Broken Intel ME, apparently after a BIOS update

[blackdoomer]

My laptop model is Samsung NP300E7A-S04RU.
It was bought back in 2012, but is still fully operational in terms of user experience.
About a year after purchase, it had undergone the BIOS update procedure to the latest available one (09QA).

Recently I’ve learned about advanced BIOS settings hidden in a menu on “Exit” tab that becomes visible if you press Ctrl+Alt+Shift+F4 in setup utility. While researching it, I found “ME Configuration” submenu and entered it, to be unpleasantly surprised at the same moment because it showed me the next information:

ME PW Version:        0.0.0.0
ME Firmware:          Unknown
Intel ME:             [Enabled]  <-- this is grayed and unavailable
End Of POST Message:  [Enabled]

I am 98% sure that me_cleaner or any similar rough method was not used on this computer. Thus, I immediately became very curious of what’s happened, because such things tend to indicate malfunctions, and I had put a lot of effort in this machine for it working flawlessly (for example, it features a completely DIY 3D-printed lid instead of original fragile one which literally crumbled to pieces over time).

To obtain the current status of ME, I first tried intelmetool from coreboot, and that’s what I’ve got (running under Xubuntu 20.04):

$> sudo ./intelmetool -m

Bad news, you have a `HM65 Express Chipset LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI found: [8086:1c3a] 6 Series/C200 Series Chipset Family MEI Controller #1

ME Status   : 0x4181
ME Status 2 : 0x163b0000

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : NO
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode  : Normal
ME: Error Code              : Debug Failure
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Pseudo-global reset
ME: Progress Phase State    : 0x3b

ME: Extend Register not valid

ME: has a broken implementation on your board with this firmware
ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed

Next I decided to try official Intel utilities. My CPU is i5-2430M, north bridge is Sandy Bridge-MB IMC and south bridge is Cougar Point HM65. From that I’ve concluded that I need ME System Tools v7, which I downloaded from the neighboring thread by @plutomaniac.

Then I tried to use MEInfoWin64 and got this (running under Windows 7 x64, with Administrator privileges):

$> Intel ME System Tools v7 r2\MEInfo\WIN64> MEInfoWin64.exe -VERBOSE

Intel(R) MEInfo Version: 7.1.50.1166
Copyright(C) 2005 - 2011, Intel Corporation. All rights reserved.

Platform stepping value is 4

FW Status Register1: 0x00304181
FW Status Register2: 0x153B0000

  CurrentState:                         Init
  ManufacturingMode:                    Disabled
  FlashPartition:                       Valid
  OperationalState:                     Bring Up
  InitComplete:                         Initializing
  BUPLoadState:                         Success
  ErrorCode:                            Debug Error
  ModeOfOperation:                      Normal
  ICC:                                  No valid OEM data, ICC not programmed
  PhaseStatus:                          UNKNOWN

PMXUtil: Error during PMX Call: PMxDrv!MAPPHYS - Bad Input Parameters

SMBIOS Table Data
    Starting address:               E0850
    Table Size in Bytes:             2469   ( 0x9A5 )
    Number of Table Entries:           61   ( 0x3D )
    Virtual mapping of complete Table:  2 4kB Pages
    Table Type   0 ( 0x 00 ) found, size of  24 (0x 18 ) bytes

