It clones the ME section from a full BIOS file to the flash chip after the FD jumper moved, and then changes 1 byte from FF to 01 at address 0x400 within the ME section. Upon reboot ME initializes, and the ME is all fresh and working, something like this:
It was discovered that by not changing this byte to 01 and keeping FF there, the ME will persist in a weird state, triggering permanent “Manufacturing mode” upon boot. That mode can be readily existed by writing a pre-existing good ME back to that flash region, or by setting a proper “01” flag:
We have learnt to use this “Manufacturing mode” to get full flash chip write access via software only with fpt instead of external programmer:
We have also tested booting modded BIOSes on Z620, thanks to @billdh2k, and it works!
Now I want to mod MEBLAST to keep that byte as “FF” after ME re-write, so that the flash write access (Manufacturing mode) can be achieved with 1 MEBLAST step. Basically, I’d do MEBLAST as usual, but since it’s modded, it’ll write FF instead of 01 to that address 0x400.
I was chasing constant of 1 in meblast.com, to make it FF. But I am quite a newbie at this, so can anybody with skills glance at MEBLAST.com (HP links from above), and see which byte needs to become FF instead of 01 ?
