[Guide] Using CH341A-based programmer to flash SPI EEPROM

@Spam00r - You can try with main battery still plugged in, that might help. And yes, as you mentioned, remove CPU might help too, be careful and put cover over socket while you work.

Is that AMD system, or Intel? If Intel, then no, you cannot extract body from capsule and write, it’s missing other BIOS regions. If Intel, I will find you a proper dump to use and then you or I can edit in your system specific details (Serial, UUID, LAN MAC ID)
What you need to do before you write anything is get a verified and valid backup of the original messed up BIOS, make sure it’s not all FF or 00 in hex editor too (It may be, but not usually) Try more than one version of the software if you do see all FF or 00, in case it’s not blank just a software issue.
What is BIOS chip actual ID, look on chip please. Sometimes you need to use other than exact ID in programmer

I was actually using an M92p as a proof of concept because I didn’t care if I bricked it. I was able to read the BIOS to file then write it back and successfully boot the system afterwards. I wasn’t trying to resurrect a dead system or build a valid file from BIN or anything that complex.

You could try a 3.3V coin battery in place of a dedicated DC power supply. Or really any 3.3V DC power supply (any old wall wart as long as it puts out the right voltage), doesn’t have to be a fancy unit like the one I linked.



Hey @Lost_N_BIOS - thank you very much for that offer. It took me three weeks to get a ch341a stick from Aliexpress (shipping takes a lot of time from china to germany).
Today it arrived, and the first thing i did after work, was dumping the Bios. I dumped the bios twice and compared the checksums. They didn’t match. After that, I dumped the Bios six times, and reattached the chip-pincer between every dump. Five of six dumps had the same checksum, so i guess these are correct.

I did the whole procedure twice, because the Board is Dual-Bios. Please don’t ask me why; the Board doesn’t work with both of them. When i bought the mainboard, it worked fine. I modded the bios of two different ASUS mainboards successful in the past, but this time something went wrong. After flashing the modded bios, the postcode display was showing nonsense information. I used the dip-switch to enable the backup-bios, but that’s not working too. But: the postcode display is showing correct codes when using the backup-bios. It still runs into a bootloop. Maybe it’s to old or something.

However, i have uploaded you the dumpfiles here:

https://toppas.net/sf72jcc8/Bios_Lebedev.7z

The file hash of this 7zip archive is:

CRC32: 0127EE7A
MD5: 1FD7D157731C43C327C6B3B1EF5820DC
SHA-1: 7E7D494DA851C3EFEC3E4DC851863244D92AB034

The file contains both bios dumps, and the latest Bios from the MSI Website (it’s an MSI Z77A-GD65 Mainboard).
I would be very grateful if you could take a look at it.

Regards,
Lebedev

Edit:

I just took a look at the dumps with the UEFITool. The "dualbios_1.bin" is the bios that i have modded. I can see the SAMSUNG_M2_DXE driver, which is normally not part of the bios.

Hi guys. I just got my CH431A flasher, but I failing to get it working (und Win10, have not tried others, yet). Programming tool reports "Detection to the driver not installed correctly [outdated link to chineses website]". I found two driver packages for 431, labeled seriell and parallel (should always be seriell, or?). The first claims to be "successfully Pre-installed in advance", the other one reports "Driver install failure!" without any further indications. I cannot find the CH431A in the system panel either to manually install drivers. Any suggestions?

Hello Torsten,

take the parallel driver (over serial USB).

