ASUS GL552VW boot issue after ME FW update

Special Topics Intel Management Engine
1

Dear Win-Raid Forum Members,

I’m creating this thread in the hope you could help me solving IntelME-related issue which affected my ASUS notebook recently. I asked ASUS Technical Support for the help more than 3 weeks ago and I haven’t received (literally) any technical help so far and I’m really concerned that waiting for their further support will lead to nowhere… All analysis so far I’ve made on my own, but please note I’m pretty new to IME stuff.

I’ve searched these forums and found some ME corruption related threads, but I think my case is different. I’ve read the guidelines from the sticky threads but I’m not yet sure if I should (or could) already apply these steps in my case. My issue happened after using official ASUS ME updater (no BIOS/FW modding from my side so far) so maybe there’s no need to move into this “advanced” stuff yet?

My notebook is:
ASUS ROG GL552VW-DM351T
i7-6700HQ CPU @ 2.60GHz, 8 GB RAM, 1 TB HDD
Windows 10 Home 64-bit (currently version 10.0.17134)
BIOS 300 (latest - updated a couple months ago)

How the issue occurred:

I haven’t had any problems with my notebook until I’ve run ASUS ME Firmware / Driver Update tool (MEUpdate_D0_H_V2.0.0.4.exe) downloaded from official ASUS site https://www.asus.com/News/q5R9EixxfAqo1anZ and updated ME FW / driver. During the update, notebook was plugged to a power source, battery was nearly 100% and nothing extraordinary happened. The tool claimed the update has been made successfully and recommended to reboot the computer. I followed the recommendation and allowed application to reboot. After reboot, my issue has started occurring.

General symptoms:

  • It takes 5 to 15 seconds to display ASUS boot screen/logo which is much longer than before and then notebook gets stuck at ASUS boot/POST screen (once I’ve tried waiting 2 hours and nothing happened),
  • It won’t boot OS from any device (HDD/USB/DVD),
  • I cannot enter neither BIOS Setup (F2), nor Boot menu (ESC),
  • It seems I can only enter ASUSTek Easy Flash Utility via Ctrl+Home for BIOS re-flash from USB pendrive,
  • Boot-freeze issue can be temporarily solved by powering on notebook while shorting two points of JRST2001 “Clear CMOS” jumper on motherboard - after that notebook reboots and then can boot/reboot normally (and I can also enter BIOS setup/Boot menu) until next power off with unplugging power supply.


Symptoms observed in Windows after successful boot after clearing CMOS:

  • Intel(R) Management Engine Interface became hidden and disabled in Device Manager - not 100% sure now but I think it had error code 45 “This hardware device is not connected to the computer”. After my attempt to reinstall MEI driver, MEI device now completely disappeared from Device Manager,
  • OS cannot wake up from sleep mode - I need to press and hold power button and restart,
  • Laptop wouldn’t actually power off on OS shutdown, i.e. power button light stays on until I manually press and hold power button.


What I’ve already tried to solve the issue and didn’t help:

  • re-flash BIOS via ASUS Easy Flash (Ctrl+Home) with same version (300),
  • downgrade BIOS to previous version (218),
  • upgrade BIOS again to latest version (300),
  • three above combined with clearing CMOS and reset to default setting in BIOS - in various order,
  • uninstall/force install Intel ME components in Windows - this installs several components but cannot bring Intel Management Engine Interface device back to Device Manager - I even cannot add the device and driver by manually selecting INF file,
  • attempt to dump & re-flash ME FW with Intel tools via Windows (FPTW64, FWUpdLcl64 with admin privileges) but cannot do this due to errors being reported by tools (more details below),
  • attempt to dump & re-flash ME FW with Intel tools via Hiren’s BootCD and FreeDOS Boot CD - same erros even from DOS tools so it’s not only due to missing MEI driver,
  • FPT -GRESET ← besides prompt notebook reboot I haven’t observed any behavior change.


