HP Elitebook 8560p BIOS chip replacement problem: ME is in recovery state

[bicalov]

Thx for your help.
Unfortunately something went wrong. I flashed your bin.file but I get black screen with the capslock and numlock blinking 5 times, fan full speed and nothing else.
I have to look into that,



Update:
Through the pressure on the testclip, the chip let go from the mobo and I have to fix that first before anything else.
system completely dead.

Update 2:
Thread can be closed. I did not get through to fix the mobo once more. Tried very hard, but my handicap plays up to much.
So now the problem with the ME is no longer an issue, I need to look for a new mobo or get writ of the HP.

Thanks a lot for all the help and patience.

[bicalov]

Hi,
Still fighting to get the laptop working
I have a semi working laptop now. Starts up, you can get in the bios.
Only on VGA I get the picture as in the example. Own display and displayport give black screen.
I can’t read the error message, is there anybody who is familiar with this?
The second picture shows the screen after windows 8.1 has started up completely. It shuts down again after 10 seconds.

Can these problems be caused by the bios ? Or is the gpu also defect ?

[plutomaniac]

The “fixed” file I attached last time only unlocked the descriptor and replaced the ME with a healthy one. Both these are not related to such issues. Why it didn’t work I don’t know, it has no reason to. Unless of course the problem is elsewhere (which it is) like hardware, BIOS corruption and so on. To me that screen looks like a malfunctioning graphics card and if it’s done at the BIOS level then it’s hardware related.

[bicalov]

Thx for your answer.
For your info, the error message is : Warning !! Machine is not in committed state.
This is because the AMT is not defined. There are tools to define that, but than you also lock the descriptor and that one should stay unlocked…

[plutomaniac]

You can provision ME from MEBx (CTRL+P) during bootup. Detailed user guide can be found at the equivalent System Tools package of the ME thread.

If HP again requires some other hoops to provision, then you should watch THIS terrible video and download the relevant files from HERE.

I won’t keep the dumps I found some time ago anymore so I have attached everything below for anyone interested. Remove the .zip extension from all 3 files to extract them.

HP.7z.001.zip (5 MB)

HP.7z.002.zip (5 MB)

HP.7z.003.zip (4.32 MB)

[freeweber]

Hi,
I have a similar problem, like bicalvo, but with an HP EliteBook 8470p (3rd GEN Intel CPU).
I flashed a new BIOS update to my system and now my ME disappeared (seems like the ME part is corrupted).
Could anybody please look into my dump file, unlock the descriptor and replace the ME with a newer one? I will flash it then and hope that it will work again.

EDIT: I fixed the problem by flashing the ME Image :-).
Thanks in advance.

[plutomaniac]

Hello @freeweber ,

Based on your dump I have done the following:

1) Unlocked the Flash Descriptor
2) Updated, Cleaned-up and Configured the ME firmware

8470p_fix_me.rar (5.14 MB)

[freeweber]

Thank you plutomaniac,
When I tried to flash only ME with this Bios (fpt -me -f dumpme.bin) , I get the error: "PDR Region does not exist". Is this a problem from ME or from the BIOS?
I uploaded the complete SPI dump from my machine. Could you maybe do the same with this SPI Dump (remove FD, update ME, clean it and configure). That would be great!
Thanks for your help.
EDIT:
will try to flash you uploaded image first
EDIT2:
I flashed the image. After the first boot I got the message "Not in Committed State". With the NbDmiFit-2.0F it was then possible to commit it.
Now everything is working yeah (ME active and vPro deactivated).

Thanks plutomaniac!!!

[danielfon]

hello sir! i have hp probook 6470b, but i’m have the same problem: “PDR Region does not exist”.

and using “fpt -d bios.bin”, my problem is: “the host cpu does not have write access to the target flash area”. Have solution?

[lfb6]

@danielfon

problem: “PDR Region does not exist”.

