EC Hacking - Your Laptop Has A Microcontroller - Hackaday
EC Hacking - Your Laptop Has A Microcontroller - Hackaday
June 7, 2022
The EC that the Framework uses is a MEC1521 chip from Microchip, and earlier this
year, they open-sourced the firmware for it. Now, there’s a repository of
By using our website and services, you expressly agree to the placement of our performance, functionality and
microcontroller code
advertising cookies. Learn that you can compile yourself, and flash your Framework OK
more
laptop’s motherboard with. In a comment section of HackerNews, a Framework
representative has speculated that you could add GPIOs to a Framework
motherboard through EC firmware hacking.
Wait… Microcontroller code? GPIOs? This brings us to the question – what is the EC,
really? To start with, it’s just a microcontroller. You can find an EC in every x86
computer, including laptops, managing your computer’s lower-level functions like
power management, keyboard, touchpad, battery and a slew of other things. In
Apple land, you might know them as SMC, but their function is the same.
Why have we not been reprogramming our ECs all this time? That’s a warranted
question, too, and I will tell you all about it.
How does it even talk to the chipset? For about two decades, ECs have been using
the LPC bus – a four-bit wide bus superficially resembling qSPI. Apart from ECs, it’s
only really been used by TPMs in the recent times. LPC uses frequencies from
25MHz to 100MHz. Thus, if you want to put a logic analyzer to your LPC signals and
capture some packets, your typical cheapo 25Msps LA won’t do, but an off-the-
shelf FPGA board or a way faster LA will work wonders, and there’s a pretty cool
paper using LPC manipulation and an FPGA to extract keys from TPMs.
LPC is about two decades old, and is a direct successor to the ISA bus – in fact, in
some laptop schematics from 2003 you’ll find the EC connected through ISA
instead, but it’s all LPC beyond that. However, recent ECs talk eSPI instead, a qSPI-
like interface meant to replace LPC, and the Framework EC talks eSPI, too.
Often, your EC is built on something like ARM or 8051 architecture, other times it’s
something more obscure like CompactRISC. The common thing is – at most, you’ll
get a binary blob when it comes to your EC’s firmware. At some point, when Google
got into laptop business, a group of their engineers presumably said “enough”, and
open-sourced their EC code – which is what Framework has been building on when
it comes to their own EC firmware. Last year, System76 opened up their EC code,
too. Unfortunately, the situation remains dire for other laptop manufacturers.
Could your
By using our EC get
website backdoored?
and services, Not
you expressly likely
agree to the–placement
it tendsofto
ourbe harder to
performance, modifyand
functionality and
update EC firmware than it is to do the same with BIOS images. Now, could you OK
advertising cookies. Learn more
yourself modify your EC’s behavior? It’s at least technically possible, and I’d argue
that you should have always been able to do that.
The battery part is more vital, however – you can more often than not live with a
subpar keyboard, even on supposedly otherwise-stellar ThinkPads. The problem is
the “genuine” battery check in the EC, which doesn’t let you charge (or even
operate from) the battery if it doesn’t pass. This isn’t just limited the third-party
battery options, in case that’s what it sounds like – such checks also prohibit use of
Lenovo batteries that were just meant for a different kind of Thinkpad, but
otherwise mechanically, electrically and electronically perfectly suitable.
”
Embedded Controller with unsigned firmware.
If you ask me, this description is bonkers. This sentence essentially means “the
laptop’s owner can flash EC firmware not approved by Lenovo”. I do wonder what
led to it and what the possible justification might be, but in the end, whatever the
reason, it’s a distraction from what I believe. That is, updating the EC firmware on
one’s own laptop should be possible, and Lenovo closed a user-friendly way to do
just that.
Also, without doubt, not all manufacturers respect your right to repair when it
comes to ECs. As an example, for almost a decade now, Dell has been shipping
their laptops with ECs that have encrypted firmware, keys fused inside the EC. This
has been a particular problem for Dell laptop repair, as EC die every now and then.
