Yesterday I acquired a former business-unit ThinkPad T440p. I’ve been experiencing the 30-minute abrupt shutdown, indicating of borked ME. I confirmed this by: - Intel Management Engine Interface is not listed under Device Manager > System Devices - attempts to install Intel Management Engine Software 11 fails with the message platform not supported - attempts to enter MEBx by pressing Ctrl+P does nothing; the system proceeds to boot to Windows as normal - MEInfoWin keeps erroring out and not displaying any information whatsoever
A few hours ago I got myself a CH314A programmer, hooked it up to what I’d presumed is the BIOS chip on the T440p (Winbond 25Q32FV adjacent to the RAM slots). I then read and saved them 2 (two) times, then compared them on HxD to confirm they’re identical. I tried opening them on ME Analyzer but it said File does not contain Intel Engine firmware. I then opened them on UEFI Tool out of curiosity, in which I saw that the root of the structure says UEFI Image rather than Intel Image. flashrom --layout (filename) gave me Error parsing layout file. Offending string: “”.
This got me wondering: - did I dump from the right chip? - if I didn’t, perhaps are there any clues as where to look for the actual BIOS chip? Google didn’t seem to help at all. - how do I proceed from here?
Additional info: - BIOS and EC is already on their latest respective version (2.52/GLET98WW and 1.12/GLHT29WW respectively) - didn’t work: fptw -d bios.bin - didn’t work: fptw -me -d me.bin - works: fptw -desc -d fd.bin - fptw -greset affects nothing - output of ifdtool -d (my image dump.bin): https://pastebin.com/7ypW00Yy
You haven’t uploaded the dumped SPI image for us to take a look. It could be that the laptop has 2 SPI chips which work together and you only dumped the 2nd one.
I peeked around more carefully, and turns out there is indeed a 2nd SPI chip that cannot be directly accessed without disassembly of the bottom chassis/rollcage. I will get back to you as soon as I’ve got it disassembled and dumped the 2nd chip!
Yeap that makes sense. The other SPI chip must be the 1st one which holds the Flash Descriptor & Engine region. That’s why MEA could not find anything and why UEFITool didn’t detect a Flash Descriptor (Intel image).
Confirmed that the Intel image is indeed in the other chip (Winbond 25Q64). Attached is the ME Analyzer results.
I’m a bit bamboozled by the results though – the chip says ME version is 9.0.31.1487 and SKU is 5MB, while on the firmware download page, said version is the 1.5MB SKU.
Understood. This means I can run ME 9.0 5MB v9.0.1.3488, correct?
How do I go about combining these two images? I’m sorry since I’m not familiar which tool(s) I should use to accomplish this.
—
EDIT: out of curiosity, I ran me_cleaner -S on the SPI dump (t440p_redump_fde.bin in the attached dumps.zip), reflashed it, but the 30 minute shutdown remains. intelmetool -m output on both pre- and post-me_cleaner remains the same, as shown in the attached image.
unhuffme output of the SPI dump before me_cleaner:
number of flash regions: 4 region: 0 in range: 00000fff-00000000 region: 1 in range: 00bfffff-00500000 region: 2 in range: 004fffff-00003000 region: 3 in range: 00002fff-00001000
Flash partition table (27 entries): partition: PSVN(type:3) at 00000bc0, size:40 partition: FOVD(type:3) at 00000c00, size:400 partition: MDES(type:3) at 00001000, size:1000 partition: FCRS(type:3) at 00002000, size:1000 partition: EFFS(type:4) at 00003000, size:dc000 partition: BIAL(type:2) at ffffffff, size:add3 partition: BIEL(type:2) at ffffffff, size:3522 partition: BIIS(type:2) at ffffffff, size:36000 partition: NVCL(type:2) at ffffffff, size:69c9 partition: NVCM(type:2) at ffffffff, size:439b partition: NVCP(type:2) at ffffffff, size:a3c0 partition: NVHM(type:2) at ffffffff, size:58 partition: NVJC(type:2) at ffffffff, size:3da0 partition: NVKR(type:2) at ffffffff, size:5c30 partition: NVNF(type:2) at ffffffff, size:175f partition: NVOS(type:2) at ffffffff, size:3a34b partition: NVSH(type:2) at ffffffff, size:22c0 partition: NVSM(type:2) at ffffffff, size:1de8 partition: NVTD(type:2) at ffffffff, size:1feb partition: NVUK(type:2) at ffffffff, size:8940 partition: PLDM(type:2) at ffffffff, size:43c5 partition: GLUT(type:3) at 000df000, size:9000 partition: LOCL(type:0) at 000e8000, size:4000 partition: WCOD(type:0) at 000ec000, size:74000 partition: FTPR(type:0) at 00160000, size:b0000 partition: NFTP(type:0) at 00210000, size:27a000 partition: MDMV(type:0) at 0048a000, size:40000
number of flash regions: 4 region: 0 in range: 00000fff-00000000 region: 1 in range: 00bfffff-00500000 region: 2 in range: 004fffff-00003000 region: 3 in range: 00002fff-00001000
Flash partition table (1 entries): partition: FTPR(type:0) at 00160000, size:b0000
Still trying to make progress, so in another attempt out of curiosity, I booted up the machine and tried running these commands with the following results:
memanufwin64 -verbose
1 2 3
Error 9278: Unknown or unsupported hardware platform
Error 9321: MEManuf Operation Failed
fptw64 -d spi.bin -bios (result attached as spi.zip)
- Reading Flash [0xC00000] 7168KB of 7168KB - 100% complete. Writing flash contents to file "spi.bin"...
Memory Dump Complete FPT Operation Passed
Attempting to execute fptw64 -rewrite -me -f somefile.bin did not error out. Does this mean that I can forego cleaning up the dumped SPI image and reflash the just ME region using fptw64 instead?
I have an official ME firmware update (attached here) for my machine off of Lenovo's site -- is it possible to extract the ME Region from said file and flash it with fptw64? As an aside, I tried flashing this particular file but fptw64 said that the file is too long (file is ~9MB, write length is ~5MB), so I guess I wasn't doing the right thing and aborted immediately.
Still curious though — since fptw64 -rewrite -me happens to work, can I just use that to rewrite the ME Region on my machine instead of cleaning & reflashing the SPI dump?
Follow directions if you want it fixed What you asked maybe possible to do, once you merge the BIOS, then clean/UPD the ME FW, but not before, otherwise you will end up with same situation or unconfigured ME.
Once the two original SPI dumps (8MB) and (4MB) are combined into one (12MB) , how does one flash the firmware if you now have one combined SPI dump and two separate chips?
What you asked maybe possible to do, once you merge the BIOS, then clean/UPD the ME FW, but not before, otherwise you will end up with same situation or unconfigured ME.
