On Sun, Jan 4, 2009 at 6:36 AM, Rudolf Marek r.marek@assembler.cz wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hi all,
do end up needed to did deeper and you can't get any info from the manufacturer then EnE is your best bet for reverse engineering.
I have taken a BIOS from Mini A110 (q1d25i.rom). The Quanta IL1 reference design seems to use ENE3310 controller. The q1d25i.rom was examined. The EC code is on 0xFFF00000 length is 64KB. The file is called HOLE0.ROM inside BIOS.
The ENE KB3310 seems to be similar to ENE KB3920, which datasheet I found via google.
I have taken IDA and did the LST file. It has 8051 inside. Yesterday I spoke with Bari and got the s51 emulator from (SVN: https://sdcc.svn.sourceforge.net/svnroot/sdcc/trunk).
I fixed the serial port issue, and now the firmware runs inside emulator:
Serial output: 00, ec[ECFV]==80ac wake@z,ACOut Zttttttttttttttttttttttttttt
It prints 't' every second or so.
It seems that a flash can be flashed even unsoldered via serial interface of EC. (some other pins must be pulled low)
http://laptop.org/teamwiki/images/e/e5/SPI_Recovery.pdf
Here is a EC schematics from reference design. http://laptop.org/teamwiki/images/f/fe/CL1_A1A.pdf
Those links are dead, any chance you know where they've moved to?
Thanks, Corey