Not problem but information

@danielfon

and using “fpt -d bios.bin”, my problem is: “the host cpu does not have write access to the target flash area”

Instead of posting and deleting the same post 3 times you might’ve as well tried the search function of this forum:

[Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing

Guide-How To: Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing Last Updated: 2018-03-20 This guide is relevant to those who need to understand what the Intel Flash Descriptor is, how its SPI Region Read/Write Access Permissions work, how to check its Locked/Unlocked status and what methods are available to unlock it for system firmware repair and/or updating. In this guide, the term "system" means an individual user machine whereas "model" refers to all those "syste…

[danielfon]

Hello, thank you. I read the guide, tried to redo some steps, but I don’t think I succeeded… All of this is new to me; I’ve never come across it before. All I wanted to do was overclock my HP ProBook 6470b. Can these attached files help me with anything? Where should I go from here? It seems like I don’t have a corrupted “ME,” but rather it’s locked for writing, is that correct?

dump.zip (2.8 MB)

[danielfon]

Perhaps this can also help me. During startup, I can access something with the “F6” key, which mentions Intel ME and has a function called “FW update” enabled/disabled. Can this help me in any way?

[lfb6]

@danielfon

You’re happy that that didn’t work! Can’t see the command you used (seems you tried to overwrite ME region with a bios region?) but this would a 100% have bricked your machine!

WHEN USING FPT DON’T IGNORE SIZE WARNINGS!

This thread is about a corrupt ME of a HP Elitebook 8560p, not about a HP Probook 6470b and not about circumventing flash protection of the bios region.

I’d recommend reading about bios structure, bios regions (HP doesn’t offer a complete firmware with its bios updates!!) and searching the forum about circumventing flash protection.

Anyway- it’s good that you at least dumped your bios region!

Just in case:

[Guide] Using CH341A-based programmer to flash SPI EEPROM

There are many different SPI programmers on the market right now and almost any microcontroller-based board can be used as one, but this time I will speak about one of the cheapest programmers to date - CH341A-based. They are sold from various chinese suppliers for about 4 euro and are capable of flashing with both SPI and I2C chips, working as USB-TTL adapter and USB-I2C bridge. In this guide I will only cover the SPI part of functionality because this is what you need to flash modified or res…

(And since HP doesn’t provide a complete firmware image- you’ll need the first ~11 MB of your firmware from your own chip in case of a brick in addition to the bios region you already dumped. If you overwrite these regions without having backed up them before- just as you tried- you’re quite dead in the water)

[danielfon]

Thank you for the warning, I didn’t think I could damage it by doing that. Unfortunately, there is not much information available about the HP ProBook 6470b. I found that it would be possible to unlock it using the shortcuts: "win + < + > "during startup, but on my laptop, it simply shuts down quickly, so it doesn’t work. Since I don’t have any knowledge, I don’t know what to look for or where to start. I just wanted to unlock the BIOS to be able to overclock it.

[lfb6]

Sorry, no knowledge regarding overclocking.

Maybe you want to put it into the bios modding requests subforum.

(I assume you already use a 2.5" SSD and at least an ivy bridge i5 processor?!)

[danielfon]

@lfb6

e ME region

Yes, it’s an i7-3720QM and ssd… How do I dump my BIOS before opening a thread? I followed other tutorials that brought me here; apparently, I need to have read/write permission in the ME region?

[lfb6]

Modding normally just covers the bios region, there are some clock settings in ME and some PCH registers are configured while ME configuration is done but stored in FD. You need the other regions just in case of a brick.

