[Problem: Error 167] Asus Zephyrus M16 GU603HM

Hello, everyone.
First, I would like to thank you for the helpful information I managed to find here.

I have an Asus Zephyrus M16 2021 GU603HM notebook with the latest BIOS version 315.

I’ve been trying to reflash the BIOS region, but I always get error 167.

I’ve tried using setup_var.efi/ru.efi and other tools to disable the BIOS lock, guard, protection flags, and anything else I could find in the Setup menu, but nothing helped.

I’m making a dump (success) and trying to immediately rewrite it, but I’m getting error 167.

I really don’t want to resort to using flashers, so I’m seeking help and assistance.

I would be happy to “buy coffee” for anyone who can help. :slight_smile:

Thank you in advance.

@sieskei Hi and welcome to Win-Raid forums.

It looks like you have come across a very common issue with Asus motherboards - multiple protections and locks that prevent you from flashing the BIOS using software tools.

Can I ask what the specific problem is with the notebook that has caused you to want to re-flash the BIOS?

Also, how did you make the BIOS dump and are you 100% sure that it is complete? Some notebooks will have the firmware split across two EEPROMs, you will also want to make sure that the UUID and serial number are present in the dump as it can be painful to restore them if erased/overwritten.

I would recommend using a hardware programmer on any Asus motherboard (as you can waste a lot of time on attempting to bypass the protections and end up buying a programmer anyway).

Hello, first, thank you for your response.

My case is a bit specific. My laptop has two NVMe M.2 ports, and one of them (PEG0, PCIe Root Port #0) is used via OcuLink for an external graphics card (RX 6800 XT). Everything works perfectly in Windows/Linux.

However, Resizable BAR only works for the integrated graphics card (PEG1, PCIe Root Port #1, RXT 3060).

All the settings are enabled, and in theory, it should work, but it doesn’t. I even managed to disable the entire PCIe Root Port #1 using setup_var.efi, but it still didn’t work. Perhaps there is simply no logic in the BIOS to enable resizing for that specific port.

By the way, in Linux, I can easily enable it using “pci=realloc” or manually configuring BAR 0/2.

My last hope remains with ReBarUEFI (GitHub - xCuri0/ReBarUEFI: Resizable BAR for (almost) any UEFI system), but to use it, I have to reflash the BIOS.

I’m a bit scared of using programmers in case I end up damaging something. :slight_smile:

The dump software I’m using is Flash Programming Tool from package ver 15 for Tiger Lake.

Thank you in advance!

@sieskei Can you please provide a link to the 315 BIOS for your specific notebook model on Asus site and also upload your BIOS dump?

The user Kuri0 on these forums can possibly answer your questions about whether a BIOS mod for rebar is possible as they are the person that created ReBarUEFI on the github page you linked.

I would suggest tagging Kuri0 when you have uploaded the two BIOS I requested above so you can get an answer about the BIOS mod (and then look into flashing the modified BIOS afterwards).

Just remember that there is always risk when flashing any BIOS and that risk increases when you do any modification. Therefore you must be 100% sure that you can recover from a failed flash or bricking the notebook, which is only possible using a hardware programmer if the system won’t POST.

Using FPT to test a BIOS mod is not a good idea, I would highly recommend that you consider purchasing a hardware programmer so you can recover the notebook should you brick it.

Hello @chinobino sorry for delay.

This is my bios region.

Original v315 bios.
https://dlcdnets.asus.com/pub/ASUS/GamingNB/GU603HM/GU603HMAS315.zip?model=gu603hm

My BIOS chip:
winbond 25R128JVSQ (2120)

ME Info

C:\Users\myozo\Desktop\ASUS_BIOS\tools\CSME System Tools v15.0 r15\MEInfo\WIN64>MEInfoWin64.exe
Intel (R) ME Info Version: 15.0.41.2142
Copyright (C) 2005 - 2022, Intel Corporation. All rights reserved.


    Platform Type                                Mobile
    FW Image Type                                Production
    Last ME Reset Reason                         Other
    BIOS Boot State                              Post Boot
    Boot Critical Code Redundancy                Disabled
    Current Boot Partition                       1
    Factory Defaults Recovery Status             Enabled
    Firmware Update OEM ID                       00000000-0000-0000-0000-000000000000
    TCSS FW partial update                       Disabled
    Crypto HW Support                            Enabled
    Intel(R) ISH Power State                     Disabled
    OEM Tag                                      0x1043
    FW Update State                              Enabled
    TLS State                                    Disabled
    CSME Measured Boot to TPM                    Disabled
    BIOS Recovery State                          Enabled

Intel(R) ME Code Versions
    BIOS Version                                 GU603HM.315
    MEI Driver Version                           2240.3.4.0
    FW Version                                   15.0.30.1716 H Consumer
    LMS Version                                  2130.1.16.1

