Attempting to Clean ME of Dell Latitude 5530

Special Topics Intel Management Engine
1

I have Dell Latitude 5530, Service Tag HYKFPT3. I tried doing a BIOS dump of the main 32MB firmware chip, using a CH341A, and used the Badcaps 8FC8 Patcher on it, then flashed the unlocked BIOS back to the chip. It didn’t work. I press the power button, only the power LED turns on for about 30 seconds, and the power light shuts off. I tried flashing the original password locked dump back to the chip. It continues as before. I press the power button, only the power LED turns on for about 30 seconds, and the power light shuts off. So, now I am learning about cleaning the ME region hoping maybe I can fix the laptop by doing that.

I am new to this. I need more information about the ME of my laptop’s motherboard. The laptop currently does not work so I cannot use programs like MEInfo, MEManuf, and FWUpdate. It looks like some people have used ME Analyzer in the past to get info about ME 16 systems from a BIOS dump. However I see on the Github page for that software that it currently supports up to ME 15. I tried running ME Analyzer on my 48MB Intel Image, anyway. The program asks for an option. I put in -dfpt and the program tells me “File does not contain Intel Engine/Graphics/Independent Firmware.”

I created the 48MB Intel Image by combining 32MB from chip U2502 and 16MB from chip U2501. Separately they both showed only as a UEFI Image in UEFITool NE alpha 72. By combining them they became an Intel Image. However, when I select the ME Region in the Intel Image in UEFITool it shows Version: unknown. Is the ME Region in my BIOS dump OK? Link to screenshot of UEFITool. I ask because there isn’t much shown when I click on the ME Region.

According to Dell this specific laptop has Alder Lake Intel Core i7-1265U vPro, Intel PCH-LP chipset, AMT is disabled. So, this laptop’s firmware is corporate, LP, and no AMT. I do not know the stepping. Maybe it doesn’t matter in my case because I found only one download in the list at Station-Drivers that looks like a possible match. This one. I was hoping to learn which version of ME my laptop has and fix it using the same version of ME. Or, will I have to try the only downloadable version that is available? I see on the page for that download the following are listed:

Chipset Stepping: ADP-LP A
Region: Extracted
SKU: LP 5Mo Consumer & Corporate
ME: 16.1.32.2418 (07/02/24) New
ME Flash Image Tool: 16.1.25.2166
PMC: 160.1.00.1030 [04/03/2023]
PCHC: 16.1.0.1014 [06/07/2022]
PHY (1): 14.531.509.8259 [21/06/2023]

The PMC, PCHC, and PHY are not files in the archive. Are they already stitched in to the ME? Or, do I need to go find them someplace else? It says ‘extracted.’ Does that mean they are ‘dirty?’ I was able to extract the firmwares from Dell’s recovery firmware image (RCV) for this laptop by using platomav’s BIOSUtilities. Am I correct in thinking those extracted firmwares are stock? To clean my laptop’s ME region am I going to load my BIOS dump in Intel FIT and stitch in the stock firmware?

Looks like there may have been a link to download the CSME System Tools v16.x at the end of the opening post of this thread but it no longer works. I’m guessing I will need to find that because I need the Intel Flash Image Tool. Can I grab just any version of 16 or does it need to match or exceed my laptop’s ME version?

At the end of all of this, will I need to flash the 32MB Winbond W25Q256JV main BIOS chip and the 16MB ME chip which is a Winbond W25R128JV (RPMC) chip?

2

Why messing with 2nd IC CSME to remove bios password, when not in main bios IC it can be in EC.

image
image524×270 23.4 KB

This should checked by you with MEAnalyser, every modern CSME fw image has sub partitions PMC, PCHC and PHY.

Not advisable as it states “Configured”, we can use a configured CSME image dump of SAME model to clean it, read the topics:
Intel (CS) Management Engine: Drivers, Firmware and Tools for ME 16+ - Special Topics / Intel Management Engine - Win-Raid Forum

Usually are update files not complete images for SPI programing, can be useful to swap volumes on a damaged dump.

On latest CSME versions the full complete dump with bios region is not always correct and should use only dumped CSME., same topic to read…the best image to use (Complete with sub partititons) it’s one NOT “Configured”.

Always the same or higher, same for CSME fw images. The forum doesnt archive any v16 tools/fw images on a repository like previous versions, users with CSME higher than v15 are on they’re own.

If the system has a separate IC for CSME were not going to mess with main SPI, so if the original locked/unlocked main SPI image is ok and didn’t suffer corruption, the best option is to program only the 2nd IC containing CSME.

This is not an easy system to deal with as you can see in several threads on Badcaps forum, an ex thread

That’s all, we cant give any “crush” courses on such matters, this is a learning forum with plenty of resources…to read and learn, good luck

3

You can decompose the latest Dell bios update with plutomaniac’s BIOSUtilities. When you do, you’ll get … 2 Intel Management Engine Corporate Firmware Update v16.1.38.2676.bin and … 3 Intel Management Engine Consumer Firmware Update v16.1.38.2676.bin. I’m pretty sure you want the first one.

I don’t think you need to mess around with finding and using individual ME components and then stitching. The ME firmware is made for your laptop, and I’m pretty sure you can clean it and use it.

plutomaniac’s MEAnalyzer result is attached.

MEA.zip (1.1 KB)

You can ignore the warning.

Grab the Intel CSME System Tools v16.1 r0.zip, and clean the Intel Management Engine Corporate Firmware Update.

