Hi All
What a cool en technical forum is this, even as guest you can use it very well. I have tried to solve my issue but I did not succeed
that’s why I am posting this help request. I just did see the clean guide, have to focus on that one yet.
The probleem is that I get on boot up ME STATE RECOVERY , laptop works fine but ME does not.
http://support.hp.com/ie-en/document/c04488064
But I can not succeed in a succesfull flash
Some steps I have done and info:
The laptop is a Hp Probook 650 G1 (1234567#abc maybe sample pc?)
BIOS:
org bios 93.10 7-25-2013
to 1.20 7-17-2014
to 1.39 Rev.A (5 Oct 2016) no downgrade possible
(http://h20565.www2.hp.com/hpsc/swd/publi…059#tab-history)
Current ME version ?
9.0.20.1387 H
As download on the hp site
9.0.22.1467 4 Oct 2013
http://h20564.www2.hp.com/hpsc/swd/publi…nvOid=4158#tab1
I get a file error
fwupdlcl.exe -F me.bin* (9.1.32.1002) *Found on the forum only one that does start, 1.5 mb
(update tool version 9.0.22.1467)
FW Update: [ 21% (stage: 4 of 19) (-)]
Processing . . . Do not Interrupt
Error 8741: FW Update failed
Error 8707: firmware update failed due to an internal error
backup seems not be possible
fwupdlcl -SAVE backup.bin
Error 8753: Restore Point Image Failure
this look cool but a bit dificult https://www.bios-mods.com/forum/Thread-U…=52669#pid52669
any help would be very welcome
thanks in advance
the former corrupt flash did break some.
but after a bios update again it does respond again.
meanwhile I did read a other thread here and did some command to it.
here are some results
Intel(R) MEInfo Version: 9.0.22.1467
Copyright(C) 2005 - 2013, Intel Corporation. All rights reserved.
Intel(R) Manageability and Security Application code versions:
BIOS Version: L78 Ver. 01.39
MEBx Version: 0.0.0.0000
Gbe Version: 1.2
VendorID: 8086
PCH Version: 4
FW Version: 9.0.20.1387 H
LMS Version: 9.5.10.1628
MEI Driver Version: 9.5.24.1790
Wireless Hardware Version: 0.0.70
Wireless Driver Version: 15.0.0.75
FW Capabilities: 0x0DF65965
Intel(R) Active Management Technology - PRESENT/ENABLED
Intel(R) Anti-Theft Technology - PRESENT/ENABLED
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Intel(R) AMT State: Enabled
TLS: Enabled
Last ME reset reason: Firmware reset
Local FWUpdate: Enabled
BIOS Config Lock: Enabled
GbE Config Lock: Enabled
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: EF4018
SPI Flash ID VSCC #1: 20252025
SPI Flash BIOS VSCC: 2025
BIOS boot State: Pre Boot
OEM Id: 00000000-0000-0000-0000-000000000000
Error 8199: Communication error between application and Intel(R) ME (Get Intel(R
) AMT State)
Error 8199: Communication error between application and Intel(R) ME (Get System
UUID)
Error 8199: Communication error between application and Intel(R) ME (Get Ipv4 In
fo)
Error 8199: Communication error between application and Intel(R) ME (Get Ipv4 In
fo)
Error 8199: Communication error between application and Intel(R) ME (Get Ipv6 In
fo)
Error 8199: Communication error between application and Intel(R) ME (Get Privacy
/Security Level Info)
Error 8199: Communication error between application and Intel(R) ME (Get Provisi
oning State)
Error 8199: Communication error between application and Intel(R) ME (Get Provisi
oning Mode)
Capability Licensing Service: Enabled
OEM Tag: 0x00000000
Slot 1 Board Manufacturer: 0x0000203D
Slot 2 System Assembler: Unused
Slot 3 Reserved: Unused
M3 Autotest: Enabled
C-link Status: Enabled
Wireless Micro-code Mismatch: No
Wireless Micro-code ID in Firmware: 0x088E
Wireless LAN in Firmware: Intel(R) Centrino(R) Ultimate-N 6235
Wireless Hardware ID: 0x088E
Wireless LAN Hardware: Intel(R) Centrino(R) Ultimate-N 6235
Localized Language: Dutch
Independent Firmware Recovery: Disabled
C:\Intel ME System Tools v9.0 r1\Intel ME System Tools v9.0 r1\MEInfo\Windows64>
C:\Intel ME System Tools v9.0 r1\Intel ME System Tools v9.0 r1\MEManuf\Windows64
>MEManufWin64.exe
Intel(R) MEManuf Version: 9.0.22.1467
Copyright(C) 2005 - 2013, Intel Corporation. All rights reserved.
