HP Compaq Elite 8300 SFF, Intel Q77 Express, BIOS K01 v03.08
I’ll just leave it here in case something will be looking for the same.
I was trying first to integrate a NVMe module, then since I’ve already dig down, I’ve decided to upgrade the ME as well.
7 tools were used for that: UEFITool 0.28.0, UEFITool NE A59, Flash Image Tool v8.1.40.1456 (FIT) and Flash Programming Tool (FPT) (DOS variant under FreeDOS 1.3 Live CD) from ME System Tools v8 r3, WinMerge for ME DATA comparison, Hex Editor Neo Professional for hex comparison and corrections.
MMTool Aptio 4.50.0023 was corrupting a pad file thus was thrown away.
UEFITool was corrupting both a ZeroVector and a Checksum of this BIOS region root filesystem.
Flash Image Tool was reordering a ME/BIOS/(empty)PDR regions while building an image.
Problems & Solutions
- Original BIOS file is signed by HP, so HP user tools won’t flash a modified BIOS it because of the signature mismatch unless you’ll find out how to generate the proper signature: you may need a quantum computer for that in case HP uses a strong signature.
- BIOS update file provided by HP contains ME region as well as expected BIOS region but while flashing it using a HP UEFI flash menu invoked by pressing Esc - ME region stays intact in spite of an unlocked write-unprotected ME region, I don’t know why. Maybe ME region could be updated only by HP DOS update tool provided with the BIOS file or even only under Windows using their Windows tool from the same package. I’ve lost so much time playing around, that at the end of the day it was easier to build a complete flash image for me from several pieces.
- Since both MMTool and UEFITool were generating image files with some discrepancies and senior members of the forum were telling me that they don’t see any problems - I’ve decided that I need to dump the whole SPI flash image for a backup purpose in a worst case scenario, not only some specific regions of a flash memory.
Flash Programming Tool was used for that but it won’t succeed to read a ME region unless you unlock it.
Later, after making a full dump, I’ve discovered, that BIOS region is locked for writing: I was trying to flash my full original dump.
Flash Descriptors region with unlocked variables flashing, HDA_SDO/GPIO33 (a.k.a. “Pinmod”) shorting, pressing Win+[left arrow]+[right arrow] or Win+B while powering up, setting a variables from a DXE “Setup” driver using a EFI shell - none of these attempts were succeeded. (link for the reference)
There were two pairs of (un?)documented pinheads and one (un?)documented pair of pin pads on a board.
Pin pad BBR - according an internet search results this is a boot block recovery for a crisis situation. I didn’t try this, but I assume it will load a BIOS file from the root of FAT32 storage device or optical disk drive attached by USB/SATA. I’m not sure if it validates the signature and if it unlocks all regions. This was not my first goal to dump the flash image.
FDO pin heads - appears to be a Flash Descriptor Override.
After booting with a shorted FDO I could dump the whole flash image by Flash Programming Tool.
But I wasn’t able to flash it back: BIOS region was write-restricted. (Error 28: Protected Range Registers are currently set by BIOS, preventing flash access.)
BB pin heads - I’m not sure if it stands for a BIOS Block or Boot Block, but booting with a shorted BB and FDO pins I could dump the whole flash image and write it as well. - 8-pin test clip connection for flashing with a hardware SPI programmer either desoldering / programming / soldering back looks hardly possible on this board because the chip is located very close to a RAM slot. Pins are right under the RAM slot lock, so I couldn’t get there neither with soldering iron I have nor with a clip. Soldering without destroying a RAM slot is possible, but I don’t have enough skills and a proper soldering iron for the task. Test clip - maybe this is possible after cutting things off from a test clip.
- Since I’ve found out a way to dump the whole flash image (fpt -d spi.bin), I’ve prepared and flashed the whole image (not by regions) as well (fpt -f spi.bin, fpt -greset). I’ve updated the BIOS to the latest version from HP prior to dumping it.
5.1. For NVMe module - UEFITool 0.28.0 was used (thanks for a manual). Original ZeroVector and a Checksum of a BIOS region root filesystem was reverted manually using a hex editor - due to some unexpected behaviour of UEFITool creating a discrepancy while rebuilding images.
At this step I got a proper flash image with a NVMe module.
ME region from my dump was very old, older than the update from HP, I don’t know why it was not updating even with FDO pins shorted.
In case I could update ME region using HP tools - maybe I would skip the next part. Anyway, I was going to use AMT but latest BIOS update from HP had it older than here.
5.2. I’ve extracted the whole ME region as is from HP BIOS update file using UEFITool NE A59 and have replaced the same whole region in my full flash image using UEFITool 0.28.0.
At this step I got a proper flash image with a NVMe module and with a latest available HP ME update.
5.3. I’ve decompressed my image using Flash Image Tool, because I need to preserve a DATA part from HP BIOS update file ME region upgrading only a CODE part to ME 8 5MB v8.1.72.3002. I’ve replaced the ME Region.bin (thanks for a manual) and built the image. However, Flash Image Tool has reordered the regions, also there were some discrepancies between the master header / Flash Descriptors of the image. So I’ve extracted the whole ME region as is from this corrupted image using UEFITool NE A59 and simply replaced the same whole region in my full flash image using UEFITool 0.28.0.
At this step I got a proper flash image with a NVMe module, with a ME DATA from the latest available HP ME update, with a ME CODE upgraded to the latest available from the firmware repository on this forum.
I’m unable to share my image file since it does have my unique GBE MAC address / maybe some other serial numbers. I think it is pretty easy to prepare update files that could be flashed by fpt -bios -f bios.bin and fpt -me -f me.bin.