Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)



I already updated my board from the downloaded ‘11.8.55.3510_CON_H_D0_PRD_EXTR.bin’ that used to be in the Download section. I want to downgrade to the ‘11.8.55.3399_CON_H_D0_PRD_EXTR.bin’ version for one board. Is there any way to extract the dump from the BIOS I want the MEI firmware from? On another board that I flash the ‘11.8.55.3510_CON_H_D0_PRD_EXTR.bin’ firmware I need to flash the same version but with the clean dumped intel regions. When you flash the BIOS to the motherboard it doesn’t downgrade the MEI firmware to the one found in the BIOS. So unless I can extract a dump from the BIOS I think I can’t flash the correct cleaned dumped version.

I wish I had of known this beforehand that it wasn’t as easy as flashing the latest MEI firmware. :frowning:

Yes, open the BIOS you want to extract known working ME version from in UEFITool, expand the Capsule or Intel UEFI section, then you will see descriptor and ME section.
Right click ME and extract, like this. Same for replacing, open BIOS, replace ME with new/other as-is

Extract-Replace-ME.png



ME reflash can be done via the command I gave above, no matter if BIOS reflashing does not do this, the fwupdlcl tool will flash it

Also, sometimes USB Flashback will reflash ME I think, so you can try that too if you don’t want to use the proper Intel ME FWupdate tool tool mentioned above (fwupdlcl)
If you do want to try that, download the Intel ME system tools package in first post section C2, that matches your current ME version type (ie 8, get v8, 9.5 get 9.5 etc)
Or you can use FPT method below to flash everything at once.

You can dump BIOS with FPT - https://www.sendspace.com/file/20hbsl

Here is backup commands for Intel FPT,

Right click main apps folder name while holding shift (ie right click “WIN” folder)
select “open command window here” then run command below

fptW -d backupbios.bin

If the above gives you error about CPU or region access, do the command below instead. If this happens, you will possibly need a CH341A flash programmer ($3 on ebay, get blue/green version not black)
fptw -bios -d biosbck.bin


Also, you can use Intel FPT to flash the BIOS from windows, this will flash the ME region with whatever is in the BIOS, it reflashes all regions of the BIOS (Do backup first, always)
fptw -rewrite -savemac -f bios.bin

After that command run this command to reset the ME state (Or remove all power, unplug from the wall, remove CMOS battery and press and hold the power on/off switch for 5-10 seconds, then wait one minute before putting battery/power back)
fptw -greset

When I ran ‘fptw -rewrite -savemac -f bios.bin’ I got a write protect error but I managed to flash the BIOS with the AMIBIOS and Aptio AMI Firmware Update Utility and then did ‘fptw -greset’ after completely powering off, removing CMOS battery and unplugging the power cord a minute.

Now I just need to make a dump/backup of my current BIOS from the board. How exactly do I do that, please?

Edit: The firmware flash with AFUDOS never worked, I checked the firmware, still 3510. :frowning:

Second edit: USB BIOS Flashback does not downgrade the firmware, still 3510.

@Lost_N_BIOS
what does ‘-savemac’ parameter stand for?



Can you do it from the BIOS from the Asus Website to the newest firmware? I can get the ME .bin from it with the UEFITool.

I ask because I already upgraded the BIOS with the wrong non-Asus MEI firmware and can’t get a proper dump from the board itself. :frowning:

I can get someone to do a dump/backup of the same BIOS without the wrong firmware from a forum I hope. I’ll post the dump here when I get it so you can help me like you said you could.

Thank you!

You wanted ME from some certain board, certain BIOS etc. The only way for that is to dump it, and extract. Aside from that, you are loosing me at what your goal is and why, I showed you already how to update ME with clean/new and you said no, now you want that or no?
If you wanted some ME from BIOS download from Asus, that is same as I already linked you to here in ME repository threads, would need cleaned and settings transferred from your BIOS to target BIOS.
I think you are saying you flashed some new ME firmware, and can’t flash back to older version, is that correct? If yes, then only way to do that is as described above (FPT) and below.
This is due to either Asus lock or sometimes Intel program ME itself to disallow backflash from certain versions to certain older versions

fptw -greset only needs done once you flash the ME FW, which you have not yet, and it needs to be done after the FPT flash parameter was run.
That needs to be done before closing the CMD window, not after powering off etc, but all that power off. remove battery/wall power for 1+ minute negates the need for this command, but only after you’ve actually flashed the ME region.

