I also have an ES47 (running Linux)! Would you send me an email to my username at gmail? I've been working on a remote management tool for the ES47 that allows controlling the fan speeds that you might be interested in.
I think they're also super useless, to be honest. Incredibly slow. Linux support continued to degrade the entire time I owned mine. The keyboard and display are far too small to be usable. The graphics chip accelerates basically nothing.
I sold mine [1] on eBay back in October. I hope the new owner enjoys it more than I did :)
I've loaded the PROM in Ghidra. The ability to decompile to C is great.
I looked at some particular parts of the PROM that took a while to understand to see if I could have understood them quicker with Ghidra. In particular, the part of `sloader` that searches for the `post1` and `firmware` sections and then calls `post1(&firmware)`. Given that I already understand how this works, I can see that this is happening from the decompiled C, but the lack of labels, comments, etc really hampers my ability to understand from the decompiled C alone.
This might all be down to inexperience with the tool.
The ability to iteratively add a label, rerun the decompiler, reread the decompiled assembly, make more inferences was really the key to building an understanding for me.
Another aspect I'm unsure how to handle in Ghidra is that the base address differs between sections of the firmware. E.g. the `firmware` section is copied to RAM and executed from `0x81000000`. It's not clear to me how to configure this in a granular way, rather than a single base address for the whole PROM image.
Netflix. ex-Google. ex-Intel. Gentoo Developer.