Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

What chip spı. a new BIOS, the motherboard is running?

Intel Management Engine Interface (MEI) Version 11.0.6.1194 WHQL

http://www.station-drivers.com/index.php…id=2274&lang=fr

Intel ME 11.0 Consumer PCH-H Firmware v11.0.12.1008

Capture.PNG



Note: Version Control Number (VCN) was increased to 15. No downgrade via FWUpdate possible after updating.

MEA: 11.0.12.1008_CON_H_XX_PRD_RGN_49ED162DB0782256B26C9BC61049E3090B0CEEB1_SHA1

Thanks to Pacman/SD for the newer firmware.

@ tObber166:

Intel Management Engine: Drivers, Firmware & System Tools (145)

@ kaptanedi:

The SPI has regions such as Flash Descriptor, ME, GbE, BIOS etc. BIOS is just one of it’s regions. We tend to say that SPI=BIOS but that’s not the case. It’s just a way to not confuse those who don’t know. So yes, you need to reflash your “BIOS” chip.


you checked on the integrity?

i try again to upgrade gives an error, 8703: PLEASE REBOOT YOUR SYSTEM. Firmware update cannot be initiated without a reboot.
better not to restart the pc)))) better to be safe and reflash via FPT.


you checked on the integrity?




It is strange, that is the error i got the first time i flashed it, second time worked, also i flashed it on my backup BIOS, but then it worked right away.
Try flashing it again, i don’t know if there is some bug or something with FWUpdate 1205.

EDIT: Try a global reset, and flash again.

Pacman Yes, the second time everything turned

OK, great
Feels like we need to find a newer version of FWUpdate soon.

Just corrupted my MEI with the 11.0.12.1008 con h 1.5m firmware on a Gigabyte GA-Z170 HD3 DDR3.



Could not boot into Windows after that, recovered the UEFI with my SPI programmer.

Does someone that has successfully updated their firmware have a SHA1 checksum for the file “ME Firmware 11.0.12.1008_CON_H…bin” ?

My file SHA1: a401578c690fa478c5b015416269180467033131

I am not game to flash it again just yet.

I updated successfully after second attempt, like jixaker.

Not sure what is the problem with this version.

sha1.png

@chinobino
watch 5 Posts above yours




Why didn’t you use your Dual Bios Feature do undo your work? wouldnt that be easier?
Please send me a dump of the bios after you updated your Firmware.



Why didn’t you use your Dual Bios Feature do undo your work? wouldnt that be easier?
Please send me a dump of the bios after you updated your Firmware.




That is the SHA1 of the LP FW.


EDIT: I used 7-Zip to calculate the SHA1, but MEA SHA1 is different, it seems possible that the FWUpdate version we have is to old.

My Fault, sorry quoted the wrong post :wink: Edited it



My mobo has no BIOS switch, I tried for half an hour to get the backup BIOS to kick in but because the system could still POST it would not switch over.

Here is a dump of the corrupted BIOS F6a after the failed update –> GA-Z170-HD3_DDR3_BIOS_F6a_CORRUPT.zip

I tried again using the supplied FWUpdLcl64.exe and received the same error msg;



And here is MEInfoWin64’s output after failed update (I have not rebooted yet);



Once I reboot I will not be able to boot into Windows again and will have to re-program the mobo flash rom again - unless there is something else I can do? (I’m open to suggestions)

Ok, something is wrong either with FWUpdate 11.0.0.1205 (latest as of 11.0.10.1002 package) or the latest 11.0.12.1008 firmware. So, do not flash it until we know more. I have reverted back to 11.0.11.1005 at the first post.

Regarding the hash, MEA calculates the SHA1 hash of the firmware’s RSA signature which is 100 bytes and close to the FTPR section’s $MN2 manifest. Yes I know you don’t understand these details but here is a picture:

MN2 RSA Hash.PNG



@chinobino

Based on what you uploaded, do not shut down your system! Your dump is empty, are you sure you did it properly? Did you use FPT and accidentally deleted the SPI contents? FWUpdate can’t cause such an issue. Do you have an unlocked flash descriptor to reflash your entire SPI image from a backup or similar?

@plutomaniac

The first dump was from the first failed MEI update - I examined with a hex editor and was very confused by all the F’s - where’s my BIOS gone lol!

Compressed BIOS file size 9KB - yeah that’s very bad!

Here is a BIOS dump from this system as it is running now;

GA-Z170-HD3_DDR3_BIOS_F6a_CORRUPT2.zip

It still retains some parts but you can see all the deleted areas…

I used the supplied FWUpdLcl64.exe (I never use FPT for anything).

I have a flash programmer (and another of the same motherboard) so I should be able to recover the system again, after removing my graphics card to get the mobo battery out again.

Pretty tired now - might leave the PC on and do it tomorrow (10:45pm here).

@ everyone that tried to flash 11.0.12.1008 PCH-H:

What filename did the firmware have? Was it the one I have uploaded or the one from SD? I think that file had two dots in the end by accident. Maybe these confuse FWUpdate or something. Or maybe it’s just old. But in such case, wouldn’t any PCH-LP CON/COR user with 11.0.12.1008 (released the past days) complain as well?

@chinobino

You must not be dumping it properly. Only the BIOS is there. If you are using some software tool, it is bound by the Intel Flash Descriptor. If that is locked then you cannot dump any protected regions such as FD, ME and GbE. You can check if it’s locked quickly via FPT. If command fptw -d spi.bin results in cpu access error or similar then it’s locked.

@Wootever

Before releasing you new mod with 11.0.12.1008 at the Consumer PCH-LP machine that you have, did you first flash it via FWUpdate by any chance or FPT directly? If you flashed via FWUpdate, did it work properly?



I noticed the double dots also so I renamed the file to MEI.bin.



The first dump was made using SP8-F SPI programmer - I think I made that dump before I realised I had accidentally left the mobo battery in - so it is probably corrupted as the data lines had additional external power.

The second dump was made using Universal BIOS Backup ToolKit 2.0 while the machine was on and the Flash descriptor was likely locked (i.e. I could not flash the MEI firmware twice).

Here is a third dump I made using Gigabyte’s @BIOS software (flash descriptor also likely locked);
GA-Z170-HD3_DDR3_BIOS_F6a_CORRUPT3.zip

I have now recovered the system using @BIOS to flash the F6a BIOS in Windows.

I assume that none of the dumps are likely to be helpful?


So even the first time you tried to update, you changed the filename to MEI.bin and not the original? If yes, we can safely disregard the double dot mistake as the cause of the FWUpdate’s problem (if that’s where the problem is).


You have a Gigabyte system, they tend to leave the FD unlocked. Not sure about their recent (SKL) policy though. I know that everything pre-SKL was unlocked.

Anyway, the 3rd dump is full. The ME region however is indeed corrupted. There are two regions that FWUpdate send to the ME to validate and update: FTPR and NFTP. At your dump, your FTPR is of version 11.0.12.1008 but it’s half-flashed or so as it’s missing many parts. Your NFTP section is left at 11.0.11.1005. It seems that during the update, only the first of the two sections got half-updated and then got stuck (at 77% as shown at your picture). Why, I don’t know yet.


I tried both methods and verified it by using MEInfo. As far as i can tell they are both working fine on my device.

Edit:
I also updated my Z170 Mainboard with the PCH-H v11.0.12.1008 firmware via FWUpdate, didn’t encounter any issues.

Updated with FWUpd x64 11.0.0.1205

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
 
Intel(R) MEInfo Version: 11.0.11.1002
Copyright(C) 2005 - 2016, Intel Corporation. All rights reserved.
 

Intel(R) ME code versions:

BIOS Version 1801
MEBx Version 0.0.0.0000
GbE Version 0.7
Vendor ID 8086
PCH Version 31
FW Version 11.0.12.1008 H
LMS Version Not Available
MEI Driver Version 11.0.5.1189
Wireless Hardware Version Not Available
Wireless Driver Version Not Available

FW Capabilities 0x31111D40

Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Intel(R) Platform Trust Technology - PRESENT/DISABLED

TLS Disabled
Last ME reset reason Power up
Local FWUpdate Enabled
BIOS Config Lock Disabled
GbE Config Lock Disabled
Host Read Access to ME Disabled
Host Write Access to ME Disabled
Host Read Access to EC Disabled
Host Write Access to EC Disabled
SPI Flash ID 1 C84018
SPI Flash ID 2 Unknown
BIOS boot State Post Boot
OEM ID 00000000-0000-0000-0000-000000000000
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer 0x00000000
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
M3 Autotest Disabled
C-link Status Disabled
Independent Firmware Recovery Disabled
EPID Group ID 0xF91
OEM Public Key Hash FPF 0000000000000000000000000000000000000000000000000000000000000000
OEM Public Key Hash ME 66687AADF862BD776C8FC18B8E9F8E20089714856EE233B3902A591D0D5F2925
ACM SVN FPF 0x0
KM SVN FPF 0x0
BSMM SVN FPF 0x0
GuC Encryption Key FPF 0000000000000000000000000000000000000000000000000000000000000000
GuC Encryption Key ME 6DB65FD59FD356F6729140571B5BCD6BB3B83492A16E1BF0A3884442FC3C8A0E

FPF ME
--- --
Force Boot Guard ACM Disabled Disabled
Protect BIOS Environment Disabled Disabled
CPU Debugging Enabled Enabled
BSP Initialization Enabled Enabled
Measured Boot Disabled Disabled
Verified Boot Disabled Disabled
Key Manifest ID 0x0 0x0
Enforcement Policy 0x0 0x0
PTT Enabled Enabled
PTT Lockout Override Counter 0x0
EK Revoke State Not Revoked
PTT RTC Clear Detection FPF 0x0
 

Thank you Wootever, so both 11.0.12.1008 CON-LP and CON-H worked with FWUpdate 11.0.0.1205. I assume the problem is with FWUpdate, it may be buggy under certain circumstances only. Hopefully we’ll find a newer version soon, if there is one.