a5 03 b5 ab 82 ┊ 23 2d 07 00 00 00 00 00 │×J××•×××┊#-•00000│
+│006f5800│ 00 00 83 b7 22 00 0b 00 ┊ 5c 00 07 00 00 00 02 01 │00××"0•0┊\0•000••│
+│006f5810│ 0c 00 d0 41 03 0a 00 00 ┊ 00 00 01 01 06 00 00 02 │_0×A•_00┊00•••00•│
+│006f5820│ 7f ff 04 00 e3 28 2a 00 ┊ 0b 00 54 00 07 00 00 00 │•×•0×(*0┊•0T0•000│
+│006f5830│ 02 01 0c 00 d0 41 03 0a ┊ 00 00 00 00 01 01 06 00 │••_0×A•_┊0000•••0│
+│006f5840│ 00 02 02 03 08 00 00 01 ┊ 01 80 7f ff 04 00 83 34 │0••••00•┊•×•×•0×4│
+│006f5850│ 3a 00 0b 00 55 00 07 00 ┊ 00 00 02 01 0c 00 d0 41 │:0•0U0•0┊00••_0×A│
+│006f5860│ 03 0a 00 00 00 00 01 01 ┊ 06 00 00 1f 02 01 0c 00 │•_0000••┊•00•••_0│
+│006f5870│ d0 41 05 0a 00 00 00 00 ┊ 02 01 0c 00 d0 41 03 03 │×A•_0000┊••_0×A••│
+│006f5880│ 00 00 00 00 7f ff 04 00 ┊ 83 83 49 00 0b 00 55 00 │0000•×•0┊××I0•0U0│
+│006f5890│ 07 00 00 00 02 01 0c 00 ┊ d0 41 03 0a 00 00 00 00 │•000••_0┊×A•_0000│
+│006f58a0│ 01 01 06 00 00 1f 02 01 ┊ 0c 00 d0 41 05 0a 00 00 │•••00•••┊_0×A•_00│
+│006f58b0│ 00 00 02 01 0c 00 d0 41 ┊ 03 03 00 00 00 00 7f 01 │00••_0×A┊••0000••│
+│006f58c0│ 04 00 03 0f 0b 00 ff ff ┊ ff ff 03 01 01 7f ff 04 │•0•••0××┊××••••×•│
+│006f58d0│ 00 e3 34 3a 00 0b 00 55 ┊ 00 07 00 00 00 02 01 0c │0×4:0•0U┊0•000••_│
+│006f58e0│ 00 d0 41 03 0a 00 00 00 ┊ 00 01 01 06 00 00 1f 02 │0×A•_000┊0•••00••│
+│006f58f0│ 01 0c 00 d0 41 05 0a 00 ┊ 00 00 00 02 01 0c 00 d0 │•_0×A•_0┊000••_0×│
+│006f5900│ 41 03 03 00 00 00 00 7f ┊ ff 04 00 83 78 0e 00 0b │A••0000•┊×•0×x•0•│
+│006f5910│ 00 5d 00 07 00 00 00 0b ┊ 00 e2 5c 3e 00 6f 00 4d │0]0•000•┊0×\>0o0M│
+│006f5920│ 00 65 00 6d 00 6f 00 72 ┊ 00 79 00 54 00 79 00 70 │0e0m0o0r┊0y0T0y0p│
+│006f5930│ 00 65 00 49 00 6e 00 66 ┊ 00 6f 00 72 00 6d 00 61 │0e0I0n0f┊0o0r0m0a│
+│006f5940│ 00 74 00 69 00 6f 00 6e ┊ 00 42 00 61 00 63 00 6b │0t0i0o0n┊0B0a0c0k│
+│006f5950│ 00 75 00 70 00 00 00 e3 ┊ 33 5c 00 14 00 6f 00 07 │0u0p000×┊3\0•0o0•│
+│006f5960│ 00 00 00 09 00 00 00 60 ┊ 00 00 00 0a 00 00 00 00 │000_000`┊000_0000│
+│006f5970│ 01 00 00 00 00 00 00 00 ┊ 10 00 00 06 00 00 00 36 │•0000000┊•00•0006│
+│006f5980│ 3a 00 00 05 00 00 00 00 ┊ 02 00 00 03 00 00 00 00 │:00•0000┊•00•0000│
+│006f5990│ 8c 00 00 04 00 00 00 00 ┊ 40 00 00 01 00 00 00 00 │×00•0000┊@00•0000│
+│006f59a0│ 02 00 00 02 00 00 00 00 ┊ 00 00 00 0e 00 00 00 00 │•00•0000┊000•0000│