These Dells usually require you to also flash a clean NVRAM (in addition to flashing a cleaned ME firmware).

I have a question for you. How did you combine the 32MB from chip U2502 and the 16MB chip from U2501? Thanks, and good luck.

PS: Have you attempted a bios recovery using the BIOS Recovery Image File? Maybe worth considering.

4

That is true. I’ve read the password may be stored in the EC or another firmware chip that is tied to the EC. This is an 8FC8 laptop firmware. Currently there is no website available for free use which has an algorithm for generating a master BIOS unlock password for an 8FC8 type of BIOS.

Someone more clever than I figured out the BIOS can be dumped and edited in a way that makes the laptop start in factory mode. The Badcaps 8FC8 Patcher does the editing automatically. The edited BIOS is flashed back to the chip. If it works the laptop is powered on and it starts in factory mode. The laptop asks for a service tag which is configured by the user by typing it, and then the laptop is restarted in normal mode. Somehow this process causes the laptop to forget about the BIOS password in the EC and the BIOS becomes unlocked and stays unlocked without needing a master unlock password.

A possible complication of trying to unlock the BIOS this way is that the ME region might prevent the edited BIOS from working or if the computer does boot it may cause some strange side effects. I’ve read the solution is to clean the ME region of the edited BIOS before flashing it back to the chip.

5

Yes, I did that. I took me some time to sort out some issues with Python on my computer. I had more than one version of Python installed and my computer was trying to run the mea.py script using a version of Python that was too old.

How did you get it to work for you? I tried running it on multiple bin files, my combined 48MB bin, the 16MB ME chip bin only, and the 32MB main BIOS chip bin too. It never showed me anything more than a message telling the file wasn’t right. I noticed the filename ‘2RELEA~1.BIN’ in the output, an 8.3 filename. Did you decompose my 48MB BIOS to get the correct file for analysis? Or, did you analyze one of the files from Dell’s BIOS update? I didn’t try that.

Thank you very much for the download link and thanks for the tip about cleaning the NVRAM, too.

I opened a command prompt in Windows and did

copy /b U2502.bin +U2501.bin U2502U2501.bin

I did try combining them the other way around, with U2501 first, but only by putting U2502 first did I get an Intel Image in UEFITool. I really don’t know if that was the right way to do it.

Yes, when I first flashed the edited BIOS back to the main 32MB chip and found the laptop no longer worked I tried pressing Ctrl + Esc while having a USB drive with the recovery file plugged in and plugging the charger in to the laptop. I thought, locked or not, maybe I could get it working again. Unfortunately it does not startup in recovery mode. It only turns on the power LED for about 30 seconds and then turns it off.

6

My MEA attachment/result is the Dell 2 Intel Management Engine Corporate Firmware Update. I ran it through just to verify all aspects of the firmware.

Your 48MB bin ME section is full of 00 and FF entries.

How did the bios get trashed?

I really hate multiple chips. But I do like MeatWar’s focus on the 2nd IC, assuming that one contains the CSME. The (main IC) bios region is newer than I’m used to messing with, and I’m not seeing the older-style NVRAM section(s) that I’m used to seeing, so on 2nd thought, that’s not an apparent issue. The “bare” ME certainly is. Again, good luck. I’d love to see you work it out.

EDIT1: Can you post another link to your 16MB chip dump? I’m sure that’s the ME chip, and I’m almost sure it’s 00 and FF “bare”. Thanks again.

EDIT2: I did find the (newer) “NVRAM” section in the bios under EfiSystemNvDataFvGuid, extracted “as is” being Volume_NVRAM_EfiSystemNvDataFvGuid.vol. So I’m back to considering the need to also flash a clean NVRAM again. Your VSS2 store is filled. The clean one from the Dell bios update is all Free space

7

I noticed that too. Since this is the first ME chip I’ve dumped I didn’t know if that was normal or not. The laptop has a yellow “3 ME Disabled” sticker on the inside of the bottom cover. At first I thought maybe that meant the ME chip wouldn’t have much to do but I’ve learned that doesn’t mean ME is disabled. It just means AMT is disabled. The dump of the 16MB chip is mostly alternating sections of 00 and FF up to 00019300 but there are some small sections of other data in there. In one of those sections I found it says DUMMY PERSONALITY. After 00019300 I think it is all FF.

As far as I know I’ve only tried to read the 16MB ME chip. I don’t think I’ve accidentally clicked erase and even if I had done that I don’t think that would explain the alternating sections of 00 and FF. However, I recently acquired an XGecu T48 that doesn’t work right for some reason. The few times I did get it to read a chip the dumps were completely different. Maybe it did something weird to the chip. I’ve been using a clip. My reads with the CH341A connected to the 16MB chip pass verification. I modded the CH341A to be sure it outputs 3.3V. I hope the chip isn’t damaged.

Sure. Here it is. There isn’t much in it. The archive is only 1.75KB.

8

The contents of that 16MB ME chip are a mess. I did a search on the badcaps forum, and found a dump good enough to know yours is toast. Not sure what happened, but even if AMT is disabled, you should get a good hex editor read and MEA output. The badcaps dump produced a good MEA analysis. I’m out of bullets on this one. Good luck again.

Edit: I don’t think it matters that the dumped ME chip is a mess. You were going to have to flash a new, cleaned ME anyway. I’d try to clean the ME update, and flash the chip with the CH341A.