Hello all,
First post…
Been lurking around here for quite a while reading, finally signed up. This site has an incredible amount of information, and knowledgeable people.
My problem, (self-inflicted) I was messing around trying to add nvme support, I got the board to the point of no post/video and 2 short beep codes (repeating). The board has a 3-pin bios header, (1-2 normal) (2-3 recovery). This board is acting exactly like it would if it had a jumper on 2-3, no matter which position it is on. In this state it is looking for a bootable CD (bios iso from Lenovo). This does work on other working units I have, but not this one.
Hardware:
Lenovo Bios update image is 4.5MB (4,612KB) AMI (APTIO 4?) *.cap format
Lenovo M92P SFF (small form factor)
Board: IS7XM, Q77 chipset
Chips: Winbond 25Q16BV (2MB), Winbond 25Q64CV (8MB)
Programmers: CH341A, black and green.
SOIC8 clip
The board I found has a ME_DIS jumper, which allows FPT -D to work on a functional board.
So with flashrom_windows:
I have a programmer dump of both chips on the messed up board (2MB, 8MB),
A programmer dump of both chips on a working board (2MB, 8MB),
A dump with FPT on a working board (10MB).
I bought a replacement motherboard (cheap on ebay) to fix my problem quickly. Now I want to figure out what I screwed up on this board.
I need some info on extraction of the GUID from the old board chip dumps, I have the old MAC/serial/model (Lenovo flash utility asks to update serial/model before each flash).
If someone could point me in the right direction, I would appreciate it.
If it aint broke, keep working on it until it is…
Thank you
Bob
@boooooob - Hey, glad you finally joined, welcome aboard! Also, very nice you have programmers in hand, hopefully you had those before the issue and didn’t have to order after the issue and then wait out a long delivery 
So, you want to know ho to find serial, UUID, model, MAC ID etc, in the BIOS, so you can transfer from one to the other (into a working dump, from a broken dump), correct?
Or do you just need to find this actual info in a broken dump, so you can then put in “before flash” using their software? I assume the previous, not this.
If yes, please upload a working dump and provide all it’s details UUID, Serial, LAN MAC ID, and then upload a broken dump and it’s details too. This way I can look at each, confirm data locations and then provide you with their locations.
EC FW (2MB) dumps are not needed, and I don’t need all the other files either, only what I mentioned it’s all I need to check and get this info for you.
In the interim, I would go ahead and copy one EC FW from working to non-working system, in case that’s part of the current startup-up issue.
Hey Lost_N_BIOS,
Thank you for reply, will load the working 2MB dump, and see if it will bring any signs of life.
Bob
Hey Lost_N_BIOS,
I flashed the 2MB file, did not help, I thought what the hell, and flashed the 8MB file. The machine now posts/video, and I can get to bios settings. I know this is not right because it is an exact clone of my other board. But I can now access FPT dos from USB.
I got one of the cheap soic8 clips with ribbon cable, with one of my programmers, and I couldn’t get it to ID chips anymore after I finished, found 2 wires broken inside the heat shrink where it is soldered to clip….This thing wouldn’t stay clipped properly without holding it in place, (which is a huge PITA). I will get some Dupont jumpers and maybe a Pomona 5250 clip.
My question now, is the UUID (where is it derived from??) listed anywhere, in print on the case or motherboard, because I have no idea what the one on the messed up board is, unless it can be found in one of my dumps which were taken after I messed it up…
Also would the changes be able to be applied now with FPT, as it is much easier.
Thank you
Bob
Thank you
@boooooob - It’s OK, now we know EC is not the main issue, and you’ve flashed in known working good copy, so once BIOS corrected it should be working.
Yes, writing in stock 8MB BIOS is not good, if that’s what you meant. You can however copy working systems 8MB BIOS to the non-working system, but that wont help you recover it’s serial, UUID, MAC etc, because you will overwrite all that with the working system BIOS once you program it in there.
I need dump from your working board, along with all it’s details UUID, Serial, LAN MAC ID, in order to give you locations of all this.
UUID and serials may be inside the casing (usually inside the bottom/back case), or on bottom stickers etc. Also look between/under memory slots for a sticker too. Or, they may not be anywhere, what I mentioned there is just for laptops in general
Then you need to find all this sticker info for the other system too, unless you have a dumped BIOS from it?
