Restore original BIOS of EVGA Z87 after accidently flashing a Z97 BIOS with downgrade of Intel ME 9.1.x to 9.0.x

Special Topics Intel Management Engine
1

I have a EVGA Z87 Classified (E878) Motherboard but recently I make a big mistake: I click on the false item in the drop down menu in the BIOS download section and download the EVGA Z97 Classified (E979) BIOS and flash it. Flashing of the Z97 firmware terminates without any problems, but flashing back the correct Z87 BIOS is problematic. I think Intel Management Engine (ME) causes the problems because it is a downgrade.

The BIOS files



The correct BIOS I want to have is v1.09 for EVGA Z87 Classified (E878):
It can be found here: http://cdn.evga.com/BIOS/E878_flashtool_109.zip and I call this package further "E878_109.zip"

ME Analyser v1.4.0 output of the included 1E878109.bin:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
 

--------- ME Analyzer v1.4.0 ---------
 
File:     1E878109.bin
 
Firmware: Intel ME
Version:  9.0.31.1487
Release:  Production
Type:     Region, Extracted
FD:       Unlocked
SKU:      1.5MB
VCN:      3
PV:       Yes
Date:     12/12/2013
FITC Ver: 9.0.22.1467
Latest:   Yes
 
 


The script to update the BIOS in E878_109.zip just run:
1
 
FPT -F 1E878109.bin -SAVEMAC
 


where FPT is:
1
 
Intel (R) Flash Programming Tool. Version:  9.0.22.1467
 


So this is the EVGA official method to update the BIOS.

EDIT1: 1E878109.bin size: 16 777 216bytes (0x1 000 000 blocks)



The actual installed BIOS is v1.08 for EVGA Z97 Classified (E979):
It can be found here: http://cdn.evga.com/BIOS/Z97/E979_flashtool_108.zip and I call this package further "E979_108.zip"

ME Analyser v1.4.0 output of the included 1E979108.bin:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
 

--------- ME Analyzer v1.4.0 ---------
 
File:     1E979108.bin
 
Firmware: Intel ME
Version:  9.1.0.1120
Release:  Production
Type:     Region, Extracted
FD:       Unlocked
SKU:      1.5MB
VCN:      10
PV:       Yes
Date:     14/02/2014
FITC Ver: 9.1.0.1120
Platform: Desktop
Latest:   No
 
 


The script to update the BIOS in E979_108.zip just run:
1
 
FPT -F 1E979108.bin -SAVEMAC
 


where FPT is:
Intel (R) Flash Programming Tool. Version: 9.1.0.1035

EDIT1: 1E979108.bin size: 8 388 608bytes (0x800 000 blocks)

What I have tried so far



1. Just run update.bat in E878_109.zip from a DOS-USB-stick, e.g. run the command:
1
 
FPT -F 1E878109.bin -SAVEMAC
 


This will result in the error 25:

Error 25: The host CPU does not have write access to the target flash area. To enable write access for this operation you must modify the descriptor settings to give host access to this region.
Screenshot:




This error occurs when the Flash Descriptor is locked, or? But the analysing/info tolls say the it is unlocked.

2. Run the same command with FPT 9.1.0.1035 (the version shipped with E979_108.zip):
1
 
FPT -F 1E878109.bin -SAVEMAC
 

This will result in a C programming error:

Assertion Failed: 0, function SpiCheckAccess, file ..\..\Common\SpiFlashUtils.c, line 1394
Screenshot:




EDIT1: I also tried it with fptw64 (the windows 64 bit version) and I get the same error as in 1., so I assume it is simple a bug in the DOS version.

3. Run the same command with FPT 9.1.10.1000 (a newer version as in E979_108.zip):
1
 
FPT -F 1E878109.bin -SAVEMAC
 

same error as in 2.

Screenshot:




EDIT1: I also tried it with fptw64 (the windows 64 bit version) and I get the same error as in 1., so I assume it is simple a bug in the DOS version.

