[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

OK, that sounded different earlier and you posted a 2 MB file which just was FF while your backup looks like a valid end- part of a bios region.

Then it’s possibly not firmware related…

I have tried to clean a (CS) ME Region of a dumped file, however during the process of building image the following error was showed up in FIT environment:

Error 197: [Fit Actions] Invalid settings combination. If “EOM on First Boot Enabled” is set to: “Yes”, Then "Boot Guard Profile Configuration " cannot be set to: “Boot Guard Profile 3 - VM”

Error 20: [Csme Binary Gen] Error executing pre-build actions.

Error 2: Failed to build.

I have two doubts:

  1. What is the best way to solve this error: Change the EOM parameter to NO or change Boot Guard Profile to another value, for instance: 4-FVE?

  2. Why was it possible for LBE to clean (CS)ME Region of same file keeping EOM as YES and Boot Guard Profile as 3-VM, considering that they are invalid settings combinations?
    See link below for Dumped and LBE Files:
    Microsoft OneDrive

Hello.
I’m wondering if you guys could help me (and many others, each one with it’s own) with my old laptop Dell, model Inspiron 5557.
Since it’s BIOS was updated via Windows Update (from 1.6 to 1.9) after a replace SSD and OS reinstall, an annoying screen with “…invalid configuration blablabla…” appears everytime that we turn it on! Trying to downgrade to 1.6 again was successful, but Intel ME with final error 2236. Installed Intel MEI version still same as 1.9 BIOS: 11.8.77.3664, when 1.6 is 11.8.60.3561. I believe that’s related to dirty MEI Region. If I was correct, can you help us? Sorry for my bad english, and thank you for now…

Link for laptop BIOS:

https://www.dell.com/support/home/en-us/drivers/driversdetails?driverid=k9n6w&oscode=wt64a&productcode=inspiron-15-5557-laptop

PS: IDK how to dump current BIOS nor extract from Dell package.

It would be nice to get a “real” translation, preferable a human reading of that “BLABLA” of yours… and maybe we get a “picture” of what is the SSD related to the Intel ME FW of a system.

Bios updates only upgrade the Intel ME FW when they’re required to (system has lower/old version) than the payload package and ME FW is never downgraded by normal flash methods.

Do you mean the backup is probably not corrupted?

Just one question: The 4MB bios dump does not correspond to the Engine region, am I correct?

Can someone help to unpack this HP Z440 ME into a clean ME area that can be flashed with FPT:
https://ftp.hp.com/pub/softpaq/sp90001-90500/sp90102.exe

Or at least point to tools to do so?

Along these lines, what’s the latest version of ME 9.1? Anything newer than 9.1.45.3000 which is in this package ?

To the best of my knowledge, this is the latest version (9.1.45.3000). What is the problem with the current file format? I have updated them without any problems with FWUpdLcl64.exe. You don’t need to modify the files under v12. You can use !save.bat to save the existing version and write.bat to update it (9.1.45.3000_5MB_PRD_RGN_D8D49751).

series_9.1.rar (4.2 MB)

The earlier versions of the HP ME update had a clean ME region that was byte copied to the ME area of the flash 1-to-1, and one byte was set to “01” to enable it to initialize upon boot.

So I wanted to extract the clean ME that’s 1-to-1 match to the flash region out of the ME update file, but it looks like it’s sort of challenging with the bin files that are supposed to be used by FWUpdLcl64.exe

See this for that other approach - called MEBLAST:
https://ftp.hp.com/pub/softpaq/sp59501-60000/sp59991.html
https://ftp.hp.com/pub/softpaq/sp59501-60000/sp59991.exe

Before ME12 one could use a configured ME region for an update. But you can’t be sure that an update is configured properly for this machine since the update process doesn’t worry anout any configuration data but updates just the code partitions of an ME region. So the udate file might ot might not be configured correctly for your machine.

So you have to check the update file in FIT if it has the correct configuration, if so you might use it as a region. But what’s all this about?

The link you gave is a procedure to update older workstations from ME7 to ME8 and the MEBLAST folder contains a complete firmware image, not just the ME. So there’s no ‘earlier’, this is a single special case for the upgrade from ME 7 to ME 8.

