Hi all,
I want to clean ME region for an Apple Macbook A1425.
When reading the dump EFI file, ME Analyzer tells that ME is 8.0.4.1441, so I used logically "Intel ME system tools v8 r3".
I used both FITC v8.1.40.1456 and FITC v8.1.10.1286 to open the file, and I get the same error in both case:
"Decomposed VSCC 0x20092009 does not match default VSCC 0x200D200D. Forcing to default."
Does that mean the dump is not good? I found another one on internet, but exactly same message.
Any help on this?
AFAIK this warning can be ignored as the FITC settings before and after it “forces” to default remain exactly the same. Is your goal to follow [Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization or something else?
Thank you for the clarification.
I am following this video:
https://www.youtube.com/watch?v=exfG5Iywmjk
It is the first time I do that, so I am learning.
When reading your guide, at first glance it seems similar, except that in the video it goes to Apple EFI repository (https://github.com/gdbinit/firmware_vault) to find the new clean ME region, and in your guide it is in “Intel (CS)ME, CS(TXE), CS(SPS), PMC & PCHC Firmware Repositories”, correct?
I also saw another video, using Intel ME/TXE injector and the "Intel (CS)ME, CS(TXE), CS(SPS), PMC & PCHC Firmware Repositories"
All these 3 ways will lead to a correct EFI file?
The procedure in the linked video is ok, albeit more confusing than it should be in my opinion. As for these "ME/TXE injector" utilities, ignore them because they are utter junk.
Regarding taking the (CS)ME EXTR region from the official Apple SPI/BIOS image, it is a good idea. Unfortunately that repo is very outdated. I actually keep a very large collection of stock/official Apple EFI and I was thinking of creating a github repo but there are some issues (repo size, latest only or all, what is public-public instead of dev/beta-public etc).
Anyway, for your system, the latest official Apple EFI is "MBP102_F000_B00_2020-04-12_14-56_D3A8FB97.scap". I extracted the ME EXTR region from the scap file for you so instead of following the cleanup guide, you can simply use UEFITool and replace the dumped ME region with the attached one (check that the total sizes are the same and add padding at the end if needed).
MBP102_ME.rar (940 KB)
Thank you for you support on this. The more I dig, the more I have questions.
When I extract ME region from the Apple EFI repo with the latest file available there: MBP102_010E_B00.scap, the ME region file is 1 409 024 bits.
The file you attached is 1 634 304 bits, and when I check it with ME Analyzer it says: "File size exceeds firmware, unneeded padding!"
So: can I use your file, even it is bigger?
If I check in the "Intel ME 8 Firmware Repository Pack r20", I see there is a file called 8.0.4.1441_1.5MB_PRD_RGN.bin, which size is 1 560 576 bits. Would this be also ok, although also bigger? And although it is type "Stock"?
You mention: "you can simply use UEFITool and replace the dumped ME region with the attached one". I have no idea how to do that, in the video he uses FITC to build the image, after replacing the ME region file. When I read you guide, in step 7, it says also: "Go to the already open FTOOLC window, click the "Build Image" icon", so you use also FITC/FTOOLC, not UEFITool?
About creating an Apple EFI repo, why not updating the existing one? Joining forces? Indeed it is outdated.
I am true if I say that at the end, outdated is not so critical? For what I understand the important is clean ME region. Then, if I reinstall an OS and look for updates, I will automatically have the newest EFI installed?
To learn more about ME firmware and the structure of the SPI/BIOS chip, read section B of Intel Management Engine: Drivers, Firmware & System Tools.
The CleanUp guide is used to take a dumped ME firmware and remove any Data Initialization (dirt) so that it can be transferred/used on another system. If you already have a Configured ME firmware (non-Initialized) from the OEM, you don’t have to follow the guide.
In your case, you can take/extract the Configured EXTR ME region from the stock Apple EFI and transfer it to the dumped SPI image either manually using a hex editor (i.e. HxD) or via UEFITool (easy). At UEFITool, all you have to do is “Replace as is…” the ME region with the attached one. The SPI/BIOS chip before & after ME region sizes must match so padding may need to be added to the end of the smallest one using a hex editor.
As for the EFI collection, it has to be a new repository because I do things differently & better in my opinion. I have my own scripts, EFI naming/identification etc. But the aforementioned issues have made its creation not possible so far.
Ok thanks, I know a bit more today. But it is quite a complex system (and many systems also…)
About “Replace as is…” in UEFITool: this option is kept grey, not active for me. I tried with different dump, same story.
I have a question about my dump for the A1425. When opening it I got the following messages:
parseVolumeHeader: unknown file system E3B980A9-5FE3-48E5-9B92-2798385A9027
checkTeImageBase: TE image base is neither zero, nor original, nor adjusted, nor top-swapped
checkTeImageBase: TE image base is neither zero, nor original, nor adjusted, nor top-swapped
parseFptRegion: FPT partition table header checksum is invalid
I don’t have such errors with other dumps I got from other machines. So not sure if my dump is good. Same issue with the one from internet for A1425 also. I attached the dump here, maybe you can have a look. The issue I have with this Macbook is that it is really slow, but Apple ASD test does not find anything wrong… So for what I have read it could be a corrupt BIOS, so now I am learning BIOS stuff!
a1425.rar (4.29 MB)
You are using UEFITool NE which does not support editing at this point. Check the UEFITool link from my previous post.
You can ignore these.