+│006f59b0│ 00 00 00 e3 4b 5c 00 14 ┊ 00 1d 00 07 00 00 00 09 │000×K\0•┊0•0•000_│
+│006f59c0│ 00 00 00 60 00 00 00 0a ┊ 00 00 00 00 01 00 00 00 │000`000_┊0000•000│
+│006f59d0│ 00 00 00 00 10 00 00 06 ┊ 00 00 00 36 3a 00 00 05 │0000•00•┊0006:00•│
+│006f59e0│ 00 00 00 00 02 00 00 03 ┊ 00 00 00 00 8c 00 00 04 │0000•00•┊0000×00•│
+│006f59f0│ 00 00 00 27 53 00 00 01 ┊ 00 00 00 00 02 00 00 02 │000'S00•┊0000•00•│
+│006f5a00│ 00 00 00 00 00 00 00 0e ┊ 00 00 00 00 00 00 00 83 │0000000•┊0000000×│
+│006f5a10│ 39 10 00 32 00 59 00 07 ┊ 00 00 00 21 04 00 00 e3 │9•020Y0•┊000!•00×│
+│006f5a20│ 71 78 02 2a 00 50 00 07 ┊ 00 00 00 38 00 2e 00 30 │qx•*0P0•┊00080.00│
+│006f5a30│ 00 2e 00 30 00 2e 00 33 ┊ 00 30 00 00 00 b3 cb 31 │0.000.03┊00000××1│
+│006f5a40│ 00 32 00 30 00 2e 00 30 ┊ 00 20 00 4d 00 48 00 7a │02000.00┊0 0M0H0z│
+│006f5a50│ 00 00 00 31 00 30 00 30 ┊ 00 2e 00 30 00 20 00 4d │00010000┊0.000 0M│
+│006f5a60│ 00 48 00 7a 00 00 00 31 ┊ 00 30 00 30 00 2e 00 30 │0H0z0001┊00000.00│
+│006f5a70│ 00 20 00 4d 00 48 00 7a ┊ 00 00 00 31 00 32 00 30 │0 0M0H0z┊00010200│
+│006f5a80│ 00 2e 00 36 00 36 00 20 ┊ 00 4d 00 48 00 7a 00 31 │0.06060 ┊0M0H0z01│
+│006f5a90│ 00 32 00 30 00 2e 00 30 ┊ 00 20 00 4d 00 48 00 7a │02000.00┊0 0M0H0z│
+│006f5aa0│ 00 00 00 31 00 30 00 30 ┊ 00 2e 00 30 00 20 00 4d │00010000┊0.000 0M│
+│006f5ab0│ 00 48 00 7a 00 00 00 31 ┊ 00 32 00 30 00 2e 00 30 │0H0z0001┊02000.00│
+│006f5ac0│ 00 20 00 4d 00 48 00 7a ┊ 00 00 00 31 00 30 00 30 │0 0M0H0z┊00010000│
+│006f5ad0│ 00 2e 00 30 00 20 00 4d ┊ 00 48 00 7a 00 00 00 31 │0.000 0M┊0H0z0001│
+│006f5ae0│ 00 30 00 30 00 2e 00 30 ┊ 00 20 00 4d 00 48 00 7a │00000.00┊0 0M0H0z│
+│006f5af0│ 00 00 00 31 00 31 00 39 ┊ 00 2e 00 33 00 34 00 20 │00010109┊0.03040 │
+│006f5b00│ 00 4d 00 48 00 7a 00 31 ┊ 00 32 00 30 00 2e 00 30 │0M0H0z01┊02000.00│
+│006f5b10│ 00 20 00 4d 00 48 00 7a ┊ 00 00 00 31 00 30 00 30 │0 0M0H0z┊00010000│
+│006f5b20│ 00 2e 00 30 00 20 00 4d ┊ 00 48 00 7a 00 00 00 30 │0.000 0M┊0H0z0000│
+│006f5b30│ 00 2e 00 35 00 30 00 00 ┊ 00 00 00 90 5b 12 c8 00 │0.050000┊000×[•×0│
+│006f5b40│ 00 00 00 30 00 2e 00 35 ┊ 00 30 00 00 00 00 00 00 │00000.05┊00000000│
+│006f5b50│ 00 00 00 02 51 4d c7 30 ┊ 00 2e 00 35 00 30 00 00 │000•QM×0┊0.050000│
+│006f5b60│ 00 00 00 20 5c 12 c8 00 ┊ 00 00 00 30 00 2e 00 35 │000 \•×0┊00000.05│
