The panq
(QNAP reversed) binary provides commands to interact with the ITE IT8528 Super I/O Controller on a QNAP TS-453Be NAS. Its main goals are to read the chassis temperature and to control the fan speed.
The lib/libuLinux_hal.so was first reversed with radare2, Ghidra, and QBDI, then the necessary functions were reimplemented.
The reimplemented functions from libuLinux_hal.so
provides the following panq
features:
$ panq
Usage: panq { COMMAND | help }
Control the I8528 Super I/O controller on QNAP TS-453Be
Available commands:
check - detect the Super I/O controller
fan [ SPEED_PERCENTAGE ] - get or set the fan speed
help - this help message
led { on | off | blink } - configure the front USB LED
log - display fan speed & temperature
test [libuLinux_hal.so] - test functions against libuLinux_hal.so
temperature - retrieve the temperature
- the binary needs
libcap-ng
andlibseccomp2
to be built. - to run
panq
as as regular user, usemake capability
- according to noise analysis from techpowerup, the fan will output 22 dBA at 10% speed, 34 dBA at 50% and 44 dBA at 100%
The original libuLinux_hal.so
library contains interesting ec_sys_*
functions that seems to indicate that the following functionalities could be implemented in panq
:
- control more LEDs
- enclosure opening detection
- read more temperature sensors
- automatic fan speed (
ec_sys_set_tfan_auto()
,ec_sys_set_qfan_auto()
...)