diff --git a/partition-the-flash.py b/partition-the-flash.py
index 4a57130..e8e05de 100644
--- a/partition-the-flash.py
+++ b/partition-the-flash.py
@@ -20,7 +20,6 @@ flash_layout_hardcoded=[
     unhex('05 05 0300 00000400 00800000'), # ???
     unhex('06 06 0300 00800400 00800000'), # calibration data
     unhex('04 03 0500 00000500 00000300'), # template database
-#    unhex('08 08 0500 00000000 000000ff'), # <-- hack to make the whole flash contents readable
 ]
 
 enable_blob=unhex('''
diff --git a/prototype.py b/prototype.py
index bf41869..abe6ffd 100644
--- a/prototype.py
+++ b/prototype.py
@@ -371,7 +371,7 @@ def dump_flash():
 def read_hw_reg32(addr):
     rsp=tls.cmd(pack('<BLB', 7, addr, 4))
     assert_status(rsp)
-    rsp = rsp[2:]
+    rsp, = unpack('<L', rsp[2:])
     return rsp
 
 def write_hw_reg32(addr, val):
diff --git a/upload-fwext.py b/upload-fwext.py
new file mode 100644
index 0000000..0848d60
--- /dev/null
+++ b/upload-fwext.py
@@ -0,0 +1,45 @@
+
+from db97 import *
+from tls97 import *
+from usb97 import *
+from prototype import *
+from util import assert_status
+
+with open('6_07f_lenovo_mis.xpfwext', 'rb') as f:
+    fwext=f.read()
+
+fwext=fwext[fwext.index(b'\x1a')+1:]
+fwext, signature = fwext[:-0x100], fwext[-0x100:]
+
+usb.trace_enabled=True
+tls.trace_enabled=True
+open97()
+
+write_hw_reg32(0x8000205c, 7)
+print('*0x80002080=%08x' % read_hw_reg32(0x80002080))
+
+tls.cmd(unhexlify('75'))
+
+# get fwext header info
+rsp=tls.cmd(unhexlify('4302'))
+# ^ should fail 'cause no fwext uploaded yet
+
+if rsp[:2] == b'\0' * 2:
+    raise Exception('FW is already present')
+
+db.flush_changes()
+
+ptr=0
+while len(fwext) > 0:
+    chunk, fwext = fwext[:0x1000], fwext[0x1000:]
+    db.write_flash(2, ptr, chunk)
+    ptr += len(chunk)
+
+rsp=tls.cmd(pack('<BBxH', 0x42, 2, len(signature)) + signature)
+assert_status(rsp)
+
+rsp=tls.cmd(unhexlify('4302'))
+assert_status(rsp)
+
+# Reboot
+tls.cmd(unhexlify('050200'))