[Guide] How to flash a modded AMI UEFI BIOS

I have done it - the motherboard was disconnected for all night (all cables + CMOS battery). After reconnecting load def values in BIOS. Unfortunatelly it still not working. All USB ports are down (only in BIOS mode, in Windows work correctly).

OMG. Why USB functionality is another in boot mode versus OS windows? Should it be HW problem? Or some setting in BIOS?

@japr

Well… not killing the brain with it, straight answer you got an onboard USB hub/chip issue, assuming this is the original bios from the correct motherboard/brand, that you didn’t answer my confirmation request.
As SVET also asked you in your post here: https://forum-en.msi.com/index.php?threa…77a-g43.371601/

The correct behavior of the motherboard after a deep CMOS reset, should resolve the issue so if not then its hardware issue.
You can try, not recommend, update the bios in OS environment or using PS/2 keyboard access bios file on root c to M-FLASH

Good luck.

EDIT: You can update the Intel ME FW to version 8.1.70.1590 1.5MB here: Intel (Converged Security) Management Engine: Drivers, Firmware and Tools
ONLY after successful bios update to version 2.13.
Nothing more to add

Sure, I have E7758IMS.250. This is original bios since I have bought this motherboard. This is first time of attemp to upgrade bios to newer version.

Current bios version is:

E7758IMS V2.5

build date 08/31/2012

ME version 8.0.10.1464

SOLVED

Issue: Motherboard Z77A-G43 unable boot from USB key. Also not work USB ports in bios menu (keyboard, USB key, M-flash).
Solution: upgrade version of BIOS MS-7758 from 2.5 to 2.13. Unfortunately there was not possibility upgrade from USB key. I have prepared separate hard disk. It has to be formated to FAT32 (format /FS:FAT32 x:) and assigned letter in diskmgmt.
Next I started MSIHQ tool, choose method 1, choose letter of disk and MSIHQ tool transfered required files to hard disk. Also partition of disk must be set as active otherwise than boot is not possible.
In next step reboot computer and chose this disk as boot device and continue normally.

I’m having trouble installing the bios mod, the bios that the seller sent me and the one I did doesn’t install, by afuwin it gives error 18 and in the instflash of the securty check flash error, I don’t know what else to do, someone could tell me to help because I want to use qnct i7 8750h cpu and xeon E2186M, I would be very grateful if someone could modify the bios so that I can flash it.

WhatsApp Image 2022-03-23 at 17.37.58.jpeg

imagem_2022-03-23_191534.png

H3CMHG44.rar (7.81 MB)

@RenegadoBR
Welcome to the Win-RAID Forum!
I have moved your help request into the matching thread. Please read the start post carefully and follow its advices.
Good luck!
Dieter (alias Fernando)

@Fernando Thank you very much, I will try, but I am very ignorant in this matter.

Does anyone have these files? the links are dead and I can’t find them via google.

<Download the appropriate AFU tool from the AMI websites. The download link to the “AMIBIOS and Aptio AMI Firmware Update Utility” can be found >here<.
<Attention: The " /GAN" command suffix is not supported by the latest AMI AFU Tools!
<Users, who are running a 64bit Windows OS and want to flash a modded AMI Aptio IV BIOS, can download the AFUWIN64 tool v3.05.04 from >here<.

@zakalwe Welcome to the Win-RAID Forum and thanks for your report.
The related links have been repaired by me.
Good luck!
Dieter (alias Fernando)

Use 3.06 here

HP Compaq Elite 8300 SFF, Intel Q77 Express, BIOS K01 v03.08
I’ll just leave it here in case something will be looking for the same.
I was trying first to integrate a NVMe module, then since I’ve already dig down, I’ve decided to upgrade the ME as well.
7 tools were used for that: UEFITool 0.28.0, UEFITool NE A59, Flash Image Tool v8.1.40.1456 (FIT) and Flash Programming Tool (FPT) (DOS variant under FreeDOS 1.3 Live CD) from ME System Tools v8 r3, WinMerge for ME DATA comparison, Hex Editor Neo Professional for hex comparison and corrections.

MMTool Aptio 4.50.0023 was corrupting a pad file thus was thrown away.
UEFITool was corrupting both a ZeroVector and a Checksum of this BIOS region root filesystem.
Flash Image Tool was reordering a ME/BIOS/(empty)PDR regions while building an image.

Problems & Solutions

  1. Original BIOS file is signed by HP, so HP user tools won’t flash a modified BIOS it because of the signature mismatch unless you’ll find out how to generate the proper signature: you may need a quantum computer for that in case HP uses a strong signature.
  2. BIOS update file provided by HP contains ME region as well as expected BIOS region but while flashing it using a HP UEFI flash menu invoked by pressing Esc - ME region stays intact in spite of an unlocked write-unprotected ME region, I don’t know why. Maybe ME region could be updated only by HP DOS update tool provided with the BIOS file or even only under Windows using their Windows tool from the same package. I’ve lost so much time playing around, that at the end of the day it was easier to build a complete flash image for me from several pieces.
  3. Since both MMTool and UEFITool were generating image files with some discrepancies and senior members of the forum were telling me that they don’t see any problems - I’ve decided that I need to dump the whole SPI flash image for a backup purpose in a worst case scenario, not only some specific regions of a flash memory.
    Flash Programming Tool was used for that but it won’t succeed to read a ME region unless you unlock it.
    Later, after making a full dump, I’ve discovered, that BIOS region is locked for writing: I was trying to flash my full original dump.
    Flash Descriptors region with unlocked variables flashing, HDA_SDO/GPIO33 (a.k.a. “Pinmod”) shorting, pressing Win+[left arrow]+[right arrow] or Win+B while powering up, setting a variables from a DXE “Setup” driver using a EFI shell - none of these attempts were succeeded. (link for the reference)
    There were two pairs of (un?)documented pinheads and one (un?)documented pair of pin pads on a board.
    Pin pad BBR - according an internet search results this is a boot block recovery for a crisis situation. I didn’t try this, but I assume it will load a BIOS file from the root of FAT32 storage device or optical disk drive attached by USB/SATA. I’m not sure if it validates the signature and if it unlocks all regions. This was not my first goal to dump the flash image.
    FDO pin heads - appears to be a Flash Descriptor Override.
    After booting with a shorted FDO I could dump the whole flash image by Flash Programming Tool.
    But I wasn’t able to flash it back: BIOS region was write-restricted. (Error 28: Protected Range Registers are currently set by BIOS, preventing flash access.)
    BB pin heads - I’m not sure if it stands for a BIOS Block or Boot Block, but booting with a shorted BB and FDO pins I could dump the whole flash image and write it as well.
  4. 8-pin test clip connection for flashing with a hardware SPI programmer either desoldering / programming / soldering back looks hardly possible on this board because the chip is located very close to a RAM slot. Pins are right under the RAM slot lock, so I couldn’t get there neither with soldering iron I have nor with a clip. Soldering without destroying a RAM slot is possible, but I don’t have enough skills and a proper soldering iron for the task. Test clip - maybe this is possible after cutting things off from a test clip.
  5. Since I’ve found out a way to dump the whole flash image (fpt -d spi.bin), I’ve prepared and flashed the whole image (not by regions) as well (fpt -f spi.bin, fpt -greset). I’ve updated the BIOS to the latest version from HP prior to dumping it.
    5.1. For NVMe module - UEFITool 0.28.0 was used (thanks for a manual). Original ZeroVector and a Checksum of a BIOS region root filesystem was reverted manually using a hex editor - due to some unexpected behaviour of UEFITool creating a discrepancy while rebuilding images.
    At this step I got a proper flash image with a NVMe module.
    ME region from my dump was very old, older than the update from HP, I don’t know why it was not updating even with FDO pins shorted.
    In case I could update ME region using HP tools - maybe I would skip the next part. Anyway, I was going to use AMT but latest BIOS update from HP had it older than here.
    5.2. I’ve extracted the whole ME region as is from HP BIOS update file using UEFITool NE A59 and have replaced the same whole region in my full flash image using UEFITool 0.28.0.
    At this step I got a proper flash image with a NVMe module and with a latest available HP ME update.
    5.3. I’ve decompressed my image using Flash Image Tool, because I need to preserve a DATA part from HP BIOS update file ME region upgrading only a CODE part to ME 8 5MB v8.1.72.3002. I’ve replaced the ME Region.bin (thanks for a manual) and built the image. However, Flash Image Tool has reordered the regions, also there were some discrepancies between the master header / Flash Descriptors of the image. So I’ve extracted the whole ME region as is from this corrupted image using UEFITool NE A59 and simply replaced the same whole region in my full flash image using UEFITool 0.28.0.
    At this step I got a proper flash image with a NVMe module, with a ME DATA from the latest available HP ME update, with a ME CODE upgraded to the latest available from the firmware repository on this forum.

I’m unable to share my image file since it does have my unique GBE MAC address / maybe some other serial numbers. I think it is pretty easy to prepare update files that could be flashed by fpt -bios -f bios.bin and fpt -me -f me.bin.

2 Likes

@Thump
Thank you very much for sharing your experiences and solutions.
This may help other users!

Queries about flashing BIOS in hp-14-dk0010ca (AMI Bios)- for unlocking Advanced menu/risk of bricking and recovery options

Hi Fernando,

Thanks so much for a wonderful and informative post. I have been reading this post (as well as ones on youtube user Barricuda) to try and unlock Advanced menu settings in my hp 14-dk0010ca Bios.

