[Solved] My first BIOS brick: What went wrong?

(What do you think AFU is the abbreviation for?)

What does the shell/OS booted for running tools have to say for the function of the tools?

Besides- there’s an efi64 shell version of fpt, too;
image

As written:

So once again: When dealing with the complete Intel firmware image it’s not reliable / adviseable to use tools which were developed for servicing only a part of it.

You’re of course free to try whatever you want!

Right. I think I see the problem now. (It stands for AMI Firmware Update.)

To be honest, I’m not sure. But I’m assuming that this kind of task is better performed outside of the main OS, in a pre-boot environment, or with a minimalist system like the EFI shell.

Right. Thanks for pointing this out. I didn’t know this, I thought it only worked in Windows. I see your point now. (It was only me who found the Windows version from the links above – NCR and Schenker Tech – and assumed that it’s the whole picture.)

OK. So despite having an AMI BIOS region, this still qualifies as an Intel firmware? Correct? I think this is the point I didn’t get at first. So I think I understand now why FPT is the preferred tool of choice here. Thank you for pressing the right points to make it clear for me.

@lfb6 Here are the files you requested. I used the Win64 version of FPT.

spi.zip (3.3 MB)
biosreg.zip (2.5 MB)

When I do a search for IWD220200050165 in the new file, I can’t find it. How can you tell if this is a serial number? Are they statically stored in NVRAM or dynamically generated by assembly code at boot time and then stored in SMBIOS tables?

Here’s a dump from AMI DMI Edit (AMIDEWINx64.EXE v5.22.0066) - “ALL” command.

          Name              R/W  Status  Information
--------------------------  ---  ------  ----------------------------------
(/IVN)BIOS vendor name.      R    Done   "American Megatrends Inc."
(/IV)BIOS version            R    Done   "TA101326.NB6"
(/ID)BIOS release date       R    Done   "03/26/2021"
(/SM)System manufacture      R    Done   "Partner Tech"
(/SP)System product          R    Done   "PAT-120"
(/SV)System version          R    Done   ""
(/SS)System Serial number    R    Done   "Default string"
(/SU)System UUID             R    Done   "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFh"
(/SK)System SKU number       R    Done   ""
(/SF)System Family           R    Done   ""
(/BM)Baseboard manufacture   R    Done   "Partner Tech"
(/BP)Baseboard product       R    Done   "PAT-120"
(/BV)Baseboard version       R    Done   "0.95"
(/BS)Baseboard Serial number R    Done   "FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF"
(/BT)Baseboard Asset Tag     R    Done   "Default string"
(/BLC)BB. Loc. in Chassis    R    Done   "Default string"
BaseBoardHandle = "0002h"
(/BMH)Baseboard manufacture  R    Done   "Partner Tech"
(/BPH)Baseboard product      R    Done   "PAT-120"
(/BVH)Baseboard version      R    Done   "0.95"
(/BSH)Baseboard Serial numberR    Done   "FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF"
(/BTH)Baseboard Asset Tag    R    Done   "Default string"
(/BLCH)BB. Loc. in Chassis   R    Done   "Default string"
(/CM)Chassis manufacture     R    Done   "Default string"
(/CT)Chassis type            R    Done   "03h"
(/CV)Chassis version         R    Done   "Default string"
(/CS)Chassis Serial number   R    Done   "Default string"
(/CA)Chassis Tag number      R    Done   "Default string"
(/CO)Chassis OEM value       R    Done   "00000000h"
(/CH)Chassis Height          R    Done   "00h"
(/CPC)Chassis Power cords    R    Done   "01h"
(/CSK)Chassis SKU Number     R    Done   "Default string"
ChassishHandle = "0003h"
(/CMH)Chassis manufacture    R    Done   "Default string"
(/CTH)Chassis type           R    Done   "03h"
(/CVH)Chassis version        R    Done   "Default string"
(/CSH)Chassis Serial number  R    Done   "Default string"
(/CAH)Chassis Tag number     R    Done   "Default string"
(/COH)Chassis OEM value      R    Done   "00000000h"
(/CHH)Chassis Height         R    Done   "00h"
(/CPCH)Chassis Power cords   R    Done   "01h"
(/CSKH)Chassis SKU Number    R    Done   "Default string"
(/PSN)Processor Serial Num.  R    Done   ""
(/PAT)Processor Asset Tag    R    Done   "Fill By OEM"
(/PPN)Processor Part Num.    R    Done   "Fill By OEM"
(/OS)OEM string         #1   R    Done   "Default string"
(/SCO)System Conf. Op.  #1   R    Done   "Default string"

So what do you make of it all? The original BIOS was newer by almost 2 years despite the lower version number, and it got corrupted by a failed downgrade?