MEManuf Test Passed
C:\Intel ME System Tools v9.0 r1\Intel ME System Tools v9.0 r1\MEManuf\Windows64
C:\Swsetup\SP63762me>FWUpdLcl.exe -f ME9.0_1.5M_Production.BIN
Intel (R) Firmware Update Utility Version: 9.0.22.1467
Copyright (C) 2007 - 2013, Intel Corporation. All rights reserved.
Communication Mode: MEI
Checking firmware parameters…
Warning: Do not exit the process or power off the machine before the firmware up
date process ends.
Error 8771: Invalid File
C:\Swsetup\SP63762me>FWUpdLcl.exe -save dump.bin
Intel (R) Firmware Update Utility Version: 9.0.22.1467
Copyright (C) 2007 - 2013, Intel Corporation. All rights reserved.
Error 8753: Restore Point Image Failure
STATUS: restore point operation failed.
C:\Swsetup\SP63762me>
C:\Intel ME System Tools v9.0 r1\Intel ME System Tools v9.0 r1\Flash Programm
Tool\WINDOWS>fptw.exe -i
Intel (R) Flash Programming Tool. Version: 9.0.22.1467
Copyright (c) 2007 - 2013, Intel Corporation. All rights reserved.
Platform: Intel(R) QM87 Express Chipset
Reading HSFSTS register… Flash Descriptor: Valid
— Flash Devices Found —
W25Q128BV ID:0xEF4018 Size: 16384KB (131072Kb)
— Flash Image Information –
Signature: VALID
Number of Flash Components: 1
Component 1 - 16384KB (131072Kb)
Regions:
Descriptor - Base: 0x000000, Limit: 0x000FFF
BIOS - Base: 0x800000, Limit: 0xFFFFFF
ME - Base: 0x003000, Limit: 0x7FFFFF
GbE - Base: 0x001000, Limit: 0x002FFF
PDR - Not present
Master Region Access:
CPU/BIOS - ID: 0x0000, Read: 0x0B, Write: 0x0A
ME - ID: 0x0000, Read: 0x0D, Write: 0x0C
GbE - ID: 0x0118, Read: 0x08, Write: 0x08
Based on the Host Region FRACC the Host/CPU/BIOS has ( 0x00004A4B ) :
Read Write
Desc : Yes No
Host : Yes Yes
ME : No No
GbE : Yes Yes
PDR : No No
Total Accessable SPI Memory: 16384KB, Total Installed SPI Memory : 16384KB
FPT Operation Passed
I also did a fptw -greset and rebooted, last some info 
after that this is diffrent:
Last ME reset reason: Global system reset
but still no crtp+p / F6 (it hangs then) and still in recovery state and also status fw recovery or something like that, after bios post
a verbose result.
Should I do some commands in pure dos ? Please advice
I have also made a bios dump with ftk9
Intel(R) MEInfo Version: 9.0.22.1467
Copyright(C) 2005 - 2013, Intel Corporation. All rights reserved.
