Hi,
my HP ZBook 15 G3 worked without problems until a few weeks ago.
Then I had the stupid idea to install a HP software (“HP Client Security Manager”), which entered a startup password into the BIOS that was compatible with my Windows 10 login password. However, this did not work properly and I could no longer use my notebook or boot from a USB stick, for example.
HP apologised and only offered to install a new mainboard (costing about 400 euros). The possibility of resetting the BIOS with the help of the SMT.BIN file is no longer offered to customers by HP since the middle/end of 2019.
I then got myself an EEpromer (CH341A from Amazon for 15 euros) and wanted to read out the BIOS chip and remove the password with the help of some forum members.)
The reading of the chip did not work optimally (BIOS battery and accumulator was removed in the Notebook) because somehow there was no stable connection (the LED (on the EEpromer) indicating the connection to the chip flickered during the reading and was not constantly on).
After 10 attempts, I wanted to try whether the notebook worked and reassembled everything (takes less than 2 minutes) and the miracle was there - the BIOS startup password was gone and I got back into the BIOS.
I reset the BIOS to default values and was then able to boot into Windows 10 again. However, 2 messages remained, which I can’t fix:
1 - (a7) me fw downgrade - request mespilock failed
2- error sending end of post message to me heci disabled proceeding with boot
If I look with the tool "ARIES MPM TOOL.rar " you can see (you can also edit BIOS values):
…
Product Family
103C_5336AN
MS Digital Marker
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
System BIOS Version
N81 Ver. 01.52 10/28/2020
BIOS Build Version
0000
ME Firmware Version
0.0.0.0
Integrated Video BIOS Version
INTEL(R) VBIOS [9.0.1033]
Embedded Controller Firmware Version
10.75
Born On Date
00/00/0000
…
What I don’t understand at all is that I can change the BIOS version of the notebook with the HP tools without any problems. I have already installed the old BIOS (version 1.32) and then the current BIOS (version 1.52). The notebook works, but the error messages remain. I hoped that the ME firmware would be re-installed with the old and new BIOSes.
When I try to install the drivers of the “Intel Management Engine”, I get an error “The platform is not supported”.
Do you have any idea how I can get the ME firmware installed in the BIOS again?
Thank you for your help and support in advance.
Kind Regards
Ronald
EDIT by Fernando: Thread title shortened (was too long)
Hi,
after a long search at HP I found the information for the appropriate ME version for my notebook (SP80341 (downloadable from HP) -11.0.18.3003 - File: 110183003_H.bin / SP110562 (downloadable from HP) 11.8.81.3781 - File: ME_11.8_Corporate_D0_H_Production.bin).
Since I no longer have any ME firmware, the Intel ME driver cannot be successfully installed in Windows 10. Without the driver I get the following error message:
…
Error 8193: Fail to load MEI device driver (PCI access for Windows)
Above error is often caused by one of below reasons:
Administrator privilege needed for running the tool
ME is in an error state causing MEI driver fail
MEI driver is not installed
…
Without the installed ME Driver, I cannot update/reinstall the ME Firmware via Windows 10.
What is the way to install the ME firmware without Windows? There must also be a way for Linux users or if you start the notebook directly in the BIOS, you can also install updates for 3rd party firmware there (the question is what the USB stick must look like (only the BIN file with the ME firmware?)?
Thanks for your help in advance.
Kind Regards
Ronald
Those HP SPs you mention contain update files which are unconfigured and only can be used to update properly working ME regions. Inserting those into a firmware image would brick the image. Your long search was simply wasted time.
Most probably your ME in the UFEI firmware/ bios is corrupted. For getting it back to proper working condition you’d have to follow the already mentioned guide:
[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization
To dump your firmware/ ME region you probably have to unlock the flash descriptor:
[Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing
Hello lfb6,
thank you for the quick answer.
As I understand the instructions, I cannot avoid an EEPromer to DUMP my BIOS, modify the BIOS and then reprogram it back into the BIOS chip.
Alternatively, there are suppliers on EBay where I can get a new BIOS chip. I would have to solder it in.
Do you have a tip where I can get ready-programmed BIOS chips (supplier name)?
I’m just afraid that I’ll do all this and then the BIOS chip won’t work properly.
Thank you for your help in advance.
Kind Regards
Ronald
No, you don’t necessarily need a programmer, there are other options to unlock a flash descriptor, too, that could work.