While you can buy a blank EC and reflow it in place of the Dell’s dead one, it won’t
have the decryption keys Dell flashes into the EC at the factory, and therefore won’t
run Dell’s encrypted firmware. Modifications are off the table here – it’s not even
possible to source a fitting replacement for the EC when your laptop is broken,
even though the chips themselves are abundant.
You can
By using ouralso fixand
website bugs, which
services, crop up
you expressly in to
agree ECs every now
the placement of ourand then, and
performance, can be
functionality andquite
advertising cookies. Learn more
annoying to deal with – imagine keyboard keys getting stuck every now and then, OK
seemingly randomly, and that’s exactly what happens when you have an EC bug.
Bug fixes or improvements, just like with any firmware currently closed to us, we
won’t see a slew of cool hacks starting tomorrow, but there are definitely cool
things on the horizon when it comes to EC hacking.
ec says:
June 7, 2022 at 7:46 am
> “the laptop’s owner can flash EC firmware not approved by Lenovo”
Don’t see how it’s limited to just the owner.
These are business laptops so it’s expected of them to plug up potential security issues,
evenour
By using onwebsite
old models.
and services, you expressly agree to the placement of our performance, functionality and
advertising cookies. Learn more OK
> Dell has been shipping their laptops with ECs that have encrypted firmware, keys
fused inside the EC
I’m actually surprised there are manufacturers that don’t do this.
The ability to install your own OS, disable Secure Boot, or plug in random USB
devices is also a ‘potential security issue’. It is inane to view it this way, however.
We are talking about “physical access” threat model when it comes to the
specifics of this hack. The laptops affected fail this model on many fronts already.
This is not a decision taken with a sane threat model in mind.
Properly working on your product’s security takes consideration – this ain’t it.
Google hasn’t fallen out with Big Security crowd after open-sourcing their EC
firmware, neither have System76 or Framework. You’d notice that if you looked.
> I’m actually surprised there are manufacturers that don’t do this.
Well yeah, not everybody makes such moronic decisions. Dell’s consumer-grade
laptops go to waste because the EC can’t be replaced without a donor. All the
other manufacturers don’t feel the need to do that, and sometimes they’re fine to
distribute an EC firmware blob, even.
Lenovo closed this way of updating after their community has embraced this way
to give old laptops new life. I prefer this to be emphasized quite clearly. There’s
nothing good about this restriction for us, and it’s not justifiable security-wise.
Dissy says:
June 7, 2022 at 9:17 am
This, I don’t understand. The EC firmware may stored in the SPI chip
alongside the BIOS (idk if Lenovo does this often), but if what you
mean is that they do encryption-at-rest for BIOS code somehow (not
something I’ve heard about), the EC code would still be executed by a
different CPU, aka the one in the EC – just stored in the same chip as
the BIOS?
…update encryption? I know they do update signing, but… encryption?
You’d need to flash decryption keys into the PCH or something, then.
Or perhaps the EC decrypts data before passing it to the PCH – but
then, that’s easily sniffable and moot, unless a secure channel is
overlaid over LPC/eSPI/whatever. Can you help me understand that –
perhaps any links that’d help here, too?
Dissy says:
June 7, 2022 at 9:55 am
Sorry, I was referring to the BIOS updates they push out. Lenovo
has a userland updater service that handles decrypting their
BIOS blobs and doing the install to the system. I’d assume they
are certainly signed as well.
Report comment
By using our website and services, you expressly agree to the placement of our performance, functionality and
Dissy
advertising cookies. says:
Learn more OK
June 7, 2022 at 10:40 am
As for links to more info, I first heard about it from a BlackHat
conference talk in 2015.
Some useful search terms are “lenovo service engine”, “uefi
windows platform binary table”, and also “uefi wpbbin.exe”
That last one is the name of the executable that the BIOS
injects, from the UEFI data, which windows auto-runs early on in
the boot process. Searching just the exe name fills the results
with all sorts of AV pages and “what is this file?” pages that look
quite shady.
This prefix returns stuff about lenovo and asus which looks
useful, but was just the first thing to come to mind.
Report comment
Interesting post, didn’t realise so much work had got into opening the system up to
mods, cool !