There arent’t many similarities when comparing the two NVRAMs to each other. Might be that the newer bios- version writes / needs a different set of values, and there’s still uncertainity what we found in the firmware dump which was downdated- remnants of an old NVRAM or repopulating a fresh ‘old version’ NVRAM. You can’t ‘read’ anything here, unfortunately.

Good luck!

1 Like

Thank you for all your advice, and for looking into this for me! This has certainly been an interesting exploration and a new experience for me. I learned something! It lead me right into the topic of BIOS modding or programming. But I will call this one Done, or Solved now (I will rename the post title). I might try to repeat the process to see if it breaks/bricks again. Now that I have an external programmer so I can reverse it. I will post an update if I do that.

But I have to say, it really blows my mind how a 1 MB chip (the boot block is even smaller) can render a complete system unusable, and prevent access to all those tens of terabytes of data on it that we commonly store on our computers these days.

@lfb6

Baseboard serial
I have found IWD220200050165 on a barcode sticker on the board. The decoded text was partially covered by a piece of thermal pad, and I can’t read barcodes, but I can scan them with an app. I then removed the thermal pad and confirmed that this is the number you previously found in the dump. I think this is the baseboard serial number.

There are other numbers that could potentially be the baseboard serial number, like one on a sticker that sits on top of the shielded CPU / RAM / ROM assembly (13 characters, alphanumeric). But I’m betting on IWD220200050165 in this case. For one, it’s found both in the BIOS dump and on the board, and two, because of its location on the board. I have already set it as the baseboard serial number using AMI DMI Edit.

System serial
I have researched the serial numbers from this company. They are all 12 characters long, they start with a letter and the remaining 11 characters are all digits. I have only one number like that. One at a sticker at the back cover, along with hardware specs. And one on the inside of the display panel. So I have set this one as the system serial number.

The funny thing is that the system serial number was never set to begin with. I’m pretty sure of this now. So this laptop is now in a better shape than it was from the factory. Also, the support guy could not find any inventory or records based on this number, or any of the other numbers. I have not given him the IWD220200050165 number because I didn’t know it at the time. Maybe he can find some records based on that.

UUID
I have also generated a new UUID. Is this important for Windows activation? I have generated one using DMI Edit, just to fill the gap if nothing else.

I have decided to try and flash it with TA101611.C46 again, using the same method as before. I am better prepared this time. I have made a complete dump with FPT, and I will make another one with CH341A as well.

Well, I tried and it failed again, and again.

I tried flashing TA101611.C46 both with the provided AfuEfix64.efi and I tried flashing directly to chip with CH341A. It’s the same problem as before: it doesn’t boot, it gets warm, and only power LED on the USB hub comes on. Also, there is no signal from mini-HDMI to external monitor, so we can rule out what was previously speculated and suggested by the support guy.

I also tried flashing the older TA101131.C46 with CH341A, skipping past AfuEfix64.efi so we can rule out any script problem. Same problem! None of these two images will work. I suspect it’s because of the “C46” file name extension. I don’t think these were made for this particular version or revision of the tablet.

I think there has to be a BIOS file with “NB6” in the file name, for whatever reason, and whatever that signifies. I did ask the support guy to find out more about these file names, and he did contact the development guys. (Or so he said, I was not included in the communication.) But I didn’t get any new information, other than some suggestion of a new LCD panel possibly being used in devices that require the “NB6” files. (Minus the assertion that using an external monitor will work in such cases if it won’t boot.)

So this is not necessarily caused by downgrading or downdating to an older BIOS. I don’t think any of these “C46” images are compatible, and I don’t think it’s because of the LCD panel alone. There is something more to this, I think. I really like to get to the bottom of things like this. But at this point, there is nothing more that I can do, and I won’t get any more information from the manufacturer. The ball is in their court now. They did proceed to silently remove all software download links from their different websites (including Australia and Europe), perhaps while they investigate. The good thing is, I have restored the device to a full working state.