Need help unbricking Asus Z170m-plus


So long story short, as trying to downgrade the bios to see if some compatibility issues I had would disappear, but ended up using some wrong commands, apparently. So now my system just shows no display output, although I can hear it spin up the disks and so on.

I found the thread on how to flash the Rom using a raspberry pi, and got that working. I flashed a Rom of the newest bios (I don’t want complications because I try to downgrade), that I exported from uefi tools.
It’s still not working though the flash went well, same symptoms as before. Can anyone help me figure this out? I obviously can’t get a dump of the original bios, but my cousin has an identical board that I can borrow and get a dump from if that can help.

Hope someone can help :slight_smile:

Asus BIOS download is not complete BIOS, usually, so you can’t flash in with programmer that downloaded file. Plus it also needs removed from the capsule first too, sounds like you did that part
However, lucky for you I checked and this board’s BIOS from Asus is complete 16MB BIOS (minus second NVRAM volume)

So, before going further, please explain. What exactly did you write to the BIOS that caused the issue initially, using what program/method and what commands etc? And then, with raspberry PI, what exactly did you program to the chip?
Before either of those, you may no backups, at all, ever? Do you have the motherboard box still? If not, get images of all stickers on the board, be sure to get ones on side of 24 pin, and top/bottom sides of PCI/PCIE slots too.
Send me those in a zip, along with the current contents of your BIOS chip, dumped via your raspberry pi programmer setup.

Then yes, if you can go over to your cousins and dump his BIOS that would be helpful too, I can rebuild you a BIOS without it, but would be easier if you had a dump from him for that second NVRAM volume.
You don’t need to borrow his board, just go to his house and dump his BIOS to file. While you are there, get the same images from his board, all stickers.
Tell him not to worry, I only need them to locate exact position of his current info, to replace it with yours on the rebuild, then all will be tossed

For now, have you tried removing all memory stick but one, then start again? Sometimes that resets things and makes it magically boot.
Same for graphics, have you tried the onboard instead of graphics card, or visa versa yet? I ask all this because I think it should be bootable with the rom/bin removed from capsule via UEFI, then programmed in, so maybe this would help, if not your programmer setup may be failing and only appearing to be programming in properly
You may need to order CH341A flash programmer, and IC Chip extractor if BIOS is in a socket, or SOIC8 test clip cable if BIOS is soldered to the board. Since you can’t be sure your programming setup is actually working properly. Don’t test on your cousins board, in case it’s not working!

That sounds very helpful! I may be able to locate the box, I’ll check when I get home and send along the requested pictures and dump. I think I have my MAC address somewhere, I guess that’s at least part of what you need?

What happened was that I was using afudos, and /GAF (or whatever that command is) did not work. I had previously flashed another file with that command, but it didn’t “stick”, it came up and said I needed to choose a valid bios image (I suppose this was actually crashfree bios-ting, but it looked like EZ-flash). I guess this happened because I downgraded BIOS, but I had too new ME maybe?
Anyway, I thought it was “safe”, so I decided, stupidly, to try something like “afudos mybios.rom /P /B /N”, though unfortunately, I am not sure if it was those exact flags :frowning:
Using the raspberry pi I programmed the newest BIOS (that I was on before all this), 3805, extracted using uefi tool, so that is indeed a 16 MB file.

I realised today that he may actually have a H170m-plus (I ordered his board), is his info still relevant? I won’t be able to get that until tomorrow or the day after.

I actually realised today myself that I have not tried just one ram stick - but I have tried both with and without gfx. I’ve also had power and battery removed with cmos reset pins shorted for >1hr, it does that thing it usually does where it starts up very shortly, then powers down and comes back up. But the screen is still blank.
The EEPROM is removable, and the SPI programmer verifies the data as well, does that not indicate that I have everything I need in terms of being able to program the chip?

If you can’t find the box, stickers on the board are usually enough (Check back of board too) Yes, MAC Address will be one of the stickers I mentioned, usually on side of 24 pin.

/GAN - Yes, that sucks AFU does too and it’s not useable on modern boards, None of that is needed for Intel boards, use Intel FPT instead (I’ll help you with that later once recovered).
You say extracted using UEFITool, do you mean you clicked on capsule and chose extract body? If so, that’s proper, should be bootable, so you may have other issue that happened at same exact time, or your programmer setup is not working like it may appear to be (more likely)

No, H170M is not relevant to this issue, thread, or your board, so no need with that if that’s the board he has.

