RGB controller |
Post Reply | Page 12> |
Author | |
wegrzycki_
Newbie Joined: 13 Dec 2018 Status: Offline Points: 3 |
Post Options
Thanks(0)
Posted: 13 Dec 2018 at 9:58pm |
Hi, I'm trying to write driver for rgb control under linux for x470 taichi, and I have troubles with discover which GPIO ports controls leds, I had tried dumping all registers from superIO chip, after changing colors in bios but it didn't works. After some research I found info that leds are controlled by other chip N76E885AT20 I assume that it is connected to superIO chipset via his GPIO interface but I have no idea which ports are used for that purpose. Do anyone have any idea how to discover which pins are controlling led's?
|
|
mylinuxguy
Newbie Joined: 11 Jan 2019 Location: Dallas Texas Status: Offline Points: 7 |
Post Options
Thanks(0)
|
Have you made any progress on this? I've got linux and an 470 taichi board too.
- jack |
|
- jack
|
|
poke3220
Newbie Joined: 06 Nov 2018 Status: Offline Points: 3 |
Post Options
Thanks(0)
|
Would be great to be able to control the LEDs from Linux.
But without some basic help from ASrock on how the LEDs are controlled will be very difficult and time consuming. |
|
poke3220
Newbie Joined: 06 Nov 2018 Status: Offline Points: 3 |
Post Options
Thanks(0)
|
My board ASROCK AB350M also uses the Nuvoton N76E885AT20 chip to drive the LEDs. From the datasheet the main difference on pin level that I see is that the 20 pin package doesn't export the P3 port. The N76E885AT20 has a builtin 8051 processor, this means that program is written and flashed by ASROCK. The interresting thing is that we don't need to know the program. The N76E885AT20 talks (RX/TX) to the SuperIO chip NCT6779D, which is accessible from Linux. Our best bet is to install Windows and ASROCK's RGB application and start snooping what it tries to write to the SuperIO chip.
|
|
poke3220
Newbie Joined: 06 Nov 2018 Status: Offline Points: 3 |
Post Options
Thanks(0)
|
Maybe some of these tools might reveal the secret saus:
https://docs.microsoft.com/en-us/sysinternals/downloads/process-utilities |
|
CalcProgrammer1
Newbie Joined: 16 Aug 2019 Status: Offline Points: 1 |
Post Options
Thanks(0)
|
Anyone who wants to help reverse engineer ASRock RGB, please check the issue below:
https://gitlab.com/CalcProgrammer1/OpenAuraSDK/issues/35 I reversed Asus Aura and wrote an open source driver for it and I'd like to help do the same for ASRock boards (and others). Asus used SMBus and USB in their implementation. I'm wondering if ASRock did the same. |
|
EUA
Newbie Joined: 09 Oct 2019 Status: Offline Points: 5 |
Post Options
Thanks(0)
|
Hello Gentlemen.
I am also wanted to control my Fatal1ty AB350 Gaming ITX/ac LEDs. But I surprised about an MCU (N76E88x) is available onboard for just driving LED lightning. I wish they don't use it some nasty security things, since it's closed sourced. I have mailed to support recently, asking about the API or engineering document about LED lightning drivers but I don't think if they give a f. So I armed and engage the war mode. There are 3 attack vectors. 1. Disassembly of AsrRgbLed.exe (picked) 2. Reversing the BIOS Led utility. 3. Disassembly of N76E88x firmware (nu51_1.10) located on AsrLed directory. From last to first; 3. one is the MCU that I don't play with it before. At worst case scenario, even if I can't disassemble it, we could reprogram it with our custom firmware. 2. Since BIOS has the RGB Led Utility inside, we could cut out the required binary with UEFITools and inspect. 1. Old friend IDA Disassembler with little free time. But first, I just inspect the binary with PE Tools and saw that it utilizes SMBus. So probably all communication done via SMBus to N76E88x chip. It also uses AsrDrv103.sys file. I also put it under IDA Debugger and renamed some functions. I don't understand how it communicates, yet. There are some strings make me suspicious about if communication uses some sort of UART connection instead of SMBus because it looks like whole strings are passed for communication some thing like "SetBreathing"...etc. I don't know how much will it stand. Also we could use SMBus eavesdropper using old DDR4 module, soldering 3 pins and could record all SMBus communication physically via RPI like SBCs to. If it communicate with it, If LED Controller don't use SMBus, than my best guess is probably using SuperIO's UART for communicate. |
|
EUA
Newbie Joined: 09 Oct 2019 Status: Offline Points: 5 |
Post Options
Thanks(0)
|
I am working on it for a while.
I found that it uses SMBus, because if you disable AMD SMBus device, program doesn't work, proper. I am debugging via IDA and found some transaction variables. Commands send to AsrDrv103.sys I think. Transactions modes are: 0x11 Static 0x12 Breathing 0x13 Strob 0x14 Cycle 0x15 Rand 0x16 Rand?? 0x17 Music 0x18 Wave And RGB send via 3 byte sequence as R-G-B values. I believe that SMBus 0x36 is the nuvoton N76E885AT20. Which give all 0xFF on the i2cdump. Well who want to buy me a beer? |
|
EUA
Newbie Joined: 09 Oct 2019 Status: Offline Points: 5 |
Post Options
Thanks(0)
|
Looks like no one interested...
Anyway, I installed AsrPolychromeRGBSetup(v1.0.60). Since it's doesn't work, I made flash update with firmware : nu51_2.10 It flashed properly, make my leds bring white but... Control program doesn't work. Indeed there are no compatibility issue or anything... As a Ms Computer Engineer, I can clearly say that: ASROCK JUST AVOID US TO USE NEW PROGRAM BECAUSE OF NOTHING. Anyway. I verify that 0x6a is the guy. Debug shows that AsrLed connected to the 0xB20 port at 0x790B1022. Control registers at 0xFED80300. So soldering to DDR4 Stick RAM pins to eavesdrop communication trick will not work at least on my AsRock Fatal1ty B350 Gaming-ITX/ac becuse of different smbus used. But direct attaching wire to i2c pins (8 SDA, 13 SCL) of N76E885AT20 will work. Anyone? Well, I think same. Hard to solder this tiny pins and could be worst case scenario. Better, continue to debugging... I think I captured good i2c data but. It doesn't actually work on Linux. Why? Do I miss some initialization communication etc? I don't know. AsRock might use some type of lock mechanism to avoid naughty users. Like us. |
|
EUA
Newbie Joined: 09 Oct 2019 Status: Offline Points: 5 |
Post Options
Thanks(0)
|
Done!
I gain *complete* control on nu51_1.10 firmwared MBs. Unfortunately PolycromeRGB firmware is not compatible with it and don't have MB to reverse it. I can make it if anyone send me B450 board. |
|
Post Reply | Page 12> |
Tweet
|
Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |