HP Elitebook 8560p BIOS chip replacement problem: ME is in recovery state

[freeweber]

Thank you plutomaniac,
When I tried to flash only ME with this Bios (fpt -me -f dumpme.bin) , I get the error: "PDR Region does not exist". Is this a problem from ME or from the BIOS?
I uploaded the complete SPI dump from my machine. Could you maybe do the same with this SPI Dump (remove FD, update ME, clean it and configure). That would be great!
Thanks for your help.
EDIT:
will try to flash you uploaded image first
EDIT2:
I flashed the image. After the first boot I got the message "Not in Committed State". With the NbDmiFit-2.0F it was then possible to commit it.
Now everything is working yeah (ME active and vPro deactivated).

Thanks plutomaniac!!!

[danielfon]

hello sir! i have hp probook 6470b, but i’m have the same problem: “PDR Region does not exist”.

and using “fpt -d bios.bin”, my problem is: “the host cpu does not have write access to the target flash area”. Have solution?

[lfb6]

@danielfon

problem: “PDR Region does not exist”.

Not problem but information

@danielfon

and using “fpt -d bios.bin”, my problem is: “the host cpu does not have write access to the target flash area”

Instead of posting and deleting the same post 3 times you might’ve as well tried the search function of this forum:

[Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing

Guide-How To: Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing Last Updated: 2018-03-20 This guide is relevant to those who need to understand what the Intel Flash Descriptor is, how its SPI Region Read/Write Access Permissions work, how to check its Locked/Unlocked status and what methods are available to unlock it for system firmware repair and/or updating. In this guide, the term "system" means an individual user machine whereas "model" refers to all those "syste…

[danielfon]

Hello, thank you. I read the guide, tried to redo some steps, but I don’t think I succeeded… All of this is new to me; I’ve never come across it before. All I wanted to do was overclock my HP ProBook 6470b. Can these attached files help me with anything? Where should I go from here? It seems like I don’t have a corrupted “ME,” but rather it’s locked for writing, is that correct?

dump.zip (2.8 MB)

[danielfon]

Perhaps this can also help me. During startup, I can access something with the “F6” key, which mentions Intel ME and has a function called “FW update” enabled/disabled. Can this help me in any way?

[lfb6]

@danielfon

You’re happy that that didn’t work! Can’t see the command you used (seems you tried to overwrite ME region with a bios region?) but this would a 100% have bricked your machine!

WHEN USING FPT DON’T IGNORE SIZE WARNINGS!

This thread is about a corrupt ME of a HP Elitebook 8560p, not about a HP Probook 6470b and not about circumventing flash protection of the bios region.

I’d recommend reading about bios structure, bios regions (HP doesn’t offer a complete firmware with its bios updates!!) and searching the forum about circumventing flash protection.

Anyway- it’s good that you at least dumped your bios region!

Just in case:

[Guide] Using CH341A-based programmer to flash SPI EEPROM

There are many different SPI programmers on the market right now and almost any microcontroller-based board can be used as one, but this time I will speak about one of the cheapest programmers to date - CH341A-based. They are sold from various chinese suppliers for about 4 euro and are capable of flashing with both SPI and I2C chips, working as USB-TTL adapter and USB-I2C bridge. In this guide I will only cover the SPI part of functionality because this is what you need to flash modified or res…

(And since HP doesn’t provide a complete firmware image- you’ll need the first ~11 MB of your firmware from your own chip in case of a brick in addition to the bios region you already dumped. If you overwrite these regions without having backed up them before- just as you tried- you’re quite dead in the water)

[danielfon]

Thank you for the warning, I didn’t think I could damage it by doing that. Unfortunately, there is not much information available about the HP ProBook 6470b. I found that it would be possible to unlock it using the shortcuts: "win + < + > "during startup, but on my laptop, it simply shuts down quickly, so it doesn’t work. Since I don’t have any knowledge, I don’t know what to look for or where to start. I just wanted to unlock the BIOS to be able to overclock it.

[lfb6]

Sorry, no knowledge regarding overclocking.

Maybe you want to put it into the bios modding requests subforum.

(I assume you already use a 2.5" SSD and at least an ivy bridge i5 processor?!)

[danielfon]

@lfb6

e ME region

Yes, it’s an i7-3720QM and ssd… How do I dump my BIOS before opening a thread? I followed other tutorials that brought me here; apparently, I need to have read/write permission in the ME region?