IUPs Information
    PMC FW Version                               150.2.10.1015
    OEM FW Version                               0.0.0.0000
    IOM FW Version                               24.22.0.0000
    NPHY FW Version                              15.105.135.5012
    TBT FW Version                               14.0.0.2500
    PCHC FW Version                              15.0.0.1020

PCH Information
    PCH Name                                     TGL
    PCH Device ID                                438B
    PCH Revision ID                              A1
    PCH SKU Type                                 Production PRQ Revenue
    PCH Replacement State                        Disabled
    PCH Replaceable Counter                      0
    PCH Unlocked State                           Disabled

Transactional FW Information
    Original image type                          Consumer
    Current sku type                             Consumer

Flash Information
    Storage Device Type                          SPI
    SPI Flash ID 1                               EF4018
    RPMC                                         Supported
    RPMC Bind Counter                            1
    RPMC Bind Status                             Post-bind
    RPMC Rebind                                  Supported
    RPMC Replay Protection Max Rebind            15
    BIOS Read Access                             0x000F
    BIOS Write Access                            0x000A
    GBE Read Access                              0x0009
    GBE Write Access                             0x0008
    ME Read Access                               0x000D
    ME Write Access                              0x0004
    EC Read Access                               0x0101
    EC Write Access                              0x0100

FW Capabilities                                  0x31119100
    Intel(R) Protected Audio Video Path          Present/Enabled
    Intel(R) Dynamic Application Loader          Present/Enabled
    Intel(R) Platform Trust Technology           Present/Enabled
    Persistent RTC and Memory                    Present/Enabled

End Of Manufacturing
    NVAR Configuration State                     Locked
    EOM Settings                                 Lock(Flash,Config)
    HW Binding State                             Enabled
    Flash Protection Mode                        Protected
    FPF Committed                                Yes

Intel(R) Protected Audio Video Path
    Widevine provisioning state                  Not Provisioned
    Attestation KeyBox                           Not Provisioned
    PAVP State                                   Yes

Security Version Numbers
    Trusted Computing Base SVN                   1

    Anti Rollback SVNs
        PMC                                      0   [minimum allowed: 0]
        CSE                                      2   [minimum allowed: 0]
        ROT KM                                   0   [minimum allowed: 0]
        IDLM                                     0   [minimum allowed: 0]
        SECURE BOOT BSMM                         0   [minimum allowed: 0]
        OEM KM                                   0   [minimum allowed: 0]
        SECURE BOOT KM                           0   [minimum allowed: 0]
        UCODE                                    1   [minimum allowed: 0]
        SECURE BOOT ACM                          0   [minimum allowed: 0]

HW Glitch Detection                              0x08
    TRC Polarity                                 Rising Trans
    TRC Mode                                     Full-cycle polarity trans
    TRC State                                    Disabled

Intel(R) Platform Trust Technology
    Intel(R) PTT initial power-up state          Enabled
    Intel(R) PTT State                           Enabled
    SMx State                                    Enabled
    RSA1K Support                                Enabled

FW Supported FPFs                                FPF         UEP
                                                 *In Use
                                                 ---         ---
1st OEM Key Hash Revoked                         Disabled    Disabled
1st OEM Key Hash size                            Enabled     Enabled
1st OEM RSA Key size                             Enabled     Enabled
2nd OEM Key Hash Revoked                         Disabled    Disabled
2nd OEM Key Hash size                            Enabled     Enabled
2nd OEM RSA Key size                             Disabled    Disabled
BSMM Anti Rollback                               Enabled     Enabled
DAL OEM Signing                                  Disabled    Disabled
DNX Anti Rollback                                Enabled     Enabled
EOM Flow                                         Full        Full
Error Enforcement Policy 0                       Enabled     Enabled
Error Enforcement Policy 1                       Enabled     Enabled
Flash Descriptor Verification                    Disabled    Disabled
Glitch Detection Disabled                        Enabled     Enabled
Glitch Detection Enabled                         Disabled    Disabled
IDLM Anti Rollback                               Enabled     Enabled
Intel PTT Encryption Key                         Not Revoked Not Revoked
Intel(R) Manageability HW Fuse Status            Enabled     Enabled
Intel(R) PTT                                     Enabled     Enabled
OEM ID                                           0x00        0x00
OEM KM Anti Rollback                             Enabled     Enabled
OEM Key Manifest                                 Enabled     Enabled
OEM Key Revocation State                         Disabled    Disabled
OEM Platform ID                                  0x00        0x00
OEM Secure Boot Policy                           0x79        0x79
CPU Debugging                                    Enabled     Enabled
BSP Initialization                               Enabled     Enabled
Protect BIOS Environment                         Enabled     Enabled
Measured Boot                                    Enabled     Enabled
Verified Boot                                    Enabled     Enabled
Key Manifest ID                                  0x01        0x01
Force Boot Guard ACM                             Enabled     Enabled
OEM key Hash RSA key size                        Enabled     Enabled
PID Refurbish Counter                            0x00        0x00
PMC Anti Rollback                                Enabled     Enabled
PTT Lockout Override Counter                     0x00        0x00
Persistent PRTC Backup Power                     Enabled     Enabled
RBE Anti Rollback                                Enabled     Enabled
ROT Anti Rollback                                Enabled     Enabled
RPMB Monotonic Counters                          0x00        0x00
RPMC Rebinding                                   Enabled     Enabled
RPMC Support                                     Enabled     Enabled
SOC Config Lock State                            Enabled     Disabled
SPI Boot Source                                  Enabled     Enabled
SPIRAL CPU                                       Enabled     Enabled
Secure boot KM Anti Rollback                     Enabled     Enabled
TXT Supported                                    Disabled    Disabled
UFS Boot Source                                  Disabled    Disabled
USB Port ID                                      0x00        0x00
uCode Anti Rollback                              Disabled    Disabled

