Thank you for answer!
Yes, I’ve seen it.
It is clear, thank.
So, as I understand it, it is not possible upload modified firmware via ME Tools (FPTW64.exe)? Only by programmator?
Oh, I remembered, UEFIToolNE is read-only.
The last version of writeable UEFITool is 0.28 from 2020:
If the machine has kinda service jumper it might be possible to flash the ME region, maybe with some hacks bios region, but I don’t think this will work. And those hacks themselves have the risk of bricking and then it’s the programmer anyway.
You need UEFIToolNE for structure and adresses, no use for UEFITool here
There is no service jumpers. (Perhaps there is some analogue - shorting some microchip pins somewhere, but I don’t know about it.)
What I meant was that UEFIToolsNE doesn’t allow you to record something if you change it. I mean, it’s a read-only. Or am I missing something?
There’s no need to use UEFITool. Cleaning the ME working on a complete image would give you a complete image, deleting last part of NVRAM is done with hex editor
Ok. Will try.
I try to clean the ME region, so I make the firmware according to the guides, but when I want to flash it (by FPTW64), I get an error:
error 368: failed to disable write protection for the bios space
Can I flash it through Intel Flash Programming Tool or only through the programmator?
You can attach the file if I should have a look into it.
Bios region is protected not only by flash descriptor! You could flash ME region with the -ME switch alone. I don’t think you need to extract it from outimage.bin, but I’m not a 100% sure.
Old
dump.rar (4.0 MB)
Created
outimage.rar (3.9 MB)
ME Region from repository
11.8.92.4222_CON_LP_C_NPDM_PRD_RGN.rar (1.3 MB)
Message:
I tried to download ME separately with the -ME key, but I was warned about the size - about 6 MB. After extraction with the Flash Image Tool (FIT) - ME Region.bin was about 2 MB.
All necessary devices “works” fine
I think I don’t understand you completely. Outimage looks OK.
You might try to extract ME region with UEFIToolMNE (right- cklick, extract as is) and to flash it with -ME switch, but ME is still locked in FD:
As I said earlier, the tablet lost touch after replacing the display and updating the firmware. The touch on the new display worked before the update. I put the old display back to rule out the possibility of a hardware failure. The touch does not work on the old display either.
You recommended cleaning the ME. I dumped my firmware (dump.bin) and replaced the ME Region with a clean one from the repository (outimage.bin). However, I can’t flash the entire firmware using FPT because the security bit is set.
I’m waiting for a new touch cable to arrive. If nothing changes after the replacement, I will flash the Winbond with a programmator.
Yes, it is locked too:
Region_ME_ME_region.rgn is extracted from UEFIToolNE, as you show on shot.
That’s an unexpected error message. What does a fptw64 -i give you?
I made a firmware with pure ME from my firmware. I removed the chip and flashed it with a CH341A.
However, the touch did not appear.
Looking for any previous version dump for SP 5 2017 LTE (1807).
The only part of the firmware that is different from a stock firmware now is NVRAM.
outimage_nvram empty.zip (6.7 MB)
The necessary parts will be rebuilt, maybe you loose machine specific data like serial, maybe these are stored in TPM and get restored therefrom.
outimage_nvram-cut.zip (6.7 MB)
That’s the basic machine related information kept, but as written one can’t be a 100% sure if the cut is made the right place.
I will try later. I order “adapter” for WSON 5x6mm for CH341. When the adapter arrives, I’ll continue my experiments. it is difficult to solder flash all the time.
Thanks for the feedback. Will be interesting if the missing touch capability really is NVRAM- related!
One of the things I’m thinking about is some kind of unique code that is stored in a small board that is responsible for the touch. When I replaced the screen with another one (along with the board), something was written/changed in the firmware and subsequently blocked the touch (again, with the new screen and the new board, the touch worked fine for a while).
On the other hand, replacing this board back to the original did not work.