No, programmers can verify a completely blank read or write (all 00 or FF) and make you think all is OK, only way you know your programming setup works is if you’ve verified it before by erasing the chip, then blank check, then write/verify and it booted up properly
With that in mind, when you do try to program the stock BIOS rom, do you erase the chip, then blank check, then write/verify? Not sure that’s possible, or how to do it with raspberry, but it’s something you should be doing because if you only write it may skip over data or leave something in place etc.

Since it’s removable, if you can’t get it with raspberry then you only need to spend $3.50 on ebay and wait 3-5 weeks to fix this.
Order CH341A and a $1 IC extractor to safely remove the BIOS, those legs bend super easy and just when you think you’ve got it out safely without one there it goes all bent crazy side sideways and the legs are a mess.

Now that you mention it, I did actually do an erase before writing the image, because the guide mentions it may be needed. But I did not read out the file to check if it was all 00/FF.
I’ll read out the contents of the chip tonight, then do an erase and read it out again.

Will you need anything that would have been on the chip? If my programming setup works, I’ll have erased that, in which case I may as well just get a new board?

I went back and pulled a stick of ram, and it booted right up. I’m not going to put it back until I have it working right again, though.
First order of business was a reflash to 3805 with ez-flash, so now all the parts ought to be in the right places, I suppose.

I’ve lost at least my MAC though, it’s all 8’s, I don’t suppose I got that by chance :slight_smile:

I’d kind of like to learn how to fix stuff rather than just having it done for me, can you point me in the right direction, or write a little thing up, or is it better I just sendt it over?

I’m also interested in how to properly flash the thing with something unofficial. I might try to play around with it again, since the issue that started the whole thing is still there, and I guess I now know how to make a backup of the chip :slight_smile:

@MathiasMM - Great you got back in! You can put your ram back in now

88:88:88:88:87:88 is normal for mac in this type of situations, that’s the standard used in place of our real MAC’s in stock BIOS downloads, built in flashing methods by the manufacturer leave real in place of that when flashed normally.

MAC can be fixed easily, I can tell you how to do that, serial and UUID is much more difficult to find and fix. If you open the stock BIOS, or a dumped BIOS, in hex program at 1000 and 2000 you will find the fake 88:88:88:88:87:88 MAC ID, replace that with your actual and save and reprogram.

Flashing unofficial way is via FPT, but first you need to unlock BIOS Lock. To use FPT you need to have Intel ME drivers installed, unless you use the DOS version. Then you need to download the correct matching package for your ME FW version.
Check BIOS main page for ME FW version, and then from the following thread in section “C” download the matching ME System Tools package.
Intel Management Engine: Drivers, Firmware & System Tools

Inside you will find Flash Programming Tool folder, and inside that, a Windows or Win/Win32 folder, select that folder and hold shift, then press right click, choose open command window here (Not power shell)
Here is commands to use

FPTw.exe -bios -d biosreg.bin << That will dump the BIOS region
FPTw.exe -bios -f filenamehere.bin << That will flash the BIOS region.

Here is my guide on unlocking “BIOS Lock”
[GUIDE] Grub Fix Intel FPT Error 368 - BIOS Lock Asus/Other Mod BIOS Flash

You can start on step #6, because here is your variable to change >> 0x8A6
Your .efi file needs to be renamed to >> Shell.efi

At grub prompt you will type the following
Setup_var 0x8A6 0x0

If you want to correct the MAC ID via FPT, this is what you do. First you need to dump the GbE region using following command
FPTw.exe -gbe -d gbe.bin

Edit the 88:88:88:88:87:88 at 0 and 1000, then save and flash back with command below
FPTw.exe -gbe -f gbe.bin

To fix the rest, yes, please make a dump of current BIOS via FPT dump BIOS region command above, send me the gbe.bin (So I can make sure only MAC ID is stored here) and biosreg.bin
Along with the images I asked for, please also run these commands from command prompt and give me the info so I can find current incorrect info location in the BIOS - put it all in a single zip
wmic csproduct get uuid
wmic baseboard get serialnumber

That sounds really great!
I won’t have time to do it tonight anyway, and tomorrow night is all booked up as well, but I’ll assemble the info for you ASAP.

I do want to pick your brain on my original issue, since it seems you’re pretty knowledgeable about this to say the least :slight_smile:
The thing is that I’ve bought a mini-pcie wireless card to run in an adapter. The problem is that when the wireless card is in the computer (empty adapter is ok), it won’t start at all. No fans spinning or anything. Once I pull the card it’s fine. I’ve tried in all the slots except the main x16 one, same result. Since it blocks startup so hard, I assume it must be really low level, and I feel like i’ve tried every setting I can find in my current BIOS.
The thing is that the card works fine in an old Asrock board with an i3 2-series or thereabouts, so I know it CAN work. just not in my motherboard with this BIOS.
Does anything here ring any bells?

@mathiasMM - no rush here, whenever you get to things I’ll be here to try and help.

Sounds to me like that card is faulty/shorted, otherwise if just incompatible it would start and either give some error or not show up at all, stuff like that.
But, since you’re sure it works in other system maybe not. Have you tested it recently in another system, or just know you used it before in others?
If you have not tested it in other system recently, then try now, if may have been damaged while not being used. I’d go ahead and see if same happens in main x16 slot too

You may need to pickup some other adapter card to use if this one is not compatible, or ask Asus directly about that specific card model and see if they can make you compatible BIOS.

Yeah, i thought I had a faulty/shorted card until I tried it in that secondary system. It was meant for the main system, but did not work, so I tested it in my other system before going for an RMA.
But I doubt Asus will be doing anything to help be out with a board that is three generations old by now, so it’s probably just destined for the secondary system.

You never know, ask and see what they say. Someone else might have already asked a year ago and BIOS is setting there waiting for you to request it.

@Lost_N_BIOS I’ve created the file as you specified, if the sticker location means anything, the one that is stuck to black metal was stuck to the PCIe x16 slot, but was a bit loose and inconveniently placed, so I moved it and took the picture along the way.
Turns out I did not have my MAC anywhere, so I’ve not fixed that. The files are here:…0stuff.rar?dl=0

wmic csproduct get uuid

wmic baseboard get serialnumber

Really appreciate the help, let me know if there’s any more I need to do!

Thanks @MathiasMM - the sticker you moved (I think), the one with model name on it (0497 image) is the serial number sticker (minus first three digits for BIOS) On those first three digits, I need to find what is used for Z170 now, I’ll pull out a Asus Z170 here and dump and see.
The one on side of 24pin is your LAN MAC ID and the long skinny one contains UUID in a mixed up format. I’ll work on this and get back to you soon.

What do you get from both of these commands for each UUID and serial -
wmic csproduct get name, identifyingnumber,uuid
wmic csproduct get name,identifyingnumber,uuid

And serial
wmic baseboard get product,Manufacturer,version,serialnumber
wmic bios get name,serialnumber,version

I think, since you wrote before making any backups, UUID will be lost. Half of it is on the long sticker on the board, but first 4 digits are month and year of manufacture and we can’t get those off any stickers.

wmic csproduct get name,identifyingnumber,uuid
IdentifyingNumber Name UUID
System Serial Number System Product Name FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF

wmic baseboard get product,Manufacturer,version,serialnumber
Manufacturer Product SerialNumber Version
ASUSTeK COMPUTER INC. Z170M-PLUS MB-1234567890 Rev X.0x

wmic bios get name,serialnumber,version
Name SerialNumber Version
3805 System Serial Number ALASKA - 1072009

How important is UUID? The system obviously works (completely, as far as I can tell) without it?
In any case, the board was purchased on October 6th 2015, and Z170 launched august 5th 2015. I guess that gives us something like 6 months or so to guess between?

Thanks, most looks to be stock/invalid/placeholder info there. UUID can be tied to windows activation, but not always. Is windows still activated after you do windows update scan?

We could maybe guess month/year, but it could be made long time before launch/purchase too, hard to say. I just setup an Asus Z170 here and gathered it’s info so I can see how it all compares to board stickers and BIOS dump.