Hmm, have a few systems, worth going through the code make sure no vulnerabilities
or hidden Bitcoin IDs ;-)
Glad to hear you liked it ^__^ It’s really fun what can be done! [DHowett], for
instance, is working on new key handler code for the keyboard, and already has a
proof-of-concept working. From here, one of the possible routes is that you could
implement keyboard layer declaration parsing, QMK-style – maybe with easy user-
space updates, too!
I have healthy respect for “hackers’ projects might be never finished”, so don’t
treat this as any kind of promise on [DHowett]’s behalf =D But it’s definitely an
idea that’s just begging to be implemented, and something we can only work on
By using our website and services, you expressly agree to the placement of our performance, functionality and
aftercookies.
the ECLearn
firmware’s been opened!
advertising more OK
Reply Report comment
ec says:
June 7, 2022 at 7:56 pm
Dan says:
June 7, 2022 at 8:23 am
> This sentence essentially means “the laptop’s owner can flash EC firmware not
approved by Lenovo”.
It also means that a bad actor with physical access can flash firmware (e.g. keylogger)
onto your laptop; maybe the “cleaner” at the hotel you’re staying at for that important
business/political trip; stuff like that happens. Which for some people is a concern,
though admittedly not most of us.
But it also potentially means there’s other security flaws including other routes to install
firmware.
But there might be worse issues. If it controls the battery charging, it could potentially
be abused to turn a laptop into an incendiary.
Given that thinkpads are (or at least were?) highly regarded in big enterprises, I suspect
the security issue might be the real motivation here.
By using our website and services, you expressly agree to the placement of our performance, functionality and
advertising cookies. Learn more
Arya Voronova says: OK
June 7, 2022 at 9:04 am
“To turn a laptop into an incendiary” is a wild and baseless speculation. Please do
check a laptop schematic sometime, and read some datasheets of the ICs in it.
There’s a myriad of protections against such failure modes, not just for malicious
intent, but because hardware fails, and you need to protect components from
each other if one of them goes haywire. Physical access can circumvent all of
these protections – and it doesn’t need the EC being in the picture for that.
You can still override CC/CV charging with physical access, you don’t need an EC
firmware mod for that, even – there’s a lot of things you can do with physical
access. Furthermore, the things you *can* do through the EC power-wise with
firmware alone, without hardware mods, are actually quite limited. This is because
of the internal protections of the charger and power path ICs – the circuits are
designing for being switched on and off, not for short-circuiting into each other or
something. Plus, the battery itself also has protections for things like overvoltage
and short-circuit.
If you’re interested in how much you can actually do through the EC firmware,
reading the code for System76 and Framework laptops would give you a good
start on what’s actually possible.
As for “other routes”, I’ll quote the article, and expand on the implications of what I
hoped you’d notice when reading it.
“one of the most comfortable” is the key part. You can reflash the Lenovo ECs
through other ways still, with physical access. They closed down the specific way
to do it that was comfortable for end users. For a bad actor with physical access,
evil maid style (that you’re referring to), it’s still possible to do flash firmware, using
i.e. the UART bootloader of the EC.
They closed the specific way to update firmware that was used by Thinkpad
enthusiasts to replace keyboards and batteries, without a sane security
justification to do so, and that’s quite apparent to me.
Foldi-One says:
June 8, 2022 at 6:51 am
Yeah, the descriptions in the security community have mostly been about Evil
Maid Attacks installing keyloggers or whatever.
I’ve had a lot of laptops over the years, ranging from little ASUS portables to Dell
and HP, that are excessively over-concerned about what power adapter is
plugged in and whether they’re willing to let you use it to charge your batteries or
not.
“Oh, noes, this 65W USB-C or (110W 19.2V barrel jack charger) doesn’t look like
OUR 65W USB-C (or 90W 19.2V barrel jack charger), so its electricity might be
inadequate to run your laptop! So we’re not going to let you get any power from it
even though you’re desperate and want to get something done even if you can’t
run Crysis 24 hours straight!”
