Probe the EC's registers

This part of the tutorial covers some tools and techniques which come in handy if you want to verify your findings from previous chapters, or haven't figured out yet which EC registers allow you to control your notebook's fan(s).

⚠️ Before you go on, backup your system to be able to restore it in case something goes wrong and make sure you know how to reset the EC to default.
Also, disable all hardware monitoring tools (and the like) which could interfere when accessing the EC.

EC probing tool

NBFC comes with a tool which provides an easy way to monitor and access the EC's registers: ec-probe
Hereafter I will explain all ec-probe features and how to use them.

Search for registers which correlate with the fan's speed

ec-probe comes with a monitoring feature which allows you to find potential ReadRegisters and WriteRegisters. It's also useful when trying to find the MinSpeedValue and MaxSpeedValue.

The idea behind this feature is simple:

1. Make the fan spin faster, e.g. by putting some load on the CPU with tools like prime95
2. Monitor the EC's registers
3. Find registers which change correlating to the fan speed

As an example, this is how the (truncated) output of ec-probe.exe monitor --clearly could look like:

0x11: CD,D0,CE,FF,00,04,   01,07,F5,04,08,02,08,F3,0C,07,08,0B,0C,   0D,0C,0D,13,0D,0E,10,00,11,0C,BE,9C,77,80,7E,73,83,79,72,76,71,79,73,C6,7B,8B,78,70,74
0x12: 00,         01,            00,01,         00,01,                                             00,                                                   00
0x26: 28,2D,2F,31,33,35,36,37,39,3A,3B,   3C,3D,   3C,3E,      3F,      40,      41,            42,41,39,38,36,35,   34,33,   31,      30,      33,34,31,2F
0x2E: FF,52,49,      48,41,   40,         3F,38,39,38,39,            38,            39,               38,      39,38,3B,41,   40,      41,               41
0x2F: FF,66,4A,      41,                  39,                                                                        41,                                 41
0x32: 28,2D,2F,31,33,35,36,37,39,3A,3B,   3C,3D,   3C,3E,      3F,      40,      41,            42,41,39,38,36,35,   34,33,   31,      30,      33,34,31,2F

The registers were monitored for a little more than 4 minutes. After about half of the time, prime95 has been stopped.

At the first glance the result might look quite confusing, but if you could have heard the fan noise during this monitoring run, you would've been able to recognize that every time register 0x2F changed, the fan noise also significantly changed. Additionally, as you can see, register 0x2E follows register 0x2F with a little delay. So, it looks like register 0x2F corresponds to the target fan speed and register 0x2E corresponds to the actual fan speed. This confirms the findings from chapter 2.
Another thing you can see (especially if you plot the register's values) is, that registers 0x26 and 0x32 are temperature readings, which again confirms the findings from chapter 2.

After you've found some interesting registers and made some assumptions based on your observations, the next step is to verify them.

Verify findings

First, to get an overview, dump all EC registers via ec-probe.exe dump:

00: E1 37 EA 1C 3B 08 B3 F7 00 1B 2E 09 55 FF FF 00
10: 00 9B 00 FF FF FF FF FF FF FF FF FF FF FF FF FF
20: FF FF 00 00 00 00 32 01 00 00 00 00 00 00 40 41
30: 00 00 32 00 00 00 FF 00 00 00 00 00 00 00 00 00
40: 00 00 00 10 00 00 16 18 06 00 1E 05 04 00 00 00
50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
80: 00 00 04 01 11 01 00 14 0F EC 13 FF FF 44 0E FF
90: FF 01 02 00 43 30 2A 00 00 00 00 FF FF 00 00 00
A0: 00 83 0D C1 01 9E 2F FF 0F F2 0F AC 0F C8 00 FF
B0: FF 96 00 00 00 64 20 E0 00 64 5A 00 5A 00 0A 38
C0: 31 FF 00 00 FF FF FF 00 00 A3 29 0B 3F 38 38 36
D0: 36 4C 4C 4C 4C FF FF FF 01 FF FF 04 00 00 00 00
E0: A6 0B FF 08 00 F4 6E 01 01 00 1A 00 00 FF FF 00
F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Next, write a value to the register which you've identified before as write register and see if the fan shows a reaction, e.g. ec-probe write 0x2F 50

In case the fan reacts to your input: Congratulations - you are now able to control your notebook's fan(s). You can now go on and find out which value lets the fan spin at maximum or minimum speed by writing different values to the newly found write register and observing the fan's reaction. You should also check if the write register needs to be reset to a certain value to hand the control over the fan back to the EC-firmware.

If the fan changes the speed only for a short period, or doesn't react at all, you're either writing to the wrong register, or you must enable the EC's manual control mode which disables the EC's builtin fan control logic and lets you control the fan(s) manually. Unfortunately, it's unlikely to find out how to do this by poking around in the EC's registers. I recommend to give the different approaches, which were explained in the previous chapters, another try.

Finally, if you were successful, you can combine all the knowledge you've gathered and create a config file.

Appendix: Read & Write Everything

If you prefer GUI over the command line, check out the awesome RWEverything.

You can use RWEverything instead of ec-probe to verify your findings:

Although RWEverything is an extremely powerful tool, if you're searching for registers which allow you to control the fan, I still recommend using ec-probe's monitoring feature, because RWEverything lacks similar functionality.