HP Pavilion 500-a60 (AMD Kabini) - How to unlock the FCH/SPI, or hell, anything???

[cfeedback]

Longtime listener, first time caller (love the show, btw, you guys rock)… I beg on the wizards here to save me from myself, because I am locked in battle with this POS Goodwill laptop-motherboard-in-a-tower’s-clothing BIOS, and I am losing the war. I don’t think I’ve accomplished anything for the last week now… the cat is starting to get hungry and eyeing me like I’m just a big pork chop. I used to think I was fairly competent at this, I have a garage full of old PCs, media players, routers (I especially like routers, you never know when you’ll need that 11th router with dd-wrt on it to make the perfect mesh network), hell I even coxed a Seagate HD out of retirement recently with a TTL cable (no, I don’t have one of those $3 gizmos yet…it’s on “the list”). It’s hard to remember to buy something on ebay when you’re busy swearing at the PC while trying to keep the cat from chewing on your leg.

Anyway, nothing works. I’ve tried every version of AFUDOS, AfuEFI, Linux, sadly the most luck I’ve had is with Windows…Safuwin will let me back up my bios, and even then only when it feels like it and/or I use the right combination of magic (swear) words. GAN, ENG mode, all nada…error 46 or 49. Tried a number of versions of the NbDmiFit package, one of the oldest ones did seem to want to let me play with the EEPROM, but it was garbled and I thought better of pushing my luck. None of the 2.0+ ones wanted to run on this platform. Can’t say I blame them.

On one of my other HPs from around the same era, a 500-070 it has the flash overrride jumper so it’s cake. But even without the jumper I could trick safuwin into flashing setup with a bunch of 01s to unlock the menus, new option ROMs, (it did balk at updating the microcode)…FPT works great. But on this AMD pos, I’ve tried changing just a single “00” to “01” and safuwin looks at me like I’m speaking Greek. Oh, I forgot, grub setup_var does work, and I’ve changed probably 2/3rds of the variables which all work great other than actually unlocking the SPI, FCH, whatever AMD wants to call it. Flashrom (log before) provides some (useful?) information… I found one other guy with the same problem on the coreboot mailing list. Didn’t see any resolution. Scoured the usual places… here (the best of course), bios-mods, my digital life, the hackintosh guys, etc. Read most of the AMD Family 16h NB BIOS developers guide and the SB one as well. I still haven’t identified the holdup… I’m thinking there’s an MSR that’s holding me up? I don’t care about the management engine or any of that crap, I just want to flip on the 5 menus in the BIOS full of options this motherboard doesn’t support. Is that too much to ask?

Thanks for listening and in advance for any help! Felt good to get that off my chest. So here’s the flashrom log, the IFR (there’s some references to SPI in there but it’s mostly just speeds I’ve tried changing most of them to no avail), a link to the original 80.15 HP BIOS… oh yeah, for reasons unbeknownst to anyone, especially me, I flashed a newer version (80.18) not specifically listed by HP for this PC, but the same SSID family. Probably didn’t help any, but they’re not too keen on downgrading so that’s what I’m rolling with. There’s 2 safuwin dumps, PRE and POST…PRE should be more or less normal, POST is when I tried flashing the stock BIOS again without the preserve setup, SMBIOS, etc flags. Didn’t do a lick of good.

[102]Setup IFR.txt (the last 4 menus, File through Advanced are what’s stock, it’s the 6 above I’d like to unlock)
PRE.ROM ← (1st safuwin dump)
POST.ROM ← (2nd safuwin dump with a whole lot less NVARs)
HP Consumer Desktop PC BIOS Update (ROM Family SSID 2AFE) 80.15 Rev. A ← official latest BIOS for this model.
HP Consumer Desktop PC BIOS Update (ROM Family SSID 2AFE) 80.18 Rev A. Pass 1 ← newer one only found on some shady hp ftp site

