Cannot flash moded BIOS: 18 - Error: Unable to start a Secure Flash session

Hi everyone,
thanks for all the great work on this forum!
i have extracted and modified the bios for a Lenovo ERAzer E510 MAIN BOARD.
I double checked that the NVMe modules were all in place, and still I cannot flash the modded BIOS
The modded bios checks out ok. BUT I cannot figure out a way around the security issue. Probably something right in front of me…
Also for AMI Firmware update Utility AFUWINx64 Ver5.05.04 there is a dizzying amount of options.
What is the correct option to flash an update?
Is there a different Firmware update that i should use? The DOS based ones also fail.

Using Ubu 1.53
Scanning BIOS… Please wait…
Platform BIOS AMI Aptio 4
Brand LENOVO
Found Option ROM VBIOS in GUID A062CF1F-8473-4AA3-8793-600BC4FFE9A8
Found Option ROM in GUID A062CF1F-8473-4AA3-8793-600BC4FFE9A8
Found EFI Intel GOP Driver GUID 5BBA83E6-F027-4CA7-BFD0-16358CC9E123
Found EFI Intel Raid Controller GUID 91B4D9C1-141C-4824-8D02-3C298E36EB3F
Found EFI AMI NVMe Driver GUID 634E8DB5-C432-43BE-A653-9CA2922CC458
Found EFI Realtek LAN Undi GUID 82CBD50E-D18A-46A8-B14B-4D206B33183F
Press any key to continue . . .

mod_AMI_lenovo.zip (4.07 MB)

@e-Solutions - I only see X510 and Z510, can you link me to the driver/BIOS download page for your E510.
Please do as mentioned below, stop after step #2 and wait for reply back


Check BIOS main page and see if ME FW version is shown, if not then download HWINFO64
Then on the large window on left side, expand motherboard and find ME area, inside that get the ME Firmware version.
Once you have that, go to this thread and in the section “C.2” download the matching ME System Tools Package
(ie if ME FW version = 10.x get V10 package, if 9.0-9.1 get V9.1 package, if 9.5 or above get V9.5 package etc)
Intel Management Engine: Drivers, Firmware & System Tools

Once downloaded, inside you will find Flash Programming Tool folder, and inside that a Windows or Win/Win32 folder.
Select that Win folder, hold shift and press right click, choose open command window here (Not power shell).
At the command prompt type the following command and send me the created file to modify >> FPTw.exe -bios -d biosreg.bin

Right after you do that, try to write back the BIOS Region dump and see if you get any error >> FPTw.exe -bios -f biosreg.bin
If you do get error, show me image of the command entered and the error given
^^ This is important step, don’t forget ^^


If you are stuck on Win10 and cannot easily get command prompt, and method I mentioned above does not work for you, here is some links that should help
Or, copy all contents from the Flash Programming Tool \ DOS folder to the root of a USB Bootable disk and do the dump from DOS (FPT.exe -bios -d biosreg.bin)
https://www.windowscentral.com/how-add-c…creators-update
https://www.windowscentral.com/add-open-…menu-windows-10
https://www.laptopmag.com/articles/open-…ator-privileges

Or here is simply registry edit that adds “Open command window here as Administrator” to the right click menu
Double-click to install, reboot after install may be required
http://s000.tinyupload.com/index.php?fil…134606820377175

Ah, it is an X510, sorry…
should i still go through this process?

thanks for the quick reply!!! and happy Christmas.

-daniel

Thanks. Yes, if you want to flash a mod BIOS you will probably have to do it the way I’ve started to help you doing above
Or, you can try this method - download the files in guide at end, and then follow just the “Flashing” part of the guide since you have mod BIOS already (basically, use that specific AFU, flash stock BIOS and then without rebooting flash mod BIOS)
https://linustechtips.com/main/topic/592…r-motherboards/

Thanks, Merry Christmas to you and your family as well!

the link; https://linustechtips.com/main/topic/592…r-motherboards/
is missing all the pictures, and the correct pictures are on this forum in a different post;
[Guide] How to get full NVMe support for all Systems with an AMI UEFI BIOS

That and other posts post on this forum, allowed me to get past the insufficient room errors…

You only need to follow the flashing part as I mentioned, you said you already had your mod BIOS done. Main jist of that guide is download the attached AFU, flash stock BIOS with that particular AFU in windows and do not reboot, then flash your mod BIOS directly after that, then reboot.

Sorry, I didn’t know you had insufficient room errors, I thought you said you were done with the BIOS mod and couldn’t flash (hence the title)

I fixed the insufficient room issue. I only need to flash.
Is there a way to secure the rom, so my flashing process works?

------------------------

Part 2:
With the flash utility, (DOS mode, in windows) there are many options, it is not clear what switch to use, and what part of the BIOS to flash. So do I need any of the following commands?
|
| /O - Save current ROM image to file |
| /U - Display ROM File’s ROMID |
| /S - Refer to Options: /S |
| /D - Verification test of given ROM File without flashing BIOS. |
| /A - Refer to Options: /A |
| /OAD - Refer to Options: /OAD |
| /CLNEVNLOG - Refer to Options: /CLNEVNLOG |
| Options: |
| /Q - Silent execution |
| /X - Don’t Check ROM ID |
| /CAF - Compare ROM file’s data with Systems is different or |
| not, if not then cancel related update. |
| /S - Display current system’s ROMID |
| /HOLEOUT: - Save specific ROM Hole according to RomHole GUID. |
| NewRomHole1.BIN /HOLEOUT:GUID |
| /SP - Preserve Setup setting. |
| /R - Preserve ALL SMBIOS structure during programming |
| /Rn - Preserve SMBIOS type N during programming(n=0-255) |
| /B - Program Boot Block |
| /P - Program Main BIOS |
| /N - Program NVRAM |
| /K - Program all non-critical blocks. |
| /Kn - Program n’th non-critical block(n=0-15). |
| /HOLE: - Update specific ROM Hole according to RomHole GUID. |
| NewRomHole1.BIN /HOLE:GUID |
| /L - Program all ROM Holes. |
| /Ln - Program n’th ROM Hole only(n=0-15). |
| /ECUF - Update EC BIOS when newer version is detected. |
| /E - Program Embedded Controller Block |
| /ME - Program ME Entire Firmware Block.

------------------------

From AFUWiINx64
This is continued;
/ME - Program ME Entire Firmware Block.
/MEUF - Program ME Ignition Firmware Block.
/A - Oem Activation file
/OAD - Delete Oem Activation key
/CLNEVNLOG - Clear Event Log.
/CAPSULE - Override Secure Flash policy to Capsule
/RECOVERY - Override Secure Flash policy to Recovery
/EC - Program Embedded Controller Block. (Flash Type)
/REBOOT - Reboot after programming.
/SHUTDOWN - Shutdown after programming.

See step #4 ONLY (only as in use that afu and method only), or do as I mentioned in step #2 (Highly suggested!)
If you continue to try and force with other AFU or find old ES AFU then you are going to mess up your BIOS or brick the board.
You cannot flash mod BIOS with AFU using anything you see in options etc. It’s meant to stop you for a reason, you either have to use old ES AFU w/ special command (DO NOT do this),
Or use method I linked you to at #4 which really is also not ideal (In my opinion, best to do with FPT since this is Intel system)

PS - REFIND is working with the NvmExpressDxe.efi driver dated 12/14/17 - not sure if there is a newer one available?

Also this main board has a strange issue with the mouse under linux. It is jumpy and often sticks to the upper right corner of the window for any distro.
It is not functional in DUET.
Works 99% in windows (occasional jumps).
Is this a BIOS issue?

Sorry, not sure what your first sentence there means, or what you are asking? Latest proper NVME Module to use is v4 here, in the “This is what you need” section - [Guide] How to get full NVMe support for all Systems with an AMI UEFI BIOS

Sorry, I can’t help with mouse or Linux issues, what you mention sounds like some linuz driver issue, maybe you can find help on a Linux forum with your board model name and mouse issue in title (or maybe google search can find you solution)