+│006f5b70│ 00 30 00 00 00 12 c8 00 ┊ 00 00 00 18 e5 57 cd 30 │00000•×0┊000•×W×0│
+│006f5b80│ 00 2e 00 35 00 30 00 00 ┊ 00 00 00 00 00 00 00 00 │0.050000┊00000000│
+│006f5b90│ 00 00 00 30 00 2e 00 35 ┊ 00 30 00 00 00 12 c8 00 │00000.05┊00000•×0│
+│006f5ba0│ 00 00 00 90 5b 12 c8 31 ┊ 00 32 00 30 00 2e 00 30 │000×[•×1┊02000.00│
+│006f5bb0│ 00 20 00 4d 00 48 00 7a ┊ 00 00 00 31 00 30 00 30 │0 0M0H0z┊00010000│
+│006f5bc0│ 00 2e 00 30 00 20 00 4d ┊ 00 48 00 7a 00 00 00 31 │0.000 0M┊0H0z0001│
+│006f5bd0│ 00 30 00 30 00 2e 00 30 ┊ 00 20 00 4d 00 48 00 7a │00000.00┊0 0M0H0z│
+│006f5be0│ 00 00 00 31 00 31 00 39 ┊ 00 2e 00 39 00 30 00 20 │00010109┊0.09000 │
+│006f5bf0│ 00 4d 00 48 00 7a 00 31 ┊ 00 32 00 30 00 2e 00 30 │0M0H0z01┊02000.00│
+│006f5c00│ 00 20 00 4d 00 48 00 7a ┊ 00 00 00 31 00 30 00 30 │0 0M0H0z┊00010000│
+│006f5c10│ 00 2e 00 30 00 20 00 4d ┊ 00 48 00 7a 00 00 00 30 │0.000 0M┊0H0z0000│
+│006f5c20│ 00 2e 00 35 00 30 00 00 ┊ 00 00 00 00 00 00 00 00 │0.050000┊00000000│
+│006f5c30│ 00 00 00 30 00 2e 00 35 ┊ 00 30 00 00 00 00 00 00 │00000.05┊00000000│
+│006f5c40│ 00 00 00 8e 3c 46 d6 30 ┊ 00 2e 00 30 00 00 00 00 │000×<F×0┊0.000000│
+│006f5c50│ 00 00 00 07 d3 71 cc 00 ┊ 00 00 00 30 00 2e 00 35 │000•×q×0┊00000.05│
+│006f5c60│ 00 30 00 00 00 12 c8 00 ┊ 00 00 00 20 5c 12 c8 30 │00000•×0┊000 \•×0│
+│006f5c70│ 00 2e 00 30 00 00 00 00 ┊ 00 00 00 90 5b 12 c8 00 │0.000000┊000×[•×0│
+│006f5c80│ 00 00 00 30 00 2e 00 30 ┊ 00 00 00 00 00 00 00 00 │00000.00┊00000000│
+│006f5c90│ 00 00 00 40 52 b7 cb 83 ┊ 5c 0d 00 34 00 5b 00 07 │000@R×××┊\_040[0•│
+│006f5ca0│ 00 00 00 01 83 5d 0d 00 ┊ 34 00 5b 00 07 00 00 00 │000•×]_0┊40[0•000│
+│006f5cb0│ 00 83 96 3c 00 31 00 58 ┊ 00 07 00 00 00 ff ff ff │0××<010X┊0•000×××│
+│006f5cc0│ ff 00 00 00 00 18 73 d4 ┊ ca 00 00 00 00 f8 c2 23 │×0000•s×┊×0000××#│
+│006f5cd0│ d6 00 00 00 00 89 8c f5 ┊ fe 4b f7 a8 4a a9 a5 03 │×0000×××┊×K××J××•│
+│006f5ce0│ b5 ab 82 23 2d 07 00 00 ┊ 00 00 00 00 00 83 b7 22 │×××#-•00┊00000××"│
+│006f5cf0│ 00 0b 00 5c 00 07 00 00 ┊ 00 02 01 0c 00 d0 41 03 │0•0\0•00┊0••_0×A•│
+│006f5d00│ 0a 00 00 00 00 01 01 06 ┊ 00 00 02 7f ff 04 00 83 │_0000•••┊00••×•0×│
+│006f5d10│ 70 0e 00 0b 00 5d 00 07 ┊ 00 00 00 13 00 83 5f 06 │p•0•0]0•┊000•0×_•│
+│006f5d20│ 01 35 00 5e 00 07 00 00 ┊ 00 00 00 00 00 00 00 00 │•50^0•00┊00000000│
+│006f5d30│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
+│*       │                         ┊                         │        ┊        │
+│006f5e20│ 00 00 00 e3 57 10 00 36 ┊ 00 5f 00 03 00 00 00 01 │000×W•06┊0_0•000•│
+│006f5e30│ 00 00 00 83 38 10 00 32 ┊ 00 59 00 07 00 00 00 22 │000×8•02┊0Y0•000"│
+│006f5e40│ 04 00 00 e3 b5 14 00 39 ┊ 00 63 00 03 00 00 00 41 │•00××•09┊0c0•000A│
+│006f5e50│ 1f 00 00 dc 5c 00 00 83 ┊ 5c 0d 00 34 00 5b 00 07 │•00×\00×┊\_040[0•│
+│006f5e60│ 00 00 00 01 83 5d 0d 00 ┊ 34 00 5b 00 07 00 00 00 │000•×]_0┊40[0•000│
+│006f5e70│ 00 83 b7 22 00 0b 00 5c ┊ 00 07 00 00 00 02 01 0c │0××"0•0\┊0•000••_│
+│006f5e80│ 00 d0 41 03 0a 00 00 00 ┊ 00 01 01 06 00 00 02 7f │0×A•_000┊0•••00••│
+│006f5e90│ ff 04 00 e3 78 0e 00 0b ┊ 00 5d 00 07 00 00 00 0b │×•0×x•0•┊0]0•000•│
+│006f5ea0│ 00 e3 2a 06 01 35 00 5e ┊ 00 07 00 00 00 00 a0 c1 │0×*••50^┊0•0000××│
+│006f5eb0│ da 00 00 a0 df 18 9f f6 ┊ da 00 00 00 00 00 00 00 │×00××•××┊×0000000│
+│006f5ec0│ 00 00 00 00 00 00 13 00 ┊ 00 00 00 00 00 00 00 a0 │000000•0┊0000000×│
+│006f5ed0│ db 00 00 60 1f 01 00 00 ┊ 00 00 00 00 fb 00 00 00 │×00`••00┊0000×000│
+│006f5ee0│ 00 00 50 22 00 00 40 02 ┊ 00 00 11 00 00 00 00 a0 │00P"00@•┊00•0000×│
+│006f5ef0│ df 00 00 00 db 00 00 00 ┊ 00 00 00 00 00 00 00 00 │×000×000┊00000000│
+│006f5f00│ 00 00 70 f0 da 00 00 00 ┊ 00 00 00 05 00 75 58 1e │00p××000┊000•0uX•│
+│006f5f10│ 77 75 2e b0 fe 00 70 f5 ┊ da 00 00 00 00 00 f0 e3 │wu.××0p×┊×00000××│
+│006f5f20│ da 00 00 00 00 6f 64 f0 ┊ da 00 00 00 00 00 a0 f6 │×0000od×┊×00000××│
+│006f5f30│ da 00 00 00 00 b0 09 0e ┊ 00 00 00 00 00 00 00 00 │×0000×_•┊00000000│
+│006f5f40│ 00 00 00 00 00 00 50 f0 ┊ da 00 00 00 00 00 00 00 │000000P×┊×0000000│
+│006f5f50│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│
+│*       │                         ┊                         │        ┊        │
+│006f5fa0│ 00 00 00 00 00 00 00 83 ┊ cb 0d 00 0f 00 11 00 07 │0000000×┊×_0•0•0•│
+│006f5fb0│ 00 00 00 01 e3 cc 0d 00 ┊ 0f 00 11 00 07 00 00 00 │000•××_0┊•0•0•000│
+│006f5fc0│ 00 e1 eb 16 00 46 00 3f ┊ 70 1c 71 85 c2 10 4b a3 │0××•0F0?┊p•q××•K×│
+│006f5fd0│ b0 36 ec bd 3c 8b e2 e2 ┊ af 2a 00 7d 00 43 00 61 │×6××<×××┊×*0}0C0a│
