Asus Laptop - ME FW Error During Boot Up

Special Topics Intel Management Engine
1

Hi Everyone,

I’ll post as much as I can and have done so far:

After a failed BIOS/Windows Update, my Asus Zenbook started reporting ME FW errors during boot up. The weird part is after either 1 or 3000 reboots, the laptop will eventually come back up without issue, do Windows Updates, etc.

It took me a while to find this, but here’s the machine details:
System Model:"N501VW"
Processor:"Intel(R) Core™ i7-6700HQ CPU @ 2.60GHz
Last Known ME Version: V11.0.0.1169

Running MEInfo -Verbose provides only this:


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
 
Intel(R) MEInfo Version: 11.8.77.3665
Copyright(C) 2005 - 2019, Intel Corporation. All rights reserved.
 

 

Windows OS Version : 10.0
 
    Table Type  98 ( 0x 62 ) found, size of   0 (0x 00 ) bytes
    Table Type   0 ( 0x 00 ) found, size of  72 (0x 48 ) bytes
    Table Type   1 ( 0x 01 ) found, size of 108 (0x 6C ) bytes
    Table Type   2 ( 0x 02 ) found, size of 119 (0x 77 ) bytes
    Table Type   3 ( 0x 03 ) found, size of 109 (0x 6D ) bytes
    Table Type  10 ( 0x 0A ) found, size of 170 (0x AA ) bytes
    Table Type  11 ( 0x 0B ) found, size of  76 (0x 4C ) bytes
    Table Type  12 ( 0x 0C ) found, size of 128 (0x 80 ) bytes
    Table Type  32 ( 0x 20 ) found, size of  22 (0x 16 ) bytes
    Table Type   7 ( 0x 07 ) found, size of  29 (0x 1D ) bytes
    Table Type   4 ( 0x 04 ) found, size of 186 (0x BA ) bytes
    Table Type  16 ( 0x 10 ) found, size of  25 (0x 19 ) bytes
    Table Type  17 ( 0x 11 ) found, size of  74 (0x 4A ) bytes
    Table Type  19 ( 0x 13 ) found, size of  33 (0x 21 ) bytes
    Table Type 221 ( 0x DD ) found, size of  35 (0x 23 ) bytes
    Table Type  20 ( 0x 14 ) found, size of  37 (0x 25 ) bytes
    Table Type 130 ( 0x 82 ) found, size of  22 (0x 16 ) bytes
    Table Type 131 ( 0x 83 ) found, size of  66 (0x 42 ) bytes
    Table Type 221 ( 0x DD ) found, size of  78 (0x 4E ) bytes
    Table Type 221 ( 0x DD ) found, size of 287 (0x 11F ) bytes
    Table Type 221 ( 0x DD ) found, size of 208 (0x D0 ) bytes
    Table Type 221 ( 0x DD ) found, size of 396 (0x 18C ) bytes
    Table Type 136 ( 0x 88 ) found, size of   8 (0x 08 ) bytes
    Table Type  14 ( 0x 0E ) found, size of  43 (0x 2B ) bytes
    Table Type  14 ( 0x 0E ) found, size of  14 (0x 0E ) bytes
    Table Type   0 ( 0x 00 ) found, size of  72 (0x 48 ) bytes
    Table Type   1 ( 0x 01 ) found, size of 108 (0x 6C ) bytes
    Table Type   2 ( 0x 02 ) found, size of 119 (0x 77 ) bytes
    Table Type   3 ( 0x 03 ) found, size of 109 (0x 6D ) bytes
    Table Type  10 ( 0x 0A ) found, size of 170 (0x AA ) bytes
    Table Type  11 ( 0x 0B ) found, size of  76 (0x 4C ) bytes
    Table Type  12 ( 0x 0C ) found, size of 128 (0x 80 ) bytes
    Table Type  32 ( 0x 20 ) found, size of  22 (0x 16 ) bytes
    Table Type   7 ( 0x 07 ) found, size of  29 (0x 1D ) bytes
    Table Type   4 ( 0x 04 ) found, size of 186 (0x BA ) bytes
    Table Type  16 ( 0x 10 ) found, size of  25 (0x 19 ) bytes
    Table Type  17 ( 0x 11 ) found, size of  74 (0x 4A ) bytes
    Table Type  19 ( 0x 13 ) found, size of  33 (0x 21 ) bytes
    Table Type 221 ( 0x DD ) found, size of  35 (0x 23 ) bytes
    Table Type  20 ( 0x 14 ) found, size of  37 (0x 25 ) bytes
    Table Type 130 ( 0x 82 ) found, size of  22 (0x 16 ) bytes
    Table Type 131 ( 0x 83 ) found, size of  66 (0x 42 ) bytes
    Table Type 221 ( 0x DD ) found, size of  78 (0x 4E ) bytes
    Table Type 221 ( 0x DD ) found, size of 287 (0x 11F ) bytes
    Table Type 221 ( 0x DD ) found, size of 208 (0x D0 ) bytes
    Table Type 221 ( 0x DD ) found, size of 396 (0x 18C ) bytes
    Table Type 136 ( 0x 88 ) found, size of   8 (0x 08 ) bytes
    Table Type  14 ( 0x 0E ) found, size of  43 (0x 2B ) bytes
    Table Type  14 ( 0x 0E ) found, size of  14 (0x 0E ) bytes
FW Status Register1: 0x80032004
FW Status Register2: 0x30650112
FW Status Register3: 0x00000000
FW Status Register4: 0x00084000
FW Status Register5: 0x00000000
FW Status Register6: 0x40000000
 