4. Try to first downgrade only the ME region with "Intel (R) Firmware Update Utility Version: 9.0.22.1467":
1
 
FWUPDLCL -F ME9015m.bin -ALLOWSV
 


where ME9015m.bin is "Intel ME Firmware v9.0.31.1487 (1.5MB)" from Intel Management Engine: Drivers, Firmware & System Tools

will result in the error:
Error 8704: Firmware update operation not initiated due to a SKU mismatch

Screenshot:





5. Try to first downgrade only the ME region with "Intel (R) Firmware Update Utility Version: 9.1.2.1000":
1
 
FWUPDLCL -F ME9015m.bin -ALLOWSV
 

same error again as in 4.

Screenshot:




6. Mention that flashing any Z97 (E979) BIOS version with the following command (so the default update command from the E979_xxx.zip" packages) still works fine:
1
 
FPT -F 1E979xxx.bin -SAVEMAC
 


7.(EDIT1) A backup and restore works:
1
 
FPT -D bak.bin
 

1
 
FPT -REWRITE -F bak.bin
 

Both fine.

Actually I don't have any further idea what to try and the EVGA support actually respond only (in PR language of course) with a "F*** you customer you already paid for the product". Have someone maybe a Idea?

Additional Information



FPT informations:
1
 
FPT -I
 





MEInfo (from Intel ME System Tools v9.1 r7 - (Updated: 18/11/2015) in Intel Management Engine: Drivers, Firmware & System Tools):
1
 
MEINFO
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
 

Intel(R) MEInfo Version: 9.1.20.1020
Copyright(C) 2005 - 2014, Intel Corporation. All rights reserved.
 
Intel(R) ME code versions:
 
BIOS Version:                           4.6.5
MEBx Version:                           0.0.0.0000
Gbe Version:                            1.3
VendorID:                               8086
PCH Version:                            5
FW Version:                             9.1.0.1120 H
 
FW Capabilities:                        0x41101960
 
    Intel(R) Anti-Theft Technology - PRESENT/ENABLED
    Intel(R) Capability Licensing Service - PRESENT/ENABLED
    Protect Audio Video Path - PRESENT/ENABLED
    Intel(R) Dynamic Application Loader - PRESENT/ENABLED
    Service Advertisement & Discovery - PRESENT/ENABLED
 
TLS:                                    Disabled
Last ME reset reason:                   Power up
Local FWUpdate:                         Enabled
BIOS Config Lock:                       Enabled
GbE Config Lock:                        Enabled
Host Read Access to ME:                 Enabled
Host Write Access to ME:                Enabled
SPI Flash ID #1:                        C22018
SPI Flash ID VSCC #1:                   20452045
SPI Flash BIOS VSCC:                    20452045
BIOS boot State:                        Pre Boot
OEM Id:                                 00000000-0000-0000-0000-000000000000
Capability Licensing Service:           Enabled
OEM Tag:                                0x00000000
Localized Language:                     Unknown
Independent Firmware Recovery:          Enabled
 
 


1
 
MEINFO -VERBOSE
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
 

Intel(R) MEInfo Version: 9.1.20.1020
Copyright(C) 2005 - 2014, Intel Corporation. All rights reserved.
 

FW Status Register1: 0x1E000255
FW Status Register2: 0x66002306
FW Status Register3: 0x00000200
FW Status Register4: 0x00004000
FW Status Register5: 0x00000000
FW Status Register6: 0x30000020
 
  CurrentState:                         Normal
  ManufacturingMode:                    Enabled
  FlashPartition:                       Valid
  OperationalState:                     M0 with UMA
  InitComplete:                         Complete
  BUPLoadState:                         Success
  ErrorCode:                            No Error
  ModeOfOperation:                      Normal
  Phase:                                HOSTCOMM Module
  ICC:                                  Valid OEM data, ICC programmed
  ME File System Corrupted:             No
 
Get ME FWU version command...done
 
SMBIOS Table Data 
    SM BIOS Spec Version :    2.8 
    Starting address:         0x ED100 
    Table Size in Bytes:        3026   ( 0xBD2 ) 
    Number of Table Entries:   the    78   ( 0x4E ) 
 
    Table Type   0 ( 0x 00 ) found, size of  24 (0x 18 ) bytes 
 
SMBIOS Table Data 
    SM BIOS Spec Version :    2.8 
    Starting address:         0x ED100 
    Table Size in Bytes:        3026   ( 0xBD2 ) 
    Number of Table Entries:   the    78   ( 0x4E ) 
 
    Table Type   0 ( 0x 00 ) found, size of  24 (0x 18 ) bytes 
    Table Type   1 ( 0x 01 ) found, size of  27 (0x 1B ) bytes 
    Table Type   2 ( 0x 02 ) found, size of  15 (0x 0F ) bytes 
    Table Type   3 ( 0x 03 ) found, size of  25 (0x 19 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
    Table Type  10 ( 0x 0A ) found, size of   6 (0x 06 ) bytes 
    Table Type  11 ( 0x 0B ) found, size of   5 (0x 05 ) bytes 
    Table Type  12 ( 0x 0C ) found, size of   5 (0x 05 ) bytes 
    Table Type  24 ( 0x 18 ) found, size of   5 (0x 05 ) bytes 
    Table Type  32 ( 0x 20 ) found, size of  20 (0x 14 ) bytes 
    Table Type  34 ( 0x 22 ) found, size of  11 (0x 0B ) bytes 
    Table Type  26 ( 0x 1A ) found, size of  22 (0x 16 ) bytes 
    Table Type  36 ( 0x 24 ) found, size of  16 (0x 10 ) bytes 
    Table Type  35 ( 0x 23 ) found, size of  11 (0x 0B ) bytes 
    Table Type  28 ( 0x 1C ) found, size of  22 (0x 16 ) bytes 
    Table Type  36 ( 0x 24 ) found, size of  16 (0x 10 ) bytes 
    Table Type  35 ( 0x 23 ) found, size of  11 (0x 0B ) bytes 
    Table Type  27 ( 0x 1B ) found, size of  15 (0x 0F ) bytes 
    Table Type  36 ( 0x 24 ) found, size of  16 (0x 10 ) bytes 
    Table Type  35 ( 0x 23 ) found, size of  11 (0x 0B ) bytes 
    Table Type  27 ( 0x 1B ) found, size of  15 (0x 0F ) bytes 
    Table Type  36 ( 0x 24 ) found, size of  16 (0x 10 ) bytes 
    Table Type  35 ( 0x 23 ) found, size of  11 (0x 0B ) bytes 
    Table Type  29 ( 0x 1D ) found, size of  22 (0x 16 ) bytes 
    Table Type  36 ( 0x 24 ) found, size of  16 (0x 10 ) bytes 
    Table Type  35 ( 0x 23 ) found, size of  11 (0x 0B ) bytes 
    Table Type  26 ( 0x 1A ) found, size of  22 (0x 16 ) bytes 
    Table Type  28 ( 0x 1C ) found, size of  22 (0x 16 ) bytes 
    Table Type  27 ( 0x 1B ) found, size of  15 (0x 0F ) bytes 
    Table Type  29 ( 0x 1D ) found, size of  22 (0x 16 ) bytes 
    Table Type  39 ( 0x 27 ) found, size of  22 (0x 16 ) bytes 
    Table Type  41 ( 0x 29 ) found, size of  11 (0x 0B ) bytes 
    Table Type  41 ( 0x 29 ) found, size of  11 (0x 0B ) bytes 
    Table Type  41 ( 0x 29 ) found, size of  11 (0x 0B ) bytes 
    Table Type   4 ( 0x 04 ) found, size of  42 (0x 2A ) bytes 
    Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes 
    Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes 
    Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes 
    Table Type  16 ( 0x 10 ) found, size of  23 (0x 17 ) bytes 
    Table Type  17 ( 0x 11 ) found, size of  40 (0x 28 ) bytes 
    Table Type  17 ( 0x 11 ) found, size of  40 (0x 28 ) bytes 
    Table Type  17 ( 0x 11 ) found, size of  40 (0x 28 ) bytes 
    Table Type  17 ( 0x 11 ) found, size of  40 (0x 28 ) bytes 
    Table Type  19 ( 0x 13 ) found, size of  31 (0x 1F ) bytes 
    Table Type  20 ( 0x 14 ) found, size of  35 (0x 23 ) bytes 
    Table Type  20 ( 0x 14 ) found, size of  35 (0x 23 ) bytes 
    Table Type 136 ( 0x 88 ) found, size of   6 (0x 06 ) bytes 
    Table Type  13 ( 0x 0D ) found, size of  22 (0x 16 ) bytes 
    Table Type 131 ( 0x 83 ) found, size of  64 (0x 40 ) bytes 
        MEBx Version found is 0.0.0.0000 
 
Get ME FWU info command...done
 
Get ME FWU version command...done
 
Get ME FWU feature state command...done
 
Get ME FWU platform type command...done
 
Get ME FWU feature capability command...done
 
Get ME FWU OEM Id command...done
FW Capabilities value is 0x41101960
Feature enablement is 0x41101960
Platform type is 0x72130302
Intel(R) ME code versions:
 
BIOS Version:                           4.6.5
MEBx Version:                           0.0.0.0000
Gbe Version:                            1.3
VendorID:                               8086
PCH Version:                            5
FW Version:                             9.1.0.1120 H
 
FW Capabilities:                        0x41101960
 
    Intel(R) Active Management Technology - NOT PRESENT
    Intel(R) Standard Manageability - NOT PRESENT
    Intel(R) Anti-Theft Technology - PRESENT/ENABLED
    Intel(R) Capability Licensing Service - PRESENT/ENABLED
    Protect Audio Video Path - PRESENT/ENABLED
    Intel(R) Dynamic Application Loader - PRESENT/ENABLED
    Service Advertisement & Discovery - PRESENT/ENABLED
    Intel(R) NFC Capabilities - NOT PRESENT
    Intel(R) Platform Trust Technology - NOT PRESENT
 
TLS:                                    Disabled
Last ME reset reason:                   Power up
Local FWUpdate:                         Enabled
 
Get BIOS flash lockdown status...done
BIOS Config Lock:                       Enabled
 
Get GbE flash lockdown status...done
GbE Config Lock:                        Enabled
 
Get flash master region access status...done
Host Read Access to ME:                 Enabled
Host Write Access to ME:                Enabled
SPI Flash ID #1:                        C22018
SPI Flash ID VSCC #1:                   20452045
SPI Flash BIOS VSCC:                    20452045
Protected Range Register Base #0 0x0
Protected Range Register Limit #0 0x0
Protected Range Register Base #1 0x0
Protected Range Register Limit #1 0x0
Protected Range Register Base #2 0x0
Protected Range Register Limit #2 0x0
Protected Range Register Base #3 0x0
Protected Range Register Limit #3 0x0
Protected Range Register Base #4 0x0
Protected Range Register Limit #4 0x0
BIOS boot State:                        Pre Boot
OEM Id:                                 00000000-0000-0000-0000-000000000000
Capability Licensing Service:           Enabled
 
Get ME FWU OEM Tag command...done
OEM Tag:                                0x00000000
 
Get ME FWU Platform Attribute (WLAN ucode) command...done
Localized Language:                     Unknown
 
Get ME FWU Info command...done
Independent Firmware Recovery:          Enabled
 
 


MEManuf (from Intel ME System Tools v9.1 r7 - (Updated: 18/11/2015) and Intel ME System Tools v9.0 r2 - (Updated: 13/06/2015)) say both that everything is fine|addpics|3i3-1-1dc4.jpg,3i3-4-c14b.jpg,3i3-5-ce2d.jpg,3i3-6-41d5.jpg,3i3-7-3a76.jpg,3i3-8-daf5.jpg|/addpics|
2

@ F.Raab:
Welcome at Win-RAID Forum!

I hope, that you will get very soon help from plutomaniac, our expert regarding Intel ME issues.

Merry Christmas and Happy New Year!
Dieter (alias Fernando)

3

You need to make a pinmod to start your PC in ME security override mode, then you can reflash your Z87 BIOS with FPT

4

Or if your bios eeprom chip is not soldered , you can try to reprogram it via an eeprom usb programmer like the EZP2010 or similar.