SMBIOS Table Data
    Starting address:               E0850
    Table Size in Bytes:             2469   ( 0x9A5 )
    Number of Table Entries:           61   ( 0x3D )
    Virtual mapping of complete Table:  2 4kB Pages
    Table Type   0 ( 0x 00 ) found, size of  24 (0x 18 ) bytes
    Table Type   1 ( 0x 01 ) found, size of  27 (0x 1B ) bytes
    Table Type   2 ( 0x 02 ) found, size of  15 (0x 0F ) bytes
    Table Type   3 ( 0x 03 ) found, size of  21 (0x 15 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes
    Table Type  10 ( 0x 0A ) found, size of   6 (0x 06 ) bytes
    Table Type  10 ( 0x 0A ) found, size of   6 (0x 06 ) bytes
    Table Type  11 ( 0x 0B ) found, size of   5 (0x 05 ) bytes
    Table Type  12 ( 0x 0C ) found, size of   5 (0x 05 ) bytes
    Table Type  13 ( 0x 0D ) found, size of  22 (0x 16 ) bytes
    Table Type  22 ( 0x 16 ) found, size of  26 (0x 1A ) bytes
    Table Type  32 ( 0x 20 ) found, size of  11 (0x 0B ) bytes
    Table Type  18 ( 0x 12 ) found, size of  23 (0x 17 ) bytes
    Table Type  21 ( 0x 15 ) found, size of   7 (0x 07 ) bytes
    Table Type  23 ( 0x 17 ) found, size of  13 (0x 0D ) bytes
    Table Type  24 ( 0x 18 ) found, size of   5 (0x 05 ) bytes
    Table Type  27 ( 0x 1B ) found, size of  14 (0x 0E ) bytes
    Table Type  39 ( 0x 27 ) found, size of  22 (0x 16 ) bytes
    Table Type   4 ( 0x 04 ) found, size of  42 (0x 2A ) bytes
    Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes
    Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes
    Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes
    Table Type  16 ( 0x 10 ) found, size of  15 (0x 0F ) bytes
    Table Type  17 ( 0x 11 ) found, size of  28 (0x 1C ) bytes
    Table Type  20 ( 0x 14 ) found, size of  19 (0x 13 ) bytes
    Table Type  17 ( 0x 11 ) found, size of  28 (0x 1C ) bytes
    Table Type  17 ( 0x 11 ) found, size of  28 (0x 1C ) bytes
    Table Type  20 ( 0x 14 ) found, size of  19 (0x 13 ) bytes
    Table Type  17 ( 0x 11 ) found, size of  28 (0x 1C ) bytes
    Table Type  19 ( 0x 13 ) found, size of  15 (0x 0F ) bytes
    Table Type  15 ( 0x 0F ) found, size of  29 (0x 1D ) bytes
    Table Type 127 ( 0x 7F ) found, size of   4 (0x 04 ) bytes

Error 1002: Failed to retrieve Intel (R) ME FW Version


Error 9458: Communication error between application and Intel(R) ME module (FW Update client)

Error 9459: Internal error (Could not determine FW features information)

Ugh. Then I decided to try MEManuf tests:

$> Intel ME System Tools v7 r2\MEManuf\WIN64> MEManufWin64.exe -VERBOSE

Intel(R) MEManuf Version: 7.1.50.1166
Copyright(C) 2005 - 2011, Intel Corporation. All rights reserved.

Platform stepping value is 4

FW Status Register1: 0x00304181
FW Status Register2: 0x153B0000

  CurrentState:                         Init
  ManufacturingMode:                    Disabled
  FlashPartition:                       Valid
  OperationalState:                     Bring Up
  InitComplete:                         Initializing
  BUPLoadState:                         Success
  ErrorCode:                            Debug Error
  ModeOfOperation:                      Normal
  ICC:                                  No valid OEM data, ICC not programmed
  PhaseStatus:                          UNKNOWN


Error 9256: Communication error between application and Intel(R) ME module (FW Update client)

Error 9257: Internal error (Could not determine FW features information)

Error 9296: MEManuf Test Failed (9257)

And finally I launched the Flash Programming Tool as it was suggested in the same neighboring thread:

$> Intel ME System Tools v7 r2\Flash Programming Tool\WIN64> fptw64.exe -VERBOSE -D output.bin

Intel (R) Flash Programming Tool. Version: 7.1.50.1166
Copyright (c) 2007-2011, Intel Corporation. All rights reserved.

Number of LPC Devices supported: 109
LPC Device Id: 1C49.
Platform: Intel(R) HM65 Express Chipset Revision: B2
Initializing SPI utilities
Reading HSFSTS register... Flash Descriptor: Valid

Region Limits as programmed into the SPI Registers
    FREG0 -  DESC Region:Base Address: 0x000000   Limit :  0x000FFF
    FREG1 -  BIOS Region:Base Address: 0x180000   Limit :  0x3FFFFF
    FREG2 -  ME   Region:Base Address: 0x001000   Limit :  0x17FFFF
    FREG3 -  GbE  Region:Base Address: 0x1FFF000   Limit :  0x000FFF
    FREG4 -  PDR  Region:Base Address: 0x1FFF000   Limit :  0x000FFF
Address Limit 0x400000    Maximum Memory 4096kB


    --- Flash Devices Found ---

Error 103: There are no supported SPI flash devices installed. Please check connectivity and orientation of SPI flash device.