Best regards, MiMo

@PCGH_Torsten - package here with all software versions and the main driver you use for regular flashing (only needs to be installed once, then you can use any software version). All drivers you find will be “dated”, nothing new needed
http://s000.tinyupload.com/index.php?fil…257455007472602

@Lebedev - sorry I missed your post the other day somehow! I would imaging “Samsung2” Is the issue, I’ve never seen anyone insert a NVME Module other than the usual NvmExpressDxe_4 (Or older versions before 4 was ready)
DualBIOS_2 appears to be broken, it has many errors in UEFITool NE, that the stock or DualBIOS_1 does not have. Both are the same BIOS versions. So looks like 2 is broken, and 1 probably OK but can’t boot due to some failure related to the Samsung NVME insert, and it has a partial stock secondary NVRAM which it shouldn’t)

Here, try this, put on via programmer, test BIOS 1 first, if OK then no need to try #2. If both fail it means NVRAM was messed up in both BIOS and we’ll need to find valid dump for your model from some other system (I can probably find)
These have your NVRAM volumes x2 from #1 and then from #2 (I think #1 might fail due to one volume is only stock NVRAM, but if not and it’s OK, then all good, or you can try #2 if you want, it has both complete/used NVRAM volumes)
Samsung NVME removed, built on stock BIOS, but I inserted NVME module for you (NvmExpressDxe_4)
http://www.filedropper.com/lebedev-fix

@Lost_N_BIOS - the Bios 1 file you provided works. Awesome, thanks alot!
I am thinking about flashing the second Bios chip too, since it’s also broken. But i could also use the integrated feature to fix a broken bios (replicate from working bios).
Can i flash the second chip with exact the same bios image sourcefile? Or are there some necessary differences between chip #1 and chip #2?

@Lebedev - I’d go ahead and check BIOS file 2 then, since it has your more complete NVRAM, but you don’t have to if you don’t want. Check to be sure your serial, UUID, and LAN MAC ID are all there and valid, and windows is still activated after a windows update check. If all that’s good, then no need to do BIOS 2 file.
As for the second BIOS, you can flash that with whatever you are certain will always work with your hardware. It can be the same as the first BIOS, no issue with that and on some boards it can cause issues if they don’t match.

@MiesMosel @Lost_N_BIOS : I managed to run the driver installation successfully on another system, but the CH431A still claims that the driver is not installed correctly and fails to recognise the hardware. :frowning:

Do you have set the jumper to [1] and [2] for 3,3V?
And please try chip with 180° drawing.
Or post a photo …

Good luck!

P.S.
For Win7 (x64) I use the CH341parallel driver v2.2 with a folder called "DRVSETUP64" (WinChipHead, 2009).

If you use Win10 you could also try CH341a driver from attachment (VID: 0x1A86, PID: 0x5512, QinHeng Electronics, 2012). VID & PID is from (my) black programmer (like post#1).

CH341a driver.zip (288 KB)

Yes, jumper was set correctly and chip orientation did not have an influnence as the whole flasher was not recognised. But I now found the error: Windows stubornly used it’s own, non working driver, no matter what I installed (or tried to). I know manually installed driver 2.2.2009.6 and finally I can use buttons like “detect”. However I do not trust the results. I read the UEFI already on the chip (as I want to mod this) and then use verify to check the validity of the read and always get “Chip Main Memory with the contents are in disagreement”. Am I doing something wrong or are read results that unreliable? I did 5 reads by now and 2 verifys each and never got a match.

You have to start the flashprogrammer tool with (as) administrator rights.
Please check, that no anti-virus tool disturbes the work of the programmer.

You’ll have to find out the right programmer (18, 29, 30, 31, 34) tool for best matches with the BIOS chip.
Flashrom you’ll find here: https://review.coreboot.org/cgit/flashrom.git/ Support overview: https://www.flashrom.org/Flashrom/1.0/Supported_Hardware

Please de-activate secure boot in UEFI/BIOS before booting into Windows!

And please check the options for reading the bios file: activate “Main Memory + secured OTP” or only “Main Memory”.
For flashing (not before you got a working backup of your actual BIOS) first use: “Main Memory” only.
You can read more about “secure OTP” here: p.e. MXIC.

Don’t (or do) “Allow to skip empty data”.

You’ll need to know the exact product name of the chip & choose it from the menu left above.

And and last check out which voltage (1.8V, 3.3V, 5V, …) the chip needs … and what your programmer provides.

