[Resolved] Fujitsu Lifebook E743 with QM77 turns off after 10min

Special Topics Intel Management Engine
1

Please, tell me what is wrong?
Chipset QM77
ME-file 8.1.72.3002_5MB_PRD_RGN.bin (size 7660Kb)
Pictures:

DSC_1541.jpg

MAresults1.jpg

DSC_1537.jpg

2

Looks like you were trying to flash a ME region with an unconfigured ME.

3


Unconfigured ME-file or ME-flash? And what should I do?
My ME-flash is broken and I can’t do anything with it :frowning: There are "get fw version error" "me invocation flow error" messages during boot and I haven’t access from Win - the driver doesn’t see ME.

DSC_1534.jpg

4

Dump bios, follow this guide: [Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

5


I tried to use "fpt -d dump.bin" but got a error like "The host CPU does not have read access to the target flash area. To enable read access for this operation you must modify the descriptor settings to give host access to this region"
Maybe I can use "pinmod" to read bios but I still doesn’t understand how to write ME-region of correct size.
Also I’ve extracted the ME-file from the latest vendor’s bios update (I can’t use the vendor’s recommended tools to write it because my current me is totally broken) - it is the same file as the file from the Intel repository (and same size). I can’t understand why fpt messages me about a size mismatch.

6

You’re up to now are the only person who knows the vendor (and type) of your board… But after your description "the vendor" uses MEs own update routine which works with unconfigured firmware files. And even if you don’t understand it: This messing kept you from bricking your board.

Regarding ME FW updates:
Intel (Converged Security) Management Engine: Drivers, Firmware and Tools

7


Ok, vendor (laptop Fujitsu Lifebook E743 with QM77 turns off after 10min 30sec after switching on) uses simple "FWUpdLcl.exe -f ME.BIN" for writing ME-file. The fujitsu’s ME-file is identical to the stock-file "8.1.72.3002_5MB_PRD_RGN.bin" from Intel’s repository. It means the file is unconfigured. But I can’t use FWUpdate with RGN-file because the current ME is broken and I must use fpt with an EXTR-file instead. To get the EXTR-file I should use "pinmod", dump current ME (or all bios), then aggregate the Data-section of dump with the RGN-file by FIT according the plutomaniac’s guide. Is it correct?

Is it possible that my data-section of dump will be broken and I won’t be able to use it?

8

You have to use fpt with a ME firmware region configured with FIT according to settings found in your dumped ME firmware region. And yes, it’s possible that the configuration cant be read, but I’ve not experienced this myself very often. Alternative to pinmod you might use a CH341 programmer. Bios chip you already got: MX25L6405D

9


Thank you, I’ll begin to try…

MX25L6406E + MX25L8006 in my case
Your advice might come in handy because I’ve found compatible (for model E733, chassis CP621880-z1) bios dump with ME for a programmer. But I don’t have a programmer yet and I’m not sure about flashing this motheboard with clips (without soldering). I don’t know how to use "bios dump for programmer" by another way but flashing by a programmer.

And there is one strange thing: this bios dump contains 2 files: "work_8mb + ME_Region_HM76_new.bin" and "work_1mb.bin". Fujitsu E733 and my E743 are compatible and bioses are same, but they are both on QM77 - not on HM76. Mayby they are compatible or some oldest model was on HM76. It’s important for me because I’ve found EXTR-me-file "HM76MEnew.bin" - it is 1,5Mb size, but I can open it with FIT!
"Intel ME 8 Firmware Repository" contains a lot of 1,5Mb files. Are they compatible with 5Mb versions? Or is it better not to try?

MA_HM76.png
MA_HM76.png448×512 12.2 KB

10

Don’t flash other bios dump, you’ll lose board specific data like serial, MAC, service tag…

You might try to dump the other regions of your uefi firmware:

fpt(w(64)) -BIOS -d biosreg.bin
fpt(w(64)) -DESC -d fd.bin
fpt(w(64)) -GBE -d gbe.bin.bin

Complete firmware is 9MB, that’s the reason for 8 MB + 1 MB Chip. If you dump the bios region it’s a little easier to work with fit, as it’ll refuse to work on an incomplete image and you’d have to extract the ME region first (UEFItool/HcD). Then you can work on ME region only, but I’d prefer to work on a complete firmware image. Since FIT doesn’t change anything in the bios region and delivers 8 MB and 1 MB image directly you wouldn’t have to flash the 1 MB chip.

Yes, 733, 743 and 753 may be same config. But: I found 3 dumps 733, and they’re all QM77, but all 3 different config and at least 2 was ‘fiddled with’.

1.5 MB and 5 MB aren’t compatible.

11

Thank you for the clarification, @lfb6 ! In the future I should read the guides more thoughtfully :slight_smile:
I did pinmod, then read, configured according to the guide and wrote again. It works. Attached my cleaned+configured full dump of latest (v1.12 + ME8.1.72.3002_HF) bios for Fujitsu Lifebook E743 here.

outimage.rar (4.47 MB)

12

Thanks for the feedback! Cleaned dump looks perfect, good work and nice that everything worked out!

13

Hello champs!

I’ve just registered with hope to get support. I think I need to attempt fixing my Fujitsu Lifebook E743 like Shulbert did, otherwise It would be e-waste of a cute i7*QM system that is still used…

I have similar symptoms: cold system shutdown after 10min. This happened after I attempted BIOS update (with hope of fixing - together with drivers update -the inability to wake from sleep with keyboard/mouse). I suspect my ME section got corrupted, ME configuration attempt via Ctrl-P key option at boot gives the “Get FW Version Error” + “ME Invocation Flow Error” messages.

I think I have the necessary skills to perform the task, however I 'd be happy to receive your guidance and review of my planed actions:
I already dismantled the notebook, and have identified the 2 MX25* ICs.
I’m planning of buying a CH341A based SPI HW tool, and I can solder some thin wires to read/write the flash IC’s in situ, I could also inject voltages with controlled max. current if needed. Otherwise I could also unmount the ICs, perform the read/write off board and remount.

The information I need I suspect can be found on following threads, albeit it might not be exhaustive, despite there is quite a bit to digest for a newcomer like myself:

  1. HW tool: … /guide-using-ch341a-based-programmer-to-flash-spi-eeprom/30834#msg13783
  2. General knowledge: … /intel-converged-security-management-engine-drivers-firmware-and-tools-16/89959
  3. Manipulating the dumped binary: … /guide-clean-dumped-intel-engine-cs-me-cs-txe-regions-with-data-initialization/31277

I’m planning on figuring out:

  1. how to handle the HW, voltages, connections, what is that “pinmod”, programmer tool usage for read and write operations;
  2. how to process the SPI read result: the dumped binary file (entire BIOS), clean it (need to understand what it means and implies), or to isolate my laptop specific data sections and merge it with uncorrupted ME factory provided/publicly available sections to obtain an uncorrupted binary, compute CRC or hash for it, sign it perhaps (but with what?);
  3. how to flash the newly obtained binary and test/validate, or debug/detect/diagnose if I made it worse or even bricked it completely.

Any tailor made guidance/step summary for me personally would be greatly appreciated! I have SW and HW background but in industrial and automotive embedded stuff, no experience around PC BIOS :frowning:

Until such help would arrive, if any, I will spend time on educating myself using the threads mentioned above and I’m available to provide answers, pictures, etc. for anyone who would like to accelerate my efforts.

Many thanks in advance!

PS: I have tried multiple times to flash many versions of BIOS, and BIOS+ME? from Fujitsu’s site:
image
and have attempted various settings and selected menu options in BIOS like disable TPM, clear (!!) TMP config. in order to try to “fix” it unknowingly :grimacing:

14

That’s a little optimistic for a task that’s been done and described here quite a lot of times …

You need to get a valid dump of your firmware (at least 2 separate dumps which have a structure in UEFIToolNE and are a 100% identical!)

Regarding use of a CH341 programmer: There are lots of threads / guides

Then follow:
[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

Ask specific questions if necessary, post your dump and the file you want to flash if someone should have a look into it before flashing the chip!

1 Like
15

I got to reading about “pinmod”. Implemented it quickly with a 1k resistor, and managed to dump a binary to file!

(It did not work without pinmod, netiher with “FWUpdLcl.exe -save fw.bin” nor with “fpt -d fw.bin”, got same message as Shulbert, basically FD was locked.)

Made a dump, then restart and made a second dump. Files attached:
Csongor_FujiE743_dump.zip (9.7 MB)
I’ll try to make sense of it in the following days, after I digest the “Clean dumped Intel Engine…” thread. If any expert cares to take a look and provide some interpretation on what is visible there, I’d be curious.

Question: if pinmod worked for reading, will it work for writing using SW tools, this means I don’t need to rush buying a SPI HW programming tool (i.e. CH341A based)? Thanks!