A pre- programmed chip bought somewhere won’t contain board specific information like serial, service tag…
Try at least to dump as much of the UEFI firmware as possible, using the ME System tools corresponding to your ME version
Intel (Converged Security) Management Engine: Drivers, Firmware and Tools Section C2
fpt -d spi.bin
If you get an error message try each region for itself:
fpt -desc -d desc.bin
fpt -gbe -d gbe.bin
fpt -me -d me.bin
fpt -bios -d bios.bin
Hello lfb6,
thank you. Fantastic instructions from you.
I used the following commands (as I did it on a Windows 10 Pro with 64 bit operating system):
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.
Reading HSFSTS register… Flash Descriptor: Valid
— Flash Devices Found —
W25Q128FV ID:0xEF4018 Size: 16384KB (131072Kb)
Error 318: The host CPU does not have read access to the target flash area. To enable read access for this operation you must modify the descriptor settings to give host access to this region.
FPT Operation Failed.
…
It worked with the individual sections except for the ME section.
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.
Reading HSFSTS register… Flash Descriptor: Valid
— Flash Devices Found —
W25Q128FV ID:0xEF4018 Size: 16384KB (131072Kb)
- Reading Flash [0x0001000] 4KB of 4KB - 100 percent complete.
Writing flash contents to file “desc.bin”…
Memory Dump Complete
FPT Operation Successful.
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.
Reading HSFSTS register… Flash Descriptor: Valid
— Flash Devices Found —
W25Q128FV ID:0xEF4018 Size: 16384KB (131072Kb)
- Reading Flash [0x0003000] 8KB of 8KB - 100 percent complete.
Writing flash contents to file “gbe.bin”…
Memory Dump Complete
FPT Operation Successful.
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.
Reading HSFSTS register… Flash Descriptor: Valid
— Flash Devices Found —
W25Q128FV ID:0xEF4018 Size: 16384KB (131072Kb)
Error 318: The host CPU does not have read access to the target flash area. To enable read access for this operation you must modify the descriptor settings to give host access to this region.
FPT Operation Failed.
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.
Reading HSFSTS register… Flash Descriptor: Valid
— Flash Devices Found —
W25Q128FV ID:0xEF4018 Size: 16384KB (131072Kb)
- Reading Flash [0x1000000] 9216KB of 9216KB - 100 percent complete.
Writing flash contents to file “bios.bin”…
Memory Dump Complete
FPT Operation Successful.
What would be the next steps from your point of view with your experience?
Thank you for the help in advance.
Kind Regards
Ronald
EDIT by Fernando: Put the different FPT command results into “spoilers” (to save space and for better readability)
@ Fernando - Thank you for the help.
Hello fb6,
I have uploaded the BIN files to the thread in case you need more information from the BIN files.
I would guess the Firmaware is either:
CSME 11.8 Consumer H D,A v11.8.82.3838 ->
CSME 11.8 CON H DA v11.8.82.3838.rar
OR
CSME 11.8 COR H DA v11.8.82.3838.rar
I don’t know how to find out the correct firmware.
Thank you in advance for your help and support.
Kind Regards
Ronald
Thanks. As you can see there’s an error to read the ME Region. This is the region you will have to dump and repair and you want to flash it back after repair!
So there’s no way around unlocking the Flash Descriptor, see guid linked in #4- or buying a CH341 hardware programmer.
[Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing
Find out right ME is done by just dumping the ME Region file on MEA.exe, it’s sorresponding to the HP update either CSME Corporate H D,A v11.0 - v11.8 or CSME Consumer LP C YPDM v11.0 - v11.8.
You got already the chip information: W25Q128FV, 16MByte 3V Chip
https://www.winbond.com/resource-files/w…32016%20kms.pdf
And you got a good backup of the bios region, that would make it easy to compare the result read with programmer to the bios region already dumped for validation.
If soldering a new chip would be your solution I’d recommend buying a programmer anyway and program it with your own firmware with reconfigured ME before soldering. But you’d have to read the ME region from the chip before soldering anyway…
I’d go for the programmer/ SOIC clip as the first try, it’s cheap and works mostly.
Hi fb6,
I found someone who has a professional EEProgrammer.
The process would be:
- Read out the BIOS chip
- Comparison of the read data
- Implementation of the working ME firmware
- Writing the data into the BIOS chip
What is not clear to me yet is how to recognise the part of the ME firmware from the read-out collected data and then replace it with the new ME firmware.
Thank you for the help and support.
Kind Regards
Ronald
Make at least 2 valid backups before writing anything to the chip. Those backups have to be a 100% identical! Post the backuped firmware
The complete procedure is described in the guide already linked in #2 and #4
[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization