Lenovo M92p Q77 Tower BIOS Bricked - Recovery with CH341A Programmer SUCCESS.

Yes, that would be it @gloobox - this means Disable ME (and FD unlock) FPT error would only appear after you remove the jumper again. Please note, he mentioned you need to reboot twice with the jumper on before it’s enabled.
Unless, there is some other “Service” jumper, I don’t know for 100% sure, I don’t have this board, only know what I see on page one (FPT Full flash confirmed at post #15) and that worked without issue @Spam00r - can you please confirm above is correct jumper

@Lost_N_BIOS
I just found an interesting thing that the whole bios I dumped by fpt was 10,485,760 bytes(command:fpt -d x.bin),but the bios I dumped by the spi programmer was 10,485,888 bytes(two bios file,one is 2,097,216 bytes,the other is 8,388,672 bytes).
I also want to mod the whole bios dumped by fpt.and split the it to 2 bios file,and flash it by the spi programmer.
And did you think anything wrong with this method?

@gloobox - Zip all that for me info a single package, so I can look at what you are seeing, and see if I can tell you why (It should all be same/same). Sometimes FPT will skip dumping a NVRAM volume in BIOS region, but it would replace that with exact same size padding instead.
Maybe (I think) your dump from programmer is wrong size due to software used or some choice made in software etc?

I have a few dumps from other users with programmer, and FPT, I checked and all are same size as expected -
10MB entire SPI dump from FPT or programmer (compiled) >> 10,485,760 bytes (A00000h)

2MB rom dump should be >> 2,097,152 bytes (200000h)
8MB rom dump should be >> 8,388,608 bytes (800000h)

It cannot be larger than those sizes for either chip, that is exact chip length and more cannot be written or dumped than that amount.

You can split it before you mod if you want, but it’s not required and I suggest against that in this case due to where the split is (middle of BIOS volumes). Some tools could work with that, but it may cause corruption on recompile so I wouldn’t do it that way.
Dump entire BIOS by FPT, mod it as you want, then split to flash back with programmer (or as whole with FPT) You only need to split the 10MB file if you plan to program it back with programmer.
Make sure you split at above mentioned size intervals, 8MB is first in 10MB FPT dump, 2MB last, and the split will be directly in the middle of BIOS volumes, so data will be present exactly at the cut

@Lost_N_BIOS
This link contains 10MB bios file and part of bios file and part of ME file.
I dumped them all by FPT.
http://s000.tinyupload.com/?file_id=01042046059794237776

This link just 2 bios files
http://s000.tinyupload.com/?file_id=72666155301176543479

Thanks!!!

These dumps are incorrect size as mentioned above >> LENOVO IS7XM 2 bios 9SKT70AUS
This is due to programmer/software issue, 64byte / 0x40h of FF padding added on end of each file. This is wrong, you cannot dump or write that much to these chips, so software/programmer issue

Other package contains correct sized files (FD/GbE/ME region + BIOS region) - if you split 10MB FPT file to program back, or after you edit as a whole to then program back, split at 0x800000h

@Lost_N_BIOS
Actually,I flash it back to the IS7XM mobo with the bios file of “LENOVO IS7XM 2 bios 9SKT70AUS”.
It’s well,with no any problem.The machine worked.

I’d try to dump it again by SPI programmer and see what would happen.

@Lost_N_BIOS
I feel so weird that I dumped it again by SPI programmer,the 8MB bios size was 8388608 byte,and 2MB bios was 2097152 byte.
But it proved that you are right.Thanks again!!!

edit:
What’s more,I found something useful about flashing the bios.

Some of LENOVO H61 mobos(eg:LENOVO ciH61mi v1.0) were stuck in supporting 32nm CPU only.Someone could flash it forcibly with another brands bios which supports 22nm CPU.

Here is the link:
http://s000.tinyupload.com/?file_id=38770599935343911897

The route is:
1.Disable ME.(CHKME.exe)
2.Flash the new bios.

There is a batch processing(flash.bat) which could disable ME when running at the first time and flash the new bios when running at the second time.
What do you think about the CHKME.exe and RSTME.exe?Could it be useful for another mobos of LENOVO or even other brand’s?

@gloobox - this is due to your software/dumping method, I’ve noticed all BIOS dumps you’ve sent me have same problem. Just use different software and then it will work properly.
As it was with how you were doing, it may write back in correctly, but I’d not even take that chance or waste time trying etc.

About the 32nm / 22nm thing you mentioned above, and flashing in some other brand BIOS. That may work, but wouldn’t the more ideal thing be to do those same changes to the correct BIOS for that system?
I guess maybe full ME FW Major version may need updated from original system first, then do those mods, that may be why they’re using some other BIOS model instead since it has the updated ME FW type.
But, since you’re disabling ME FW, it may not matter, I would try that with the original model BIOS and see what is the outcome.

