https://forum.thinkpads.com/viewtopic.php?p=837385#p837385 0x9aee struct{ uint8_t temp_in,uint8_t temp_out,uint16_t pwm}[7] -> 4*7= 28 Byte dd if=ec.bin bs=1 count=28 skip=$[0x9aee] 2>/dev/null|hexdump -C >tempTable.hex dd if=ec.bin skip=$[0x09d7e] bs=1 count=32 2>/dev/null |hexdump -C The table at 0x9aee has following type: struct{ uint8_t temp_in,uint8_t temp_out,uint16_t pwm}[7] 00000000 00 00 65 00 29 28 19 00 38 2d 23 00 42 39 41 00 |..e.)(..8-#.B9A.| 00000010 4c 43 5a 00 5a 4d 64 00 ff 00 64 00 |LCZ.ZMd...d.| 0000001c https://forum.thinkpads.com/viewtopic.php?p=837223#p837223 vladisslav2011's linux kernel ec debugfs patch ported to 5.1: https://dump.bitcheese.net/files/fazusav/linux-5.1-ec.patch #https://stackoverflow.com/questions/29440784/writing-to-embedded-controller-registers-in-ubuntu-14-04 sudo modprobe ec_sys write_support=1 root@michis-ibm-haupt:/sys/kernel/debug/ec/ec0# hexdump -C io 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000050 38 b3 0d 0d 49 90 00 00 00 00 00 00 00 00 02 00 |8...I...........| 00000060 b4 24 99 12 30 2a 5f 00 2f 00 00 00 9e 11 c8 30 |.$..0*_./......0| 00000070 41 38 43 00 00 00 65 00 00 00 00 00 00 00 00 00 |A8C...e.........| 00000080 b3 b3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000100 https://forum.thinkpads.com/viewtopic.php?p=834033#p834033 git repo: https://github.com/l29ah/x210-ec x210-ec/checksum ec.temp_pwm_patched.bin dd if=x210-current-internal-flashrom.bin of=fw.bin bs=1024 count=2048 dd if=ec.temp_pwm_patched.bin of=fw.bin bs=1024 count=64 seek=2048 dd if=x210-current-internal-flashrom.bin of=fw.bin bs=1024 count=6080 seek=2112 sudo flashrom -V -p internal -l layout -i ec -w fw.bin r2 -w -q -P x210-ec/patches/lcd-backlight-925hz.rapatch ec.temp_pwm_patched.bin || true