How to Reset MEBx Password for Esprimo Q957?

Hello everyone,

I have recently bought an esprimo q957 mini pc, it has no bios password and i wanted it because it has a q270 chipset so it would allow me to use vpro.
While it has no bios password, the mebx passsword is set and i cannot reset it , bios option allows to reset everything but without the password(says so explicitly).
I also looked over the motherboard documentation and tried setting the board in recovery mod, that did not reset the mebx password.

So my question is , would a modded bios flashed with a ch431a solve this issue ?
Any reply is appreciated !


Edit by Fernando: Thread title shortened

Normally access to the bios allows for full unprovisioning?

The D3513-A1.UPD from the latest bios package contains a stock ME region, you could try to dump you bios and replace it with the stock region and flash it back.

Thank you for the reply!
Yes, the normal bios setting allows for full unprovisioning, minus the password reset (states it clearly in the description), I tried it just to be sure :confused:
Should this be done with a flasher or could the efiflash do the job ?
Also, could you please point me to the correct tutorial for the ME region replacement?

D3513-A1.UPD UEFIToolNE; ME region ‘extract as is’

Your own dump, UEFITool 0.28, ME region ‘replace as is’

Flashing might be done with fpt if your motherboard has a jumper for ME servicing. Be careful, fpt flashes without warnings everything everywhere.

Efiflash seems to be a vendor tool, not clear if it backups up a complete dump and what it flashes. Recommend to try a complete dump with fpt:
fpt(w(64)).exe -d spi.bin

Possible locations for password might be TPM or NVRAM, too.

All this includes the possibility for bricking! So most important thing is a backup of the existing bios.

As you already pointed, an thank you so soo much for all the digging you’ve been doing, the motherboard has some pins, I do not know which are the ones you talk about, I only know that the flash chip(bios I suppose) is on the back side, near the RAM area.

I own a ch341a(the black one) never used it , and it would be a great first use case :smiley:
In my mind the way I could do what you suggest is as follows:

  1. Open the little one up, and read the bios chip from the backside
  2. Using the tool you suggested(UEFIToolNE), and some documentation, extrat and later on replace ME(using UEFITool)
  3. Write the new file back to the bios chip

This is the backup I made using the efiflash tool before updating the bios to the latest one https://we.tl/t-8lyqkf7iWK
Before writing this post, I already tried replacing the ME version using coffetime and flashing it back, the flash succeeded but ME did not change…later on I found out that ME downgrade is not possible without a flasher …lucky me :))

Mainboard D3403-U/D3403-V/D3513, Short description

Coffeetime does fiddle with the ME depending on hardware config and ME version. Is this still the original hardware configuration?

It was the original backup.
In the meantime, I have successfully backed up, modified and write the modded bios(as you instructed)…but i bricked my device, and i dont think it is because of the bios, since i flashed the original one back and it still wont start.

While dissasmeling, i found a dumb mistake, the previous owner screwed the cpu heatsing so hard in the socked that when i unscrewed the cooler it unscrued the back side of the socket plate as well… i removed the cooler and because of the automatism(or just being a idiot) i flipped the mobo(being accostomed to fixed cpus , be it amd or intel) …and dropped the cpu on the floor.
Needles to say i think that i killed the poor i3.
I will postpone doing anything for a week until i get in my hometown where i have one spare 7500t.

Until then , thank you for the help, I really appreciate it a lot, and if the mobo is not dead, i really hope i could get ahold of you if needed.

Many many thanks for your help @lfb6

An i3 dosn’t support vpro. You need vpro capable chipset, cpu, lan/wlan to run vpro.

  • Please read the firmware back with the programmer and attach it just to be sure that the flashing did work well.

  • Please attach the modified file, too.

For the sake of speed and security, I uploaded all the files to my own server, you can also upload if you need.

I know that the i3 dont support vpro, but my 7500t from home does.
The big plan was, buy the q957(it was under 75 euro) , upgrade the ram(already had 16gigs) and the cpu(already have the 7500t) and set it as a secondary node for my proxmox cluster, next to my p330 tiny.

Vpro is extremely important for me as if something goes south, i can control the devices and hard reset them from a distance.

Seems you did some work between first posted backup and this one- bios region and ME updated, NVRAM reset?

  • Did the PC work with bios_backup3.bin ?
    (The ME exchange looks correct)

  • Did you check the contacts in the socket?
    If the cpu fell out a litte askew it might have damaged those little contacts?

Good luck!

  1. Now it did not work
  2. The socket is perfect no issue there, the cpu was dropped by me, so it’s probably gone.
    I will try as said, when i get in my hometown a different cpu to make sure.
    Until then, thank you so so much for your help :slight_smile:

As promised, I am coming back with an update.
So there are great news:

  1. The cpu is fine and dandy, the issue was my cheap ch341a flasher that left the motherboard bios in a borked state
  2. The motherboard is fine as well :smiley: , after the realization that the boardis toast, I wenr full ret*** on the board and tested several flashers and what not only to find the 2 tools solution to my problem
    I needed a tool such a ch341a programmer/as flasher to first wipe/erase the chip(and i had to pick a chip simmilar to mine since the version mine is using was not available) and after that i needed siberia-programmer (this one had the chip model, yet it was unable to erase the chip)to flash the actual content on the chip and then test and cofnirm that what is on the chip is actually matching the flash file.
    Mebx is password free and all is thanks to you :slight_smile: lfb6 the GOAT - Album on Imgur
    I want to make a short guide regarding this device in particular as the web doesn’t really have much about it , also I want to post both the original bios and the doctored one, as there is no free dump online, only some sites that ask for money for the dumps.

Cheers and thank you for the patience and help

1 Like

Well, we did try to check for this possibility?

But good to hear that it works now, CPU isn’t damaged, board isn’t damaged and MEBx isn’t any longer password protected! Congratulations :+1: