Close

Progress on the EC

A project log for Reverse engineering Toshiba R100 BIOS

We are reverse engineering the BIOS and EC firmware of an old laptop in order to create a keygen for their password recovery mechanism.

q3kq3k 01/18/2016 at 21:340 Comments

Some progress has been made the past few days on the actual Renesas EC chip. A detailed log will probably follow in the upcoming few days, once I get the chance to take a few pictures and screenshots.

In 2014 I etched a PCB to mount the EC on after desoldering it from the mobo. I know this, because it says 'q3k delineavit 2014'. It is now 2016, and I finally managed to hook it up to a bus pirate and issue it a few Standard Serial I/O commands. As predicted, though - it is locked. However, the next step is to use my shiny new ChipWhisperer to take a snap a few powertraces while we feed it data.

First things first, I will have to figure out how to make the chipwhisperer talk this weird synchronous-UART protocol that the EC bootrom uses.

By the way, the chip is a Renesas M306K9FCLRP.

Discussions