Skip to content

Development

Jump to bottom
Maximilian Luz edited this page Jan 4, 2023 · 3 revisions

Getting Windows Logs for Reverse Engineering

  1. Get the required software:

  2. Disable driver signature verification (required to get IRPmon working):

    Hold shift while clicking on the restart button in the start menu. Go through Troubleshoot, Advanced Options, See more recovery options, Start-up Settings and press Restart. Boot into windows. On the screen appearing afterwards press 7 to Disable driver signature enforcement.

    Note: This step will re-boot your PC.

  3. Start IRPMon via x64/IRPMon.exe.

    Select Action, Select drivers / devices... and search for \Driver\iaLPSS2_UART2. Expand and right-click on the inner-most entry and select Hooked. Select the Data option while hooking, then click Ok to close the selection window.

    Make sure there is a check mark next to Monitoring, Capture Events. If not activate this.

  4. Perform a/the task involving the EC (eg. detaching the clipboard on the SB2). You should then see messages appearing in the window. You can see which items have data in the "Associated Data" column and look at the data under Request, Details, Hexer. You can save those to a file via Action, Save.

    Please try to submit concise logs containing one test at a time. Usually the messages should stop appearing after a short period of time and you can then assume that the exchange between Windows and the EC is complete.

Notes on the Hardware

From what I can figure out, the (newer) Surface devices use two different ARM chips:

In addition to these two chips, there are also two different communication interfaces:

  • The Surface Book 2, Surface Pro 5, Surface Pro 6, Surface Laptop 1, and Surface Laptop 2 use a UART serial bus.

  • The Surface Book 1 and Surface Pro 4 use HID-over-I2C.

Currently only the first interface is supported, meaning this module does currently not support the Surface Book 1 and Surface Pro 4.

Table of Contents

Clone this wiki locally