+│006f5fe0│ 00 70 00 73 00 75 00 6c ┊ 00 65 00 55 00 70 00 64 │0p0s0u0l┊0e0U0p0d│
+│006f5ff0│ 00 61 00 74 00 65 00 44 ┊ 00 61 00 74 00 61 00 00 │0a0t0e0D┊0a0t0a00│
+│006f6000│ 00 83 35 14 00 46 00 7d ┊ 00 07 00 00 00 18 00 ff │0×5•0F0}┊0•000•0×│
+│006f6010│ d6 00 00 00 00 83 21 14 ┊ 00 46 00 7d 00 07 00 00 │×0000×!•┊0F0}0•00│
+│006f6020│ 00 00 00 00 01 00 00 00 ┊ 00 e1 47 16 00 47 00 28 │0000•000┊0×G•0G0(│
+│006f6030│ 5a 70 48 4e ff 73 45 81 ┊ 64 a0 26 96 3d 80 1f e2 │ZpHN×sE×┊d×&×=×•×│
+│006f6040│ 90 2a 00 7e 00 4c 00 65 ┊ 00 6e 00 6f 00 76 00 6f │×*0~0L0e┊0n0o0v0o│
+│006f6050│ 00 53 00 65 00 63 00 75 ┊ 00 72 00 65 00 46 00 6c │0S0e0c0u┊0r0e0F0l│
+│006f6060│ 00 61 00 73 00 68 00 00 ┊ 00 e3 26 0d 00 47 00 7e │0a0s0h00┊0×&_0G0~│
+│006f6070│ 00 07 00 00 00 01 e2 5a ┊ 30 00 7f 00 4c 00 65 00 │0•000•×Z┊00•0L0e0│
+│006f6080│ 6e 00 6f 00 76 00 6f 00 ┊ 46 00 6c 00 61 00 73 00 │n0o0v0o0┊F0l0a0s0│
+│006f6090│ 68 00 49 00 6e 00 50 00 ┊ 72 00 6f 00 63 00 65 00 │h0I0n0P0┊r0o0c0e0│
+│006f60a0│ 73 00 73 00 00 00 e3 23 ┊ 10 00 47 00 7f 00 07 00 │s0s000×#┊•0G0•0•0│
+│006f60b0│ 00 00 00 00 00 00 e3 37 ┊ 10 00 32 00 59 00 07 00 │000000×7┊•020Y0•0│
+│006f60c0│ 00 00 23 04 00 00 83 5c ┊ 0d 00 34 00 5b 00 07 00 │00#•00×\┊_040[0•0│
+│006f60d0│ 00 00 01 e3 78 14 00 15 ┊ 00 1e 00 03 00 00 00 18 │00•×x•0•┊0•0•000•│
+│006f60e0│ 82 cb d9 00 00 00 00 e3 ┊ 5d 0d 00 34 00 5b 00 07 │×××0000×┊]_040[0•│
+│006f60f0│ 00 00 00 00 e3 8c 3c 00 ┊ 31 00 58 00 07 00 00 00 │0000××<0┊10X0•000│
+│006f6100│ ff ff ff ff 00 00 00 00 ┊ 18 cd 7d cc 00 00 00 00 │××××0000┊•×}×0000│
+│006f6110│ f8 22 c7 d7 00 00 00 00 ┊ 89 8c f5 fe 4b f7 a8 4a │×"××0000┊××××K××J│
+│006f6120│ a9 a5 03 b5 ab 82 23 2d ┊ 07 00 00 00 00 00 00 00 │××•×××#-┊•0000000│
+│006f6130│ e3 b7 22 00 0b 00 5c 00 ┊ 07 00 00 00 02 01 0c 00 │××"0•0\0┊•000••_0│
+│006f6140│ d0 41 03 0a 00 00 00 00 ┊ 01 01 06 00 00 02 7f ff │×A•_0000┊•••00••×│
+│006f6150│ 04 00 ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │•0××××××┊××××××××│
+│006f6160│ ff ff ff ff ff ff ff ff ┊ ff ff ff ff ff ff ff ff │××××××××┊××××××××│
 │*       │                         ┊                         │        ┊        │
 │00710000│ 5f 46 4c 41 53 48 5f 4d ┊ 41 50 15 00 00 00 00 00 │_FLASH_M┊AP•00000│
 │00710010│ 00 00 00 00 00 00 00 00 ┊ 00 00 00 00 00 00 00 00 │00000000┊00000000│