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
 

kale@Pavilion-500-a60 ~ % sudo flashrom -p internal --verbose
[sudo] password for kale: 
flashrom v1.1-rc1-36-gdeeac7e on Linux 5.1.15-arch1-1-ARCH (x86_64)
flashrom is free software, get the source code at https://flashrom.org
 
flashrom was built with libpci 3.6.2, GCC 9.1.0, little endian
Command line (3 args): flashrom -p internal --verbose
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing internal programmer
/sys/class/mtd/mtd0 does not exist
No coreboot table found.
Using Internal DMI decoder.
No DMI table found.
Found ITE Super I/O, ID 0x8605 on port 0x2e
Found chipset "AMD FCH" with PCI ID 1022:780e.
Enabling flash write... SPI base address is at 0xfec10000
Yangtze detected.
SpiRomEnable=1, RouteTpm2Sp=0, PrefetchEnSPIFromIMC=0, PrefetchEnSPIFromHost=0
(0x2f0c2105) SpiArbEnable=1, IllegalAccess=0, SpiAccessMacRomEn=0, SpiHostAccessRomEn=0, ArbWaitCount=7, SpiBusy=0
ERROR: State of SpiAccessMacRomEn or SpiHostAccessRomEn prohibits full access.
ROM strap override is not active
PROBLEMS, continuing anyway
 

Thanks again, I (hopefully) owe someone a beer or ten for helping me end this madness! ;)

[Lost_N_BIOS]

@cfeedback - Our cats think alike

For NbDmiFit the new 2.0 ones may work but you need valid SBC.Bin file from HP, they will send you via email if you request and provide serial/UUID and proof of purchase (make one)

No management engine here, otherwise you could use Intel FPT and be done with all this mess. I agree, even on modern mainstream boards, AMD is crap when it comes to flashing in a mod BIOS a good 90% of the time, it’s often a fight.

Which version of AFUWin lets you backup BIOS in windows? That same one may allow you to flash mod BIOS, if you first flash stock, then without reboot flash the mod BIOS.
You did try many versions of AFUWin, correct? If not, especially since this is older Aptio IV BIOS not Aptio V, that is where you need to be, not safuwin
And probably AFUDOS will work better, but do not resort to methods/versions that require /GAN to flash mod, others will flash mod too once you find the right one.

However, I may be able to directly modify the stock safuwin.exe to get around the error, if you give me the exact error you get when trying to flash mod BIOS (image or text you write out, but it has to be exact).

Best bet, and quickest way to solve things here, is to purchase a CH341A flash programmer ($2.50) and a SOIC8 test clip cable ($3.60) on ebay, let me know if you need links to examples.
At those prices shipping will be 3-5 weeks, but you can find local sellers or sellers that ship faster for more $$, and other stores aside from ebay also carry these (Newegg or places like Amazon etc)

[cfeedback]

Thanks for the quick reply. The safuwin that comes with the HP BIOS package will let you do a few things, it’s just very picky. On the Intel Pavilion (i3, H61 series 6 me 8) I could mod the menus, change option roms, everything but the microcode… which was nice and all that, but since it had the flash override jumper entirely unecessary. There’s obviously some sort of checksum with their amifldrv.sys or the safu variant that I’m not able to avoid.

What I don’t get is how is there nothing I can do with setup_var to get around this? Take a look at that IFR and tell me if there’s something I’m missing? Obviously it can be unlocked, HP’s dumb asses can do it… in Intel terms, I don’t care about the descriptor region or the ME engine, I just want to flash/mod the BIOS region.

I sifted through a lot of the coreboot mailing list discussions, it’s those 2 registers that flashrom doesn’t like that’s holding me up, I’m sure of it. This was 6 years ago:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
 