16

Good :+1:

FWUpdLcl -save will just give you a basic backup of ME, nothing else. For re-initializing the ME working on a complete firmware image is much easier.

I assume you dumped with fpt(w(64)).exe -d spi.bin? If that works it’s one of the safest modes to dump, you avoid bad contact trouble with the SOIC clip…

Reinitialize the ME for one of those images according to the guide (they slightly differ in NVRAM, but that’s normal since new entries can get created with every boot).
Extract ME with UEFIToolNE (“extract as is”) from created outimage, save it as ME.bin and flash the ME region with fpt(w(64) -ME -f ME.bin

That should work, but you have to be precise, fpt writes whatever it gets to the SPI!

1 Like
17

Correct. Please allow me to explain for the possible benefit of next victim/forum reader:

  1. From manufacturer website I have identified Intel ME 8.x being used:
    image
    image822×456 59.1 KB
  2. Downloaded “ME System Tools v8 r3.rar” from link “ME System Tools v8” of chapter “C. Intel (CS)ME System Tools” from thread
    Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)
  3. Made a FreeDOS bootable USB pendrive using latest Rufus to date v4.3, then copied extracted rar content.
  4. In laptop BIOS: disabled secure boot, allowed compatibility mode. Booted from DOS pendrive using F12 keystroke on Fujitsu.
  5. Finally have navigated to "…\Flash Programming Tool\DOS" on pendrive and ran “fpt.exe -d fw.bin” command to obtain flash content dumped to file, making sure I move quickly to avoid dump procedure being interrupted by the 10 minute mark, where the system does a cold shutdown.

I could have run Flash Programming Tool within Windows (fptw64.exe) or should I stay in DOS especially for write operation to avoid Windows chewing from my 10 min time?

Also used MEInfo and MEManuf from toolbox, but I guess they don’t show more than ME analyzer on dumped binary, or I don’t comprehend what I’m looking at.

I still need to wrap my head around on what is corrupted and how I fix it. I presume I need to take a factory original (RGN) ME Code section and concatenate my Configured DATA section using UEFIToolNE (open source tool?) or fitc.exe (Intel’s Flash Image Tool?). The obtained “fixed” Extracted (EXTR) binary shall be written back to SPI BUS operated MX25L* CMOS Flash storage ICs using same method (pinmod to unlock security and use fpt.exe)? No need for HW tool to access physical layer on SPI directly.
I’m planning to read carefully thread “Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)” to understand the working principles and then thread “[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization” section “D3. ME 7 - 10 & TXE 1 - 2” to understand the procedure of ME reinitialization.

18

Guys, I think it’s fixed, it’s a success!

Kudos @lfb6 for the guidance!

What I did:
I started with “ME8_5M_Production.bin” from Fujitsu’s site instead of ME firmware repository to eliminate human error of selecting wrong file. Opened it with Intel’s Flash Image Tool (fitc.exe) and got the ME sector “…\ME System Tools v8 r3\Intel ME System Tools v8 r3\Flash Image Tool\v8.1.40.1456\ME8_5M_Production\Decomp\ME Region.bin”.

Then opened my dumped binary and followed “[Guide] Clean Dumped …" steps to replace my corrupted ME Region.bin with supplier’s. Built the entire image which is fixed.

Then used UEFITool_NE_A68_win64 to open this entire image and select ME region, extract as ME.bin as @lfb6 suggested I only needed the ME, not the entire flash content including BIOS, etc. Copied ME.bin to my USB pen drive which is DOS bootable and has Flash Programmer Tool.

Here is the resulted ME region’s binary:
ME.zip (2.5 MB)
Also made some basic checks with MEAnalyzer along the way.

Then booted my laptop with pinmod (short with a 1k resistor between my Realtek ALC269 Sound Driver IC’s pins 1=DVDD=3V3 and 5=SDATA-OUT) and wrote flash with command: “fpt.exe -f me.bin -me”. It took a minute or two to erase the sectors and write new data. It also verified and confirmed original file and read-back after erase+write are identical. Once done, I rebooted directly to Windows, and fan is no longer active righ after startup despite no heat, this was a promising sign! Ultimately I waited, did some CPU load, and shutdown after 10 minutes is no longer happening!

Thank you Win-Raid Forum and @lfb6 !!!

19

Glad you made it and thank you for sharing your detailed experience for future users guidance with this model, all the best.

1 Like
20

Thanks for the feedback! And don’t forget the creator of the cleaning guide…

1 Like