I don’t have any opinion about chkme.exe, never heard of this. RSTME.exe never heard of either. If it’s similar to ME Cleaner, not ideal way to do things, I’d prefer to use FITc when possible, and if you are disabling ME FW that can easily be done with FITx by changing one setting usually.
Ohh, I checked the download, I see now, these are OEM BIOS flashing tools. I think these are just temp ME Disable (or more likely FD Unlock/ME Disable) tools so you can flash BIOS or not via FPT, based on what I see in the batch file.
Probably only compatible with certain ME FW versions (V8) or certain chipsets. I don’t see any brand checking in assembly, but text is limited there and doesn’t look like much is going on, but it may be checking brand too and I don’t recognize it.

Sorry I just saw your response now.

Yes I activated manually with a key.

It is possible that the BIOS never had a DPK. I never came around checking this before the BIOS crashed, as everything was running fine and Windows was activated before my troubles started.

Basically I have Installed windows once on a DPK activated Lenovo and than used that image to install it other lenovos. Actually this one M92p we are dealing in this post with still has a windows sticker, so it may be possible that this key was never embedded in the BIOS. But as I never had to eneter any key, I thought that windows took the key from the BIos. WIndows never asked me for a key up to now.

I think the windows not activated anymore came from doing too many hardware changes and not from the BIOS issues. Who nows? I ended up activating windows manually.

Also on my other Lenovos that have a DPK, WIndows gets deactivated after too many hardware changes and it does not activate itself.

I now also have a M92p that has no Sticker key and DPK. If I feel like it I will dum that units bios and flash it on the older M92p to check wether it will have DPK afterwards.

@gloobox : The jumper is the correct one and you have to reboot twice for Disable ME to work.

After the experience form this post I made FPT backups from all of my Lenovos. If something like this happens again, I will have backups. This is essential for the Lenovos as unlike with other boards, you can not just use the Bios file downloaded from the Manufacturer and flash it.

@Spam00r
Thanks!!!What is the " reboot twice " mean?
Was it the right route?
Once I short the jumper,launch the machine,enter the bios,and press "Ctrl+Alt+Del" to restart.And I should do it twice.
And then I could enter the DOS or Windows,and use FPT to flash the modded bios?

What I mean with " reboot twice " is that. After setting the jumpers and booting up to windows, I tried to dump the Bios, but FPT was still unable to dump giving the same error message as before changing the jumpers.

Only after another restart of the PC, I could dump without errors.

Apparently the systems needs to start up fully twice with the jumpers moved to allow the dumping. After that however, the dumping is possible as long as the jumpers remain at the disabled position.

I’m a bit late for this thread anyways I’m grateful for Spam00r & Lost_N_BIOS for having this discussion on M92P bios fix. And it saved my IS7XM mobo.

@Spam00r
Is it you mean that dumping full bios needs " reboot twice " ?
What I want to know more is :
Could you ever tried to flash the bios which was modded into this mobo after rebooting twice?

I flashed the Bios that Lost_N_BIOS posted above without any issues. How far reaching his modifications were, he may explain in more detail.

@gloobox - put on jumper, boot to windows, shut down, boot to windows again (= reboot/boot twice) then FPT dump or boot to DOS and FPT dump or flash etc. I assume, booting 3-5-10 times is fine too, just not once

@Lost_N_BIOS
I had done as you said,and tried 10 times rebooting but failed all the time.I still couldn’t flash the modded bios with FPT on IS7XM.

@Lost_N_BIOS
Awesome!I found something new in this bios.When I open the AMIBCP,turn to page of the BIOS Strings,you will find many term which don’t show in the page of SETUP Configuration.
Such as the term of “Me FW Image Re-Flash”

a1.jpg



On the other hand,I found "Me FW Image Re-Flash"in the uefitool,and it located the text is in the GUID: 97E409E6-4CC1-11D9-81F6-000000000000 of Setup module.But I still couldn’t find the “Me FW Image Re-Flash” in the txt file after extracting by the IRFExtractor.

a2.jpg



Could you help to show it?I think it could help to flash the modded bios.
I have uploaded the full bios dumped file.
http://s000.tinyupload.com/?file_id=44032817384309265809

@gloobox - Yes, this often left in BIOS strings, also sometimes you see internal AMI stuff, under language name (AMI something)
This option is removed from BIOS, only left in strings (This is text string only 97E409E6-4CC1-11D9-81F6-000000000000), thus there is no BIOS option for that so you don’t see in IFR
This is very common with removed BIOS options, but strings left in, due to lazy engineer building on base BIOS and removing options but leaving string

Are you giving me random BIOS unrelated to thread board again?

What error are you getting when trying to FPT Flash? If 28, try PRR/PRR2 tool

@Lost_N_BIOS
Thank you for your explanation!
This topic we talk about the M92p Q77 Tower BIOS,and the bios I memtion is M92p too.I’m trying to solve this problem in flashing the modded bios of this machine.
It would only show error 280 in these mobo even I shorted the ME_DIS jumper.I will try pin-work to see if something would change when I got these mobo next time.