Main thing is really LAN MAC ID, which is end of UUID, rest only needed to get corrected if your windows wont activate, or in case you need to RMA, but they may already deny that due to you moving/messing with the serial sticker.
Give me a bit, and I’ll get this sorted out for you tonight probably

Yeah, I’m mostly concerned with the LAN MAC, to be honest. Everything has worked until now, and it’s been a week or so since it came back to life. I’ve not manually scanned for windows update, but if it loses activation I’ll deal with that from there. And since the board is from 2015, I guess RMA is not a big issue either :slight_smile:

I’ll pick some random data then for the rest of the UUID/Serial. From the board I’m using as comparison, I’ve found the data in dumped BIOS in 3 modules, and now I can see the format it’s laid into the BIOS using too (UUID is a bit funky, partially backwards, but not all etc)
Serial sticker on board is not used at all in BIOS, long white sticker (first two chunks of #'s) is part of the BIOS Serial number + YY/MM at begining. UUID is random data now (As far as I can tell) + MAC at end
Give me about 15 minutes or so and I’ll have a BIOS for you.

* Edit @MathiasMM - your BIOS layout is not exact same as I was using to compare with, it’s missing some sections and volumes probably due to your using stock BIOS to recover. And I see the same comparing with an actual full dump from your board.
I have a dump from same system, I’ll use that and rebuild you a complete BIOS, but it’s only 3606 BIOS, can you flash that stock BIOS in from Asus, and send me BIOS region dump again using 3606, then I can make you full BIOS, then you can put in with FPT, once done, then re-update to 3805.
I think that is best way to do this, that way your UUID, serial and all that get put back in correct location and so that you have complete BIOS on there not partial as you have now (missing 1 NVRAM volume, 1 data padding file and 4 entire BIOS volumes)

That sounds like a good idea, is there any tool that I can use to flash a .cap? EZ-flash won’t downgrade me. Or is it fine for me to unpack it with uefi tools and just flash it with FPT? Is that just FPTw -f -filename.rom to flash all regions?

Crap, sorry I forgot about that, and 3606 from Asus download would not be complete either, it would be same/similar to the partial one you programmed in already (Missing same volumes etc). I will take this dump and fix it for you

YOu can’t flash like that with FPT unless you have unlocked FD and a complete BIOS file (including FD, GbE, ME, BIOS regions, which is not available for download from Asus usually, but I did not check this boards stock BIOS package)
Checked what I had in storage, 1805 is complete, so 3606 may be as well, checking now… All you need to flash is the BIOS region. I checked, 3606 is complete BIOS, but you can’t flash full BIOS like that anyway due to security locks (FD locked/ME Locked, unless you unlocked that during your Pi recovery programming)

Open 3606.cap in UEFITool, expand down to BIOS region, select BIOS region itself and right click, choose extract, save as BIOSreg36.bin, then flash using FPT >> FPTw -bios -f biosreg36.bin

Then reboot, load optimized, set anything you need to set, then make new dump >> FPTw -bios -d biosreg3606.bin

After this, you will need to unlock BIOS lock via grub again before you can reflash the BIOS I will send you as final one (If you want, I can disable that in this BIOS, but it will be reset next time you reflash any stock BIOS)
Actually, I will send you full unlocked BIOS if you want, BIOS lock disabled and FD unlocked, but you’ll have to program it on with programmer (Then above still applies about next stock flash, for BIOS lock anyway, not FD/ME that will remain unlocked)

You may need to unlock BIOS lock now too, sorry I thought you did before, but just remembered you used programmer to recover. Here’s how to unlock it - [GUIDE] Grub Fix Intel FPT Error 368 - BIOS Lock Asus/Other Mod BIOS Flash
Or you can simply extract body from capsule of 3606 and program that on with your programmer, then send me FPT dump of BIOS region.

Then I’ll sort this out. Sorry for all the hassles, but I think it’s best to do this way so you get complete BIOS on there, not sure what it all does when there or causes being missing, but I’d want my BIOS to be properly complete so any instability I might have later I know wouldn’t be due to this.
If you don’t want to mess with all this though, and are happy/fine using the board as it is now, I can just send you back corrected GbE file which you can fix LAN MAC ID with, up to you?

Yeah, of course I can always flash it with the programmer, I’ll probably just dump what I have now with the Pi, check that it reads something, and then try flashing full bios from you afterwards.
If that won’t work, I should already have a programmer in the mail, but with the chinese new year and all, who knows when that’ll happen…

I’ll try to flash 3606, tonight, hopefully, and get back to you.