The device is basically like a Intel NUC on steroids: in particular, with a CPU that doesn’t suck (mine is a i7-8850H). It’s made by a mysterious manufacturer somewhere in China and has been sold under numerous “brands,” including: EGlobal, Inctel (英科特尔)/Partaker (model B18), or Soarsea (双影王族). Overall it’s a very nice, high-quality unit but the AMI Aptio V BIOS it ships with is hopelessly deprived of all the interesting settings, although a couple of the advanced ones were copied over to the Boot menu (such as for example CPU Turbo options).
Even though it has a Coffee Lake CPU, the chipset is QM175 (Skylake-H). There is also an older generation of this product with previous-generation CPUs using DDR3 memory, I’m not sure if it uses the same BIOS but the steps below should at the very least apply to all the DDR4 versions.
This is a rather niché product but the information might be useful for dealing with similar systems as well.
Flashing
As far as I know no flashable BIOS files are publicly available, so be sure to do a complete backup of whatever the device came with before making any changes. There is also no “official” flash utility (some version of AFUWIN would probably do the job) but the good news is there is also no protection of any kind such as PRR in place, so Intel’s FPT(W64) works great. The interesting bits from a Chipsec report are quoted below:
- bios_wp1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
[*] running module: chipsec.modules.common.bios_wp
[x][ =======================================================================
[x][ Module: BIOS Region Write Protection
[x][ =======================================================================
[*] BC = 0x00000A88 << BIOS Control (b:d.f 00:31.5 + 0xDC)
[00] BIOSWE = 0 << BIOS Write Enable
[01] BLE = 0 << BIOS Lock Enable
[02] SRC = 2 << SPI Read Configuration
[04] TSS = 0 << Top Swap Status
[05] SMM_BWP = 0 << SMM BIOS Write Protection
[06] BBS = 0 << Boot BIOS Strap
[07] BILD = 1 << BIOS Interface Lock Down
[-] BIOS region write protection is disabled!
[*] BIOS Region: Base = 0x00200000, Limit = 0x007FFFFF
SPI Protected Ranges
------------------------------------------------------------
PRx (offset) | Value | Base | Limit | WP? | RP?
------------------------------------------------------------
PR0 (84) | 00000000 | 00000000 | 00000000 | 0 | 0
PR1 (88) | 00000000 | 00000000 | 00000000 | 0 | 0
PR2 (8C) | 00000000 | 00000000 | 00000000 | 0 | 0
PR3 (90) | 00000000 | 00000000 | 00000000 | 0 | 0
PR4 (94) | 00000000 | 00000000 | 00000000 | 0 | 0
[!] None of the SPI protected ranges write-protect BIOS region
[!] BIOS should enable all available SMM based write protection mechanisms or configure SPI protected ranges to protect the entire BIOS region
[-] FAILED: BIOS is NOT protected completely
- spi_access1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
[*] running module: chipsec.modules.common.spi_access
[x][ =======================================================================
[x][ Module: SPI Flash Region Access Control
[x][ =======================================================================
SPI Flash Region Access Permissions
------------------------------------------------------------
[*] FRAP = 0x0000FFFF << SPI Flash Regions Access Permissions Register (SPIBAR + 0x50)
[00] BRRA = FF << BIOS Region Read Access
[08] BRWA = FF << BIOS Region Write Access
[16] BMRAG = 0 << BIOS Master Read Access Grant
[24] BMWAG = 0 << BIOS Master Write Access Grant
BIOS Region Write Access Grant (00):
FREG0_FLASHD: 0
FREG1_BIOS : 0
FREG2_ME : 0
FREG3_GBE : 0
FREG4_PD : 0
FREG5 : 0
BIOS Region Read Access Grant (00):
FREG0_FLASHD: 0
FREG1_BIOS : 0
FREG2_ME : 0
FREG3_GBE : 0
FREG4_PD : 0
FREG5 : 0
BIOS Region Write Access (FF):
FREG0_FLASHD: 1
FREG1_BIOS : 1
FREG2_ME : 1
FREG3_GBE : 1
FREG4_PD : 1
FREG5 : 1
BIOS Region Read Access (FF):
FREG0_FLASHD: 1
FREG1_BIOS : 1
FREG2_ME : 1
FREG3_GBE : 1
FREG4_PD : 1
FREG5 : 1
[*] Software has write access to Platform Data region in SPI flash (it's platform specific)
[!] WARNING: Software has write access to GBe region in SPI flash
[-] Software has write access to SPI flash descriptor
[-] Software has write access to Management Engine (ME) region in SPI flash
[-] FAILED: SPI Flash Region Access Permissions are not programmed securely in flash descriptor
- spi_desc1
2
3
4
5
6
7
8
9
10
11
12
13
[*] running module: chipsec.modules.common.spi_desc
[x][ =======================================================================
[x][ Module: SPI Flash Region Access Control
[x][ =======================================================================
[*] FRAP = 0x0000FFFF << SPI Flash Regions Access Permissions Register (SPIBAR + 0x50)
[00] BRRA = FF << BIOS Region Read Access
[08] BRWA = FF << BIOS Region Write Access