DNX SVN                                          0x00        0x00
IDLM SVN                                         0x00        0x00
OEM KM SVN                                       0x00        0x00
PMC SVN                                          0x00        0x00
ROT KM SVN                                       0x00        0x00
Secure boot ACM SVN                              0x00        0x00
Secure boot BSMM SVN                             0x00        0x00
Secure boot KM SVN                               0x00        0x00
Ucode SVN                                        0x00        0x00```
1 Like

@chinobino Hello, is it actually possible to overcome this protection and avoid error 167?

If I overcome my fear :slight_smile: and decide to reflash it using a flasher, which model would be the best for that, CH341A?

@sieskei Do you have a complete SPI dump? You may not be able to flash only the modified BIOS region on TGL platform.

@Kuri0 Could you please have a look at this BIOS/OcuLink issue that is blocking access to Resizable BAR with external AMD GPU? Thanks in advance.

[Edit] You posted just as I was replying, so to answer your question - a hardware programmer can bypass all software locks.

The CH341A is not the best but is the cheapest, which is why many people use it.

The main problem with the CH341A is that you need to find a version of the software that supports your specific BIOS chip (WinBond 25R128JVSQ) and supplies the correct voltage.

I use an SP8-F programmer as it gets regular software updates to support new BIOS chips, and is capable of in-system programming, which means I can flash the BIOS EEPROM without desoldering it in most cases.

It also detects and visually shows pin contact (one of the biggest problems when using SOP-8 test clips) and has over-current and ESD protection.

1 Like

@chinobino
Oops, last night I forgot to upload it. :frowning: I have the whole dump, yes, it was read with FPT - ME, DESC, BIOS regions. But I’m at the office right now, and I’ll upload it a bit later.

I haven’t tried rewriting the entire dump, only the BIOS region.

@Kuri0 I thank you too. I have written on the GitHub page asking if it’s possible to create an EFI tool (equivalent to Linux realloc) specifically for this reason, as I cannot add it to the BIOS region.


EDIT:
@chinobino

Thank you for the clarification. This “in-system programming” feature sounds critical to me as I definitely wouldn’t want to remove it from the motherboard. Does FlyPro in combination with SP8-F support my 25R128JVSQ chip?

1 Like

@sieskei I did mention a method that could be tried (safeboot-loader). I’ve tried making an EFI tool to resize BARs before and I got it working but wouldn’t show enabled in driver, only in GPU-Z.

Try getting safeboot-loader working on your system, can assist you from there if you get it booting.

Best way would be using ReBarUEFI UEFI mod though.

Also have you checked hidden BIOS settings using IFR Extractor ?

2 Likes

@sieskei In-system programming (AKA in-circuit programming) whilst being extremely convenient, isn’t always guaranteed.

You will need to remove any power source (AC Power, DC battery and CMOS battery) and peripherals from the notebook motherboard, then use a USB port on a second PC/laptop to supply the hardware programmer with power for programming the BIOS chip.

In some situations there may be a voltage drop that stops you from programming in-circuit, it is difficult to know if this will occur as motherboard circuit designs differ so much.

Also, some motherboards have a SPI (Serial Peripheral Interface) header that you can connect to specifically for in-system programming. It’s usually located near the BIOS chip so you need to check that it isn’t a similar looking TPM header.

Looking at the SP8-F support list I can see W25R128JV [SOIC8] listed.

Looking the W25R128JV Datasheet on page 75:

PACKAGE TYPE      SOIC-8 208-mil
DENSITY           128M-bit
PRODUCT NUMBER    W25R128JVSIQ
TOP SIDE MARKING  25R128JVSQ

So yes, it should work.

1 Like