Intel AMT on Dell 5070 - way to success

Special Topics Intel Management Engine
1

Hi Guys. Nearly two years ago i resurrect a dell 5060 after i destroyed it by flashing the wrong image to the spi.

Now i’m trying to active Intel AMT on a Dell 5070 with i5-8500 CPU.

On the beginning of every journy stands the preperation of tools. So downloaded the neccassry CSME 12 Tools and the both firmware images for creating the new ME region file.

This is the MEInfo before updating anything on the host:

C:\Intel\CSME System Tools v12 r38\MEInfo\WIN64>MEInfoWin64.exe
Intel (R) MEInfo Version: 12.0.90.2077
Copyright (C) 2005 - 2022, Intel Corporation. All rights reserved.

General FW Information

    Platform Type                              Desktop
    FW Type                                    Production
    Last ME Reset Reason                       Global system reset
    BIOS boot State                            Post Boot
    Slot 1 Board Manufacturer                  0x00001028
    Slot 2 System Assembler                    0x00000000
    Slot 3 Reserved                            0x00000000
    Capability Licensing Service               Enabled
    Local FWUpdate                             Enabled
    OEM ID                                     68853622-EED3-4E83-8A86-6CDE315F6B78
    Integrated Sensor Hub Initial Power State  Disabled
    Intel(R) PTT Supported                     Yes
    Intel(R) PTT initial power-up state        Disabled
    OEM Tag                                    0x00
    TLS                                        Enabled

Intel(R) ME code versions:
    BIOS Version                               1.35.0
    MEBx Version                               12.0.0.0011
    GbE Version                                0.5
    Vendor ID                                  8086
    FW Version                                 12.0.97.3000 H Corporate
    LMS Version                                2514.7.7.0
    MEI Driver Version                         2512.7.3.0
    Wireless Hardware Version                  Not Available
    Wireless Driver Version                    Not Available

IUPs Information
    PMC FW Version                             300.2.11.1025
    LOCL FW Version                            12.0.97.3000
    WCOD FW Version                            12.0.97.3000

PCH Information
    PCH Version                                10
    PCH Device ID                              A306
    PCH Step Data                              B0
    PCH SKU Type                               Production PRQ Revenue
    PCH Replacement State                      Disabled
    PCH Replacement Counter                    0
    PCH Unlocked State                         Disabled

For backup-reasons and after lessons-learnd from 2023 i backup the whole spi, the bios region and the me region.

After that the MEAnalyser does his jobs and give me this information:

╔═══════════════════════════════════════════╗
║         ME Analyzer v1.307.0 r374         ║
╚═══════════════════════════════════════════╝

╔═════════════════════════════════════════════╗
║             me-region.bin (1/1)             ║
╟─────────────────────────────┬───────────────╢
║            Family           │     CSE ME    ║
╟─────────────────────────────┼───────────────╢
║           Version           │  12.0.97.3000 ║
╟─────────────────────────────┼───────────────╢
║           Release           │   Production  ║
╟─────────────────────────────┼───────────────╢
║             Type            │   Extracted   ║
╟─────────────────────────────┼───────────────╢
║             SKU             │  Corporate H  ║
╟─────────────────────────────┼───────────────╢
║           Chipset           │ CNP/CMP-H B,A ║
╟─────────────────────────────┼───────────────╢
║ TCB Security Version Number │       1       ║
╟─────────────────────────────┼───────────────╢
║ ARB Security Version Number │       15      ║
╟─────────────────────────────┼───────────────╢
║    Version Control Number   │       70      ║
╟─────────────────────────────┼───────────────╢
║       Production Ready      │      Yes      ║
╟─────────────────────────────┼───────────────╢
║      OEM Configuration      │       No      ║
╟─────────────────────────────┼───────────────╢
║       FWUpdate Support      │   Impossible  ║
╟─────────────────────────────┼───────────────╢
║             Date            │   2025-05-26  ║
╟─────────────────────────────┼───────────────╢
║      File System State      │  Initialized  ║
╟─────────────────────────────┼───────────────╢
║             Size            │    0x77C000   ║
╟─────────────────────────────┼───────────────╢
║       Flash Image Tool      │  12.0.33.1422 ║
╚═════════════════════════════╧═══════════════╝
╔═════════════════════════════════════════════╗
║         Power Management Controller         ║
╟─────────────────────────────┬───────────────╢
║            Family           │      PMC      ║
╟─────────────────────────────┼───────────────╢
║           Version           │ 300.2.11.1025 ║
╟─────────────────────────────┼───────────────╢
║           Release           │   Production  ║
╟─────────────────────────────┼───────────────╢
║             Type            │  Independent  ║
╟─────────────────────────────┼───────────────╢
║         Chipset SKU         │       H       ║
╟─────────────────────────────┼───────────────╢
║       Chipset Stepping      │       B       ║
╟─────────────────────────────┼───────────────╢
║ TCB Security Version Number │       3       ║
╟─────────────────────────────┼───────────────╢
║ ARB Security Version Number │       3       ║
╟─────────────────────────────┼───────────────╢
║    Version Control Number   │       0       ║
╟─────────────────────────────┼───────────────╢
║       Production Ready      │       No      ║
╟─────────────────────────────┼───────────────╢
║             Date            │   2020-02-06  ║
╟─────────────────────────────┼───────────────╢
║             Size            │    0x14000    ║
╟─────────────────────────────┼───────────────╢
║       Chipset Support       │      CNP      ║
╚═════════════════════════════╧═══════════════╝

Note: File has harmless unneeded Firmware end padding!