Administrator Rights - check
3.3 V for 2.7-3.6 V Winbond 25Q128FV - check (thanks for the link)
1.18 - chip type not available
1.29 - fail
1.30 - fail
1.34 - fail
1.4 (from Lost_n_Bios’ package) - success. though without defining correct chip. Someone got experience whether this could cause problems on flashing?

You mean the AsProgrammer v1.4 -> yes, this tool has support for your chip.
You’ll find that information @ menu [IC] -> [SPI] -> Winbond -> 25Q128FV.

Programmer v1.29, v1.30 and v1.34 have support for your BIOS chip, too.
If [Search] doesn’t work, you could define the correct chip @ left menu.
Type: 25/26
Manu: Winbond
Name: W25Q128FV

1.4 in my package is freeware 1.31 version (Sucks). If that one works for you, then 1.30 and 1.34 probably do as well. Use detect and pick chip ID.
I tested that exact chip here with 1.29 too, so it also works - Xeon E3-1240 v5 working with MSI Z170-A PC MATE but with bios reset on boot (3)

However, later I tried some other testing and found this, using same W25Q128FV
Query for MOD add bios CSM mode (LEGACY support) (3)

So you may need to use ASProgrammer 1.4 instead.

The read errors mentioned above did occur with manually defined chip (autodetect only narrows down to 3 chips). Guess I will have to use the 1.31 freeware, which does not have any menus (@MiesMosel ). But it does name a “Chip Info” string which matches the Manufacture ID, Memory Type, Capacity and Device ID given by 1.34, so I hope everything is recognized correctly. Which me luck.
pic showing lacking options and information of 1.31free

Feedback: I got lucky.
While the region unlock for ease of future mods did not work fully out, the rest of my CFL mod worked out and the everything seems to work fine so far. Thx for your help again.

Region unlock (Flashing FD) is not always simply for “ease of future flashes” when you are doing CFL mod, if you changed ME SKU then you need to re-write FD for the full mod BIOS to be flashed in since FD is changed with SKU Change.
Good it’s all working, that may be sign you didn’t change ME SKU

@Lost_N_BIOS :
I uploaded a dump here http://s000.tinyupload.com/index.php?fil…213562451378357
According to CoffeeTime 0.7p, SKU hack instead of mod is applied, I am not quite sure whether this is possible with limited FD access. I only checked with CT for locks, which does not specify which locks are present. But there CT definetly sees a difference between the image I used for flashing (“regions unlocked”) and a dump of the flashs result (“region locks found”). While I am content with the results I got, I would be interested in your analyses. My current guess is that 1.31free does exclude FDs Master section (and probably more), as the diffences between image an flash result do not trigger a verify error either.
Probably flashrom could get around this, but right now I got what I needed (and a lot of tweaking work on top).

@PCGH_Torsten - SKU Hack, instead of mod, what is that supposed to mean? Hack=Mod in BIOS editing, there is only change SKU or not change SKU in this process.
Ch341A any version, programs all data you give it, it’s not going to leave out a region, it writes from 0x0 to end of file, unless you specify some specific hex addresses to write From>>To (But you’d know if you did that, since it’s out of norm)

The BIOS dump you attached has unlocked FD (FD, ME, GbE, BIOS regions all = Read/Write Yes/Yes. The only ones that are NO arer read access to PDR/EC (not needed for any of this), rest is read/write Yes/Yes.
BIOS Lock is disabled, RTC Lock is enabled, but this is not usually needed to be unlocked for BIOS modifications or flashing etc. So to my eyes, this BIOS is fully unlocked unless you wanted to dump EC or PDR from an FPT or other similar software tools.
I don’t know what locks still enabled CoffeeTime would be referencing, unless it’s those two things blocked from “read access” via FD?
Svarmod would have to let us know what that’s actually checking when it says something is still locked or not.

You may get around not flashing in a mod FD, if you do not change SKU, or if you do but don’t use a CPU that requires the SKU mod, maybe I’m unsure on that scenario? @svarmod would have to answer that one for us.