HP EliteBook 1030 G3 — NUVOTON NPCX797HA0BX

Hello,

I had to replace the NUVOTON chip in this laptop. It was shorted, showing 0 ohms on the 2R2 resistor. After replacing it, I now measure 3.4 V on the same resistor, so the new chip seems fine. However, the laptop still does not work. When I connect a USB‑C power adapter, it draws almost no power and the LED blinks white/orange.

There are no other shorts on the board, so this chip probably needs to be programmed. I was hoping it would program itself automatically, but that did not happen. The problem is that I have not found any information on how to program this chip on this motherboard, model DA0Y0PMBAF0 REV F.

I do not have a schematic or boardview. The one I found on this forum here does not match this laptop or motherboard, despite what the title says.

Has anyone here programmed this chip before? I could use the keyboard connector with SVOD or Vertanov, but there are no ready‑made configurations for this board. Without a schematic or boardview, I cannot create one myself.

Can I extract firmware for this chip from the BIOS? I've dumped both chips - 16MB and 32MB. ECFind hasn't found anything inside, and searching through the dump in HxD, I haven't found anything useful yet.

S/N: 5CD8468N9C

Thank you in advance for any help!

Update on the repair

It's a journey with this laptop. I've continued the repair by searching for another schematic/boardview that uses the same or at least a similar NUVOTON chip. I eventually found the CATALONIA 6050A3022401, which uses the NUVOTON NPCX797HA1BX. From what I’ve gathered, the difference between A1 and A0 is the flash size: A1 is 256KB, A0 is 128KB — something that later turned out to be correct.

Using that schematic and boardview, I identified the signals I would need: JEN, SWCLK, SWI0, TDI, TDO. It turned out later that only the first three are actually required.

I removed the EC and started tracing connections between the chip pads and the keyboard connector.

Here's what I've found:

My plan was to use SVOD4 and create a new profile. While browsing the database, I accidentally found a profile for a different motherboard — DA0X8MMB6D0 with NPCX797HA1BX — and to my surprise, the keyboard pin mapping was exactly the same as what I had traced. That gave me confidence that my findings were correct.

Unfortunately, at this point I still couldn’t establish a connection to the chip.

So I decided to try my luck with the Vertyanov SUCCESSOR programmer. Setting everything manually didn’t get me any further, and every attempt required re‑entering all parameters from scratch. To speed things up, I added my motherboard configuration to the "**MB connection NUVOTON.txt" **file

EliteBook DA0Y0PMBAF0 KB_pins=42 RIGHT DOWN 05MM JEN=17 SWCLK=2 SWIO=20 TDI=3 TDO=14 CHIP=NPCX797HA0BX

Now I could load the profile instantly instead of typing everything again. However, I noticed that even though I included TDI=3 TDO=14 in the string, these two values were not being loaded when selecting the profile.​

When I tried setting the pins manually in Vertyanov and try to left TDI/TDO empty, the software refused to apply the settings:

​While creating the profile, I got lucky — it allowed me to set only the three required pins, and with that I finally managed to read the EC. At this point I suspected that SVOD4 might also work without TDI/TDO, something I plan to verify later.​

Now, after reading the chip, the size automatically changes to 128 KB regardless of setting a different value here, which confirms that A0 uses this size.

As expected, the chip is completely empty — just FF FF FF….

With some AI assistance, I learned that a valid Nuvoton NPCX797 firmware should begin with the sequence 00 20 00 20. None of my BIOS dumps contained anything resembling EC firmware. But in the meantime, I downloaded the official BIOS update from HP. At first it didn’t seem useful - the file is 24 MB while the full dump is 32 MB — but after searching through it, I got lucky again.

The EC firmware segment is located at the very end of the file; selecting 20,000 bytes ends exactly at the final byte of the entire image. That couldn’t be a coincidence.

I flashed the EC with this data.

Now the laptop’s LED stays solid white, and when I press the power button, the Caps Lock blinks 7 times, which indicates a bad EC. So still no success.

I also cleaned the ME region using the “Unconfigured” region from the HP BIOS update — no change.

So, I’m still working on it…

​

Attached Files
Premium supporters get full download access and other benefits.

•

Вложения: https://www.badcaps.net/forum/troubleshooting-hardware-devices-and-electronics-theory/troubleshooting-laptops-tablets-and-mobile-devices/filedata/fetch?id=3815463

What’s even more interesting, and makes me believe this could actually work, are the changes in the EC firmware after I program the chip with the extracted firmware and power it on for the first time. The differences keep changing: when I programmed the chip a second time, tried to power it on, and then read it again, the contents were different from the first read. The differences appear in the middle of the chip, starting at address 0x1000.

Attached Files
Premium supporters get full download access and other benefits.

•

Вложения: https://www.badcaps.net/forum/troubleshooting-hardware-devices-and-electronics-theory/troubleshooting-laptops-tablets-and-mobile-devices/filedata/fetch?id=3815660

Not discounting what you've done, but you may want to double check the board, as I believe this model has a separate SPI ROM for the EC (to the left of the BIOS chip). Seems to have EC written on the silk screen, you may want to compare it to your board.

Not discounting what you've done, but you may want to double check the board, as I believe this model has a separate SPI ROM for the EC (to the left of the BIOS chip). Seems to have EC written on the silk screen, you may want to compare it to your board.