  CurrentState:                               Disabled
  ManufacturingMode:                          Disabled
  FlashPartition:                             Valid
  OperationalState:                           Transitioning
  InitComplete:                               Initializing
  BUPLoadState:                               Success
  ErrorCode:                                  Disabled
  ModeOfOperation:                            Temporary Disable mode
  SPI Flash Log:                              Not Present
  FPF HW Source value:                        Not Applicable
  ME FPF Fusing Patch Status:                 ME FPF Fusing patch NOT applicable
  Phase:                                      BringUp
  ICC:                                        No valid OEM data, ICC programmed with default values
  ME File System Corrupted:                   No
  PhaseStatus:                                UNKNOWN
  FPF and ME Config Status:                   Match
 
 


Running MEInfo to obtain information only returns and 81 and 86 error.

Reflashing the BIOS through Asus backdoor process while it works, provides no fix.

Is there any hope to this or should I give up on it and just let it continue to be a pain?

Thanks for any help anyone can provide.

Edit: Added FW Dump

fd.zip (425 Bytes)

2

The ME firmware is corrupted so you need to repair it. Check if your Flash Descriptor is locked and unlock it via [Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing. Then dump your SPI image via “fptw -d spi.bin”, follow [Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization and flash it back via “fptw -f outimage.bin” followed by “fptw -greset”. The most difficult part is to unlock the FD.

3

Thanks, Pluto. I’ll give it a shot. Seems straight forward enough. If I can’t unlock the FD using software, do you know of anyone that offers their services to do it the programmer way?

4

Pluto,

Here’s what I got:

0x18E08 One Of: Me FW Image Re-Flash, VarStoreInfo (VarOffset/VarName): 0x3C8, VarStore: 0x1, QuestionId: 0xA4, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 F1 02 F2 02 A4 00 01 00 C8 03 10 10 00 01 00}
0x18E19 One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x18E20 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}


Looks like it’s locked. I’ll work on attempting to disabling it.

Thanks again!

5

Alright, you seem to be following the guide properly, good work so far. As for services that offer SPI chip re-programming etc, that’s entirely specific to your local area so I cannot recommend anything. Hopefully it won’t come to that though.

6

@plutomaniac - Looks like this might be harder than expected.