I found some topics here and on other forums claiming that such issue could be caused by BIOS update. Moreover, some guy said there that Samsung BIOS updates for Intel-based devices are “incomplete” (idk what did he mean, lack of ME region?..). That why I’m asking for help here. This would involve some BIOS modding, and I literally hate such kind of things because of being too afraid of messing with proprietary vendor software after bricking a HDD a time ago using similar stuff.

Attaching the BIOS dumps I’ve made: Вы не робот?

• samsung/
  original BIOS update utility from Samsung website and the EXE package it downloads
• ITEM_20130312_816_WIN_09QA/
  package contents (unpacked using samsung_extract_archive.py script)
• PhoenixTechnologiesLtd.-09QA.rom
  current BIOS dump obtained using Universal BIOS Backup ToolKit 2.0.exe.

Really hope for any help.

Cheers.

[MeatWar]

Usually its ME FW image corruption, so your task only: [Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization - Intel Management Engine - Win-Raid Forum

EDIT: The system has an SPI…lol, fw device its the one not found aka ME FW.
The ME FW device doesnt require a standalone chip, a few can be on certain OEM boards/systems.

The cleanup process is to be made on the current dump of the ME or the whole SPI image, preferably with Intel FPT tool. This requires access by the tool to the SPI regions, Flash Descriptor, Bios, ME, GBE, EC etc.

When this actions are not possible on the system, your only resource is the use of an SPI programmer, like the CH341A or similar device, so see the results for:

fpt64.exe -d spi.bin and fpt64.exe -bios -d bios_region.bin

Some OEM bios update files indeed do not contain ME FW image, when this happens you need a dump with an ME FW image, to perform a programming or work in cleaning the ME.

The NP300 complete bios with ME dump is usually 4Mb

[blackdoomer]

But why is it unable to detect SPI flash chips then?
Anyway, thanks for the first reply!

[blackdoomer]

@MeatWar

so see the results for:

fpt64.exe -d spi.bin and fpt64.exe -bios -d bios_region.bin

Pretty interesting. As you can see in the first post, I tried fptw64.exe -VERBOSE -D output.bin at last, and it failed, asserting that there are no available SPI chips. But I didn’t think that it could be a failure due to the fact that I had already run too much low-level software before in the same session, which could set something in its own way and not clean up correctly and/or completely after finishing.

Now I have restarted the machine and run the commands you gave me.
And the result is different: it has found a chip!

fpt64.exe -d spi.bin

$> Intel ME System Tools v7 r2\Flash Programming Tool\WIN64> fptw64.exe -VERBOSE -D spi.bin

Intel (R) Flash Programming Tool. Version: 7.1.50.1166
Copyright (c) 2007-2011, Intel Corporation. All rights reserved.

Number of LPC Devices supported: 109
LPC Device Id: 1C49.
Platform: Intel(R) HM65 Express Chipset Revision: B2
Initializing SPI utilities
Reading HSFSTS register... Flash Descriptor: Valid

Region Limits as programmed into the SPI Registers
    FREG0 -  DESC Region:Base Address: 0x000000   Limit :  0x000FFF
    FREG1 -  BIOS Region:Base Address: 0x180000   Limit :  0x3FFFFF
    FREG2 -  ME   Region:Base Address: 0x001000   Limit :  0x17FFFF
    FREG3 -  GbE  Region:Base Address: 0x1FFF000   Limit :  0x000FFF
    FREG4 -  PDR  Region:Base Address: 0x1FFF000   Limit :  0x000FFF
Address Limit 0x400000    Maximum Memory 4096kB


    --- Flash Devices Found ---
    GD25B32B    ID:0xC84016    Size: 4096KB (32768Kb)

Flash program registers are locked! HSFSTS[15] (FLOCKDN)
Using software sequencing.
Reading region information from flash descriptor.
Base: 0x000000, Limit: 0x000FFF
Base: 0x180000, Limit: 0x3FFFFF
Base: 0x001000, Limit: 0x17FFFF
FW Status Register1: 0x00104181
FW Status Register2: 0x153B0000
Reading FOV configuration file "fptcfg.ini"
DumpFlashToFile (spi.bin, 0x0, 0x0)...