FW Status Register1: 0x1E000242
FW Status Register2: 0x6800230E
FW Status Register3: 0x00000300
FW Status Register4: 0x00000000
FW Status Register5: 0x00000000
FW Status Register6: 0x00000000
CurrentState: Recovery
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: M0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
Phase: HOSTCOMM Module
ICC: Valid OEM data, ICC programmed
ME File System Corrupted: No
Get ME FWU version command…done
Windows OS Version : 6.1.7601 "Service Pack 1"
OS BIOS Support : Legacy
Table Type 0 ( 0x 00 ) found, size of 24 (0x 18 ) bytes
Windows OS Version : 6.1.7601 "Service Pack 1"
OS BIOS Support : Legacy
Table Type 0 ( 0x 00 ) found, size of 24 (0x 18 ) bytes
Table Type 1 ( 0x 01 ) found, size of 27 (0x 1B ) bytes
Table Type 2 ( 0x 02 ) found, size of 16 (0x 10 ) bytes
Table Type 3 ( 0x 03 ) found, size of 17 (0x 11 ) bytes
Table Type 4 ( 0x 04 ) found, size of 42 (0x 2A ) bytes
Table Type 7 ( 0x 07 ) found, size of 19 (0x 13 ) bytes
Table Type 7 ( 0x 07 ) found, size of 19 (0x 13 ) bytes
Table Type 7 ( 0x 07 ) found, size of 19 (0x 13 ) bytes
Table Type 7 ( 0x 07 ) found, size of 19 (0x 13 ) bytes
Table Type 8 ( 0x 08 ) found, size of 9 (0x 09 ) bytes
Table Type 8 ( 0x 08 ) found, size of 9 (0x 09 ) bytes
Table Type 8 ( 0x 08 ) found, size of 9 (0x 09 ) bytes
Table Type 8 ( 0x 08 ) found, size of 9 (0x 09 ) bytes
Table Type 8 ( 0x 08 ) found, size of 9 (0x 09 ) bytes
Table Type 8 ( 0x 08 ) found, size of 9 (0x 09 ) bytes
Table Type 9 ( 0x 09 ) found, size of 13 (0x 0D ) bytes
Table Type 10 ( 0x 0A ) found, size of 6 (0x 06 ) bytes
Table Type 11 ( 0x 0B ) found, size of 5 (0x 05 ) bytes
Table Type 13 ( 0x 0D ) found, size of 22 (0x 16 ) bytes
Table Type 16 ( 0x 10 ) found, size of 23 (0x 17 ) bytes
Table Type 17 ( 0x 11 ) found, size of 34 (0x 22 ) bytes
Table Type 17 ( 0x 11 ) found, size of 34 (0x 22 ) bytes
Table Type 19 ( 0x 13 ) found, size of 31 (0x 1F ) bytes
Table Type 20 ( 0x 14 ) found, size of 35 (0x 23 ) bytes
Table Type 22 ( 0x 16 ) found, size of 26 (0x 1A ) bytes
Table Type 32 ( 0x 20 ) found, size of 20 (0x 14 ) bytes
Table Type 41 ( 0x 29 ) found, size of 11 (0x 0B ) bytes
Table Type 41 ( 0x 29 ) found, size of 11 (0x 0B ) bytes
Table Type 130 ( 0x 82 ) found, size of 20 (0x 14 ) bytes
Table Type 131 ( 0x 83 ) found, size of 64 (0x 40 ) bytes
MEBx Version found is 0.0.0.0000
Get ME FWU info command…done
Get ME FWU version command…done
Get ME FWU feature state command…done
Get ME FWU platform type command…done
Get ME FWU feature capability command…done
Get ME FWU OEM Id command…done
FW Capabilities value is 0xDF65965
Feature enablement is 0xDF65965
Platform type is 0x42131401
Intel(R) Manageability and Security Application code versions:
BIOS Version: L78 Ver. 01.39
MEBx Version: 0.0.0.0000
Gbe Version: 1.2
VendorID: 8086
PCH Version: 4
FW Version: 9.0.20.1387 H
LMS Version: 9.5.10.1628
MEI Driver Version: 11.6.0.1032
Wireless Hardware Version: 0.0.70
Wireless Driver Version: 15.0.0.75
FW Capabilities: 0x0DF65965
Intel(R) Active Management Technology - PRESENT/ENABLED
Intel(R) Standard Manageability - NOT PRESENT
Intel(R) Anti-Theft Technology - PRESENT/ENABLED
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Service Advertisement & Discovery - NOT PRESENT
Intel(R) NFC Capabilities - NOT PRESENT
Intel(R) Platform Trust Technology - NOT PRESENT
Intel(R) AMT State: Enabled
TLS: Enabled
Last ME reset reason: Power up
Local FWUpdate: Enabled
Get BIOS flash lockdown status…done
BIOS Config Lock: Enabled
Get GbE flash lockdown status…done
GbE Config Lock: Enabled
Get flash master region access status…done
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: EF4018
SPI Flash ID VSCC #1: 20252025