Further analysis:

1. I’ve extracted contents of MEUpdate_D0_H_V2.0.0.4.exe with Resource Hacker and found regular Intel ME update stuff there:

METool.exe (this is actually FWUpdLcl64.exe)
MEFW.bin
SetupME.exe
IntelMEFWVer.dll
mup.xml
MEInfoWin64.exe
Idrvdll32e.dll
ISHLib64.dll
Pmxdll32e.dll

FW / Driver update in ASUS tool is triggered by following commands:

METool.exe -Y -F MEFW.bin >> "FWUpdLcl64_F_<datetime>.log"
SetupME.exe -s -overwrite -report "SetupME_<datetime>.log"


Logs from faulty ME FW update for your reference:
https://drive.google.com/file/d/1MtPeKQ0…MXE_jGG7x-/view
https://drive.google.com/open?id=1YloqK2…z570omh4BcIHW2y
https://drive.google.com/open?id=1V34G1g…VwG5-tnDlOV-xHb
https://drive.google.com/open?id=1DcXJE0…FHLhZSLN4Ip1jNB

In the logs you might also notice newer messages and that currently I cannot just re-update the FW / driver with ASUS tool, even if I uninstall all IME components from Windows, e.g.:

[2018/09/19 18:09:52] MEUpdate V2.0.0.4(H) tool start.
[2018/09/19 18:09:53] Current ME FW version: 0.0.0.0
[2018/09/19 18:09:53] Find no MEI device!
[2018/09/19 18:09:53] UI show “Your ME Firmware/Driver version is the latest.”
[2018/09/19 18:09:57] MEUpdate V2.0.0.4(H) tool end.


It seems ME FW version cannot be read at all. Moreover, when I run SetupME.exe directly I’m getting “Platform is not supported” error.

But I figured out I can force re-install IME components this way: 
.\SetupME.exe -overwrite -preinst

It finishes successfully and I can see it brings back all the stuff like jhi_service, LMS, and I can see MEI driver is copied into Windows dir, but there’s no ME Interface in Device Manager at all (not even hidden/disabled).

2. Since re-flashing BIOS doesn’t help in my case, I assume ME region/FW itself somehow gets corrupted. So I started learning on how to use Intel tools how to re-flash ME FW (I have a binary). But I’m getting the following errors:

METool:

Intel (R) Firmware Update Utility Version: 11.8.50.3399

Error 8743: Unknown or Unsupported Platform
Cannot locate hardware platform identification
This program cannot be run on the current platform.


MEInfo:

Intel(R) MEInfo Version: 11.8.50.3399

Error 86: Communication error between application and Intel(R) ME module (FWU client)

Error 81: Internal error (Could not determine FW features information)

As already mentioned, I’m getting same errors in FreeDOS BootCD so I think it’s not only about missing driver.

I’ve found on these forums that I can try such command:
.\MEInfoWin64.exe -fwsts


I get the following output:


Intel(R) MEInfo Version: 11.8.50.3399
Copyright(C) 2005 - 2017, Intel Corporation. All rights reserved.

FW Status Register1: 0x8030404E
FW Status Register2: 0x340D0006
FW Status Register3: 0x00000420
FW Status Register4: 0x00000000
FW Status Register5: 0x00000000
FW Status Register6: 0x00000000

CurrentState: Unknown (14)
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: CM0 with UMA
InitComplete: Initializing
BUPLoadState: Success
ErrorCode: Debug Error
ModeOfOperation: Normal
SPI Flash Log: Not Present
Phase: BringUp
ICC: Valid OEM data, ICC programmed
ME File System Corrupted: No
PhaseStatus: CHECK_BUP_OVERRIDE_STRAP
FPF and ME Config Status: Not committed


So there’s clearly something wrong with current ME FW: CurrentState Unknown (14), Debug Error, etc.

Does anybody familiar with such errors?


3. For your reference, just in case:

MEFW.bin (size 0x1F0000 / 2 031 616) extracted from MEUpdate_D0_H_V2.0.0.4
https://drive.google.com/open?id=1wwaI1j…et_d3S3eQjzIg-H

ME Analyzer output for this FW:

-==========================================¬
¦ ME Analyzer v1.61.0 r137 ¦
L==========================================-

-=========================================¬
¦ MEFW.bin (1/1) ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦T¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Firmware Family - CSE ME ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Firmware Version - 11.8.50.3399 ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Firmware Release - Production ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Firmware Type - Region, Stock ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Firmware SKU - Consumer H ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Chipset Stepping - D0 ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Security Version Number - 3 ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Version Control Number - 269 ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Lewisburg PCH Support - No ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Production Version - Yes ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ OEM Unlock Token - No ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Firmware Date - 2017-09-26 ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Firmware Size - 0x1F0000 ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Chipset Support - SPT/KBP ¦
?¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦+¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦?
¦ Firmware Latest - No ¦
L=========================?===============-

Official/unmodified GL552VW-AS.300 bios binary (size 0x5E0800 / 6 162 432)
https://drive.google.com/open?id=1Gxpf3f…6BNdHaLWr5EUCEz

I would appreciate any help on how to proceed with further analysis and what else I could try (i.e. to fix Intel ME tool errors) before I move into trying to re-flash ME FW manually according to the guidelines.

Best Regards,
Bartosz

2

First of all, amazing work on your part. Seriously, you did your homework very well and provided every info which could be helpful as well as trying pretty much everything I have recommended in the past. Thank you for that, now let’s try to fix this issue.

I can tell you for a fact that the problem was not caused due to a mistake on your part. I can think of two problems in this case, either bad CSME firmware or bad BIOS NVRAM. The former could have happened by itself while FWUpdate was updating the firmware despite what the output message claimed. The latter could have happened after the reboot for some unknown to us reason. In order to fix this for sure, we need read/write access to the SPI/BIOS chip firmware so try following the Flash Descriptor guide to see if you can do that. One of E1,E3,E5,E6 should work for you. Certainly E1 which is the official method but it will require opening the laptop.

3

@plutomaniac
Thank you for your prompt answer and help. I’ve done some research for my laptop and it seems I have to proceed with either E1 or E6. I will get back to you once I have made an progress on this.

4

Since E1 is invasive (requires opening the laptop) and E6 is not always guaranteed to work, another option is to use the OEM warranty, if one still exists of course.

5

On E6, ME Re-Flash in BIOS can be changed via grub boot at variable >> Me FW Image Re-Flash, VarStoreInfo (VarOffset/VarName): 0x3C3
Default is disabled in your BIOS (0x0) set to 0x1 to enable

However, these BIOS do not contain ME images I came here and wrote out long post to help you with ME Re-Flash and edited BIOS, before I remembered that, and checked to see and no ME in this BIOS.
So I don’t think ME Re-Flash enabled will help, due to this is used during BIOS flash with the built in flasher, as far as I know that is only time the setting matters.
I don’t think this unlocks ME in the FD, so you can’t use this option change to flash ME via FPT, nor by BIOS update since the image does not contain ME region.

But! If you can get a full BIOS dump via AFU, or Asus software tools, that may be able to be edited (to fix ME region) and then enable ME Re-Flash and use FPT to program me region only from that BIOS image.
If you can get a 8MB BIOS dump from AFU then open in UEFITool and see if ME region is shown in top area, or drop on ME Analyzer and see if ME present or not, if you can get dump with ME then we may be able to fix this way.

6

No, E6 does not work like that. The BIOS option unlocks access to the Engine region of the SPI/BIOS chip at the next reboot. The BIOS from the OEM or what it contains have nothing to do with this process. It simply unlocks access and then the user can service it however they see fit.

7

Thanks, sounds like that is all that’s needed then, boot to grub, change variable and then reflash with fixed ME

8

@plutomaniac
@Lost_N_BIOS
Thank you very much for your hints. I’ve decided to try E6 first and followed the guidelines. I’ve double-checked the variable offset with IFR Extractor LS and could see the same offset Lost_N_BIOS has mentioned:


0x149B5 	VarStore: VarStoreId: 0x1 [EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9], Size: 0xD55, Name: Setup {24 1C 43 D6 87 EC A4 EB B5 4B A1 E5 3F 3E 36 B2 0D A9 01 00 55 0D 53 65 74 75 70 00}

…

0x17EF5 	Form: Firmware Update Configuration, FormId: 0x276E {01 86 6E 27 EF 02}
0x17EFB 		Gray Out If {19 82}
0x17EFD 			QuestionId: 0x8E5 equals value 0x1 {12 06 E5 08 01 00}
0x17F03 			One Of: Me FW Image Re-Flash, VarStoreInfo (VarOffset/VarName): 0x3C3, VarStore: 0x1, QuestionId: 0x9F, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 F1 02 F2 02 9F 00 01 00 C3 03 10 10 00 01 00}
0x17F14 				One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x17F1B 				One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x17F22 			End One Of {29 02}
0x17F24 			Suppress If {0A 82}
0x17F26 				QuestionId: 0x934 equals value 0x3 {12 86 34 09 03 00}
0x17F2C 					Not {17 02}
0x17F2E 				End {29 02}
0x17F30 				One Of: Local FW Update, VarStoreInfo (VarOffset/VarName): 0x3C4, VarStore: 0x1, QuestionId: 0xA0, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 F3 02 F4 02 A0 00 01 00 C4 03 10 10 00 01 00}
0x17F41 					One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x17F48 					One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0x17F4F 				End One Of {29 02}
0x17F51 			End If {29 02}
0x17F53 		End If {29 02}
0x17F55 	End Form {29 02}


I’ve successfully boot to GRUB via USB drive and tried:

> setup_var 0x3C3 0x01

But the result of this command is “error: offset is out of range…”.

I’ve taken a picture of entire output for your reference:
https://drive.google.com/open?id=1lCcneX…R-NXKbRqYsJDyi5

Obviously I can see it didn’t work and still cannot use e.g. FPT tool:

> .\FPTW64.exe -ME -d ME.bin

Intel (R) Flash Programming Tool. Version: 11.8.55.3510
Copyright (c) 2007 - 2017, Intel Corporation. All rights reserved.

Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
MX25L6473E ID:0xC22017 Size: 8192KB (65536Kb)



Error 318: The host CPU does not have read access to the target flash area. To enable read access for this operation you must modify the descriptor settings to give host access to this region.
FPT Operation Failed.


For sure this is the BIOS image I have flashed last time (Ver 300) and I’ve double-checked this.

Could this mean I cannot proceed with E6 due to some restriction? In the meantime I’ll try to re-analyze the BIOS image with UEFI tool…

EDIT:
I noticed that even I cannot dump ME with FPT, I can do so for BIOS:

> .\FPTW64.exe -BIOS -d bios.bin

Intel (R) Flash Programming Tool. Version:  11.8.55.3510
Copyright (c) 2007 - 2017, Intel Corporation. All rights reserved.

Reading HSFSTS register… Flash Descriptor: Valid

        — Flash Devices Found —
        MX25L6473E      ID:0xC22017     Size: 8192KB (65536Kb)


- Reading Flash [0x0800000]  6016KB of  6016KB - 100 percent complete.
Writing flash contents to file “bios.bin”…

Memory Dump Complete
FPT Operation Successful.


So I double-checked the variable offset in my dump and it’s the same (0x3C3):

0x17EF5 	Form: Firmware Update Configuration, FormId: 0x276E {01 86 6E 27 EF 02}
0x17EFB 		Gray Out If {19 82}
0x17EFD 			QuestionId: 0x8E5 equals value 0x1 {12 06 E5 08 01 00}
0x17F03 			One Of: Me FW Image Re-Flash, VarStoreInfo (VarOffset/VarName): 0x3C3, VarStore: 0x1, QuestionId: 0x9F, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 F1 02 F2 02 9F 00 01 00 C3 03 10 10 00 01 00}
0x17F14 				One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x17F1B 				One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x17F22 			End One Of {29 02}
0x17F24 			Suppress If {0A 82}
0x17F26 				QuestionId: 0x934 equals value 0x3 {12 86 34 09 03 00}
0x17F2C 					Not {17 02}
0x17F2E 				End {29 02}
0x17F30 				One Of: Local FW Update, VarStoreInfo (VarOffset/VarName): 0x3C4, VarStore: 0x1, QuestionId: 0xA0, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 F3 02 F4 02 A0 00 01 00 C4 03 10 10 00 01 00}
0x17F41 					One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x17F48 					One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0x17F4F 				End One Of {29 02}
0x17F51 			End If {29 02}
0x17F53 		End If {29 02}
0x17F55 	End Form {29 02}

Ref: BIOS-dump.bin.

So it seems I’m trying to change correct offset? I’m now checking if this could be related to a “BIOS Lock” variable and if there’s anything I could do on this.

EDIT2:
Or maybe my interpretation of setup_var output is wrong. Based on these two lines:

successfully obtained “Setup” variable from VSS (got 3413 (0xd55) bytes).
…
successfully obtained “Setup” variable from VSS (got 6 (0x6) bytes).


Now I think there are apparently two Setup variables, first one (the valid one) maybe was actually set and command failed on setting second variable which I assume I can ignore.
Anyway, it seems this hasn’t helped me. When I enter GRUB again and try setup_var command again and can see it always sets from 0x00 to 0x01 so the problem might be that this setting is not preserved after reboot.

EDIT3:
I’m sorry for another edit. I’ve found on these forums (e.g. here) that sometimes setting both “ME FW Image Re-Flash” and “Disable ME” helps. I cannot find “Disable ME” in my IFR Setup export, but I can see “ME State” which I think might have the same meaning:

0x17E79 			One Of: ME State, VarStoreInfo (VarOffset/VarName): 0x3D2, VarStore: 0x1, QuestionId: 0x9B, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 D8 02 D9 02 9B 00 01 00 D2 03 10 10 00 01 00}
0x17E8A 				One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x17E91 				One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0x17E98 			End One Of {29 02}

Do you think I could give this a try?

> setup_var 0x3C3 0x01
> setup_var 0x3D2 0x00

9

I think changing ME state to disable will disable ME, but best to let plutomaniac answer that one.

On the setup_Var, try this instead >> setup_var 0x3C3 0x1 (not 0x01)

Also, this may not work from Linux grub, I am not sure? Boot to normal bootx64.efi grub from BIOS (boot to EFI Shell, you may need to hover this option and rename the file according to what it says on hover)
What you are doing may be the same, I am not sure, but just in case try this instead.
Put in root of USB, remove any others >> https://www.sendspace.com/file/s8l5jr

May also need to be done this way I described here, depends on the board/BIOS
[Help needed] Hidden Advanced menu Bios HP Z1 J52_0274.BIN (2)

Yes, it’s not going to work until you get normal output from grub after change, 6 bytes returned instead of 3000something means there is an issue, not applied correctly etc.
ie second one is due to error after your first input change. So yes, it’s going to always be 00 after reboot, either due to error and that is how this works too (Only stays disabled until after next reboot - ie make this change, save and boot then flash ME, without any reboots between)
However, I don’t see how you can flash ME without a full BIOS dump, fixed ME, then use FPT. Because your current ME is corrupted, so you cannot use FW Update tool, and your BIOS from Asus does not contain ME, so without a dump containing ME I don’t see a way to flash ME otherwise.
That is why I said we need to get a full BIOS dump from your system.