I was able to boot into the Thumb Drive and saw the Grub Prompt. Typed the command system_var 0x3C8 0x01 as well as w/ 0x1. Both give the following error:

GUID does not match expected GUID, taking it nevertheless…
successfully obtained “Setup” variable from VSS (got 6 (ox06) bytes).
error: offset is out of range…

However. There’s more to this. The offset is currently set to 0x1 as reported by the error further down (it started as 0x0, then as I changed it, it reflected as 0x1).

When running FPT, I still get the same:
Error 318: The host CPU does not have read access to the target flash area. To enable read access for this operation you must modify the descriptor settings to give host access to this region.
FPT Operation Failed.

Can you point me in the right direction to dumping a copy of my current BIOS? It’s possible that Variable place might be different on my BIOS than the one I got from the Asus Website (although it’s reflecting as the same).
–Disregard. Found it.

1
 
FPTW64.exe -bios -d backup.bin
 


Here's the output of the BIOS Dump:

0x18E08 One Of: Me FW Image Re-Flash, VarStoreInfo (VarOffset/VarName): 0x3C8, VarStore: 0x1, QuestionId: 0xA4, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 F1 02 F2 02 A4 00 01 00 C8 03 10 10 00 01 00}
0x18E19 One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x18E20 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x18E27 End One Of {29 02}

Looks like the value was left unchanged.

I can post a picture of the error if needed.
7

If the BIOS is AMI, you can try AMISetupWriter instead via "AMISetupWriter 0x3C8 0x1"

Boot_Shell_AmiSetupWriter.rar (251 KB)

8

It is. I’ll give this a shot. Any specific or different installation instructions for this one compared to the original shell?

9

@iFixRobots - Not all grub are same, for this I suggest you use the one I attached to this guide
[GUIDE] Grub Fix Intel FPT Error 280 or 368 - BIOS Lock Asus/Other Mod BIOS Flash

Show me image of what you do in grub, sounds like normal errors to me, and or sounds like you did change it, out of range may be an issue though but not necessarily if you get 0x1 when you check via method below.

Additionally, it sounds like you may have already changed it (this only applies for one reboot), change it in grub and then before you reboot from grub check once more with just this >> setup_var 0x3C8
If it reports back 0x1 then CTRL-ALT-Del to windows and reflash ME FW region only (ONLY THIS >> FPTw.exe -me -f mefilename.bin, or BIOSfilename.extension if you are using full BIOS dump that includes ME FW region.)

Checking value in dumped BIOS region from setup will always remain same, you are not changing setup values (with setup_var) but rather current applied value in NVRAM area

ME FW fix can be huge pain sometimes, you may need to get flash programmer, or do E.1 pinmod from the unlock guide to unlock FD (Without unlocking FD, you can’t use commands in post #2 to write to chip, the grub only unlocks ME FW area for above FPT command)

10

Alright. I understood most of that. Thank you.

So that’s our problem @Lost_N_BIOS. As I mentioned on my original post, every reboot is quite a painful process. Sometimes it can get stuck 100 times on that error message before it decides to move forward with loading. Note that the error comes up before I can even do an F2, F8.

So getting TWO quick reboots without the error in a row is probably as close to impossible as it can get.

11

I once ‘had to’ change a variable which was not stored in the standard store, described here. Unsure if this might help/ could be of interest?

Good luck anyway!

12

Ok. So I was able to do it, and after change the value, retyping the setup_var command, offset reported as 0x1. I was able to boot into Windows with no issues. However, running the command on FPT reported the 451 error.

This was attempted with the boot64 file on your thread @Lost_N_BIOS

13

What LOST can try is to modify the BIOS to have the ME reflash option permanently enabled and then flash the modded BIOS region only (fptw -bios -f bios_mod.bin) to unlock the FD that way and then repair the CSME firmware.

14

If that can be done, the BIOS is here.

Thank you both for all your help so far.

N501VWAS307.zip (2.71 MB)

15

[quote="iFixRobots, post:14, topic:35110"] If that can be done, the BIOS is here.

Thank you both for all your help so far. [/quote]
Hey @Lost_N_BIOS , if you think this is doable then we can give it a try with your help.