> > > +         msg_pwarn("Could not determine chipset generation. Assuming SB6xx.");
> > > +         amd_gen = CHIPSET_SB6XX;
> > > + }
> > > 
> > > if (amd_gen == CHIPSET_YANGTZE) {
> > > msg_perr("SPI on Kabini/Temash and newer chipsets are not yet supported.\n"
> > > @@ -341,35 +372,83 @@ int sb600_probe_spi(struct pci_dev *dev)
> > > return ERROR_NONFATAL;
> > > }
> > > 
> > > - tmp = pci_read_long(dev, 0xa0);
> > > - msg_pdbg("AltSpiCSEnable=%i, SpiRomEnable=%i, "
> > > -              "AbortEnable=%i\n", tmp & 0x1, (tmp & 0x2) >> 1,
> > > -              (tmp & 0x4) >> 2);
> > > - tmp = (pci_read_byte(dev, 0xba) & 0x4) >> 2;
> > > - msg_pdbg("PrefetchEnSPIFromIMC=%i, ", tmp);
> > > -
> > > - tmp = pci_read_byte(dev, 0xbb);
> > > - /* FIXME: Set bit 3,6,7 if not already set.
> > > -  * Set bit 5, otherwise SPI accesses are pointless in LPC mode.
> > > -  * See doc 42413 AMD SB700/710/750 RPR.
> > > + /* Chipset support matrix for SPI Base_Addr (LPC PCI reg 0xa0)
> > > +  * bit   6xx         7xx/SP5100         8xx       9xx  hudson1  hudson2+  \
> > > yangtze +  * 3    rsvd         <-                 <-        ?    <-       ?     \
> > > RouteTpm2Spi +  * 2    rsvd         AbortEnable        rsvd      ?    <-       \
> > > ?         <- +  * 1    rsvd         SpiRomEnable       <-        ?    <-       \
> > > ?         <- +  * 0    rsvd         AltSpiCSEnable<1>  rsvd      ?    <-       \
> > > ?         <-
> > 
> > Maybe it's just me, but I have trouble parsing that table. Let's talk
> > about bit 2: What you mean is clear for 6xx (rsvd), 7xx (abortenable),
> > 8xx (abortenable). I'm assuming that this bit is not described for 9xx
> > and hudson1, but why is the hudson2+ entry "?" instead of "<-" ? Or do
> > the "?" entries for 9xx and hudson2+ have a different meaning?
> 
> Actually it is the <- that changes meaning, if you will, and the ? are
> not just "we dont know", as one obviously would to infer.
> The ? marks values where we do not have a datasheet, but which we
> assume to be identical to the previous generations. So maybe we should
> use "<-?" instead? Other suggestions are very welcomed.
> Now it should also be clear what the <- after a ? means: we have a
> datasheet and it indicates the same values as the generation *before*
> the question marks before it. I used this mainly for myself but I would
> still like to include it in some form.
 
Let me try to phrase this in a way I can understand:
+++++++++++++
How to read this table:
"nd" means we have no datasheet for this chipset generation.
"ni" means the datasheet for this generation doesn't have any relevant info.
"<-" means the bit/register meaning is identical to the next non-ni/non-nd
     chipset to the left.
If a "nd" chipset is between two chipsets with identical meaning, we assume
the meaning didn't change twice in between, i.e. the meaning is unchanged
for the "nd" chipset. This is a tried and (so far) valid assumption.
+++++++++++++
Your "?" would turn into "nd".
 
That said, keeping your symbols is also an option. My phrasing for that
scenario would be:
+++++++++++++
How to read this table:
"?" means we have no datasheet for this chipset generation or the datasheet
    doesn't have any relevant info.
"<-" means the bit/register meaning is identical to the next non-"?"
     chipset to the left. "<-" thus never refers to a "?".
If a "?" chipset is between two chipsets with identical meaning, we assume
the meaning didn't change twice in between, i.e. the meaning is unchanged
for the "?" chipset. This is a tried and (so far) valid assumption.
+++++++++++++
 

 
> > > +  *
> > > +  *  <1> It is unknown if that was ever working. On later chipsets the CS \
> > > config is at memmapped 0x1D.
> > 
> > Heh. Let's find someone with DualBIOS on a SB7xx board. But seriously,
> > I'd assume this works if it's still in the current revision of the
> > register reference guide.
> 
> The problem is (IIRC) that it is not too well defined (who would have
> thought that!) but maybe I am confusing it with Fast Speed.
 
AFAICS the meaning is well defined, except that vendors apparently didn't
use it on the boards we know. A simple test would be to set that bit and
check if SPI probe still returns anything. If yes, there are either two
flash chips or my understanding of that bit is wrong.
 