Error 26: The host CPU does not have read access to the target flash area. To enable read access for this operation you must modify the descriptor settings to give host access to this region.

fpt64.exe -bios -d bios_region.bin

$> Intel ME System Tools v7 r2\Flash Programming Tool\WIN64 > fptw64.exe -VERBOSE -BIOS -D bios_region.bin

Intel (R) Flash Programming Tool. Version: 7.1.50.1166
Copyright (c) 2007-2011, Intel Corporation. All rights reserved.

Number of LPC Devices supported: 109
LPC Device Id: 1C49.
Platform: Intel(R) HM65 Express Chipset Revision: B2
Initializing SPI utilities
Reading HSFSTS register... Flash Descriptor: Valid

Region Limits as programmed into the SPI Registers
    FREG0 -  DESC Region:Base Address: 0x000000   Limit :  0x000FFF
    FREG1 -  BIOS Region:Base Address: 0x180000   Limit :  0x3FFFFF
    FREG2 -  ME   Region:Base Address: 0x001000   Limit :  0x17FFFF
    FREG3 -  GbE  Region:Base Address: 0x1FFF000   Limit :  0x000FFF
    FREG4 -  PDR  Region:Base Address: 0x1FFF000   Limit :  0x000FFF
Address Limit 0x400000    Maximum Memory 4096kB


    --- Flash Devices Found ---
    GD25B32B    ID:0xC84016    Size: 4096KB (32768Kb)

Flash program registers are locked! HSFSTS[15] (FLOCKDN)
Using software sequencing.
Reading region information from flash descriptor.
Base: 0x000000, Limit: 0x000FFF
Base: 0x180000, Limit: 0x3FFFFF
Base: 0x001000, Limit: 0x17FFFF
FW Status Register1: 0x00104181
FW Status Register2: 0x153B0000
Reading FOV configuration file "fptcfg.ini"
DumpFlashToFile (bios_region.bin, 0x180000, 0x280000)...

- Reading Flash [0x400000] 2560KB of 2560KB - 100% complete.
Writing flash contents to file "bios_region.bin"...

Memory Dump Complete
FPT Operation Passed

The obtained BIOS dump is slightly different to the one I got using Universal BIOS Backup ToolKit 2.0.exe. And if I take the second dump using the same FPT command, it’s still the same. Attaching it: bios_region.bin — Яндекс Диск

Any further hints?

[blackdoomer]

Additional info. I’ve found some full (4 MiB) BIOS dumps for similar NP300E7A editions to check for exact ME version:

links

Нужен дамп биоса Samsung NP300E7A • Notebook1 форум
NP300E7A Scala3-17 06QA • Notebook1 форум
Scala3-17 np300e7a-a02ru • Notebook1 форум

The output of ME Analyzer v1.282.0 r295 for all of them is the same:

Family:                     ME
Version:                    7.1.13.1088
Release:                    Production
Type:                       Extracted
SKU:                        1.5MB
Patsburg Support:           No
Date:                       2011-05-04
Size:                       0x17D000
Downgrade Blacklist 7.0:    <= 7.0.10.1203
Downgrade Blacklist 7.1:    <= 7.1.12.1086
Chipset Support:            CPT

[lfb6]

As written, follow the linked guide to fix the ME region. If you want to flash the firmware back with a programmer see here:

[Guide] How to Use a CH341A SPI Programmer/Flasher (with Pictures!)

I came across a similar? fault with my old notebook- I couldn’t read the bios chip, a simple old GD25Q32. It took a while until I found out that Samsung had grounded pin 3- IO#2/write protect. Neither a CH341 nor a TL866 plus could handle that: The 866 gave a short circuit warning, the ch341 didn’t say anything but the led went off and the software said “CH341 not connected”. Disconnected the wire for pin 3 from clamp- everything fine! But I first disconnected the wrong wire (ground,pin 4)- The…

[blackdoomer]

@lfb6

If you want to flash the firmware back with a programmer see here:

Thank you, but unfortunately, I don’t have one.
Is it possible to flash it programmatically and if so, how?