Try to dump the regions each for itself
ftp(W(64) -bios -d biosreg.bin
ftp(W(64) -DESC -d DESC.bin
ftp(W(64) -GbE -d GbE.bin
ftp(W(64) -ME -d ME.bin (That’s possibly the one that doesn’t work)

[danielfon]

Returned this, the only one that didn’t work was the last one. I will create a new topic with these dumps. Thank you. LOGS:

PS C:\Users\Daniel\Downloads\Remove_IntelME_FPT-master\Intel_ME_System_Tools\Flash Programming Tool\WIN64> .\FPTW64.exe -bios -d biosreg.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

• Reading Flash [0x1000000] 5120KB of 5120KB - 100% complete.
  Writing flash contents to file “biosreg.bin”…

Memory Dump Complete
FPT Operation Passed
PS C:\Users\Daniel\Downloads\Remove_IntelME_FPT-master\Intel_ME_System_Tools\Flash Programming Tool\WIN64> .\FPTW64.exe -DESC -d DESC.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

• Reading Flash [0x001000] 4KB of 4KB - 100% complete.
  Writing flash contents to file “DESC.bin”…

Memory Dump Complete
FPT Operation Passed
PS C:\Users\Daniel\Downloads\Remove_IntelME_FPT-master\Intel_ME_System_Tools\Flash Programming Tool\WIN64> .\FPTW64.exe -GbE -d GbE.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

• Reading Flash [0x003000] 8KB of 8KB - 100% complete.
  Writing flash contents to file “GbE.bin”…

Memory Dump Complete
FPT Operation Passed
PS C:\Users\Daniel\Downloads\Remove_IntelME_FPT-master\Intel_ME_System_Tools\Flash Programming Tool\WIN64> .\FPTW64.exe -ME -d ME.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

Error 26: The host CPU does not have read access to the target flash area. To enable read access for this operation you must modify the descriptor settings to give host access to this region.

[lfb6]

OK, that’s as expected.

Access rights for the regions are defined in the FD. But for the bios region it might as well be protected range registers. Try fptw64 -i to get the status for region access rights.

In case you some day have to or want to use a programmer: Note that fpt gave you a chip type already.

One way to find if the bios region can be written to by fpt ist to dump it and try to write it back instantly. Some caveats here, too:
A power loss during reflashing (if allowed) will possibly brick the machine
Windows writes often variables into an area in the bios region (NVRAM), so I recommend to do this from a dos usb boot stick, but if I remember correctly there are lots of people who did this from windows

FPTW64.exe -bios -d biosregtest.bin
FPTW64.exe -bios -f biosregtest.bin

Register the output, will probably not be error 26.

Good luck!

[danielfon]

C:\Users\daniel\Downloads\Intel ME System Tools v9.1 r7\Flash Programming Tool\WIN64>fptw64 -i

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

--- Flash Image Information --
Signature: VALID
Number of Flash Components: 1
    Component 1 - 16384KB (131072Kb)
Regions:
    Descriptor - Base: 0x000000, Limit: 0x000FFF
    BIOS       - Base: 0xB00000, Limit: 0xFFFFFF
    ME         - Base: 0x003000, Limit: 0xAFFFFF
    GbE        - Base: 0x001000, Limit: 0x002FFF
    PDR        - Not present
Master Region Access:
    CPU/BIOS - ID: 0x0000, Read: 0x0B, Write: 0x0A
    ME       - ID: 0x0000, Read: 0x0D, Write: 0x0C
    GbE      - ID: 0x0118, Read: 0x08, Write: 0x08

Total Accessable SPI Memory: 16384KB, Total Installed SPI Memory : 16384KB

FPT Operation Passed

C:\Users\daniel\Downloads\Intel ME System Tools v9.1 r7\Flash Programming Tool\WIN64>FPTW64.exe -bios -d biosregtest.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

• Reading Flash [0x1000000] 5120KB of 5120KB - 100% complete.
  Writing flash contents to file “biosregtest.bin”…

Memory Dump Complete
FPT Operation Passed

C:\Users\daniel\Downloads\Intel ME System Tools v9.1 r7\Flash Programming Tool\WIN64>FPTW64.exe -bios -f biosregtest.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

Error 280: Failed to disable write protection for the BIOS space!