I didn’t expect Asus would have locked out ME region, sorry it’s unexpected and still does not sound correct to me. So, this command fails for you with error 26? fptW -d backupbios.bin
Then this command with Flash Update program fails also correct? fptw -rewrite -me -f bios.bin << BIOS.bin here, change name to whatever BIOS you have that contains ME you want ME flashed from *remove BIOS from capsule first DO NOT flash an actual “ME” file this way, only complete BIOS files
To flash “ME” file you can use this command from FW Update tool in Intel Flash Programming Tools package - FWUpdLcl.exe -f me.bin << but this method, I would only use a cleaned, updated, settings transferred ME file.

If yes, then you may need CH341A flash programmer, they are only $3, here choose green/blue, don’t get black/gold - https://www.ebay.com/itm/263458010112
Or you can use this method, whichever is easier for you, this or order flash programmer - [GUIDE] Coffee Lake CPUs on Skylake and Kaby Lake motherboards (8)

-savemac saves your LAN MAC ID and other credentials so it does not get overwritten in the FPT flash process. If you already have a valid backup, that you know contains your boards serial, UUID, and LAN MAC ID then you can remove this switch and try the flash via FPT again

I posted link to FPT above in post 4024, with commands to make a backup being the first command I mentioned. You only want a dump from your board for this issue, not another users board or you will loose all credentials (Serial, UUID, DTS Key, LAN MAC ID)
If the above backup command does fail for you, and gives error 26, you can create a good backup with AFU but that wont help you flash ME region
For that you need to either short pins according to the guide linked below, or follow the link I posted above for EFI method, or get flash programmer (Suggested for many reasons )
[Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing

#3 here shows how to make backup with AFU - [Guide] Flashing modified AMI Aptio UEFI using AFU


OR Do you now just want latest BIOS from Asus, updated with latest ME for that series, with clean and settings transferred? If yes, please link board download page again and I will do update for you.

Thank you, here is the download page.

https://www.asus.com/ca-en/Motherboards/…pDesk_Download/

ROG MAXIMUS X FORMULA BIOS 1602 already has latest ME FW version for 11.8 series - 11.8.50.3470_CON_H_D0_PRD_RGN - so no modifications needed. You only need to force ME update to roll it back from 3510

Is your BIOS locked from writing to the ME region? BIOS descriptor says you cannot (Meaning NO write to ME), however board may be programmed differently already, only you can confirm with backup dump via FPT or by trying to dump ME via FPT

Please try running this from command prompt at FPT folder >> fptw -me -d me.bin
Do you get error 26? If yes, it’s ME locked and you’ll only be able to reflash ME in the ways I described above (ie CH341A flash programmer, this method, or by shorting pins on the board)

If it’s not ME locked and you don’t get error then you an update ME in the ways I described above with FPT and complete BIOS, or with FWUpdLcl and an ME file, or if BIOS updater gives “Full Update” option.
Another way is to try making flashback run erase all by renaming the BIOS file to ERALL.CAP

Flash stock BIOS using FPT and this command, if that fails or does not update ME try next command for ME region only.
Files to use for this (extracted BIOS “M10F.rom” and clean settings transferred ME “MExtr.bin”) are linked below
https://www.sendspace.com/file/v3nnrr

fptw -rewrite -me -f M10F.rom << Only use included complete BIOS file for this command, never use “ME” Files

fwupdlcl -f MExtr.bin << ONLY use the included MExtr.bin file for this command, or standard Intel ME.bin files cleaned and settings transferred, and do not use these kind of ME files for any FPT commands

If neither of those work, you will have to try this method, short the pins, or purchase a CH341A programmer

@Lost_N_BIOS
In my case(https://www.gigabyte.com/Motherboard/GA-…support-dl-bios, descriptor is obviously unlocked because I’ve managed to get spi dump) if I want to be sure that full spi(especially ME region) will be overwritten, I can just download stock bios for my motherboard and use fptw -rewrite -f H81MHD32.FB(without .extension) and then fptw -greset?

