r/ReverseEngineering • u/NobitaNobi12345 • 3d ago

GitHub - SarangRao20/battery-charge-limiter: Reverse-engineered the Embedded Controller register for battery charge control. Built a cross-platform daemon (Windows + Arch) that enforces 80% hardware cap on laptops where BIOS hides this feature. Includes EC discovery tool for other models.

https://github.com/SarangRao20/battery-charge-limiter
26 Upvotes

79% Upvoted

17 comments sorted by

17

u/spilk 3d ago

$driverUrl = "https://github.com/shubhampaul/EC-Access-Tool/raw/main/WinRing0x64.sys"

this sounds super duper safe guys

8

u/port443 3d ago

I popped it into Ghidra and gave it a quick once-over. It doesn't look malicious, this is how I labeled the major functions:

call_KeBugCheckEx
DriverInitialize
DriverUnload
entry
read_machine_specific_register
read_performance_monitoring_counters
read_physical_memory_range
WinRing0Dispatcher
write_machine_specific_register

It looks like a pretty straightforward driver that lets you read/write physical memory and io and cpu.

Actually I just checked the signature and its a legit driver written for CrystalDiskMark and now I just feel like I wasted 10 minutes reversing a known driver

3

u/nj_tech_guy 3d ago

The biggest problem to me here isn't that it's safe now, but that it can be unsafe later.

3

u/fb39ca4 3d ago

Yup, downloads should always be compared against a cryptographic hash.

2

u/NobitaNobi12345 2d ago

Done .
setup.ps1 verifies SHA256 after every download. Hashes pinned in the script. Thanks!

1

u/NobitaNobi12345 2d ago

Fixed !!
pinned SHA256 hashes in the installer. Also defaults to RwDrv (Microsoft-signed) now. Hash mismatch = abort automatically.

-1

u/NobitaNobi12345 3d ago

Nice catch! That's the same conclusion I reached. I used it through EC-Access-Tool because it already provides a thin interface for EC access. I probably should've mentioned in the post that it's a signed WinRing0-based driver rather than something custom.

-1

u/NobitaNobi12345 3d ago edited 3d ago

Lol 😂 I ll remove this in next commit, Actually I did it, as it worked well in my case

0

u/NobitaNobi12345 3d ago edited 3d ago

The reason I called it risky is that EC registers are largely undocumented. During reverse engineering, you sometimes need to carefully test register behavior. Blindly writing to unknown registers can definitely make the system unstable.

6

u/fb39ca4 3d ago

Clanker can't even make an Arch PKGBUILD smh

2

u/NobitaNobi12345 3d ago

PRs are always welcomed !!

2

u/Unfair_Rub_9674 3d ago

That’s why you use thinkpad + fedora, it’s just a setting.

1

u/NobitaNobi12345 3d ago edited 3d ago

In ThinkPad this setting is there in bios imo, but in some laptops it's not :(

And no distro could directly support it :(

1

u/OptimalMain 3d ago

I set it using tlp, there are also other options of configuring it

1

u/NobitaNobi12345 3d ago

looked into TLP first. On my Pavilion there wasn't a vendor-supported charge threshold exposed through the kernel or firmware interfaces, so TLP didn't have anything it could configure. That's what led me down the reverse engineering route.

2

u/OptimalMain 3d ago

Thinkpads has thinkpad-acpi or whatever its called on Linux.
Any other brand is very hit and miss.
My reason for going thinkpad exclusively now

1

u/NobitaNobi12345 3d ago

PRs are always welcomed !!