SPI Flash BIOS VSCC: 2025
Protected Range Register Base #0 0xF0A
Protected Range Register Limit #0 0xFFF
Protected Range Register Base #1 0x0
Protected Range Register Limit #1 0x0
Protected Range Register Base #2 0x0
Protected Range Register Limit #2 0x0
Protected Range Register Base #3 0x0
Protected Range Register Limit #3 0x0
Protected Range Register Base #4 0x0
Protected Range Register Limit #4 0x0
BIOS boot State: Pre Boot
OEM Id: 00000000-0000-0000-0000-000000000000
Get Intel(R) AMT state command…
Error 8199: Communication error between application and Intel(R) ME (Get Intel(R) AMT State)
Get system UUID command…
Error 8199: Communication error between application and Intel(R) ME (Get System UUID)
Get LanInterfaceSettings command for wired interface…
Error 8199: Communication error between application and Intel(R) ME (Get Ipv4 Info)
Get LanInterfaceSettings command for wireless interface…
Error 8199: Communication error between application and Intel(R) ME (Get Ipv4 Info)
Get IPv6InterfaceStatus command for wired interface…
Error 8199: Communication error between application and Intel(R) ME (Get Ipv6 Info)
Get privacy/security level info command…
Error 8199: Communication error between application and Intel(R) ME (Get Privacy/Security Level Info)
Get provisioning state command…
Error 8199: Communication error between application and Intel(R) ME (Get Provisioning State)
Get Provisioning Tls Mode command…
Error 8199: Communication error between application and Intel(R) ME (Get Provisioning Mode)
Capability Licensing Service: Enabled
Get ME FWU OEM Tag command…done
OEM Tag: 0x00000000
Get System Inegetrator ID command…done
Slot 1 Board Manufacturer: 0x0000203D
Get System Inegetrator ID command…This slot is unused.
Slot 2 System Assembler: Unused
Get System Inegetrator ID command…This slot is unused.
Slot 3 Reserved: Unused
Get M3 Autotest command…done
M3 Autotest: Enabled
Get CLink Status command…done
C-link Status: Enabled
Get ME FWU Platform Attribute (WLAN ucode) command…done
Wireless Micro-code Mismatch: No
Wireless Micro-code ID in Firmware: 0x088E
Wireless LAN in Firmware: Intel(R) Centrino(R) Ultimate-N 6235
Wireless Hardware ID: 0x088E
Wireless LAN Hardware: Intel(R) Centrino(R) Ultimate-N 6235
Get ME FWU Platform Attribute (WLAN ucode) command…done
Localized Language: Dutch
Get ME FWU Info command…done
Independent Firmware Recovery: Disabled
Your system uses 5MB firmware, not 1.5MB. If problem persists you will have to unlock the Flash Descriptor (1,2,3), dump the SPI image with “fptw -d spi.bin”, follow the ME cleanup guide and flash back with “fptw -f spi.bin” followed by “fptw -greset” command. Everything beyond that is HP/BIOS specific.
ah ok that helps, I succesfully flashed to 9.0.22.1467 H now after reboot caps lock and numlock keep flickering for 3 times a while, after a while I turned off the latop, me recovery status message returns but laptop boots fine.
before I did the 5 mb file I played also with the bios battery, when removed you can press F6 and you see it in screen but noting happens, sometimes it even hangs on it.
can it also be that it has something to do with serial number and or product id ? or with youre expiernce only the onlock methode will work ?
edit
after bios reaset there is no me state recovery message.
still lock for making dump
but meinfo shows a version
BIOS Version: L78 Ver. 01.39
>>MEBx Version: 9.0.0.0025<<<
Gbe Version: 1.2
VendorID: 8086
PCH Version: 4
FW Version: 9.0.22.1467 H
LMS Version: 9.5.10.1628
MEI Driver Version: 11.6.0.1032
Wireless Hardware Version: 0.0.70
Wireless Driver Version: 15.0.0.75
but after reboot all the same again.
press f6 will hang the system totaly.
