ME FW Recovery

Hello,

Relevant SPECS:


Model: Dell Latitude E5420
CPU: 2520M
Chipset: HM65, ME7.x 1.5 MB


Intro: After selling my old laptop, instead of purchasing a new laptop, I only bought an old motherboard along with its DC cable and corresponding charger and decided to use it as a mini desktop replacement. I was using an eGPU via PE4C w/ GTX 970.

Problem: I dumped my ME FW and modified it using FITC to enable PCIe x2 and proceeded with flashing it in DOS. I later learned that the FITC for ME7 was bugged and caused a semi-brick.

Symptoms: Startup is exceedingly slow. While I am still able to access its BIOS settings, the system halts during the last step of POST which is when the BIOS sends the End Of Post message to the ME FW. The error message displayed is: “Error sending End of Post Message to ME” and the system halts. Unresponsive to CTRL-ALT-DEL which is the hotkey for rebooting during POST.

Attempted Troubleshooting: Initially, I tried using my programmer to flash my backup ME firmware but my programmer does not support the flash chip MX25L1606E however it DOES support MX25L1606. Afterwards, I purchased its keyboard and tried to perform BIOS recovery using various filenames and key combinations but I do not know the correct filename or key combo. Googling this is extremely difficult because there is little to no information for the E5420. Using Andy’s Phoenix Tool (which is supposed to return the correct BIOS recovery filename) gives me gibberish (I tried it anyway).
I have also tried removing the CMOS even though I suspected it not to work since the issue lies with the ME FW. Have also tried switching/removing the RAM sticks around as well as removing the CPU then powering on, turned it off and put CPU back in to maybe refresh/reset some NVRAM variables.

Request: What can I do? Does anyone know the correct parameters to initiate BIOS recovery on the Dell Latitude E5420? Which programmer should I purchase?
@CodeRush I would greatly appreciate your input on this.

EDIT: I reposted this on bios-mods forums as well, here is a link to that thread for those who want to follow.

First, use the latest System Tools v7 package that can be found at the ME thread and not other older stuff found around the web which may be old or wrong. Then try a ME reset by running Flash Programming Tool with command fptw -greset and test again after the system has reset.

If that does not help, what you most probably need is a ME Region relfash. The ME region is not in the BIOS so trying to restore/reflash the BIOS is of no use as far as ME corruptions are concerned. You need to use a programmer for that, it’s the easiest and safest solution. Can’t your programmer work with the slightly different chip? They might be basically the same when it comes to their clocks. If not, check if your Flash Descriptor is unlocked by running Flash Programming Tool with command fptw -dumplock and you should see 00 00 FF FF for both CPU/BIOS and ME. If not, your flash descriptor is locked and the ME region can re reflashed only via a hardware programmer.

Do you have the dumped (backup) ME firmware region before you modified it with FITC? Dell does not include the full ME region at their latest BIOS packages so if we are to reflash the ME region with a programmer or unlocked FD, we need one. If you don’t have the backup then you need to search around the web for a full SPI dump of the Dell model you have.

Regarding the FITC “corruption”, if you used FITC v7.1.20 (common version found online), it’s not that it creates corrupted files, it’s just not compatible with newer firmware releases. You should have seen an error message during the final building process, otherwise the problem might be at the changes you performed or something else.

Thank you for the swift response.


I used FITC v7.1.60.1191 and was informed by Khenglish at Techinferno about the FITC for ME7 producing corrupt ME images. That aside, I just want to get it up and running. I am unable to use any commands because I receive the error, "Error sending End Of Post Message to ME" before booting to any drive. I am still able to select the boot device, but unfortunately the error and system halt occurs before anything can happen.


Yes, I do have a backup of my ME FW. After decompressing the stock BIOS, I was able to extract the ME FW from it using a hex editor. Also I should mention that I have fulfilled many BIOS & ME mods requests in the past; mostly for unlocking advanced menus and various ME FW mods for unlocking BCLK for ME8 and ME9. This was my first ME7 encounter. My flash descriptor was unlocked previously, and I made sure the DESC hex values in the ME FW image I flashed were unlocked.

Regarding my programmer, I’m using CH341a. When I try to read from the flash chip I get an error, can’t remember correctly which error but was only getting FF.

Ok, the fact that you have past experience and knowledge is good. I suppose fpt -greset cannot be tested because you can’t boot to anything. The manual way would be to remove system power for 30 seconds or so but I don’t think it will help in this case. What you need to do is reflash the ME region. You have an unlocked FD but if you can’t boot to anything (not even DOS) then the programmer + back-up SPI is the only way. Personally I have a CH341a as well but regarding other programmers and whether CH341a can support your exact chip, I don’t know unfortunately. Maybe CodeRush knows more. Maybe you can edit the database of CH341a and add the chip manually based on it’s datasheet or the timings set at fparts.txt of Intel’s FPT. Longshot but you never know.


I have the fparts.txt I used and I know which line of text is for the ME SPI chip, but how would I manually add that data to the CH341a’s database? Now that I think about it, the issue could also be with my clip; I literally have to hold it in place because if I let go then the clip snaps.

EDIT: From past experience, I know for a fact that when performing BIOS recovery on laptops, the ME region is temporarily unlocked during the procedure. This is actually how I’ve unlocked most flash descriptors by extracting the ME FW image via hex editor, changing the corresponding values from 0B 0A xx xx 0D 0C to FF FF xx xx FF FF then flashing it using BIOS recovery worked everytime. Therefore, it should be possible to repair my ME FW using BIOS recovery, right? Would you happen to know how I could find the recovery filename from within the bios image in hex? I’m fairly certain the key combination for Dell Latitudes is END, the filename is where I’m stumped.


I didn’t know that the FD is temporarily unlocked when an emergency AMI BIOS recovery is triggered. Interesting fact though. I’m curious if the AMI BIOS recovery does indeed work as you mentioned. If you happen to verify it again on your machine, please let me know for future reference. Unfortunately I don’t know the answers to your other questions (CH341a database editing, whether it’s the clip’s fault, the name of the recovery image & dell key combination to trigger the recovery).


I’ve exclusively only dealt with Phoenix/Insyde BIOS, so I’m not sure if this holds true for AMI BIOS although I would assume it would. I am going to try my programmer again and try to make my own clip using aluminum foil and tape lol, if that fails then I am going to call Dell and see if they will tell me the necessary parameters for initiating BIOS recovery without paying for a silly warranty.