Daniel says:
June 7, 2022 at 8:40 am
Won’t be long before someones got a string of WS2812s hooked up to it and are using it
as a monitor to browse the desktop :D
=D
By using ourwith the and
website Framework exposing
services, you expressly24 GPIOs
agree to the(keyboard
placement ofcontrol pins), I sure
our performance, hope and
functionality
advertising cookies.does
someone Learn this!
more OK
Reply Report comment
Myself says:
June 7, 2022 at 10:16 am
So many cool repurposed-hardware ideas seem to require cooperation from ECs and
bootloaders.
You want to turn an old laptop into a remote solar-powered piratebox-style information
kiosk? Gonna have to mod the EC to understand charging from a PV panel that doesn’t
behave anything like a normal brick. You want to power off when the battery is on a bad
trend, but automatically power back up when the sun returns and SoC climbs above a
certain point? Again, the EC controls all that.
For the era before USB-C “docking stations”, docks were a many-pin connector with all
sorts of signals on it. And ISTR many of those signals are bus-switched under the EC’s
control. So if you don’t need the dock, you could repurpose that connector and signals,
if the EC would help out by switching them over to your new peripherals when desired.
Shall we talk about fingerprint-readers and stuff? Imagine integrating the FPR into a
hardware security token, resident entirely within the EC and TPM. I wouldn’t trust a
manufacturer-proprietary integration as far as I could throw it, but an open and auditable
firmware for same would be a gamechanger. Especially if I can solder-out the write-
protect pin for the EC flash IC after burning it.
This truly is an exciting frontier. Unfortunately it moves very fast, and mods developed
for one machine are likely to become substantially or entirely obsolete in the next
model, entirely based on the manufacturer’s whim. I think that’s part of why we don’t see
more hacking here already, but then, ThinkPad owners are a special breed.
As for mod obsolescence, if the firmware is open, it should be way easier to port
mods from generation to generation. Thinkpad stuff was complex to figure out, in
By using our website and services, you expressly agree to the placement of our performance, functionality and
part, because it relied heavily on RE and patching – otherwise, the keyboard mod
advertising cookies. Learn more OK
described in the Thinkpad video would take minutes to perform. So, we get a
lower barrier of entry, and with sources being available, we also get “apply
sourcecode patch to new revision” kind of portability!
“And.. give us an expansion header with some fun pins, too :3 I.e. an ADC
channel, for instance”
https://en.wikipedia.org/wiki/Be_Inc.
t says:
June 7, 2022 at 1:30 pm
https://en.wikipedia.org/wiki/BeBox
tttt56 says:
June 8, 2022 at 5:44 am
Leave a Reply
Enter your comment here...
Please be kind and respectful to help make the comments section excellent.
(Comment Policy)
This site uses Akismet to reduce spam. Learn how your comment data is
processed.
By using our website and services, you expressly agree to the placement of our performance, functionality and
advertising cookies. Learn more OK
SEARCH
Search … SEARCH
SUBSCRIBE
Enter Email Address SUBSCRIBE
IF YOU MISSED IT
IRON NITRIDES: POWERFUL MAGNETS WITHOUT
THE RARE EARTH ELEMENTS
29 Comments
181 Comments
By using our website and services, you expressly agree to the placement of our performance, functionality and
advertising cookies. Learn more OK
MILITARIES ARE RUSHING TO GET ANTI-DRONE
LASERS OPERATIONAL
116 Comments
61 Comments
64 Comments
OUR COLUMNS
HACKADAY LINKS: SEPTEMBER 4, 2022
15 Comments
By using our website and services, you expressly agree to the placement of our performance, functionality and
advertising cookies. Learn more OK
FAIL OF THE WEEK: BRONZE-BRAZED WROUGHT
IRON
16 Comments
No comments
4 Comments
25 Comments
Copyright © 2022 | Hackaday, Hack A Day, and the Skull and Wrenches Logo are Trademarks of Hackaday.com |
Privacy Policy | Terms of Service
Powered
By using our website and services, you expressly agree by WordPress
to the VIPof our performance, functionality and
placement
advertising cookies. Learn more OK
By using our website and services, you expressly agree to the placement of our performance, functionality and
advertising cookies. Learn more OK