I can reprogram your chip and fix your issues but I don’t think we are of the same country. :slight_smile:

5

@Fernando
Thanks :slight_smile:

Also marry Christmas and a happy new year to everyone!

pinmod



@CodeRush
Correct me, but a pinmod would only set the Flash Descriptor to unlocked? But MEInfo says that it is already unlocked. Also FPT -D bak.bin works which indicates that it is Unlocked?

external programmer



@Sylar76
Thanks :slight_smile: … mhmm two of them are soldered (the Motherboard has three), the third is in a box. Unfortunately the box was bad soldered and I ripped it accidentally off while trying to open the box^^, but there are two left. I have a raspberryPi which I could maybe use, but lets try other things first.

size problems



Maybe the problem is not ME. I found out that the BIOS images have different sizes:

1E878109.bin size: 16 777 216bytes (0x1 000 000 blocks)
1E979108.bin size: 8 388 608bytes (0x800 000 blocks)

So the actual installed BIOS is smaller than the correct one. The tools seems to not be able to detect the correct size of the flash storage (it must have at least 16 777 216bytes because of it is the original BIOS size):

If I run the command (with FPT 9.0 or 9.1):

1
 
FPT -ERASE -LENGTH 8388608
 

it works fine, but if I run
1
 
FPT -ERASE -LENGTH 8388609
 

it fails with
1
 
Error 321: The address is outside the boundaries of the flash area.
 

Screenshot:


This is maybe also the reason why FPT alway prints the Warning on every operation:
1
 
Warning: There are some addresses that are not defined in any regions. Read/Write/erase operations are not possible on those addresses.
 


I tried also flashrom and it could also detect only the first 8388609bytes:

1
 
flashrom -p internal -w 1E878109.bin
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
 

flashrom v0.9.7-r1711 on Linux 3.14.56-std461-amd64 (x86_64)
flashrom is free software, get the source code at http://www.flashrom.org
 
Calibrating delay loop... OK.
Found chipset "Intel Z87". 
This chipset is marked as untested. If you are using an up-to-date version
of flashrom *and* were (not) able to successfully update your firmware with it,
then please email a report to [email protected] including a verbose (-V) log.
Thank you!
Enabling flash write... Enabling hardware sequencing because some important opcode is locked.
OK.
Found Programmer flash chip "Opaque flash chip" (8192 kB, Programmer-specific) at physical address 0x0.
Warning: SPI Configuration Lockdown activated.
Error: Image size (16777216 B) doesn't match the flash chip's size (8388608 B)!
 
 


But this makes not really sense for me. Why should the flash storage suddenly shrink? And why I don't have access to the rest. Is there anywhere a max_size value which I could not erase?

Maybe the --force option of flashrom could help; does anybody know?
1
2
3
4
5
6
7
8
9
10
11
12
 

-f, --force
    Force one or more of the following actions:
 
    * Force chip read and pretend the chip is there.
 
    * Force chip access even if the chip is bigger than the maximum supported as size for the flash bus.
 
    * Force erase even if erase is known bad.
 
    * Force write even if write is known bad. 
 
 


Or has anybody another idea for that?|addpics|3i3-9-abe2.jpg|/addpics|
6

@F.Raab , you have flashed a descriptor region with a wrong size of BIOS region and SPI flash chip. This problem can’t be corrected with FPT no matter if the descriptor is locked or not, buy yourself a cheap external SPI programmer and flash your 16Mb binary with it.

7



You brought me to the correct idea :slight_smile: yea! (without an external programmer :wink: )

I solved the issue doing the following:

1. The first 4096 bytes are the Flash Descriptor, so overwrite it with the flash descriptor which contains the correct BIOS length information

1
 
FPT -F 1E878109.bin -REWRITE -LENGTH 4096
 


2. To accept the new lengths, the computer has to be restarted. Of course now there are two different BIOS flashed, but it works enough to start again a DOS system from a USB stick.

3. Now I have access to all 16 777 216bytes and a normal BIOS flash is working now
1
 
FPT -F 1E878109.bin -SAVEMAC
 



Now my computer is working again, yea Thanks for the help!
8


Nice, didn’t know it’s possible, normally the system can’t boot from this point and you have to use external SPI programmer to recover. Glad it worked this way.