The first problem i saw was the flag “FWUpdate Support: Impossible”. Following the Manual from @plutomaniac on Intel (CS) Management Engine: Drivers, Firmware and Tools (2-15) i had to stop here in the process. But i didn’t found any information how to handle this situation. What should i do to get rid of “Impossible”.

So. I ignore this circumstance and proceed. I used FIT, load the CSME Firmware, link to the PMC Firmware and set a few point according to the manual. The Build Process succeed and i could upload the ME Update via

.\FWUpdLcl64.exe -allowsv -f C:\intel\Bakery\cse_image_FWU_Base.bin

The Upload also succeeded, but nothing changed in the BIOS or the POST Output. I did it again, even with fwupd64 -greset after the upload. Power Cycling / CMOS Reset, no changes.

HWInfo shows me the following information

hwinfo
hwinfo1249×1112 86.4 KB

Okay. After updating ME Region doesn’t work i switch over to modify the whole BIOS / SPI

I used the previuos SPI Dump (32Mybte), loaded it into FIT, enabled the AMT Parameter, build the Image, check the Image (outimage.bin) with UEFITool_NE and then upload the whole dump with fptw64.exe -f outimage.bin. After a few minutes, the moment of truth, i power down the host. Unplug Power Supply and after approx. 30 Seconds i plug power.
But instead the nice Dell Logo 2x orange 1x orange Error Code (Bad Motherboard) occurs. Last chance - CMOS Reset - I removed the CMOS Battery and the power supply for 30 Seconds, reconnect & reinstall everything and the system is back alive.

But…… still without AMT. Nothing in the Bios / Nothing in the Post prompts.

My last step was to dump the whole SPI again and load into FIT. Intel AMT is disabled. Like in the original dump.

So i activate all the AMT stuff and build outimage.bin. Close FIT, open it and load outimage.bin. Even now Intel AMT is disbled. Like my settings aren’t stored in the binary.

Now i’m running out of ideas. Maybe somebody out there has any clue.

Best Regards from Germany

Florian

2

I succeeded :man_dancing: the problem was the “dirty” me data region which has to be replaced

Let me summarize the whole process

Download Tools and Firmware Repos as advised in Intel (CS) Management Engine: Drivers, Firmware and Tools (2-15) and [Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

Be realy sure to this the versions matching to your system. In my case it be CSME 12

Create a folder on C:\ or D:\ without any blank spaces in the name.

(1) First step is to create a copy of your SPI / BIOS Chip

FPTW64.exe -d HolyBackup.bin
Intel (R) Flash Programming Tool Version: 12.0.85.1919
Copyright (C) 2005 - 2021, Intel Corporation. All rights reserved.

Reading HSFSTS register... Flash Descriptor: Valid

    --- Flash Devices Found ---
    ID:0xC84019    Size: 32768KB (262144Kb)


- Reading Flash [0x2000000] 32768KB of 32768KB - 100 percent complete.
Writing flash contents to file "HolyBackup.bin"...
Memory Dump Complete
FPT Operation Successful.

Be sure to copy this file to an external storage. It could be your life saver

(2) Use MEAnalyser to gather information from this dump

╔═══════════════════════════════════════════╗
║         ME Analyzer v1.307.0 r374         ║
╚═══════════════════════════════════════════╝