Not just that, there was the same for installing ME7:
https://ftp.hp.com/pub/softpaq/sp59501-60000/sp59990.html
https://ftp.hp.com/pub/softpaq/sp59501-60000/sp59990.exe

That MEBLAST would literally copy the ME region out of the full size BIOS (with the FD jumper on), does not copy/touch anything else. I think later HP switched to FWUpdLcl64.exe for everything, with the repackaged binaries:
https://ftp.hp.com/pub/softpaq/sp82501-83000/sp82644.html
https://ftp.hp.com/pub/softpaq/sp82501-83000/sp82644.exe

Anyway, I thought 9.1 could do the same - if only I could find a clean 1:1 ME area somewhere, LOL.

Btw, if you need to see what the full Z440 dump looks like with that ME9.1 installed, see this:

That’s different models, the one you asked for first is Z1 G2, Z228, Z230, Z440, Z640 and Z840 Workstations, the ones you mentioned later are for Z420, Z620, Z820, Z1 G1, Z210 CMT, and Z210.

What kinda machine do you want to update from which version to which version?

Of course, you are correct, these are 2 different workstation series!

I want a clean ME image for Z440 (exactly sized to the flash chip ME region), but using that early meblast-like procedure from Z420. So would be doing this on Z440 with clean ME 9.1:
fpt.exe -ME -f me91_clean_image.bin

Probably all data regions in the clean image will be filled with FF, except for byte 0x400 which would be “01” to initialize the ME.

If you have a dump of such a machine - clean the ME region according to this guide and you have what you want.

Right, this is the full dump here, with ME in there as well:

I guess it’s a bit older version of ME (Version: 9.1.25.1005) in there:

Fixed: Yes

Base: 5000h

Address: FF005000h

Offset: 5000h

Full size: 5FB000h (6270976)

Version: 9.1.25.1005

Hi, I followed the instructions to clean ME region, but after flashing with fptw command, ME Firmware Version in BIOS still shows 0.0.0.0. My laptop has a replaced PCH so I need to clean ME region.
The original BIOS I extracted from another laptop of the same model: GF63_8RD_BIOS_Stock.bin - Google Drive
And the BIOS I cleaned myself: GF63_8RD_BIOS_Stock_Clean.bin - Google Drive
I tried to extract the BIOS back to the flashed version and the File System State was Initialized. Once I entered the BIOS I saw that the ME Firmware Version was there and displayed the correct version, but after a few restarts, it returned to 0.0.0.0.
Sorry my English is not good, I hope everyone can help me check if my file is wrong, thank you!

What model are we talking about here? And why are you attaching the dumps of two different models?

Sorry I sent it by mistake!

MSI provides complete firmware images (at least for the two types mentioned). Use the ME region from a stock MSI bios corresponding to your machine type. The ME region has a state of ‘configured’ = ‘cleaned’.

1 Like

I managed to follow the steps for CSME 11 (section D4) all the way to Step 14. Unfortunately even though I have read access to the FD, I don’t have write access at all. I have my cleaned image ready to flash and everything. My HP EliteDesk G3 800 SFF’s motherboard has an FDO jumper pin that I can utilize, but when I attempt to boot the machine with those pins shorted, all it did was power on the system for like maybe 10 seconds, then it just suddenly powers back off (the BIOS logo never shows in that time).

I’ve also tried treating the jumper pins like the pinmod method - power on with the pins shorted, then removing the jumper after it powers up. Unfortunately that didn’t do anything either.

Does anyone know how the FDO pins on these boards are supposed to be used?

@ plutomaniac

There are several reports of Microsoft Surface machines loosing touch after cleaning ME. One proposed solution was to change settings for ISH in FIT (link to badcaps), but that did only work for some machines.

I happened to come over a Surface pro 4 with still working firmware after a memory exchange (link to thread)

The user was able to run MEInfo on a firmware with a cleaned ME and and his own still working firmware.

The firmware with the cleaned ME had an identical bios region and identical flash descriptor, so settings in FD and bios region (NVRAM) can’t be relevant here. Still the cleaned ME didn’t have touch and the output of MEInfo was different:

I searched here, closest was this thread, but these are FD bits as far as I could find out and FD is unchanged.

I unpacked ME regions of the working (old118.bin) and cleaned (031024e.bin) firmware (MEA -unp86) but couldn’t find any hint where this settings could be stored in MFS.

Tried several FIT versions down to 11.0.0.1202 - the version the Surface firmware originally was composed with. But these settings aren’t covered by FIT and accordingly don’t show in the xml- files.

Read the bringup- guides as far as available, but there’s only information on Flash Descriptor Records.

Do you have an idea where to search from here?

Files

Surface 4 touch MEInfo.zip (4.1 KB)

old118_mem.zip (6.0 MB)
031024e.zip (5.8 MB)