LENOVO ThinkCentre M73 Tower, Intel H81 (Lynx Point) NVME PCI-E BIOS Mod + Flash Unlock

Hello everyone! :wave:
Before I start with my problem I want to say some remarks. It may look like a flood, but I feel the need to explain.

First, my native language is not English so I apologize if I make some misspellings.

Second, I repaired and built PC systems from scratch for years and basically don’t remember if I ever had a problem with a BIOS on any types of mobos.Couple times maybe just to recover corrupted ones with manufacturer recommendations. Back in years, Win 95 - XP era I did heavy mods with many types of system files, reversing, using HEX editors etc for my needs. Not any more. Somehow it just doesn’t need me at current times, so knowledge has faded over years, and modding BIOS right now is my first experience in this field and basically I am a noob :crying_cat_face: And last, after spending hours researching, I realized there is a lack of info in the modding community, about mods for OEM legacy mobos from business/enterprise oriented manufactures like HP,DELL, Lenovo. Some, mostly for laptops, but not a lot for office oriented desktops, etc. Everything’s spinning around retail, top end legacy gaming boards from Asus, MSI, AsRock etc. They usually have very complicated BIOS setup menus, with a bunch of options, for tuning, for overclocking, flashing, but not for mobos, like a Lenovo type OEM board, with a simple limited options, mostly loaded with security options, but not for hardware settings. So finally I found this forum, which I learned is probably the best one in the community according to many websites in the world. I spent hours here reading and learning, but still have not found a working solution yet. A lot of info, at many times confusing, my brain overfilled and i may miss some important info :slight_smile: I don’t want to give up, so I decided to ask for help. So thanks in advance for a fix or simple proper way to DIY in that particular case, if it is possible.

Problem: My friend who is a tech for a big insurance company, offered me some office workstation that is supposed to be trashed, because the company is in process of upgrading their equipment, and now have some Lenovo ThinkCentre M73 and E73 tower type PCs. Absolutely in fine condition, only HD removed for security purposes. I decided to create a system for light office use, WEB and some type of media center hub. I am not planning to use it for gaming, so the CPU graphic engine is absolutely fine for my needs. And since the NVMe M.2 2280 slots have been integrated to modern mobos, I use NVMe drives as main storages to install OS and boot into. For years. Never used PCI-E other than for graphics cards or peripherals. This time I had a M.2 224242 SAMSUNG PM991 256GB PCIe 3.0x4 NMMe drive laid around, so I ordered a PCI-E adapter from Amazon. I decided to use it in the empty PCI-E x16 slot as the main OS and boot drive. In fact at the beginning, as only the drive was installed, it looked promising, because I saw a Other Device string in the BIOS boot menu, hoping it would be assigned to that and Windows 11 PRO setup media from the USB drive immediately found stick and installed in less than cpl minutes. But all fun with legacy boards, as many here know now, started at first initial boot. System can’t see the drive and refuses to boot into the OS. It does not appear in BIOS as a valid boot device, Other Device string was empty and not assigned to anything. Board has controllers set as AHCI on default, switching boot priorities on different storage types led to nowhere. No boot. In hope Lenovo has a modern fix for support booting from PCI-E, i immediately flashed BIOS to the latest available to time, FCKT99AUS version, and it did not help. Attached SATA SSD, quickly installed Win 11… Everything’s boot fine and Explorer can see the NVME as a storage drive loaded with Windows just fine, OS clearly communicates with the drive, PCH providing support to it. But not boot from it. So that’s all the story and I am here for a solution :crying_cat_face:

So I am now looking to mod BIOS with a NVME PCI-E support, if possible and most important to flash it back without errors and stops. Because it seems to be the main problem for me now. Modding itself was not that hard, but I can’t flash it back. So 3 questions I need to resolve. Is it due to mistakes I did modding ROM or security locks in the BIOS, as well maybe overall ME settings and FW of PCH?

Collected initial tech info for beginning for a local gurus, maybe enough for conclusion, maybe not. Ready to provide more if it is needed.

Specs:
LENOVO ThinkCentre M73 Tower
Type:10B00006US
Motherboard Model:LENOVO 3098
BIOS Manufacturer: American Megatrends
BIOS Date: 11/18/2020
BIOS Version: FCKT99AUS
PCH: Intel H81 (Lynx Point)
BIOS seems based on AMI core template but coded by LENOVO and signed as Lenovo Setup Utility, no mention of AMI in Setup menus.

M73 IMPORTANT LOGS, REPORT.rar (39.0 KB)

Thank you for answer! I read this posts before. One has nothing useful, but another help a bit. I missed some steps, i admit it and did some corrections. There a confusing result. I used FPT with a -bios -d entry and was able do a region dump without problem. Than flashed it back un-moded without errors. That what CodeRuch was recommended to checking locks.

Than i try to mod region dump with UEFITool 0.28. Checked for pad files Seems all ok and attempted to re-flash it again. Numerous sequences to write detected error pop up. Powered of system, cleared CMOS. Booted back and try to do dump again. FD Read/Write Protected error. So used service pin on mobo, booted back. Able to do dump and another error this time.


I may missing some points Very frustrating. There no samples of successes on this type of Lenovo motherboard to follow like on numerous guides for Asus MSI and etc… Still digging and try…

Verbose from MEinfo

Intel(R) MEInfo Version: 9.1.20.1020
Copyright(C) 2005 - 2014, Intel Corporation. All rights reserved.