╔═════════════════════════════════════════════╗
║              complete.bin (1/1)             ║
╟─────────────────────────────┬───────────────╢
║            Family           │     CSE ME    ║
╟─────────────────────────────┼───────────────╢
║           Version           │  12.0.97.3000 ║
╟─────────────────────────────┼───────────────╢
║           Release           │   Production  ║
╟─────────────────────────────┼───────────────╢
║             Type            │   Extracted   ║
╟─────────────────────────────┼───────────────╢
║             SKU             │  Corporate H  ║
╟─────────────────────────────┼───────────────╢
║           Chipset           │ CNP/CMP-H B,A ║
╟─────────────────────────────┼───────────────╢
║ TCB Security Version Number │       1       ║
╟─────────────────────────────┼───────────────╢
║ ARB Security Version Number │       15      ║
╟─────────────────────────────┼───────────────╢
║    Version Control Number   │       70      ║
╟─────────────────────────────┼───────────────╢
║       Production Ready      │      Yes      ║
╟─────────────────────────────┼───────────────╢
║      OEM Configuration      │       No      ║
╟─────────────────────────────┼───────────────╢
║       FWUpdate Support      │   Impossible  ║
╟─────────────────────────────┼───────────────╢
║             Date            │   2025-05-26  ║
╟─────────────────────────────┼───────────────╢
║      File System State      │  Initialized  ║
╟─────────────────────────────┼───────────────╢
║             Size            │    0x77C000   ║
╟─────────────────────────────┼───────────────╢
║       Flash Image Tool      │  12.0.33.1422 ║
╚═════════════════════════════╧═══════════════╝
╔═════════════════════════════════════════════╗
║         Power Management Controller         ║
╟─────────────────────────────┬───────────────╢
║            Family           │      PMC      ║
╟─────────────────────────────┼───────────────╢
║           Version           │ 300.2.11.1025 ║
╟─────────────────────────────┼───────────────╢
║           Release           │   Production  ║
╟─────────────────────────────┼───────────────╢
║             Type            │  Independent  ║
╟─────────────────────────────┼───────────────╢
║         Chipset SKU         │       H       ║
╟─────────────────────────────┼───────────────╢
║       Chipset Stepping      │       B       ║
╟─────────────────────────────┼───────────────╢
║ TCB Security Version Number │       3       ║
╟─────────────────────────────┼───────────────╢
║ ARB Security Version Number │       3       ║
╟─────────────────────────────┼───────────────╢
║    Version Control Number   │       0       ║
╟─────────────────────────────┼───────────────╢
║       Production Ready      │       No      ║
╟─────────────────────────────┼───────────────╢
║             Date            │   2020-02-06  ║
╟─────────────────────────────┼───────────────╢
║             Size            │    0x14000    ║
╟─────────────────────────────┼───────────────╢
║       Chipset Support       │      CNP      ║
╚═════════════════════════════╧═══════════════╝

Press enter to exit

C:\Clean\MEA>

As mentioned in the linked post you need some information about versions and platforms your host uses. If you see “File System State” Initialized it could be the reason why ME / AMT wont show up on boot.

(3) Modify and Create the new SPI Dump

Use FIT to open the SPI Dump

fit_1
fit_11208×784 35.1 KB

Now, activate the AMT Features

fit_2
fit_21064×695 32.8 KB

fit_3
fit_31190×843 43.9 KB

Now exactly follow the guide [Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization Section 4D - Important: Remeber that you work with a full SPI Dump, not a region.

I ignored the whole KEY SSL HASH Chapters because i dont work at the TXE Part on ME

Importand is

  • Modify the Build Settings
  • Modify AMT Settings
  • Replace the ME Sub Partion.bin in the Decomp Folder with the correct Version from CSME 12 Repo (in my case 12.0.68.1606_COR_H_BA_PRD_RGN.bin)

now build the image. a file named outimage.bin with the same size as the original SPI Dump should be created.

Analyse the newly created dump with MEAnalyser and UEFITool_NE. The parameter “File System State” should now be “Configured”. Chipset, SKU, Release should be same as in the original dump. UEFITool_Ne shoudn’t show any errors. In my case a unknown version of the FD was marked. I compared the content of the old and the new one and they were exactly the same.

Now it comes to the dangerous part. Shutdown your host and set the Service Mode Jumper. You are now officaly allowed to overwrite the SPI (with all the risk that comes with it )

(3) Flash SPI

fptw64.exe -f outimage.bin

Now you have to wait. Maybe five minutes or so. Do never never never interupt this process. The tool will confirm the successful flash.

If something is wrong in the new binary so your host wont come up, this will be your last chance to access the OS.

fptw64.exe -greset

now wait. your host will go off and on and off and on. And you done everythin correct, you will be greeted with the Dell Logo. Press F12 to enter Boot Menu.

Don’t be disappointed because you don’t see any MBEX / AMT entries. Thats because the service mode jumper is still set.

Power Down Host, remove Jumper, and power on again. The Host will go on and off again multiple times. Press F12 again to get the Boot Menu. Now you should see the MBEX Menu entry. Go into MBEX set Password, Management Features and dont forget to activate and configure network.

Now. Youre done ! Congratulations

Your next steps should be download latest Dell Bios Package and install to get the recent ME Firmware. Use MeshCommander to connect to the ME Platform and active KVM SOL or what you need.

To be clear: This guide is without any warranty. I bricked a Dell 5060 Host two years ago by flashing a bad firmware. So, in the worst case, you maybe have to desolder the SPI and reprogramm it with your backup. See Bricked Dell Optiplex 5060 + CH341a + SOP16 > Alive again

Good luck and thank you @lfb6 and @plutomaniac for your provided information. Without that, the whole process wouldn’t be possible.

1 Like