There’s no need to use UEFITool. Cleaning the ME working on a complete image would give you a complete image, deleting last part of NVRAM is done with hex editor
Ok. Will try.
I try to clean the ME region, so I make the firmware according to the guides, but when I want to flash it (by FPTW64), I get an error:
error 368: failed to disable write protection for the bios space
Can I flash it through Intel Flash Programming Tool or only through the programmator?
You can attach the file if I should have a look into it.
Bios region is protected not only by flash descriptor! You could flash ME region with the -ME switch alone. I don’t think you need to extract it from outimage.bin, but I’m not a 100% sure.
Old
dump.rar (4.0 MB)
Created
outimage.rar (3.9 MB)
ME Region from repository
11.8.92.4222_CON_LP_C_NPDM_PRD_RGN.rar (1.3 MB)
Message:
I tried to download ME separately with the -ME key, but I was warned about the size - about 6 MB. After extraction with the Flash Image Tool (FIT) - ME Region.bin was about 2 MB.
All necessary devices “works” fine
I think I don’t understand you completely. Outimage looks OK.
You might try to extract ME region with UEFIToolMNE (right- cklick, extract as is) and to flash it with -ME switch, but ME is still locked in FD:
As I said earlier, the tablet lost touch after replacing the display and updating the firmware. The touch on the new display worked before the update. I put the old display back to rule out the possibility of a hardware failure. The touch does not work on the old display either.
You recommended cleaning the ME. I dumped my firmware (dump.bin) and replaced the ME Region with a clean one from the repository (outimage.bin). However, I can’t flash the entire firmware using FPT because the security bit is set.
I’m waiting for a new touch cable to arrive. If nothing changes after the replacement, I will flash the Winbond with a programmator.
Yes, it is locked too:
Region_ME_ME_region.rgn is extracted from UEFIToolNE, as you show on shot.
That’s an unexpected error message. What does a fptw64 -i give you?
I made a firmware with pure ME from my firmware. I removed the chip and flashed it with a CH341A.
However, the touch did not appear.
Looking for any previous version dump for SP 5 2017 LTE (1807).
The only part of the firmware that is different from a stock firmware now is NVRAM.
outimage_nvram empty.zip (6.7 MB)
The necessary parts will be rebuilt, maybe you loose machine specific data like serial, maybe these are stored in TPM and get restored therefrom.
outimage_nvram-cut.zip (6.7 MB)
That’s the basic machine related information kept, but as written one can’t be a 100% sure if the cut is made the right place.
I will try later. I order “adapter” for WSON 5x6mm for CH341. When the adapter arrives, I’ll continue my experiments. it is difficult to solder flash all the time.
Thanks for the feedback. Will be interesting if the missing touch capability really is NVRAM- related!
One of the things I’m thinking about is some kind of unique code that is stored in a small board that is responsible for the touch. When I replaced the screen with another one (along with the board), something was written/changed in the firmware and subsequently blocked the touch (again, with the new screen and the new board, the touch worked fine for a while).
On the other hand, replacing this board back to the original did not work.
I also have this same issue and am looking to see if there has been any solution to this problem with the touch capability on the surface pro 5 after changing the screen. I have the same bubble showing up on the sides of the screen that indicates the touch screen is not responsive.
There are a lot of reasons for touch not working. It seems that the problem- if firmware related- isn’t related to the bios region, but to ME region. There’s a ME firmware setting ‘Intel Precise Touch Technology’ which can’t be set when configuring Intel ME options / cleaning ME region. It can be enabled by commandline, but only if the ME region is in manufacturing mode. Unclear how one could change this setting after machine is in end of manufacturing state. See
Otherwise it may be a corrupt ME, the fault in ME that’s described in the badcaps solution, or simply hardware…
BIOS with cleared ME does not helped.
Back to the “original” BIOS (after “breaking” update, i don`t have an earlier one). Changed screen again to an other one (with touch board).
No effect (
Intel(R) MEInfo Version: 11.8.92.4189
Copyright(C) 2005 - 2020, Intel Corporation. All rights reserved.
Intel(R) ME code versions:
BIOS Version 239.871.768
MEBx Version
GbE Version Unknown
Vendor ID 8086
PCH Version 21
FW Version 11.8.94.4494 LP
Security Version (SVN) 3
LMS Version Not Available
MEI Driver Version 2251.4.2.0
Wireless Hardware Version Not Available
Wireless Driver Version Not Available
FW Capabilities 0x11111650
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Intel(R) Precise Touch Technology - PRESENT/ENABLED
Re-key needed False
Platform is re-key capable True
TLS Disabled
Last ME reset reason Power up
Local FWUpdate Disabled
BIOS Config Lock Enabled
GbE Config Lock Enabled
Host Read Access to ME Enabled
Host Write Access to ME Disabled
Host Read Access to EC Disabled
Host Write Access to EC Disabled
SPI Flash ID 1 EF4018
SPI Flash ID 2 Unknown
BIOS boot State Post Boot
OEM ID 00000000-0000-0000-0000-000000000000
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer 0x00000000
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
M3 Autotest Disabled
C-link Status Disabled
Independent Firmware Recovery Disabled
EPID Group ID 0x200F
LSPCON Ports None
5K Ports None
OEM Public Key Hash FPF E411ABDD342436C68E614C7452858EF509339D2B22E338151CEF5ACECFF19740
OEM Public Key Hash ME E411ABDD342436C68E614C7452858EF509339D2B22E338151CEF5ACECFF19740
ACM SVN FPF 0x2
KM SVN FPF 0x2
BSMM SVN FPF 0x0
GuC Encryption Key FPF 0000000000000000000000000000000000000000000000000000000000000000
GuC Encryption Key ME 0000000000000000000000000000000000000000000000000000000000000000
FPF ME
--- --
Force Boot Guard ACM Enabled Enabled
Protect BIOS Environment Enabled Enabled
CPU Debugging Enabled Enabled
BSP Initialization Enabled Enabled
Measured Boot Enabled Enabled
Verified Boot Enabled Enabled
Key Manifest ID 0x1 0x1
Enforcement Policy 0x3 0x3
Error 483: Communication error between application and Intel(R) ME module (Intel(R) Precise Technology client).
Touch - Vendor ID Not Available
Error 483: Communication error between application and Intel(R) ME module (Intel(R) Precise Technology client).
Touch - Device ID Not Available
Error 483: Communication error between application and Intel(R) ME module (Intel(R) Precise Technology client).
Touch - HW Revision ID Not Available
Error 483: Communication error between application and Intel(R) ME module (Intel(R) Precise Technology client).
Touch - FW Revision ID Not Available
Error 483: Communication error between application and Intel(R) ME module (Intel(R) Precise Technology client).
Touch - Frame Size Not Available
Error 483: Communication error between application and Intel(R) ME module (Intel(R) Precise Technology client).
Touch - Feedback Size Not Available
Error 483: Communication error between application and Intel(R) ME module (Intel(R) Precise Technology client).
Touch - Sensor Mode Not Available
Error 483: Communication error between application and Intel(R) ME module (Intel(R) Precise Technology client).
Touch - Maximum Number of Touch Point Not Available
Error 483: Communication error between application and Intel(R) ME module (Intel(R) Precise Technology client).
Touch - SPI Frequency Not Available
Error 483: Communication error between application and Intel(R) ME module (Intel(R) Precise Technology client).
Touch - SPI I/O Mode Not Available
Seems ME doesn’t see the touch. Either firmware of the touch, maybe connection/ cable, maybe hardware