Thank you for your help, I got it downgraded! The only trick was I noticed my Section_PE32_image_Setup_Setup_body IFR.txt had 0x1 as the value so in the EFI prompt I have to put ‘setup-var 0x705 0x1’ instead of '0x01’

Form: Firmware Update Configuration, Form ID: 0x27AE {01 86 AE 27 16 11}
0x6E9FA Setting: Me FW Image Re-Flash, Variable: 0x705 {05 91 18 11 19 11 53 0B 01 00 05 07 10 10 00 01 00}
0x6EA0B Option: Disabled, Value: 0x0 (default) {09 07 05 00 10 00 00}
0x6EA12 Option: Enabled, Value: 0x1 {09 07 04 00 00 00 01}
0x6EA19 End of Options {29 02}
0x6EA1B Suppress If: {0A 82}

Thanks for all your help. I learned so much.

@KedarWolf - glad you were able to finally get that sorted out! Sorry I didn’t think to check that part of the BIOS, I briefly read that link and thought it was more about booting to EFI and changing the setting, not BIOS mod (I should have known better and will remember in the future!)

@andr84 - yes, if that BIOS includes ME that will work to reflash entire BIOS+ME. extension is fine, or rename file to .bin or .rom
You may be able to choose full update in Qflash instead of quick/fast etc. YOu may need to remove power for 30sec to 1 minute too, not sure if greset applies in this usage.

@Lost_N_BIOS
thank you. So, if I’ll use downloaded stock rom, it’s better to use ‘-savemac’ parameter? In UefiTool I could see Descriptor, ME and BIOS regions (no GbE region ).
If I use command without ‘-savemac’, fptw will skip overwriting of credentials anyway?

Always use it when possible, but my answer is without knowing what you are doing with that stock downloaded rom. LAN MAC ID is not always stored in GbE region, even when there is GbE region.

If you use without savemac, be sure you already have a valid verified backup of the entire BIOS chip via FPT or programmer, in case you loose your board info.

@Lost_N_BIOS
I don’t have enough knowledges for doing something with bios files, so I wanted to use downloaded bios as it is. Thank you, I will use this parameter. That’s all ( fptw -rewrite -savemac -f BiosFile) and no extra parameters need for safe flashing process(when using stock downloaded bios and if manufacturer’s home page provides bios image with descriptor, ME and bios regions)?

@andr84 if you need help with BIOS mod, ask and someone can help. If you are just flashing stock BIOS, don’t use FPT, use the manufacturers normal methods to update BIOS. No need for FPT on a stock non-modified BIOS.

Intel ME 10.0 5MB Firmware v10.0.60.3000

Capture1.PNG



Intel ME 9.5 5MB Firmware v9.5.65.3000

Capture2.PNG



Intel ME 9.1 5MB Firmware v9.1.45.3000

Capture3.PNG



Intel ME System Tools v10.0 r7

Intel ME System Tools v9.5 r6

Intel ME System Tools v9.1 r6

@Lost_N_BIOS
The point is to be sure that all the regions will be overwritten, in Qflash there is no option like ‘quick flash’ or ‘full’ and it’s unclear what it actually rewrites or skips.

Use SPIFlash or EFIFlash etc whatever comes with the BIOS for DOS then, it will update it all except the board specific details.

v9.1.45.3000

@Lost_N_BIOS
Efiflash.exe comes with the bios .zip archive. So, I just need to create a DOS bootable USB(or it must be efi boot) stick and use Efiflash H81MHD32.FB command line and it will rewrite all regions from scratch?