[16] BMRAG = 0 << BIOS Master Read Access Grant
[24] BMWAG = 0 << BIOS Master Write Access Grant
[*] Software access to SPI flash regions: read = 0xFF, write = 0xFF
[-] Software has write access to SPI flash descriptor
[-] FAILED: SPI flash permissions allow SW to write flash descriptor
- spi_lock1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
[*] running module: chipsec.modules.common.spi_lock
[x][ =======================================================================
[x][ Module: SPI Flash Controller Configuration Locks
[x][ =======================================================================
[*] HSFS = 0x0010E800 << Hardware Sequencing Flash Status Register (SPIBAR + 0x4)
[00] FDONE = 0 << Flash Cycle Done
[01] FCERR = 0 << Flash Cycle Error
[02] AEL = 0 << Access Error Log
[05] SCIP = 0 << SPI cycle in progress
[11] WRSDIS = 1 << Write status disable
[12] PR34LKD = 0 << PRR3 PRR4 Lock-Down
[13] FDOPSS = 1 << Flash Descriptor Override Pin-Strap Status
[14] FDV = 1 << Flash Descriptor Valid
[15] FLOCKDN = 1 << Flash Configuration Lock-Down
[16] FGO = 0 << Flash cycle go
[17] FCYCLE = 8 << Flash Cycle Type
[21] WET = 0 << Write Enable Type
[24] FDBC = 0 << Flash Data Byte Count
[31] FSMIE = 0 << Flash SPI SMI# Enable
[+] SPI write status disable set.
[+] SPI Flash Controller configuration is locked
[+] PASSED: SPI Flash Controller locked correctly.
As you can see, the FLOCKDN bit is still set, although it doesn't actually lock down anything.
The FPT utility is part of Intel's CSME System Tools helpfully provided by @plutomaniac in a dedicated thread: Intel Management Engine: Drivers, Firmware & System Tools. Since the chipset is a Skylake-H (QM175), use version 11 (not 12) of the tools. Specifically, I used FPTW64 version 11.8.65.3606, part of Release 28 of 2019-10-27 (the latest at the time):
1
2
3
4
2
3
4
% FPTW64.exe -ver
Intel (R) Flash Programming Tool. Version: 11.8.65.3606
Copyright (c) 2007 - 2018, Intel Corporation. All rights reserved.
The ME was already disabled on the device when I got it so there is no risk it could interfere with the flashing process:
- ME Analyzer (1.96.2 Release 175)1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
Family : CSE ME
Version : 11.0.22.1000
Release : Production
Type : Region, Extracted
SKU : Consumer H
Chipset : SPT-H D
Security Version Number : 1
Version Control Number : 20
Production Ready : Yes
Lewisburg PCH Support : No
OEM RSA Signature : No
OEM Unlock Token : No
Date : 2016-12-12
File System State : Configured
Size : 0x1BF000
Flash Image Tool : 11.6.0.3307
Latest : No
- ME Info1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
% MEInfoWin64.exe -fwsts -verbose
Intel(R) MEInfo Version: 11.8.70.3626
Copyright(C) 2005 - 2019, Intel Corporation. All rights reserved.
Windows OS Version : 10.0
[...]
CurrentState: Disabled
ManufacturingMode: Enabled
FlashPartition: Valid
OperationalState: Transitioning
InitComplete: Initializing
BUPLoadState: Success
ErrorCode: Disabled
ModeOfOperation: Alt Disable Mode
SPI Flash Log: Not Present
FPF HW Source value: Not Applicable
ME FPF Fusing Patch Status: ME FPF Fusing patch NOT applicable
Phase: BringUp
ICC: Valid OEM data, ICC programmed
ME File System Corrupted: No
PhaseStatus: UNKNOWN
FPF and ME Config Status: Not committed
Physically, the flash chip is a run-of-the-mill Winbond W25Q64JVSIQ. The bad news is that the CH341A programmer (at least the version I have) does not seem to provide enough power to make in-circuit SPI flash programming possible, which makes for a strong incentive not to mess anything up while software-flashing, so that the device doesn't end up bricked. I think it should still be possible to either try programming a live (powered on) system (disconnecting the power from the SOIC8 clip) or, in the worst-case scenario, desoldering the chip to reflash it. Fortunately I did not have to attempt either but the prospect of having to deal with it made me somewhat less adventurous than I would usually be, and double-check everything.
There is also another SPI flash chip present, a Winbond W25Q80DVSIG. I presume it's used by the onboard RTL8168G Ethernet controller.
To dump the BIOS (6,291,456 bytes):
% FPTW64.exe -bios -d BIOS.bin
I also suggest you make a complete dump (8,388,608 bytes) once before making any changes:
% FPTW64.exe -d All.bin
This could be used with a hardware programmer if things go south. My suggestion would be not to flash the full dump with FPTW64 (I did not try it myself but, from the experience with other systems, it could potentially lead to problems, and is in any case superfluous).
Instead, just flash the BIOS portion as follows:
% FPTW64.exe -bios -f BIOS.bin
See the following post on how to come up with a modified BIOS file.