[Request] Intel Flash Programming Tools SPS 4 and SPS 5

[miczyg]

Hey everyone,

I have a board with Intel SPS 4.1.4.109 and C236 chipset. Are there any SPS tools available on this forum for this particular chipset/SPS version (or at least close enough to work)?

I would like to modify some settings via FITc. Furthermore, the SPS is still in manufacturing mode according to HECI FWSTS registers, so it leaves quite a big room for playing around.

Thanks,
Michał


Edit by Fernando: Thread title customized

[Lost_N_BIOS]

@miczyg - I will send you PM, if that version does not work for your system then you’ll have to send a PM to plutomaniac and ask if he has newer version

[westernly]

@Lost_N_BIOS @miczyg do either of you by chance still have these tools that you’d be willing to share with me? Thanks!

[Diesel336]

Can you give it to me too?

[lerom]

Hello! can anyone pm me fit sps4+5.0 ? regards, thanks.

[Fernando]

@lerom
Welcome to the Win-Raid Forum!
Since it doesn’t make sense to have 2 threads about the same topic, I have merged your recently started separate thread with this already existing one and gave it a customized title.
Good luck!

[lerom]

who have premium access, please download Upload files for free - Intel ME SPS 4 PU.7z - ufile.io

[alpha1943]

Good Day! Can anyone pm me fit sps4? regards, thanks.

[syscomau]

Hey guys! I’m also looking for the SPS tools. Working on adding DCPMM support for a T640 Dell.

[simoutekd]

@lerom
Hello, how are you?
I have an Asus RS720Q-e9-RS24-S 4 nodes server which I want to update his ME REGION and also try to modify his BIOS. My problem is that I dont know which Intel (Converged Security) SPS I need to use.
The ME version is SPS version to E5_04.01.04.901.0.
Please help
Thank you
Salim

[xftv5608]

Hey guys! I’m also looking for the SPS tools.my X12SPL-4NF.

[iamspamiam]

I’m also trying to track down the SPS 4 tools for a gigabyte server board. If anyone has them or any clues where to hunt for them it would be much appreciated.

[roland155]

Hi! Server DELL poweredge R640 after rework new PCH chipset chip sr3hl i need edit my bios from sps4 tool? After reball new PCH chip my motherboard not start, idrak worked. or i wrong poor sold bga chip on motherboard.

generator time clock on PCH 32.768khz work, pwgood CPU ok. all VCC 1v/1.1v/1.8v/3.3v/5v ok

i see #CS 1 level to SPI

i not see other (MISO, MOSI) logical level request send to SPI flash BIOS into motherboard circuit scheme…..

DUMP SPI 25Q256 ok i read it

╔═════════════════════════════════════════════════════╗
║ wind256no work no start.bin (1/1) ║
╟───────────────────────────────────┬─────────────────╢
║ Family │ CSE SPS ║
╟───────────────────────────────────┼─────────────────╢
║ Version │ 04.01.04.381 ║
╟───────────────────────────────────┼─────────────────╢
║ Release │ Production ║
╟───────────────────────────────────┼─────────────────╢
║ Type │ Extracted ║
╟───────────────────────────────────┼─────────────────╢
║ SKU │ Server ║
╟───────────────────────────────────┼─────────────────╢
║ Chipset │ LBG-H B,A ║
╟───────────────────────────────────┼─────────────────╢
║ TCB Security Version Number │ 3 ║
╟───────────────────────────────────┼─────────────────╢
║ ARB Security Version Number │ 0 ║
╟───────────────────────────────────┼─────────────────╢
║ Version Control Number │ 0 ║
╟───────────────────────────────────┼─────────────────╢
║ Production Ready │ Yes ║
╟───────────────────────────────────┼─────────────────╢
║ OEM Configuration │ No ║
╟───────────────────────────────────┼─────────────────╢
║ Date │ 2019-12-05 ║
╟───────────────────────────────────┼─────────────────╢
║ File System State │ Initialized ║
╟───────────────────────────────────┼─────────────────╢
║ Size │ 0x37E000 ║
╟───────────────────────────────────┼─────────────────╢
║ Flash Image Tool │ 04.01.04.381 ║
╟───────────────────────────────────┼─────────────────╢
║ Chipset Support │ Purley ║
╚═══════════════════════════════════╧═════════════════╝

[lzp428]

Hello everyone,

I am currently working on a firmware debugging project for a Dell PowerEdge R740 server (Intel C621 / Lewisburg PCH chipset, Purley platform).