> > > */
> > > - msg_pdbg("PrefetchEnSPIFromHost=%i, SpiOpEnInLpcMode=%i\n",
> > > -              tmp & 0x1, (tmp & 0x20) >> 5);
> > > - tmp = mmio_readl(sb600_spibar);
> > > - /* FIXME: If SpiAccessMacRomEn or SpiHostAccessRomEn are zero on
> > > -  * SB700 or later, reads and writes will be corrupted. Abort in this
> > > -  * case. Make sure to avoid this check on SB600.
> > > + if (amd_gen >= CHIPSET_SB7XX) {
> > > +         tmp = pci_read_long(dev, 0xa0);
> > > +         msg_pdbg("SpiRomEnable=%i", (tmp >> 1) & 0x1);
> > > +         if (amd_gen == CHIPSET_SB7XX)
> > > +                 msg_pdbg(", AltSpiCSEnable=%i, AbortEnable=%i", tmp & 0x1, \
> > > (tmp >> 2) & 0x1); +
> > > +         tmp = pci_read_byte(dev, 0xba);
> > > +         msg_pdbg(", PrefetchEnSPIFromIMC=%i", (tmp & 0x4) >> 2);
> > > +
> > > +         tmp = pci_read_byte(dev, 0xbb);
> > > +         /* FIXME: Set bit 3,6,7 if not already set.
> > > +          * Set bit 5, otherwise SPI accesses are pointless in LPC mode.
> > > +          * See doc 42413 AMD SB700/710/750 RPR.
> > 
> > Are these bits required to be set even for post-SB7000 chipsets?
> 
> That's left as an exercise to the reader. :P
> 5 is reserved anywhere but on sb7x/sp5100, the other bits change
> semantics in sb8xx...
> 
> > > +          */
> > > +         if (amd_gen == CHIPSET_SB7XX)
> > > +                 msg_pdbg(", SpiOpEnInLpcMode=%i", (tmp >> 5) & 0x1);
> > > +         msg_pdbg(", PrefetchEnSPIFromHost=%i\n", tmp & 0x1);
> > > + }
> > > +
> > > + /* Chipset support matrix for SPI_Cntrl0 (spibar + 0x0)
> > > +  * bit   6xx                7xx/SP5100      8xx               9xx  hudson1  \
> > > hudson2+  yangtze +  * 17    rsvd               <-              <-              \
> > > ?    <-       ?         <-
> > 
> > Again the table I don't understand. Maybe you should add an explanation
> > which specifies the meaning of "?".
> 
> Given the explanation above, would you mind formulating it? IMHO it
> improves such things quite a bit if another mind puts it into words
> than the one inventing it.
 
Done, see above.
 

> > > +  * 18    rsvd               <-              fastReadEnable<1> ?    <-       ? \
> > > SpiReadMode[0]<1> +  * 19    SpiArbEnable       <-              <-              \
> > > ?    <-       ?         <- +  * 20    (FifoPtrClr)       <-              <-     \
> > > ?    <-       ?         <- +  * 21    (FifoPtrInc)       <-              <-     \
> > > ?    <-       ?         IllegalAccess +  * 22    SpiAccessMacRomEn  <-          \
> > > <-                ?    <-       ?         <- +  * 23    SpiHostAccessRomEn <-   \
> > > <-                ?    <-       ?         <- +  * 24:26 ArbWaitCount       <-   \
> > > <-                ?    <-       ?         <- +  * 27    SpiBridgeDisable   <-   \
> > > <-                ?    <-       ?         rsvd +  * 28    rsvd               \
> > > DropOneClkOnRd  = SPIClkGate      ?    <-       ?         <- +  * 29:30 rsvd    \
> > > <-              <-                ?    <-       ?         SpiReadMode[2:1]<1> + \
> > > * 31    rsvd               <-              SpiBusy           ?    <-       ?    \
> > > <- +  *
> > > +  *  <1> see handle_speed
> > 
> > Which handle_speed? Can't find it in svn HEAD nor in this patch.
 