Here’s the background and how I am trying to do it:

1. Background:

  • My hp 14-dk-0010ca had a non-soldered in spot for an m.2 nvme slot (it already had an integrated 64 GB emmc as a sata drive) [Snapshots of m.2 soldered slot, AMIBCP of hidden Advanced BIOS menu, IFR_hex-based BIOS modification procedure.pdf - Google Drive ; point1]
  • Other variants of this laptop hp-dk-xxxx seem to have a native functioning m.2 nvme slot and they have the same bios as per the hp support website
  • After soldering in the m.2 drive, the nvme ssd I had did not get detected in bios and didn’t work (though it would get warm)…which meant it was either a hardware issue (missing components) or it was blocked in BIOS.
  • To maximize my chances of getting a working drive, I ordered an m.2 nvme to m.2 a/e adapter (x1 lane limitation on adapter) and plugged it into my wifi module slot (after removing the wifi card). This worked and I was able to clone my emmc drive into this nvme and make it bootable. I expected at least 500-600 MB/s speeds for the x1 lane, however I am getting read speeds around 200 MB/s (the drive is rated at 2400MB/s for x4 lanes). On checking the CPUz utility, I saw that link width for the NVME was at 2.5 GT/s (and showed PCI 2.0 even though my laptop mainboard is a PCI 3.0). It also showed the native emmc was operating at SATA II even though SATA III was available.

Seeing the above scenarios, 2 thoughts came to mind:

  1. The m.2 nvme slot (whose socket was factory unsoldered), may actually be disabled in BIOS
  2. There is probably an m.2 speed bottleneck and m.2 pcie version setting (and also perhaps sata speed settings) within the BIOS

I went ahead and opened up my backed up BIOS (using the universal bios backup tool) and opened it within the AMIBCP aptio tool as per advise from youtube user Barricuda (Bios menu unlock via IFR edit - YouTube). Thats where I found the the Advanced features in the bios. I used Barricuda’s technique to unlock the Advanced settings and create a .rom BIOS file (Points 2,3 and 4 of the pdf document)

I basically had the following queries:
i) Am I on the right track to unlock the Advanced settings and what is the risk of bricking the Bios ?
Would I likely get any “checksum” errors as I have heard newer bioses (2015 onwards) have some sort of security protection that will either cause a flash failure or cause a bricked and unusable bios [incidentally the size of the bios rom file remains the same after making the changes using your method- since I think I am just moving the code out of the if-endif loop and not adding or subtracting information ?..does this mean there is no chance of a checksum error or a very low chance?..
If there is a risk of a checksum error in making the hidden Advanced option visible using this method, would it be safer for me to just try and toggle and change the pcie speed from x1 to x4 in the AMI BCP tool menu, and not unhiding the whole Advanced options, as I have that option as well ]

ii) Flashing procedure:

  • which flash tools would you recommend ? I am planning on using the AMI Aptio 5 flash tool but would it be better to use the Flashrom utility ?
  • if the bios is corrupted on flashing, whats the best bios recovery method…would it be by using a usb bootable disk with the old stock Bios .rom file and reflashing using tools like “flashrom” or “Flash programming tool” or is there a chance that the usb drive won’t boot since the usb boot drive might need the bios to be able to “find it”.
  • My hp laptop also has a usb bios recovery drive method where you can boot the computer and press “windows key + B + power on” but sometimes this doesn’t work.
  • Is using the ru.efi tool a better option than flashing ?

iii) Do you think the m.2 nvme drive is disabled or somehow enabled as a SATA port ? It is a key m port so I would assume it was an nvme (like the laptops other variants)…would switching off the sata ports (also in the advanced menus)

Thanks so much for bearing with the long post.
Nooman

@nauman
Welcome to the Win-RAID Forum!
Since I never tried to flash a modded BIOS into a HP mainboard, I cannot really help you.
Many of your questions are off-topic and should be asked within a better matching Sub-Forum. Regarding the M.2 slots you should check their functionality (WiFi/Storage) and data transfer protocol (NVMe/AHCI), before you start with the BIOS modding.
Good luck!
Dieter (alias Fernando)

Hi Fernando,

Thanks for the super prompt reply. Just had one lingering doubt that was more of a “general” BIOS modding related question for which you may have experience- during the flashing procedure itself, will the flashing program let me know for sure whether the procedure (just the flashing part itself) was a) a success; or b) a failure (perhaps causing an immediately bricked BIOS) ?
The reason I ask this is lets say the flashing was a failure, but did not immediately “brick” the laptop, I could then immediately reflash the original BIOS back…but if the “bricking” is only evident on restarting the computer, then perhaps there is more risk I can’t boot into a USB recovery, etc. to reflash the BIOS with the original rom file.

Lastly, I am getting an option to flash the main BIOS region or all regions and there are some other minor options too (AFUWIN_flashing_options.jpg - Google Drive) …which is better ? Also, are there some options seen here that I should be careful to enable/unable before starting the flashing ?

Thanks a lot again!
Nauman

Thanks for the answer Fernando.
Where I can find the detailed proceed to flash bios using AiSuite by Wishbringer?
Thanks
Charles

Here post #246: [Guide] How to flash a modded AMI UEFI BIOS - BIOS/UEFI Modding / BIOS Modding Guides and Problems - Win-Raid Forum (level1techs.com)

Thanks.I tried it but flash with AiSuite didnt work on H87 Plus mobo.
Any other chance to flash for me?
Thanks

@charlesko1
Since your recent posts have much more to do with the topic of this thread, I have moved them here.

@MeatWar
Just for your information.