[lfb6]

Modding normally just covers the bios region, there are some clock settings in ME and some PCH registers are configured while ME configuration is done but stored in FD. You need the other regions just in case of a brick.

Try to dump the regions each for itself
ftp(W(64) -bios -d biosreg.bin
ftp(W(64) -DESC -d DESC.bin
ftp(W(64) -GbE -d GbE.bin
ftp(W(64) -ME -d ME.bin (That’s possibly the one that doesn’t work)

[danielfon]

Returned this, the only one that didn’t work was the last one. I will create a new topic with these dumps. Thank you. LOGS:

PS C:\Users\Daniel\Downloads\Remove_IntelME_FPT-master\Intel_ME_System_Tools\Flash Programming Tool\WIN64> .\FPTW64.exe -bios -d biosreg.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

• Reading Flash [0x1000000] 5120KB of 5120KB - 100% complete.
  Writing flash contents to file “biosreg.bin”…

Memory Dump Complete
FPT Operation Passed
PS C:\Users\Daniel\Downloads\Remove_IntelME_FPT-master\Intel_ME_System_Tools\Flash Programming Tool\WIN64> .\FPTW64.exe -DESC -d DESC.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

• Reading Flash [0x001000] 4KB of 4KB - 100% complete.
  Writing flash contents to file “DESC.bin”…

Memory Dump Complete
FPT Operation Passed
PS C:\Users\Daniel\Downloads\Remove_IntelME_FPT-master\Intel_ME_System_Tools\Flash Programming Tool\WIN64> .\FPTW64.exe -GbE -d GbE.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

• Reading Flash [0x003000] 8KB of 8KB - 100% complete.
  Writing flash contents to file “GbE.bin”…

Memory Dump Complete
FPT Operation Passed
PS C:\Users\Daniel\Downloads\Remove_IntelME_FPT-master\Intel_ME_System_Tools\Flash Programming Tool\WIN64> .\FPTW64.exe -ME -d ME.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

Error 26: The host CPU does not have read access to the target flash area. To enable read access for this operation you must modify the descriptor settings to give host access to this region.

[lfb6]

OK, that’s as expected.

Access rights for the regions are defined in the FD. But for the bios region it might as well be protected range registers. Try fptw64 -i to get the status for region access rights.

In case you some day have to or want to use a programmer: Note that fpt gave you a chip type already.

One way to find if the bios region can be written to by fpt ist to dump it and try to write it back instantly. Some caveats here, too:
A power loss during reflashing (if allowed) will possibly brick the machine
Windows writes often variables into an area in the bios region (NVRAM), so I recommend to do this from a dos usb boot stick, but if I remember correctly there are lots of people who did this from windows

FPTW64.exe -bios -d biosregtest.bin
FPTW64.exe -bios -f biosregtest.bin

Register the output, will probably not be error 26.

Good luck!

[danielfon]

C:\Users\daniel\Downloads\Intel ME System Tools v9.1 r7\Flash Programming Tool\WIN64>fptw64 -i

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

--- Flash Image Information --
Signature: VALID
Number of Flash Components: 1
    Component 1 - 16384KB (131072Kb)
Regions:
    Descriptor - Base: 0x000000, Limit: 0x000FFF
    BIOS       - Base: 0xB00000, Limit: 0xFFFFFF
    ME         - Base: 0x003000, Limit: 0xAFFFFF
    GbE        - Base: 0x001000, Limit: 0x002FFF
    PDR        - Not present
Master Region Access:
    CPU/BIOS - ID: 0x0000, Read: 0x0B, Write: 0x0A
    ME       - ID: 0x0000, Read: 0x0D, Write: 0x0C
    GbE      - ID: 0x0118, Read: 0x08, Write: 0x08

Total Accessable SPI Memory: 16384KB, Total Installed SPI Memory : 16384KB

FPT Operation Passed

C:\Users\daniel\Downloads\Intel ME System Tools v9.1 r7\Flash Programming Tool\WIN64>FPTW64.exe -bios -d biosregtest.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

• Reading Flash [0x1000000] 5120KB of 5120KB - 100% complete.
  Writing flash contents to file “biosregtest.bin”…

Memory Dump Complete
FPT Operation Passed

C:\Users\daniel\Downloads\Intel ME System Tools v9.1 r7\Flash Programming Tool\WIN64>FPTW64.exe -bios -f biosregtest.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) QM77 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L12805D    ID:0xC22018    Size: 16384KB (131072Kb)

Error 280: Failed to disable write protection for the BIOS space!