 

One last thing I forgot to mention, I'm getting a bunch of boot errors about the i2c bus not being able to be reset, it falls back to an alternative/secondary SMBus driver? (sorry, don't have the log in front of me). This wasn't happening a few months ago, so I'm not sure if it's just because of the 5.x kernel vs the 4.19 I was running before or something related to my may failed attempts to force this to flash.

I should've posted a long time ago and saved myself all this aggravation. I want to get back to my far more interesting project, which is to add A.C.C. to an Asus MA3-76-CM board that never had it in the first place (it does have the the SB710 though). It's got a phenom I'd like to unlock the 4th core on.... what's the over/under on that project being possible?

[Lost_N_BIOS]

You’re welcome! safu does not have any additional driver/sys file to edit, only that exe, so that is why I asked you for the exact error it gives you. Does this also run in DOS? If yes, that will be the target method, since usually less protections applied there.

I checked, and didn’t see anything in setup to avoid this, sometimes it’s an actual edit you need to make in another BIOS file though, that has to be programmed onto the chip before locks are removed though (I know this for Intel, unsure about AMD, would have to check but doubt same file is there - PCHInitDXE)
Nothing in the setup IFR has anything to do with BIOS flashing, or BIOS lockdowns etc. All that stuff you see at SPI xxx is only about how the BIOS chip functions (ie how fast it reads, erases etc), so they can set different ways for different model IC’s

Sorry, I have no clue about I2c bus or SMBus drivers, I only know BIOS mods and this has nothing to do with modifying BIOS for the usual stuff. Flash back in proper, correct model stock BIOS for you system and that should go away, probably some to do with you flashing that other model or removing NVRAM.

Once you show me the error you get with stock flasher and mod BIOS, I can try to get you around that lock.

As for the AMD, I’ll have to check it’s BIOS and get back to you. * Edit - I checked, nothing to unlock/enable here for you on core unlocking, this board/BIOS was made long before Asus/others enabled those type of functions, it’s not even a hidden part of the BIOS

[cfeedback]

I was trying to avoid rebooting back into windows lol. I’m taking some screenshots now, but what happens is when you run the HP Installer, it creates a dir at C;\SWSetup[sp70374]\ and does it’s dirty work there, which it leaves behind when it’s done. too. This is when it automagically creates the samifldrv.sys, which is very much required by the HP version of Safuwin. It’s complain if you try to flash from the command line and mess with the driver at all, and modded ROMs give an error about incorrect ROM for this system (working on the exact details stlll.

I had to let it flash to get the screenshot, no other real way about it. I did make a little progress last night getting it downgraded back to the last official 80.15 BIOS. I can’t say for sure what made it work, all I can remember is I spent most of the night booting Windows via the Clover-EFI bootloader (which allows you to trick the OS in all sorts of ways, that’s how they make the hackintosh work) and finally something I messed with did the trick. So I’m now back on the official plane jane stock HP BIOS.

re: NVARs, I didn’t mean that I deleted any I shouldn’t have it…this was an old system it had well over 400, mostly invalid or ghost boot entries from years past. I just took out the “/N” flag one time to get it back to a stock state. I’ll get some more screenshots shortly too. Oh and about te SMBus/ii2C thing… I’m not an expert myself, but my understanding was the SMBus was how the system accessed the FCH (or maybe vice versa), which is responsible for the actual flashing? I can find no traces on the internet of anyone ever trying to mod a Kabini board… it’d be nice to know if this was a normal problem or just something screwed up on my particular HP.

More screenshots to follow.

[cfeedback]

So, this is what’s left over after a successful flash… as long it’s the stock BIOS and the driver is there, it’l let me do any of those commands I believe.

