Am excited to hear it’s likely to work.
Getting the board fired up today to report on status (I have not updated anything), and will get the CPU, and will report back.
Motherboard:
BIOS Version: 3504 x64
Build Date: 06/29/2017
EC1 Version: MBEC-Z170-0423
ME Version: 11.6.10.1196 (Good, yes?)
CPU:
BX80684I59400F
i5-9400F, S-spec: SRF6M
http://www.cpu-world.com/sspec/SR/SRF6M.html ← Stepping U0, 10 (0Ah), supports DMI 8 GT/s
https://en.wikichip.org/wiki/intel/core_i5/i5-9400f
Will I need to short and/or isolate points on the CPU? I need to pick up a conductive pen - let me know.
Hmmm… will also need some polyimide tape.
Hi, thanks for all the info, I am working on a modded BIOS now.
All the BIOS for the ASUS Z170-AR have ME 11.6 (so we can use any BIOS) and as ME hasn’t been manually updated we don’t have to worry about downgrading which is good yes!
This means we shouldn’t need a programmer.
You have U0 stepping which means you need a microcode for CPUID 906EA inserted in your BIOS.
Yes you will need to isolate pins and short the SKTOCC pins as per this image;
I’m building out a PC w/Windows using an old Celeron processor so that i can get the other information necessary to update the BIOS to get the new i5 working on it - thanks, in advance, for the help and guidance.
I also have Polyimide tape and a conductive pen now, but I’ll get the Windows build done so I can get you the information before I start playing with taping off the new CPU.
Well, after many trials and tribulations (no M.2 screw in the mobo… and then my beefy PSU and full-length graphics card wouldn’t fit in the available case…), I have a working box with Windows installed on the Celeron.
PM sent with the necessary details.
I have received your PM thanks.
First we need to do a complete BIOS backup.
You need to use Intel Flash Programming Tool (FPT) which you can download from this page.
For ME v11.x you need to download Intel CSME System Tools v11 r29 on that page.
To do a full BIOS backup and check for BIOS locks run this from a command prompt;
fptw64 -d backup.bin
If you get an error message post it here so we can work out what BIOS locks may be present.
No errors. 
C:\Tools\Intel CSME System Tools v11 r29\Flash Programming Tool\WIN64>fptw64 -d backup.bin
Intel (R) Flash Programming Tool. Version: 11.8.70.3626
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.
Reading HSFSTS register… Flash Descriptor: Valid
— Flash Devices Found —
GD25B128C ID:0xC84018 Size: 16384KB (131072Kb)
- Reading Flash [0x1000000] 16384KB of 16384KB - 100 percent complete.
Writing flash contents to file “backup.bin”…
Memory Dump Complete
FPT Operation Successful.
That’s great!
Could you please upload the backup somewhere and PM me the link to it so I can transfer your board’s details into the modified BIOS - it will save me time from doing it manually with a hex editor.
Done.
@MentalNomad PM sent with BIOS mod complete, if you have problems you can post here if you want or PM me.
Many thanks! Almost there.
I got the file, and the SHA1 for the .bin matches.
But when I open an Administrator Command Prompt and try to flash it, I get:
C:\Tools\Intel CSME System Tools v11 r29\Flash Programming Tool\WIN64>fptw64 -f Z170-AR-ASUS-3504.MOD1.bin
Intel (R) Flash Programming Tool. Version: 11.8.70.3626
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.
Reading HSFSTS register… Flash Descriptor: Valid
— Flash Devices Found —
GD25B128C ID:0xC84018 Size: 16384KB (131072Kb)
Error 368: Failed to disable write protection for the BIOS space.
FPT Operation Failed.
Ok, we need to bypass an Asus BIOS lock.
Lost_N_BIOS posted this guide on how to disable the Asus BIOS lock to get past error 368.
You will need a bootable USB stick with an EFI shell (you can download the EFI shell from the link at the bottom of the 1st page “EFI-Setup-FPT-Universal-IFR-Extractor.zip”)
For your BIOS (3504) the “Setup Variable” you will need to change is 0x8C6 and it’s default setting (0x1) needs to be changed to (0x0) to disable the BIOS lock.
You can start at step 6 as I have found the BIOS lock VarOffset/VarName for you.
Once you have disabled the lock you should get no errors using FPT to flash the modified BIOS in Windows.
OK, I followed the steps to disable the BIOS lock.
My BIOS utility did not show the “Clear Secure Boot Keys” option, so I needed to manually delete teh PK, KEK, DB, and DBX keys.
It showed secure boot disabled, I booted into Shell.efi from USB, and successfully set 0x8c6 to 0x00.
When I rebooted into Windows and re-tried the flash, I got a new error:
C:\Tools\Intel CSME System Tools v11 r29\Flash Programming Tool\WIN64>fptw64 -f Z170-AR-ASUS-3504.MOD1.bin
Intel (R) Flash Programming Tool. Version: 11.8.70.3626
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.