My ultimate goal is to enable DCI (Direct Connect Interface) via PCH Soft Straps so that I can use my SVT CCA Adapter to perform hardware-level Run-control debugging on custom DXE drivers I’ve written.

What I Discovered via Reverse Engineering (IDA Pro):

Through extensive analysis of the PEI and DXE phase modules, I mapped out the security locking timeline and chain-of-trust behavior:

• Chained Validation & Hardcoded Locks: Dell’s 14th generation servers implement a strict chained validation mechanism anchored in the BootGuard protected area. Crucially, certain platform security-related configurations completely bypass and ignore UEFI NVRAM setup variables. Instead, these key security locks—such as the configuration of the BIOS_CNTL register—are explicitly hardcoded into the binary execution flow, making it impossible to change them via variables.
• The Locking Timeline (PEI vs DXE): These hardcoded security locks operate across different boot phases. DCI control bits (including disabling DCIEN/HDCIEN) are evaluated and locked early during the PEI phase by reading hardcoded policy configurations. In contrast, other registers like BIOS_CNTL have their policies initialized via HOBs during the PEI phase, but the actual hardcoded lockdown is executed later during the DXE phase.
• The Policy Overwrite Conflict: In the Intel Reference Code (PeiPchPolicyLib), the default configuration initially sets the HOB policy for DciAutoDetect to 1. However, following the platform’s hardcoded security principle, Dell’s custom layer (PeiPchPolicyUpdate) completely bypasses the NVRAM variable buffer and immediately overwrites this policy field later in the PEI execution flow, forcing it unconditionally to 0.
• The Role of DciAutoDetect: In Intel’s RC code design, the purpose of DciAutoDetect is to act as a safety gate. When enabled, if a hardware debugging probe is physically detected (via a mask of 0x600 on Bit 9 or Bit 10 of the ECTRL register), it prevents the BIOS from executing the lockdown code. By preventing lockdown, the ECTRL register stays unlocked (LOCK bit = 0), allowing for later activation.
• The DCI Lockdown: Although DCIEN/HDCIEN (Bit 4) is already disabled by default, Dell forces DciAutoDetect to 0 via hardcoding, so the PEI code completely skips the hardware probe evaluation branch and unconditionally executes the lockdown routine (PchPcrAndThenOr to PID 0xB8 Offset 4). This explicitly forces DCIEN/HDCIEN to 0 and flips the hidden Bit 0 LOCK bit to 1, rendering the entire register strictly Read-Only and deadlocking any further software intervention before the DXE phase even begins.

My Progress So Far:

I have managed to inject and successfully execute my custom DXE driver by utilizing a few unused, non-validated firmware volumes that fall outside Dell’s validation chain. I can fully confirm that my custom driver is active and running, as it appears properly when running the drivers command in the UEFI Shell.

However, because the hardware ECTRL register is already physically locked in the PEI phase (verifiable via UEFI Shell where mm fdb80004 returns 0x00000001 without a device connected, or values like 0x00000201 / 0x00000401 with the probe attached indicating that the register is fully locked), my DXE driver cannot dynamically reconfigure or activate DCI.

The Solution:

Fortunately, the Flash Descriptor (FD) is not protected by BootGuard on this machine. Since software workarounds are mathematically deadlocked by Dell’s chained validation and hardcoded execution flow on these components, the absolute only way to revive DCI is to force-enable DCI enable via PCH Soft Straps in the Flash Descriptor using spsFITc before the CPU executes its first instruction.

My Request:

To proceed, I urgently need the Intel SPS 4 Purley Package / Tools which contains the version of SPS FITc supporting the C621/Purley platform.

Please note that I do not strictly require a version that can successfully rebuild/compile a new full image, as I know some versions might face compatibility issues when exporting. As long as the tool can properly parse and display the PCH Soft Straps for the Purley platform, it will be perfectly sufficient. I only need to locate the exact configuration offset of the DCI enable option within the PCH Soft Strap layout so that I can manually patch my raw SPI dump using a hex editor.

Could anyone kindly share the SPS 4 Purley package/tools? A PM would be greatly appreciated!

Thank you very much for your time, insight, and help!