[spoiler]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
 

PS C:\SWSetup\[sp70374]> .\safuwin.exe
 +---------------------------------------------------------------------------+
 |            AMI Firmware Update Utility(APTIO)  v2.38_HP_v04_B04           |
 |      Copyright (C)2011 American Megatrends Inc. All Rights Reserved.      |
 +---------------------------------------------------------------------------+
 | Usage: SAFUWIN <ROM File Name> [Option 1] [Option 2]...                   |
 |           or                                                              |
 |        SAFUWIN <Input or Output File Name> <Command>                      |
 |           or                                                              |
 |        SAFUWIN <Command>                                                  |
 | ------------------------------------------------------------------------- |
 | Commands:                                                                 |
 |         /O - Save current BIOS into file                                  |
 |         /U - Display ROM file's ROMID                                     |
 |         /S - Refer to Options: /S                                         |
 |         /D - Verification test of given ROM File without flashing BIOS.   |
 |         /A - Refer to Options: /A                                         |
 |       /OAD - Delete system's OAKey.                                       |
 | /CLNEVNLOG - Refer to Options: /CLNEVNLOG                                 |
 | Options:                                                                  |
 |         /P - Program main BIOS image                                      |
 |         /B - Program Boot Block                                           |
 |         /N - Program NVRAM                                                |
 |         /E - Program Embedded Controller Block                            |
 |         /K - Program all non-critical blocks and ROM Holes                |
 |        /Kn - Program n'th non-critical block or ROM Hole only(n=0-15)     |
 |         /Q - Silent execution                                             |
 |    /REBOOT - Reboot after programming                                     |
 |         /S - Display current system's ROMID                               |
 |         /R - Preserve ALL SMBIOS structure during programming             |
 |        /Rn - Preserve SMBIOS type N during programming(n=0-255)           |
 |      /ECUF - Update EC BIOS when newer version is detected.               |
 |  /SHUTDOWN - Shutdown after programming.                                  |
 |     /HOLE: - Update specific ROM Hole according to RomHole GUID.          |
 |              NewRomHole1.BIN /HOLE:GUID                                   |
 |  /HOLEOUT: - Save specific ROM Hole according to given GUID.              |
 |              NewRomHole1.BIN /HOLEOUT:GUID                                |
 |        /SP - Preserve Setup setting.                                      |
 |        /EC - Program Embedded Controller Block. (Flash Type)              |
 |      /MEUF - Program ME Ignition Firmware Block.                          |
 |        /ME - Program ME Entire Firmware Block.                            |
 |       /CAF - Compare ROM file's data with Systems is different or         |
 |              not, if not then cancel related update.                      |
 |         /A - Oem Activation file.                                         |
 |              Example: /Akey.bin will update OA key with key.bin file.     |
 |       /OAD - Delete system's OAKey.                                       |
 | /CLNEVNLOG - Clear Event Log.                                             |
 |       /MPM - Show MPM status.                                             |
 |  /MPM:LOCK - Set MPM LOCK.                                                |
 |       /NH: - Switch Hybrid and Native mode.                               |
 |       /SB: - Set Secure Boot.                                             |
 |       /FB: - Set Fast Boot.                                               |
 +---------------------------------------------------------------------------+
 

PS C:\SWSetup\[sp70374]> cat .\flash.bat
mountvol z: /s
del z:\efi\hp\bios\current\*.bin
copy .\KAB_8015.BIN z:\efi\hp\bios\current
mountvol z: /d
safuwin KAB_8015.BIN /p /b /n /r /reboot
PS C:\SWSetup\[sp70374]>
 

 
PS C:\SWSetup\[sp70374]> .\safuwin.exe /S
 +---------------------------------------------------------------------------+
 |            AMI Firmware Update Utility(APTIO)  v2.38_HP_v04_B04           |
 |      Copyright (C)2011 American Megatrends Inc. All Rights Reserved.      |
 +---------------------------------------------------------------------------+
 System ROM ID = KAB_8015
 System ROM GUID = b5c59087-feac-4b41-9d80790ba5aa070f
 

 Reading flash ......... done
PS C:\SWSetup\[sp70374]> .\safuwin.exe safbak.rom /D
 +---------------------------------------------------------------------------+
 |            AMI Firmware Update Utility(APTIO)  v2.38_HP_v04_B04           |
 |      Copyright (C)2011 American Megatrends Inc. All Rights Reserved.      |
 +---------------------------------------------------------------------------+
 Reading file .......... done
 FFS checksums ......... ok
 - ROM File Size checking ........ ok
 - ROM ID checking ............... ok
 - ROM File verification status .. ok
 