No thats the 16MB EC_Bios ,its for bios recovery, hashes for the serial number, ME and passwords. Filling 37000 - 37FFF with FF`s removes the password.

What is the source of this information from AI?

In the dump i see several times mentioned "cypress", i think it might be firmware for usb-c controller.

####################################################################

With some AI assistance, I learned that a valid Nuvoton NPCX797 firmware should begin with the sequence 00 20 00 20.

What’s even more interesting, and makes me believe this could actually work, are the changes in the EC firmware after I program the chip with the extracted firmware and power it on for the first time. The differences keep changing: when I programmed the chip a second time, tried to power it on, and then read it again, the contents were different from the first read. The differences appear in the middle of the chip, starting at address 0x1000.

I read on a russian repair forum that the HA version does not require flashing.

I've posted both - 16MB and 32MB dumps including 'all the rest' here

I’m planning to dump the third chip as well — the smallest one. I downloaded the Thunderbolt firmware from the HP support page, so I’ve got the binaries for comparison.

I've used a few different AI to analyze begging of what I believe is EC.

I read on a russian repair forum that the HA version does not require flashing.

Can you post where did you find that information?

I'm also cannot read or connect a simlar EC in a 840 G5 project. (NPCX797HA0BX )

Can you post where did you find that information?

I'm also cannot read or connect a simlar EC in a 840 G5 project. (NPCX797HA0BX )

Sorry, cant find where i read it now so that might not be true. I did come across a pdf posted by Sergey Vertyanov for an Acer motherboard with a NPCX797HA1BX EC , its in russian but it might be useful

Attached Files
Premium supporters get full download access and other benefits.

•
Z8QA NPCX797HA1BX разбор полетов.pdf

(2.28 MB, 49 views)

Вложения: Z8QA NPCX797HA1BX разбор полетов.pdf

Thanks for the detailed NPCX797HA1BX flashing guide.

In the meantime I bought a second motherboard with a defective CPU. I removed all three EEPROMs and the NPCX797HA1BX chip from it. With this full set of chips installed, the laptop started up normally. After the first boot it automatically performed a BIOS update (2 or 3 times), and then the laptop refused to start again, showing the same symptoms as before.

I reflashed the chips once more and the laptop booted again with the updated BIOS. This time, after a few restarts, Windows loaded, and it looks like the laptop is working now.

I can’t get a connection to the NPCX797HA1BX chip anymore, but on the second attempt (after flashing the original SPI dumps) I soldered an empty NPCX797HA1BX and the laptop started successfully.

Working set of the all 3 SPIs: https://www.badcaps.net/forum/troubl...08#post3867508

hi [автор темы](https://www.badcaps.net/member/346571-автор темы) ,

I've been tinkering around with a NPCX797HA1BX recently, as well. Thanks to your instructions, I managed to wire up the bare IC to a FT2232H and with Nuvoton's OpenOCD available on GitHub.

I've got a HP EliteBook 850 G7 in with this EC and because of a shorted 3V3 line I believed the EC is the cause for this and desoldered it, only to find out it was only a shorted capacitor somewhere else.

Since I've never reballed a BGA chip, and didn't want to mess up things even more, I ordered a "new"? NPCX from AliExpress and soldered it, but the laptop wouldn't start with it, only showing the amber charging LED and nothing more even after an hour of waiting.

Well, I've somehow managed to reball and solder the original the EC on the board and it's working again, but, for the sake of science, I've then spent some time to find out why the ordered EC wouldn't work and how to make it work.

Regarding the 00 20 00 20 sequence - I can't find it in the eeprom dumps neither, but in the HP firmware update file. I believe the EC firmware gets encrypted / scrambled during the update process and then written into the EEPROM. However, at address 0x2000 of the BIOS eeprom of the HP (not EC eeprom!), there is a small block probably representing the "anchor header" which the NPCX will search for first on startup, it starts with "AA 55" and contains only some 90 bytes with further instructions for the EC where to find the real firmware code in the flash - says Gemini.

Gemini also suggests that the original NPCX get some HP-specific fuses/registers burnt in resembling the encryption/decryption info as well as the SPI parameters on how to connect to the flash, for HP boards, while its bootloader would always be the same. If my NPCX is just a plain "dumb" model with no extra information or has been taken from another brand's device, having different flags burnt in, this would indeed explain why it won't work with the HP - even if it would be able establish a connection to the EEPROM and read its contents, it would find the anchor header, but would then not be able to execute the encrypted EC firmware. IF that is the case. Because why would the anchor header not be encrypted then?

I've now been wondering what did you mean in the last post, you soldered an "empty" NPCX and it started - what exactly means empty, because as much as I think to have found out, the NPCX only has RAM as writable and no firmware programmed onto it besides the bootloader ROM (96kb) - which I managed to read, but no flash is detected via SWD/OpenOCD besides of the shadowed SPI EEPROM. Where did the EC come from? Completely new? Or from another HP board?

Using OpenOCD I could do everything with the EC - read its ID and registers, read its bootloader ROM, read/modify/execute RAM contents, but not program it because it obviously does not have a flash. Or maybe I'm totally wrong and a (real!) NPCX797HA1BX SHOULD have an in-built flash but I've got scammed and mine is fake with missing flash but everything else is alright.

I'm very curious what you think about this and looking forward to your reply.

Also, maybe some other members here know something and can tell me more about how those NPCX ECs are customized, or not, and how to make it cooperate with my board, or any board. Thanks!