I really really like to get this anbale to do remote power up and so on.
mean while I will read 1 2 3 you provide me.
thx
use DOS to do bios and firmware updates … as you prove ,once again , that windows corrupts data .
if you have no choice than windows : do the update [or not] when pc is very cold : like after it was off during night [ same good advice with dos either ]
like this page says : http://www.bootdisk.com/ Driver Free Disk For BIOS Flashing…
that means disk of win98 or me dos with only : io.sys [msdos.sys] command.com and himem.sys
good luck repairing
ok thanks for the tips
1 I will check if I also can find the audio chip to unlock it and dumpe the file, maybe I get help later with the cleanup
2 the windows key + left right does not help, it will not go on with that combination
3 yes could be, there are no numbers on the laptop itself …
Jeroen
According to past HP+5MB experience, it very much has to do with system provisioning with the proper numbers etc. In your case you haven’t changed the motherboard or something hardware related so hopefully a reflash of a cleaned+configured ME region will be enough for the BIOS to stop throwing the ME in recovery state. When it comes to HP systems with 5MB firmware it’s almost always the BIOS being weird, something which can be seen in your case as well when the error went away after a BIOS reset only to reappear at the next reboot. So what I suggest is to have the latest BIOS applied first, then dump-clean-configure-reflash the ME (via audio chip as your FD is locked, you can also update it at the same time by using the latest ME 5MB firmware as the clean base at the cleanup guide instead of the suggested same-version), do a "fptw -greset" and also a BIOS reset. If these steps don’t work you are at the same boat as other users with such a problem (1,2 etc), but in your case I think/hope it can be solved by the aforementioned steps.
today I get my hands on NbDmiFit_207 and can run the wndmifit.exe /64 in windows and in the windows PE. it complains about also a lock : please escalate with uuid to get smc blob to unlock mpm
but is does opens and all values are filled in except that the SKU is totally wrong 123456#abc but does recognise my laptop model.
edit: ct code does have 13 char and should be 14 accoording the tool
edit: some times I do see the the sol amt com3 port appear, but could not start, as it came it is also gone again …
ok I will work on youre suggestion and try some to flash in dos after I also flashed the bios
thanks
I am unable to modify data with NbDmiFit_207 on dos or efi. keeps give lock error and on the ME part. tired all brand11 12 etc. greset does work but does not solve, flash bios, pressed windows key + up /down and left right combinations. with up down the laptop respons a bit diffrent but does not unlock any.
flash in dos gives memory allaction error, so I gues my last chance is doning the pin mod to save the me.bin and so hopefully with some help the clean up, maybe then I could start using the the AMT feature.
merry christmas every one !
Jeroen
ok, there I was hoping to fix this without opening the laptop I tried some things but it did not help.
I figured out that windows + up down does do some when you have ALSO the SMC.bin file on usb stick or on the d drive, offcource in my case it give a SMC failure messages in some bios screen and does not realeae anything.
my hope was to change the sku and maybe the recovery is gone but that seems not be possible to do for me, maybe I have to sent HP a email with the correct SMC file. but on the other hand I also read in the HP docs of nbdmifit_2.10 ( http://lakost08.no-ip.org/Temp/TEMP/ ) that the ME state cannot be changed:
" Intel ME is Locked If the Intel ME (Management Engine) is locked, you must replace the system board with a new board. A locked ME cannot be fixed in the field or by escalation."