PS C:\SWSetup\[sp70374]> .\safuwin.exe safbak.rom /U
 +---------------------------------------------------------------------------+
 |            AMI Firmware Update Utility(APTIO)  v2.38_HP_v04_B04           |
 |      Copyright (C)2011 American Megatrends Inc. All Rights Reserved.      |
 +---------------------------------------------------------------------------+
 Reading file .......... done
 FFS checksums ......... ok
 ROM File ROM ID = KAB_8015
 ROM File ROM GUID = b5c59087-feac-4b41-9d80790ba5aa070f
 

[/spoiiler]

I never really compared the ROM GUID...is that changing with Ubutool? Gotta go it a try... ALso I seem to be having issues with the bbcode, I don't knokw what's up with that seems to depends on what OS/browser I'm in.


EDIT: Added the last backup and the driver.

samifldrv64.rar (7.91 KB)

safbak.rar (1.92 MB)

[Lost_N_BIOS]

Please edit your posts when you want to add more thoughts and no one has replied yet. Also, please either use thumbnails, or attach images using the forum software (only possible in full reply)
I hope more images to follow, the above one doesn’t show any error. I need to see the exact error that’s stopping you with safuwin, I can edit the safuwin.exe or the samifldrv64.sys, whichever contains the error (probably the exe, since the sys file is only 16kb)

Yes, I tried to fix your coding there, even removing the code tag didn’t help. I think it’s due to use of the < and > when not needed (ie, it’s never needed), I removed a few but not all, too many for me to sit and remove.

Nothing should be in German, maybe a few random words here or there, but nothing important used to edit or make a post.

Still waiting to see an error image from safuwin. Thanks for latest backup, but I don’t need it or the drivers etc, I can extract all that from the exe

ROM GUID doesn’t matter to anything here, maybe it changed when you flashed one BIOS to the other possibly, but none of that is relevant to what we’re doing here.

[cfeedback]

@Lost_N_BIOS

Please edit your posts when you want to add more thoughts and no one has replied yet. Also, please either use thumbnails, or attach images using the forum software (only possible in full reply)
I hope more images to follow, the above one doesn’t show any error

Sorry about that, I’m having problems with editing posts because everything comes up in German… I can’t figure out why, it shows my language as English in my profile settings.

[Lost_N_BIOS]

Please see my edits above. I see it’s mounting a drive, is the actual flash done in windows, or happens on reboot in DOS?
Either way, I need to see exact error it’s giving you. And order a flash programmer and SOIC8 test clip with cable now if you have not already

[cfeedback]

Sorry I was in a hurry, I wasn’t as clear as I could have been. I dumped the contents of “flash.bat” which is what the HP Installer runs, but you’ll notice it fails. It’s just attempting to mount the EFI System partition and make a copy/backup of the bios before flashing. I’ve seen that behavior before on a lot of HPs, I think it fails because this isn’t the original HD with the HP recovery partition crap. It doesn’t really affect the flashing in any way though. Then it does the “safuwin KAB_8015.BIN /p /b /n /r /reboot” command. (This is running the installershield exe from HP).

after that reboot, I can run safunwin manually from the command line (this is where that samidrv.sys comes into play-- it’s left over there. If I delete or move it, safuwin stops working), all the commands work with a stock file. If I try a modded BIOS, it just says "Invalid ROM ID for System"

edit: Everthing I’m doing is from windows 10 home command line (well, powershell) run as an administrator.

[Lost_N_BIOS]

flash.bat is a text file, with a single command line as you mentioned above, nothing to dump there.

Thanks for the error finally. Please confirm that is the exact error word for word?
@cfeedback - Actually, please show me image of that, I’m not seeing “Invalid ROM” as possible text for any error with Invalid or Error: Invalid at the beginning of the error - thanks

Nothing should be done from Powershell, use Admin Command prompt only.

If it is just Invalid ROM ID and it’s correctly saying that, /X should bypass it. But, often this is generic way of saying “Nope, not gonna flash your modified BIOS” or the mod BIOS is actually a broken mod BIOS.