FW Status Register1: 0x1E000245
FW Status Register2: 0x60002306
FW Status Register3: 0x00000200
FW Status Register4: 0x00004000
FW Status Register5: 0x00000000
FW Status Register6: 0x30000020

CurrentState: Normal
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: M0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
Phase: HOSTCOMM Module
ICC: Valid OEM data, ICC programmed
ME File System Corrupted: No

Get ME FWU version command…done

Windows OS Version : 6.2.9200 “”
OS BIOS Support : UEFI

Table Type   0 ( 0x 00 ) found, size of  24 (0x 18 ) bytes 

Windows OS Version : 6.2.9200 “”
OS BIOS Support : UEFI

Table Type   0 ( 0x 00 ) found, size of  24 (0x 18 ) bytes 
Table Type   1 ( 0x 01 ) found, size of  27 (0x 1B ) bytes 
Table Type   2 ( 0x 02 ) found, size of  15 (0x 0F ) bytes 
Table Type   3 ( 0x 03 ) found, size of  25 (0x 19 ) bytes 
Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
Table Type  10 ( 0x 0A ) found, size of  12 (0x 0C ) bytes 
Table Type  11 ( 0x 0B ) found, size of   5 (0x 05 ) bytes 
Table Type  12 ( 0x 0C ) found, size of   5 (0x 05 ) bytes 
Table Type  24 ( 0x 18 ) found, size of   5 (0x 05 ) bytes 
Table Type  32 ( 0x 20 ) found, size of  20 (0x 14 ) bytes 
Table Type   4 ( 0x 04 ) found, size of  42 (0x 2A ) bytes 
Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes 
Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes 
Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes 
Table Type  16 ( 0x 10 ) found, size of  23 (0x 17 ) bytes 
Table Type  17 ( 0x 11 ) found, size of  40 (0x 28 ) bytes 
Table Type  15 ( 0x 0F ) found, size of  73 (0x 49 ) bytes 
Table Type  20 ( 0x 14 ) found, size of  35 (0x 23 ) bytes 
Table Type  17 ( 0x 11 ) found, size of  40 (0x 28 ) bytes 
Table Type  20 ( 0x 14 ) found, size of  35 (0x 23 ) bytes 
Table Type  19 ( 0x 13 ) found, size of  31 (0x 1F ) bytes 
Table Type 140 ( 0x 8C ) found, size of  19 (0x 13 ) bytes 
Table Type 140 ( 0x 8C ) found, size of  23 (0x 17 ) bytes 
Table Type 131 ( 0x 83 ) found, size of  22 (0x 16 ) bytes 
Table Type 136 ( 0x 88 ) found, size of   6 (0x 06 ) bytes 
Table Type 140 ( 0x 8C ) found, size of  85 (0x 55 ) bytes 
Table Type 140 ( 0x 8C ) found, size of  47 (0x 2F ) bytes 
Table Type 140 ( 0x 8C ) found, size of  63 (0x 3F ) bytes 
Table Type 140 ( 0x 8C ) found, size of  17 (0x 11 ) bytes 
Table Type 140 ( 0x 8C ) found, size of  19 (0x 13 ) bytes 
Table Type 131 ( 0x 83 ) found, size of  64 (0x 40 ) bytes 
    MEBx Version found is 0.0.0.0000 

Get ME FWU info command…done

Get ME FWU version command…done

Get ME FWU feature state command…done

Get ME FWU platform type command…done

Get ME FWU feature capability command…done

Get ME FWU OEM Id command…done
FW Capabilities value is 0x41101960
Feature enablement is 0x41101960
Platform type is 0x71130302
GBE Region does not exist.
Intel(R) ME code versions:

BIOS Version: FCKT99AUS
MEBx Version: 0.0.0.0000
Gbe Version: Unknown
VendorID: 8086
PCH Version: 4
FW Version: 9.1.1.1000 H
LMS Version: Not Available
MEI Driver Version: 11.0.0.1166
Wireless Hardware Version: Not Available
Wireless Driver Version: Not Available

FW Capabilities: 0x41101960

Intel(R) Active Management Technology - NOT PRESENT
Intel(R) Standard Manageability - NOT PRESENT
Intel(R) Anti-Theft Technology - PRESENT/ENABLED
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Service Advertisement & Discovery - PRESENT/ENABLED
Intel(R) NFC Capabilities - NOT PRESENT
Intel(R) Platform Trust Technology - NOT PRESENT

TLS: Disabled
Last ME reset reason: Power up
Local FWUpdate: Enabled

Get BIOS flash lockdown status…done
BIOS Config Lock: Enabled

Get flash master region access status…done
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: C22017
SPI Flash ID VSCC #1: 20452045
SPI Flash BIOS VSCC: 20452045
Protected Range Register Base #0 0x440
Protected Range Register Limit #0 0x66A
Protected Range Register Base #1 0x66E
Protected Range Register Limit #1 0x66C
Protected Range Register Base #2 0x66F
Protected Range Register Limit #2 0x66E
Protected Range Register Base #3 0x674
Protected Range Register Limit #3 0x73F
Protected Range Register Base #4 0x741
Protected Range Register Limit #4 0x7FF
BIOS boot State: Post Boot
OEM Id: 00000000-0000-0000-0000-000000000000
Capability Licensing Service: Enabled

Get ME FWU OEM Tag command…done
OEM Tag: 0x00000000

Get ME FWU Platform Attribute (WLAN ucode) command…done
Localized Language: Unknown

Get ME FWU Info command…done
Independent Firmware Recovery: Disabled

@dedka, look with AMIBCP here
Advanced-PCH Configuration-BIOS Security Configuration-BIOS Lock
Now, CH341 programmer or IFRextractor-EFI shell-set_var xxx,xxx

Thank you! Will check :wave:

@dedka, I want additiv soft for you. Other info in ReadMe.txt
Tnx SoniX aka LS_29
SetVar.zip (1.3 MB)