Merge Clevo Bios & EC

[plutomaniac]

Hello,

I was interested in merging my laptop's BIOS & EC together into one image and came to an interesting conclusion. My laptop is Clevo W25xHNx from 2011 (EOL). The latest BIOS is 1.01.07 and was released alongside EC 1.00.05. After some time EC 1.00.06 was released and no more updates after that. I opened BIOS 1.01.07 and EC 1.00.05 with AMIBCP and saw that both of them are based on the 1.01.07 BIOS which makes sense since they were released together.

Next I opened EC 1.00.06 with AMIBCP and saw that it is also based on the 1.01.07 BIOS which again makes sense since it had to be based on the latest released BIOS.

So I wondered whether I had to do anything to merge the 1.01.07 BIOS and 1.00.06 EC. I could just flash the 1.00.06 EC image (/E & /P /B /N) to update both EC and then BIOS. Obviously I had to make sure first that there were no other differences apart from an updated EC. Maybe the bare EC image didn't include parts of the main BIOS block. I opened both 07 BIOS and 06 EC with Beyond Compare and saw that only a small block was different on both of them. That block should contain the EC.

However, since I don't know from where exactly I should copy-paste I decided to use UEFIExtract.

I extracted both BIOS 07 and EC 06 and checked both folders for file differences with WinMerge. The only difference was a single 64KB "padding" file at the top of the main BIOS block: eW251HNQ.06.dump\2 BIOS region\0 Padding\body.bin

I copied both files in a folder and after naming them appropriately I opened both of them with HxD hex editor.

At the top I can see ITE which is the BIOS/EC chip manufacturer. Scrolling down a bit reveals the file's version number witch is 1.00.05 for the BIOS 07 one and 1.00.06 for the EC 06 one. This is definitely the EC firmware.

Now, I want to test whether the latest EC_06 is a full 1.01.07 BIOS + EC 1.00.06 image. I opened both BIOS 07 and the extracted 64KB EC 06 firmware. The first line of the extracted EC file is 02 00 2E 02 00 0E 22 22 22 22 22 02 06 80 C2 AF. I search that at the BIOS 07 image and find it at offset 180000.

I go back to the EC and right click > Select all > Copy. The length is 10000 as shown by HxD.

Now I go back to BIOS 07 tab, click before the first hex number of the 180000 offset (02 in my case), Edit > Select block and enter the length of the EC file which is 10000 or 64KB.

Then right click > Paste write. The 64KB that I replaced will appear in red.

I save the result in a new file (TEST_BIOS07_EC06). In theory I have now created a 07 BIOS + 06 EC. So if I compare the stock Clevo 06 EC file with my TEST one, they should be identical. And I'm right, they both have the same SHA-1 hash.

So that proves that the EC_06 provided by Clevo can be used on it's own to update both the BIOS & EC of a machine. So, in my case I don't have to merge the 64KB EC firmware, I can use the EC image by itself. Of course, IF EC_06 was based on the 04 BIOS for example (whereas the latest BIOS is 07) I would have to extract the 64KB EC and insert it manually like I shown above. But in THIS case, that's not necessary.

Am I wrong?

[Guest]

Sure you can just directly flash the v7 BIOS that comes with EC v6, same thing.

(In general be very careful with EC firmware, one bit too much or too less and it bricks the system.)

[plutomaniac]

Thank you for verifing that Prema, I'll base my mod on the "EC" file. That's what I thought. Btw, UEFITool can also be used for doing the extraction quickly without a hex editor and copy-pasting (I know you know that, just for helping others who might be looking into that). To insert it back though, a hex editor is needed since you cannot import and replace "padding".

I checked one or two newer models for reference and saw that again the EC is signified by 02 00 2E 02 00 0E 22 22 22 22 22 02 06 with a size of 64KB or 10000 length. However, this is probably for systems with one EC firmware using one BIOS/EC ITE chip. The position, size etc might differ otherwise. Just pointing that out. And yes, I'm not going to mess with the actual EC. I can't afford bricks nor do I have a programmer!

It's weird that Clevo has decided to have one BIOS and one EC image when they could easily release one file with both updated. And their batch files shut down the system after the EC making it more dangerous to actually cause a brick. Who knows, they probably have a reason...

[Guest]

They just don't know what they are doing...they simply use the files the way they are spit out by the dev tools and send to them...

All Clevo models since Sx series have the EC directly hosted in the ITE controller (some also have a secondary EC chip (co-lay).

Those ECs contained in BIOS files are only used until Ex series.

[plutomaniac]

I actually tested a W3xxST before and the EC block was there. That's the rom that I said I tested for reference.

[Guest]

It is a left over and unused part, no difference if you write FF into the entire region and flash with /e, it is simply no longer used on Sx+ production units.

[plutomaniac]

Ha, ha. Oh Clevo... I can't imagine how many systems you must have bricked and brought back to life in order to know all these.

I guess I could transform this thread slightly into a small guide for older systems up until Ex series on how to do the BIOS/EC merger. Could be useful for someone, who is feeling dangerous, later on.