…yeah, look at these changes below 0x3fffff — it has corrupted the ME region!!

This is why I avoid vendor tools as much as possible.

Dec 27 '21 14:12 valpackett

thinkpad-ec
thinkpad-ec copied to clipboard

L430 with BIOS G3ET68WW (2.07) / EC G3HT39WW (1.13)

Patching L430/530 for a classic 7-row Keyboard

Location of the keyboard table

Table format

Current layout

Patching the keyboard layout

Patching Thinkpad L430/L530 battery check

The Problem

The authentication routine

Writing a patch for the authentication routine

Patching the authentication routine

Hotpatch memory at runtime

Hotpatch firmware code

Permanently patch firmware

Mapping	Normal	FN	New Key	New FN
0B	10	C2		C3
0C	04	CD	E7
0D	10	C3		BD
16	0A	D7	A3
18	01	D9	A2
1A	09	DB	A6
1C	78	DD	A8
1E	07	DF	A9
20	29	E1	A4
22	32	E3	E9
24	1B	E5	9D
26	42	E7	A7	E8
28	4D	E9	10	B7

Mapping	Normal	FN	New Key	New FN
0B	10	C2		C3
0C	04	CD	E7
0D	10	C3		BD
16	0A	D7	A3
18	01	D9	A2
1A	09	DB	A6
1C	78	DD	A8
1E	07	DF	A9
20	29	E1	A4
22	32	E3	E9
24	1B	E5	9D
26	42	E7	A7	E8
28	4D	E9	10	B7

thinkpad-ec thinkpad-ec copied to clipboard

L430 with BIOS G3ET68WW (2.07) / EC G3HT39WW (1.13)

Patching L430/530 for a classic 7-row Keyboard

Location of the keyboard table

Table format

Current layout

Patching the keyboard layout

Patching Thinkpad L430/L530 battery check

The Problem

The authentication routine

Writing a patch for the authentication routine

Patching the authentication routine

Hotpatch memory at runtime

Hotpatch firmware code

Permanently patch firmware

thinkpad-ec
thinkpad-ec copied to clipboard

Mapping	Normal	FN	New Key	New FN
0B	10	C2		C3
0C	04	CD	E7
0D	10	C3		BD
16	0A	D7	A3
18	01	D9	A2
1A	09	DB	A6
1C	78	DD	A8
1E	07	DF	A9
20	29	E1	A4
22	32	E3	E9
24	1B	E5	9D
26	42	E7	A7	E8
28	4D	E9	10	B7