Reading HSFSTS register… Flash Descriptor: Valid
— Flash Devices Found —
GD25B128C ID:0xC84018 Size: 16384KB (131072Kb)
Unable to detect ME disabled.
Do you wish to proceed with the flash write operation? Y/<N> or q to quit : y
Error 451: The host CPU does not have write access to the target flash area. To enable write access for this operation you must modify the descriptor settings to give host access to this region.
FPT Operation Failed.
Should I be using
fptw64 -BIOS -F
?
@MentalNomad In your previous post it says ME is disabled, can you post your output from MEInfo and MeManuf using these commands;
MEInfoWin64
MEInfoWin64 -verbose
MEManufWin64
If there are no error messages then the Error 451 might just be a problem with the Windows 64-bit FPT, you can try using the DOS version from a bootable USB stick e.g.
fpt -f Z170-AR-ASUS-3504.MOD1.bin
Yes, you could try flashing just the BIOS region but you should try the DOS version of FPT first.
MEManufWin64:
Intel(R) MEManuf Version: 11.8.70.3626
Copyright(C) 2005 - 2019, Intel Corporation. All rights reserved.
MEManuf Operation Passed
MEInfoWin64
https://pastebin.com/ahu7J7U1
MEInfoWin64 -verbose
https://pastebin.com/D8rh6pJa
------------------------
I created a FreeDos boot USB using Rufus, copied the image and fpt.exe to it.
Running it in DOS produced identical output to running fptw64, including:
Unable to detect ME disabled…
Error 451: The host CPU does not have write access to the target flash area. To enable write access for this operation you must modify the descriptor settings to give host access to this region.
I’ll wait on flashing BIOS-only until you can look at my MEInfo dumps to confirm that’s the appropriate next step.
--------------------
GRUB / offset success:
https://paste.pics/22d37941bdaca5a0b253a5cd8dcc9d91
(I did this again to make sure it was 0x00.)
DOS flash output:
https://paste.pics/f35b457dac8eeb716a6631761301b98d
Secure Boot status:
https://paste.pics/da69b86c07daf42676a2584db88f0e6e
Secure Boot detail:
https://paste.pics/2eecda2372d7ad77d4a1cdbcca4aac59
@MentalNomad Thanks for posting all the info, at least we know you don’t have any ME FW corruption.
You can try flashing BIOS region only as it is the same size and location as the original.
If that doesn’t work then you’ll need to either try the HDA pinmod or use a programmer.
It’s working!
fptw64 - bios -f z170-ar-asus-3504.mod1.bin
------------------------------
FPT Operation Successful
Rebooting now… we may have a reboot loop… not getting into BIOS…
------------------------------
Yep. Definitely trouble.
Does not POST; just keeps power cycling. Nothing on the screen at all.
Next step?
----------------------------------
By the by, I’m not giving up… I didn’t menntion this, but I have two of this motherboard. If necessary, we can work on the second one until I get a programmer to fix the first. 
@MentalNomad
This is as far as we can go as the Z170-AR does not have USB flashback to recover from bad flash (although it says it does in the manual and on Asus web site!!!).
I’m afraid you will need to buy a programmer, I would suggest getting a ch134A with the green PCB (not black, it over volts).
[̶E̶d̶i̶t̶]̶ ̶M̶a̶k̶e̶ ̶s̶u̶r̶e̶ ̶y̶o̶u̶ ̶a̶l̶s̶o̶ ̶b̶u̶y̶ ̶a̶ ̶S̶O̶I̶C̶ ̶8̶ ̶t̶e̶s̶t̶ ̶c̶l̶i̶p̶ ̶s̶o̶ ̶t̶h̶a̶t̶ ̶y̶o̶u̶ ̶c̶a̶n̶ ̶p̶r̶o̶g̶r̶a̶m̶ ̶t̶h̶e̶ ̶B̶I̶O̶S̶ ̶c̶h̶i̶p̶ ̶w̶i̶t̶h̶o̶u̶t̶ ̶r̶e̶m̶o̶v̶i̶n̶g̶ ̶i̶t̶ ̶f̶r̶o̶m̶ ̶t̶h̶e̶ ̶b̶o̶a̶r̶d̶.̶
[Edit] The BIOS chip is actually socketed (as shown here) so can be extracted and flashed externally as Lost_N_BIOS has pointed out.
Did you try with your old CPU? If yes, then sounds like the BIOS region you flashed in was a bad BIOS edit (or FPTw64 issue)
From what I see here, if no FPTw64 caused issue, reboot should have been fine (unless bad BIOS region was flashed in)
Give me your mod BIOS, I will check it vs stock and tell you if I see anything that normally causes bricked BIOS (ie missing padding files, added padding files, other issues etc) << This is VERY common issue = brick, usually due to incorrect microcode edit method