Maybe plutomaniac knows how you can flash ME without being able to use FW Update tool (due to corruption/error) and stock BIOS image does not contain ME? Only way I know of is using FPT with a BIOS containing ME, which is why my first goal was getting the dumped BIOS.

BIOS lock controls your ability to write to BIOS region, nothing to do with ME region, it’s locked in FD which is why you want to do the FD unlock methods. What you can do, is do the E1 pinmod, unlock FD, dump the FD with FPTw -desc -d fd.bin and unlock it, then write it back to BIOS with FPTw -desc -fd.bin
Then you can use FPT to dump your entire BIOS, then we can fix ME, and you can reflash it all with FPT.

10

@Lost_N_BIOS
I’m booting to bootx64.efi from Setup_EFI_Shell.rar attached to plutomaniac’s guide and strictly followed steps from E6. So I think it’s more or less the same as the approach you’ve described.

Setting 0x1 instead of 0x01 has same effect so it’s not the case. When I enter setup_var command twice in one session, I can see the value is changed for the variable-of-interest, i.e. the one with size of 3413 (0xd55) bytes. Hence I still think I can just ignore the error for the second variable (the small one - 6 bytes). Moreover, I’ve found grub-mod-setup_var script which seems to confirm my understanding.

To sum up, I think I can set variable value correctly in GRUB/bootx64.efi but it’s value is not preserved after force reboot needed to exit GRUB (or could I somehow boot to Windows from GRUB without reboot? or run FPT tool from GRUB shell?). According to plutomaniac’s guide I understand this unfortunately sometimes takes place (different behavior for different OEM/ODM) so I think I have two options in theory:

  • check if changing “Me FW Image Re-Flash” variable together with some other variable (e.g. “ME State”) would trigger a different behavior - as some users claim that might be the case,
  • already switch to E1 “pinmod” approach since unlocking ME would be insufficient to solve the issue anyway - as you mentioned, I will need full BIOS/SPI dump which I don’t have.


BTW I’ve tried searching for the full SPI dump for my laptop over the Interne, but without success. ASUS Tech Support is not willing to help me such way as well (I mean they won’t send me any tools or images), their response is of course to RMA.

Therefore, I think it’s time for me to find the datasheet for my audio chip which is Conexant HD Audio (HDAUDIO\FUNC_01&VEN_14F1&DEV_510F&SUBSYS_10431C5D&REV_1001) and proceed with opening the laptop… unless you would still see some hope for any other approach (let’s skip programmer for now). I was thinking if would be able to debug MEUpdate_D0_H_V2.0.0.4.exe to see how this tool acquires rights to flash ME FW. Or at least force it to re-flash ME FW but not sure if this makes sense anyway.

11

Guys, as explained at Intel Management Engine: Drivers, Firmware & System Tools, the FWUpdate tool works only when the Engine firmware is healthy and a MEI driver is installed. That’s what ASUS and any other OEM or end-user uses. It does not unlock read/write access to the Engine region, it does not need to. Read the aforementioned thread carefully. Everything else requires read/write access to its region at the SPI/BIOS chip. Once you have that (E1 is perfect if you can open the laptop) you need to dump the SPI/BIOS chip firmware (“fptw -d spi.bin”), follow [Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization and flash it back (“fptw -f spi_fix.bin”, “fptw -greset”).

12

Hello @BartoszB ! I think that your issue with changing the “Me FW Image Re-Flash” variable value is very similar to mine.
I was able to eventually change it in my system using @plutomaniac advice, and then reflash the ME region using ‘FPT -me -f fixed_dump.bin’ (other previously locked regions will still be locked).

I suggest your carefully read my thread Asus X510UQR Power On\Off Issues - Probably Intel ME Related at least from message #6 to message #9.

Good luck!

