[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

Before ME12 one could use a configured ME region for an update. But you can’t be sure that an update is configured properly for this machine since the update process doesn’t worry anout any configuration data but updates just the code partitions of an ME region. So the udate file might ot might not be configured correctly for your machine.

So you have to check the update file in FIT if it has the correct configuration, if so you might use it as a region. But what’s all this about?

The link you gave is a procedure to update older workstations from ME7 to ME8 and the MEBLAST folder contains a complete firmware image, not just the ME. So there’s no ‘earlier’, this is a single special case for the upgrade from ME 7 to ME 8.

Not just that, there was the same for installing ME7:
https://ftp.hp.com/pub/softpaq/sp59501-60000/sp59990.html
https://ftp.hp.com/pub/softpaq/sp59501-60000/sp59990.exe

That MEBLAST would literally copy the ME region out of the full size BIOS (with the FD jumper on), does not copy/touch anything else. I think later HP switched to FWUpdLcl64.exe for everything, with the repackaged binaries:
https://ftp.hp.com/pub/softpaq/sp82501-83000/sp82644.html
https://ftp.hp.com/pub/softpaq/sp82501-83000/sp82644.exe

Anyway, I thought 9.1 could do the same - if only I could find a clean 1:1 ME area somewhere, LOL.

Btw, if you need to see what the full Z440 dump looks like with that ME9.1 installed, see this:

That’s different models, the one you asked for first is Z1 G2, Z228, Z230, Z440, Z640 and Z840 Workstations, the ones you mentioned later are for Z420, Z620, Z820, Z1 G1, Z210 CMT, and Z210.

What kinda machine do you want to update from which version to which version?

Of course, you are correct, these are 2 different workstation series!

I want a clean ME image for Z440 (exactly sized to the flash chip ME region), but using that early meblast-like procedure from Z420. So would be doing this on Z440 with clean ME 9.1:
fpt.exe -ME -f me91_clean_image.bin

Probably all data regions in the clean image will be filled with FF, except for byte 0x400 which would be “01” to initialize the ME.

If you have a dump of such a machine - clean the ME region according to this guide and you have what you want.

Right, this is the full dump here, with ME in there as well:

I guess it’s a bit older version of ME (Version: 9.1.25.1005) in there:

Fixed: Yes

Base: 5000h

Address: FF005000h

Offset: 5000h

Full size: 5FB000h (6270976)

Version: 9.1.25.1005

Hi, I followed the instructions to clean ME region, but after flashing with fptw command, ME Firmware Version in BIOS still shows 0.0.0.0. My laptop has a replaced PCH so I need to clean ME region.
The original BIOS I extracted from another laptop of the same model: GF63_8RD_BIOS_Stock.bin - Google Drive
And the BIOS I cleaned myself: GF63_8RD_BIOS_Stock_Clean.bin - Google Drive
I tried to extract the BIOS back to the flashed version and the File System State was Initialized. Once I entered the BIOS I saw that the ME Firmware Version was there and displayed the correct version, but after a few restarts, it returned to 0.0.0.0.
Sorry my English is not good, I hope everyone can help me check if my file is wrong, thank you!

What model are we talking about here? And why are you attaching the dumps of two different models?

Sorry I sent it by mistake!

MSI provides complete firmware images (at least for the two types mentioned). Use the ME region from a stock MSI bios corresponding to your machine type. The ME region has a state of ‘configured’ = ‘cleaned’.

1 Like

I managed to follow the steps for CSME 11 (section D4) all the way to Step 14. Unfortunately even though I have read access to the FD, I don’t have write access at all. I have my cleaned image ready to flash and everything. My HP EliteDesk G3 800 SFF’s motherboard has an FDO jumper pin that I can utilize, but when I attempt to boot the machine with those pins shorted, all it did was power on the system for like maybe 10 seconds, then it just suddenly powers back off (the BIOS logo never shows in that time).

I’ve also tried treating the jumper pins like the pinmod method - power on with the pins shorted, then removing the jumper after it powers up. Unfortunately that didn’t do anything either.

Does anyone know how the FDO pins on these boards are supposed to be used?

@ plutomaniac

There are several reports of Microsoft Surface machines loosing touch after cleaning ME. One proposed solution was to change settings for ISH in FIT (link to badcaps), but that did only work for some machines.

I happened to come over a Surface pro 4 with still working firmware after a memory exchange (link to thread)

The user was able to run MEInfo on a firmware with a cleaned ME and and his own still working firmware.

The firmware with the cleaned ME had an identical bios region and identical flash descriptor, so settings in FD and bios region (NVRAM) can’t be relevant here. Still the cleaned ME didn’t have touch and the output of MEInfo was different:

I searched here, closest was this thread, but these are FD bits as far as I could find out and FD is unchanged.

I unpacked ME regions of the working (old118.bin) and cleaned (031024e.bin) firmware (MEA -unp86) but couldn’t find any hint where this settings could be stored in MFS.

Tried several FIT versions down to 11.0.0.1202 - the version the Surface firmware originally was composed with. But these settings aren’t covered by FIT and accordingly don’t show in the xml- files.

Read the bringup- guides as far as available, but there’s only information on Flash Descriptor Records.

Do you have an idea where to search from here?

Files

Surface 4 touch MEInfo.zip (4.1 KB)

old118_mem.zip (6.0 MB)
031024e.zip (5.8 MB)

@lfb6 It has been a couple of years since I dealt with ME, and I’m already forgetting, but I think this kind of thing can be changed via Flash Programming Tool, by modifying NVAR configuration (-cfggen etc). Check the FPT NVAR chapter of the System Tools User Guide.

I also found this, when searching the forum, in case it helps (no idea if these apply to CSME 11, but the year might indicate that it does):

1 Like

OK, Thank you, I’ll have a look into the fpt commands!

Tried already, but don’t have a ME 11 machine at hand, unfortunately. ME 14 already has a FIT section for precise touch, so there wasn’t anything to find there.

Edit:
Of course youwere right! I could read the variable for ME 14, too:

Now it’s just finding the syntax for ME11 to update it…(and check if this is really what was missing)

Edit 2:
Any idea why the “FeatureShipState” is 47 50 F6 01 (0x01F65047) (reported by fptw64)

but MEInfo reports

FW Capabilities value is 0x7DF6D147
Feature enablement is 0x5DF6D147

image

OK, and touch can’t be enabled after EOM

1 Like

Makes sense from a security standpoint

2 Likes


440 G8 failed to decompose

Attach / post a link to the dump you’re trying to decompose

Hi need help with this bios file. I failed to do me region clean on it. Hoping someone with better knowledge can help. here is link https://www.mediafire.com/file/xlcosq0vy9fhm89/X133GV3.1_-_my_dump.zip/file

Well, file opens fine in FIT, so I’d assume it’s just following the guide to the letter…

can you send me a link to your fit app, mine got an error unrecognized binary format