[lfb6]

[Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing

Guide-How To: Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing Last Updated: 2018-03-20 This guide is relevant to those who need to understand what the Intel Flash Descriptor is, how its SPI Region Read/Write Access Permissions work, how to check its Locked/Unlocked status and what methods are available to unlock it for system firmware repair and/or updating. In this guide, the term "system" means an individual user machine whereas "model" refers to all those "syste…

[blackdoomer]

Thank you very much, I’ll try it.
I have a few more questions, but first I’ll describe the results of today’s investigation.

I found some full (!) BIOS firmwares exactly for my laptop model (NP300E7A-S04RU).

links

Samsung NP300E7A-S04RU - Scala3-17 Rev 1.0 -09QA bios | Laptop & Motherboard
Samsung NP300E7A-S04RU Bios Dump | fixbios.com
Samsung NP300E7A-S04RU Bios Dump | Bios-Fix.com

All of them are of latest update version 09QA. 2nd and 3rd links require payment for access, but 1st one needs only registration and one post, so I reuploaded it: Samsung NP300E7A-S04RU - Scala3-17 Rev 1.0 -09QA bios.zip — Яндекс.Диск

Now I have some questions:

1. Can I use the full BIOS I found without any modifications? I suspect that in this case DMI and OEM things like serial number etc will be overwritten, which I would very much like to avoid.

2. Which BIOS dump I should use for ME restoration: from Universal BIOS Backup ToolKit 2.0.exe or from fptw64.exe -BIOS -D bios_region.bin? As I had already noted above, they’re slightly different, and I have no clue or any idea about the exact differences.

3. In this topic @plutomaniac not only repaired ME, but also removed Intel AntiTheft, stating that it’s no longer supported and may cause problems. Is it possible to find out in more detail whether it is worth doing this, and if so, how?

[MeatWar]

-Yes flashing a full dump, not being yours, will overwrite the system data. Some shared dumps sometimes are cleaned without personal data, some not.
Your system data can be found in a healthy/partial dump, lfb6 can help you with this, if possible.
-FPT dump.
-Each ME has its own guide by pluto. He explains why Intel AntiTheft is now disable, this is done by the guide already linked before on repair/clean the ME.

[blackdoomer]

@MeatWar

-FPT dump.

Just curious, is there any particular reasons for this?
Or just the same assumption that “Intel know things better” I’m sharing as well?

[lfb6]

You dont need a bios region to work on me region?!!

Work on your own dump fpt(w(64)) -d spi.bin

It’s a little misunderstanding that we are here since we like to answer questions. Most of these questions are answered several times before (your hardware is from 2010/2011!) and there’s no meaning in it to write up this stuff again and again.

Most of the answers to your questions are outlined in already linked threads and for the rest the answers can be found already here in the forum. Some reading is required.

So if there are specific questions regarding this process of cleaning the ME please ask or present results for a check. Otherwise are plutomaniacs guides best founded, it’s just to follow them to the letter.
As far as I can see you didn’t even try to extract your firmware yet otherwise we’d have read about fpt refusing to backup the ME since it’s normally locked in the FD for these machines.

[blackdoomer]

@lfb6

As far as I can see you didn’t even try to extract your firmware yet otherwise we’d have read about fpt refusing to backup the ME since it’s normally locked in the FD for these machines.

This is not true. In the attached console outputs you can see how I tried to do that and failed (even twice, and with different errors). Since I’m not a professional repairman or a firmware modder, it is quite difficult for me to formulate the right questions, and therefore to search for answers to them. That’s why I asked for help here: to get a direction to search.

[MeatWar]

We answered to a lot of users on the middle of a working day whenever we have some time.
Some times we loose, as expected tracking of critical users points etc… but its expected that links provided and tips are to follow and read.
So indeed you already performed the cmd fpt.exe -d spi.bin and what did you found out about it and whats your clue to next step?

Hint: This is a test as you should already know the answer, reply if you want or not.

EDIT: No action need on restoring locks. Good to go, good luck.

[blackdoomer]

@MeatWar

So indeed you already performed the cmd fpt.exe -d spi.bin and what did you found out about it and whats your clue to next step?

Hint: This is a test as you should already know the answer, reply if you want or not.

In general terms:

1. Unlock the read/write permissions of the SPI chip.
2. Obtain the full SPI dump using fptw64.exe -d spi.bin.
3. Fix it according to the guide by @plutomaniac.
4. Flash the fixed firmware back to SPI chip.
5. Restore the access lock of the SPI chip.