Regarding firmware corruption, you can use MEInfo tool with "-fwsts" parameter to check the status of the ME. If that’s the problem, you can follow the instructions above. If the BIOS is problematic, you can use the internet dump but it is a good idea to first move certain model specific info (serial number etc) from the current/old BIOS to the new. Do you have a dump of the current/old/corrupted SPI/BIOS image? If yes, @Lost_N_BIOS might be able to move the BIOS info because that is a bit more difficult.
Indeed it was UEFITool NE. With the one you provided, insertion works. Also, the messages when I open the dump are different, not so frightening:
parseVolume: unknown file system E3B980A9-5FE3-48E5-9B92-2798385A9027
parseVolume: unknown file system 153D2197-29BD-44DC-AC59-887F70E41A6B
parseVolume: unknown file system 153D2197-29BD-44DC-AC59-887F70E41A6B
parseVolume: unknown file system FFF12B8D-7696-4C8B-A985-2747075B4F50
I also noted that with UEFITool NE I was able to see inside for example the ME region folder (FPT partition table, padding…) which I don’t see anymore with UEFITool 0.28: No problem with that?
So I created a new dump with UEFITool and the extracted ME region you provided. The size of the dump is the same as the original, although your ME region.bin file was bigger than the one present in decomp folder. Does that mean that UEFITool does the padding automatically? I don’t understand why, when I use FITC, in the folder decomp I have the file ME region.bin with a size different than if I “extract as is” from UEFITool?
Now MEInfo tool. I used the one in the folder Intel ME System Tools v8 r3 > MEInfo > Windows
I got the error: Error 9460: Unknown or unsupported hardware platform
I got this error either when I run it as admin or from the cmd window as admin in the folder > Windows with the command MEINFOWin.exe -verbose, or -fwsts
What is wrong here?
I will test the new dump as is and give you a feedback, to see if it is needed to move the model specific info.
A lot of questions, thank you for your patience
NE is the "New Engine" of UEFITool with support for many new things (including ME region parsing) but it does not support editing yet so that’s why you need to use the old versions.
Ignore the Decomp folder. Ignore Flash Image Tool for now. All you need to do as a first test is to replace the ME region using UEFITool and then flash back the result to see if the problem goes away and what MEInfo reports. Just make sure that during UEFITool > ME region > "Replace as is…", the size of the old and new ME region is the same.
You cannot use MEInfo tool when the ME firmware is not working.
Just make sure you keep a full SPI image backup before you re-write the firmware so that it will even be possible to get such info back when the true problem is resolved.
Result is not good, same slowness. I tried with several other dumps from internet, as is and after updating the ME region (I saw how to check the size, good tip), some gave even more problems: SSD not visible, quarter fan spin then nothing… interesting at least, I could not imagine that such problems could come from BIOS.
This I don’t understand. Do you mean that I should use MEInfo tool directly on the A1425?
Don’t try other dumps and never with a dirty ME firmware. You either follow the CleanUp Guide on them or do the UEFITool ME region Replace as is procedure as explained above. Define slowness please. Slow to boot or slower in general? What does MEInfo -verbose report after you’ve repaired the ME firmware? Also, do you have a backup of your original SPI/BIOS chip image before any alternations, re-flashes etc?
Can you explain what do you mean with "You cannot use MEInfo tool when the ME firmware is not working"? Should I run MEInfo tool on the A1425?
Slow, when booting and when using. It takes more than 2 minutes to arrive to the password screen, which is very slow for a machine with a SSD; the beach ball appears; when I run the "Intel power gadget", it shows that the processor is used 20% (why? It should be less, but anyway there is margin), no overheating (40ºC) but it is impossible to run the tests (Maximum frequency, 2 thread frequency, etc) because then the graphs become blanks. The test with Apple Service Diagnostics 3S152 did not reveal any issue… and I am stuck.
Indeed I have a backup of the original BIOS.
To get all info via MEInfo utility, the ME firmware of the SPI chip must be healthy/operational. That’s all. Ignore that.
Since you repaired the ME firmware section of the SPI image and the problem remains, the actual problem must be at the BIOS section. For that, you need the help of someone else who knows these things. Your best bet is @Lost_N_BIOS . What I can do is provide the latest BIOS (scap) image from Apple for your system, attached below, which will be used as stock reference.
Good, you need to upload it somewhere so that Lost_N_BIOS can compare the two BIOS images and hopefully fix the problem.
Thank you. This weekend I do mechanics, I will get back to you and Lost_N_BIOS about this next week.
Have a great weekend!
Hello,
I am back. With the file you provided I don’t know how to extract the BIOS.
From the video, from a scap file I understand I can extract the ME region; but this is not the objective here.
If I extract the UEFI image with UEFItool I got a bin file, but with a size of 8320kB after extraction, and I need a file of 8192kB (original size)
If I expand in UEFItool I manage to find a file of 8192kB after extraction, but is this correct? How do I know it is the BIOS I need? There is no specific name
Hello,
anybody can tell me if the volume FFSv2 is the BIOS file, from the scap file posted?
Thanks
hi
I have a similar problem with this machine A1425 which was working fine and then catalina was installed it worked for a week and came back to me for ram beeps.So i started to reball the ram chips on board and also replaced with new one but still same ram beeps.Then i tried a bios from the internet and i got my display but wont boot from ssd i cleaned it with a nice ME still not detecting maybe it is AFS format the drive anyways i used another ssd and format it installed a new macos 10.12 works fine no problem.But a new problem has cropped up if i go 10.13 or higher next reboot i get ram beeps.
This is annoying now as i have tried so many bios.now i dont know is it the firmware or hardware.
@plutomaniac pls help i am lost some where
thanks