13

@plutomaniac
@v0yAgEr
Thank you very much for your input. @v0yAgEr Also, I’m happy to read you’ve solved your problem!

So I’ve tried the following:

  • GRUB efi shell → change value + force reboot (press and hold power button),
  • AMISetupWriter efi shell → change value + force reboot (press and hold power button),
  • AMISetupWriter efi shell → change value + exit + boot Win10 + wait until it get asleep + cannot wake up hence force reboot (press and hold power button).

Unfortunately, I still cannot dump ME region via 
 .\FPTW64.exe -me -d me.bin
. :frowning: Still same read access error (318). I believe I’m following the steps as I should. Shall I try without power supply or battery? Maybe I’ll double-check.

On the other hand, I have now noticed I can dump Descriptor region:

> .\FPTW64.exe -desc -d desc.bin

Intel (R) Flash Programming Tool. Version:  11.8.55.3510
Copyright (c) 2007 - 2017, Intel Corporation. All rights reserved.

Reading HSFSTS register… Flash Descriptor: Valid

        — Flash Devices Found —
        MX25L6473E      ID:0xC22017     Size: 8192KB (65536Kb)


- Reading Flash [0x0001000]     4KB of     4KB - 100 percent complete.
Writing flash contents to file “desc.bin”…

Memory Dump Complete
FPT Operation Successful.


To be honest, I have never tried this before. For now, I don’t know if this is the effect of “Me FW Image Re-Flash”. Then I’ve tried dumping other regions one by one: GBE, PDR, EC - for these three I’m getting Error 329: Region does not exist.
GbE Region does not exist.
…
PDR Region does not exist.
…
EMBEDDED CONTROLLER Region does not exist.

As before, I can also dump BIOS region.

Ref:
desc.bin (4 096 bytes)
bios.bin (6 160 384 bytes)

So I have a mixed feelings now. Such output is possible? Does it mean for my SPI only FD + BIOS + ME is present and I have BIOS and FD regions unlocked and only ME is still locked?

Could it be that “Me FW Image Re-Flash” doesn’t work and I cannot dump ME region due to ME FW weird state as noticed in my initial logs? Is there any known risk of switching ME State into disabled state and then into enabled state to see if this would trigger some other behavior?

Thank you for your help.

EDIT:
Well, I might be wrong regarding Descriptor region. If I understand UEFITool output for desc.bin correctly then Desc region is readable by default but still I might not be able to write to it…


Full size: 1000h (4096)
ME region offset:   1000h
BIOS region offset: 220000h
Region access settings:
BIOS: 00Bh 00Ah ME: 00Dh 00Ch
GbE:  008h 008h EC: 020h 020h
BIOS access table:
      Read  Write
Desc  Yes   No  
BIOS  Yes   Yes
ME    No    No  
GbE   Yes   Yes 
PDR   No    No  
EC    No    No  
Flash chips in VSCC table:
1F4700h
EF4018h
EF4017h
EF6017h
C22017h

14

Probably only read access to FD, unless its accidently unlocked or you did the pinmod. Edit, now I see you last spoiler, sorry missed it, yes as suspected, likely you cannot write to the FD

See if you can write back to the FD >> FPTW64.exe -desc -f desc.bin
https://www.sendspace.com/file/38c5v9
https://nofile.io/f/4TcqAMgD4Te/desc.bin

If you get error, do the pinmod, then flash that FD back in there, then it’s all unlocked and you can do whatever you want.

Not all BIOS have GbE or PDR, so that is normal.

15

Just short update. I gave up. I haven’t opened the notebook to try E1. I’ve decided to RMA it since ASUS is so kind to help solving my particular issue for free even thought it’s 3 months past warranty.

Thank you everybody for your kind help. I’ve learned much on these topics. This thread can be closed.

16

Sorry you weren’t able to get it fixed yourself, but it’s good Asus will fix for you for free outside of warranty, can’t beat that!