[cfeedback]

Thanks again for all the help, I apologize I should be more specific since you’re taking the time to help me. The exact error is:

1
2
3
 

Reading file .......... done
FFS checksums ......... ok
- Incorrect BIOS for the system.
 

I don't think it matters, but just to be sure we're on the same page...."flash.bat" is actually 5 lines long, it includes those lines about mounting volume Z: you were asking about. And re: powershell, I'm more of a Linux guy honestly so I used powershelll because the syntax is more familiar to me... I didn't realize there would be any difference in running a program. I'll make sure to use good old regular cmd.exe in the future.

I've tried various DOS flashes, but it's a real pain in the ass because for whatever reason this PC does not like to boot up in DOS. I can format the same USB stick the same way and it'll work maybe 1 out of 3 times. I've tried different sticks of various capacities, different usb ports, different programs (rufus/unetbootin/dd/hp usb creator)... I cannot see any rhyme or reason to why it works sometimes but not always.

I'm definitely going to order a cable because it'll help with my other mad projects. You don't think it would be possible to add A.C.C. to that Asus MB, ehh? The hardware theoretically supports it. I was hoping to backport it somehow from the newer M4A78-x bioses that did have it.

[Lost_N_BIOS]

@cfeedback - Thanks - what error do you get now using this one - http://s000.tinyupload.com/index.php?fil…886093725628395
And again, please show me the exact error, so I can find it and go around

Sorry for any confusion about the flash.bat, I was thinking of another BIOS, I do see those five lines. Yes, for some BIOS apps, powershell can cause flashing issues, or incorrect errors, so always best to use Admin CMD.

On the Asus board, it may be possible, if you know some other same version (OLD) BIOS that has this, but general this is only on the newer chipsets and newer BIOS types.

Once you have correct SOIC test clip w/ cable for this BIOS, then all your issues will be instantly solved, we can program in any mod BIOS you want.

[cfeedback]

Oops, I thought I replied to this. Whatever you did seemed to work? You’ll have to teach me that trick. Or the HP just gave up and surrendered, I don’t know, but I have a fistful of options now, most of which the hardware doesn’t actually support…

I finally got my programmer coming tomorrow, and a stack of laptops and towers to really start going to town on… including a Toshiba Satellite I bricked awhile ago getting a little too careless with some mod attempts. I may have to call on your expertise again but I eventually learn… usually. As Douglas Adams once said, “You live and learn. At any rate, you live.” I had a hard time determining among the 5000 Chinese programmers if any of them were better than the other. This is what I ordered, it should work fine yes? (I don’t think the TTL adapter has any bios use? I got it for routers and HDs and what not)

https://www.amazon.com/gp/product/B013Q5…GC9B25845&psc=1
https://www.amazon.com/gp/product/B07BRS…UBGLNXTG9&psc=1
https://www.amazon.com/gp/product/B075N8…FAGEJEBHM&psc=1

Thanks again!!

[Lost_N_BIOS]

@cfeedback - Great to see it’s working now! For the AFU edit, this is done in assembly and hex editor. I edited all possible options that lead to the exact error you mentioned, that’s why I wanted exact error, I edited so that nothing can go to that error.
Here is image of original on left, see how all those possible flow points can go to the error you received, and then edit is on right, see how nothing can go there now = all bypassed

Here is the exact edit in hex -
Hex location >> original value >> edited value
37D3: 1E >> 00
37D9: 18 >> 00
37E2: 0F >> 00
37EB: 06 >> 00
37F0: 75 >> EB
3809: 74 >> EB

Great you have programmer arriving soon! Yes, we can get all those systems you bricked fixed
All you need is $2.50 CH341A (First link) and $3.50 SOIC8 test clip with cable (second link). Should be easy to pick, most all are same/same
Yes, third link not used for BIOS recovery, at least I’ve never seen one nor seen anyone have to use etc. It may be possible to be used in some manner for BIOS fixing, but it’s not something usually used or needed.

[unique1188]

@Lost_N_BIOS , Wow. My jaws just dropped seeing the way you did this and bypassed that error. I wish I had that expertise. Great work of a Bios genius.

[Lost_N_BIOS]

@unique1188 - Thank you for the appreciation!!