So knowing that my sku is wrong and mabye the CT also do I still have a change to get ME working if I unlock the discriptor by the pin mod and the clean up ?
or does the pin mod also unlocks the mpm
thanks for reading.
jeroen
These “SMC” and “MPM” stuff are HP specific so a) I don’t know what they do and b) they are not related to the pinmod most probably. You have the correct ME SKU (5MB), the problem is either that the ME is dirty (pinmod + cleanup guide) or that the BIOS/HP-specific-methods have detected a motherboard change and need HP provisioning using that DMI tool you mentioned. Unless by SKU you meant the HP DMI’s equivalent option. Generally that package seems to contain all the needed docs to fully understand these protections and fix the problem. That “ME lock” means “Flash Descriptor lock” as seen at the picture right next to it. Changing the motherboard is kind of stupid though, according to what the docs instruct, when the pinmod exists. Personally I would first rule out the ME itself by unlocking the FD with the pinmod (the other HP stuff should not matter), reflashing its firmware (cleanup guide + latest 5MB firmware) and then by performing a “fptw -greset”. If the problem persists then you must have changed the motherboard which will require both ME cleanup+reflash and also adjusting HP DMI settings with the tool you mentioned and linked to.
ok thanks
today I spoke 45min to hp for this issue but because of the wrong serial and ct they can’t generate a file for me and so an, so last chance is the pin mod. This laptop has the most screws I ever have seen 
. I also bought a electic schema of this laptop just in case.
in the schema I found U501 it seems also be pin 1 and 5, is that correct ?
jeroen
Since there have been another three cases this past week regarding HP problems, I’m confused: have you actually changed the motherboard? Because if you haven’t and the problem occurred out of the blue, then it cannot be that the BIOS is not HP provisioned with serial numbers, tags etc. Unless you performed some BIOS update which for some reason accidentally replaced those with empty/default entries? It shouldn’t happen but who knows. Regardless, it’s a shame that they cannot generate a file for you to use with the DMI tool. I was expecting them to not even be willing to help as these tools are supposedly used only at the factory or by field technicians. As for the audio chip, I see that you have an IDT 92HD91 so you could have also seen its pinout from the official datasheet. The needed pins are indeed 1 and 5 in your case. Hopefully you will be able to short them as they tend to be very small nowadays. If you succeed, remember that the pinmod is temporary until the next reboot or shutdown. However, once you do it once, you can disable the FD lock for good while you try to fix this problem. Once you are done, you can easily lock it back if you like for security reasons etc.
no, not by me, and it also looks the laptop is never opend before, it seems a sample or demo laptop. but this is how I bought it. You are right the hp guy told me but was really try to help, but without proper serials he can’t do anything even a new systemboard was not possible. I have now opened it is there is not much info on the serials , some handwriting I can see. The bad news is I can’t find the chip so i assume it is on the other side. can’t find u501 or a idt labeld chip.
on this movie https://www.youtube.com/watch?v=4Li_wXt7kHw at 2:33 you see exact the same service taq label as I have. btw
thanks for helping !
got it
when I short pin 1 upper left and pin 5 below, and power the laptop on and release it when I see windows booting it is still locked … 
edit:
between the pins I get 2.79v
done with bios reset
on off and so on, result both is not unlocked
edit2
ik completly read the story of the other dutch guy: HP Elitebook 8560p BIOS chip replacement problem: ME is in recovery state (5)
and he was also unable to use the pin mod but did come further with the programmer @plutomaniac
Try pins 3 and 5 instead of 1 and 5. You need to short them, start the system and release when the OS starts to load. That IDT audio chip’s pins seem large enough so it shouldn’t be hard. Realtek pins are a nightmare to short on the other hand. If the pinmod does not work for some reason then the only way is to use a programmer. These are all useful to reflash the ME firmware, if the problem is at the BIOS then I don’t know about the other HP stuff. Maybe the FD lock is sort of related to these other stuff and if you disable it then you can use the DMI tool. I doubt it but it doesn’t hurt to try at this point.
just to be sure on my picture HP Laptop Me state recovery, unable to flash firmware Solution = Donation ! (2)
pin 1 is upper left right ? on the realtek it is on the bottom left next to the dot on the chip.
If I also replace the bios do I have a better chance ? or is the programmer then mendatory?
Yes I searched for a direction assist as well but IDT does not put a dot like Realtek. It makes sense for the schematics to be equivalent to the actual soldered chip so, as you are testing, pin 1 should be left of the IDT name. I also saw that pin 9 is DVDD. We definitely need pin 5, the other pin is either 1,3 or 9. Assuming that the schematic is equivalent to the chip orientation on the board from a top down view, I suggest you try all combinations and one should work. Meaning, 1-5, 3-5 and 9-5.