For Serial, UUID run each these commands from CMD Prompt and either copy all to text or take screenshot
>> wmic baseboard get serialnumber
>> wmic bios get name,serialnumber,version
>> wmic csproduct get name,identifyingnumber,uuid
Then dump BIOS region via FPT since you broke your cable >> FPTw.exe -bios -d biosreg.bin
Also dump GbE, this will be where the LAN MAC ID is stored (usually at 0h and 1000h if in there twice) >> FPTw.exe -gbe -d gbe.bin
You’ll need to use FPT from ME System Tools package V8, here in section "C"
Intel Management Engine: Drivers, Firmware & System Tools
As for correcting everything with FPT, I am not sure if you can or not, we’ll have to see what error is given when you try to write back BIOS region via FPT
ME region, usually no go without programmer or several BIOS edits/flashes/dancing. This due to locked in FD, but since you programmed this in already we don’t need to do anything to this region anyway, only GbE and BIOS region.
On those clips, if you remove all wires or at least the broken ones, there is 5-8mm or longer metal leg that comes out of the plastic, so where the cables ripped off, you can pull off the plastic sleeve if stuck there and solder on wire directly.
It looks like this with no wires attached
Hey Lost_N_BIOS,
Working Board
Machine type model: 3209A84
System brand id.: Thinkcentre M92p
System serial number: MJ637LA
System UUID: 35ECC93C-B741-11E2-818F-7888BDE192300
Mac: 44-37-E6-BE-5D-5C
Bios rev. level: 9SKT9BAUS
Boot block rev. level: 9S9BA
Bios date: 07/17/2018
Original non-working
Machine type model: 3209E4U
System brand id.: Thinkcentre M92p
System serial number: MJ15G9K
System UUID: I think it is only listed on original packing box label…don’t have, doesn’t exist.
Mac: FC-4D-D4-3B-50-18
DumpW = working board
DumpO = non-working original
Really only concerned with UUID and MAC, serial and type can be changed with Lenovo flash utility.
Note, it would not allow me to upload a .zip of my FPT dump (said somthing about 6MB)
My current time and date is 08:20A 3-18-2019…
Thank you
Bob
DumpW2.zip (1.14 MB)
DumpW8.zip (4.92 MB)
DumpO2.zip (1.14 MB)
DumpO8.zip (4.75 MB)
Hey Lost_N_BIOS,
Sorry forgot to add this, other info came from bios screen.
Microsoft Windows [Version 10.0.17763.348]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>wmic baseboard get serialnumber
SerialNumber
C:\WINDOWS\system32> wmic bios get name,serialnumber,version
Name SerialNumber Version
9SKT9BAUS MJ637LA LENOVO - 1620
C:\WINDOWS\system32> wmic csproduct get name,identifyingnumber,uuid
IdentifyingNumber Name UUID
MJ637LA 3209A84 35ECC93C-B741-11E2-818F-788BDE192300
Thank you
Bob
Thanks @boooooob I will check into this tonight for you. If you want you can upload any/all files in a single zip to any free file host and I can download from there. The attached file names seem odd, are you sure I can download and extract those?
Hey Lost_N_BIOS,
I just zipped my bin files and attached, I guess attaching the files renamed them different from displayed names, but it should unzip to a folder with my *.bin file inside, (I tried it)…
If it doesn’t work for you , will try plan B. I am not in any hurry whatsoever. I am trying to learn something along the way.
Thank you
Bob
Hey Lost_N_BIOS,
Plan B just incase, has FPT dump also…
Dropbox link: https://www.dropbox.com/s/u70bq7kjuk00o3y/Dumps.zip?dl=0
Thank you
Bob
@boooooob - Thanks, I just grabbed it all at dropbox. The file names w/ 02 08 confused me in the attached files, until I saw it all again at dropbox, then I realized 2MB / 8MB duh 
So, you need working BIOS, but info from non-working board swapped in, so you can then flash that to the non-working board to correct it’s info, correct? Or, do you just need to know the info’s locations and you can do all that yourself?
I have collected all info/locations, waiting to know for sure what you want to do.
All can be corrected with UEFITool and hex editor, then reflashed via FPT or by programmer. Since you have programmer, well once you get cable fixed, first thing you should do is reprogram any BIOS with FD unlocked and then all edits after that always redo the FD unlocked if using programmer.
That way, you can use FPT in windows/DOS without having to use programmer. There may be another lock that stops FPT, FPRR/PRR Protected Range Register, but FD is main one, other I would need to see FPT error first.
I have already made an edit DIF file for the lock I expect, so if you run into it I’ll be ready to tell you where to edit/how to unlock. Or, I can just send you FD unlocked, FPRR unlocked 10MB BIOS (Or split if you want), then you can use that to further edit in the system details if you want.
This would need programmed in, then any subsequent edit would be able to be flashed in via FPT without error, and that would remain unlocked provided you always use this as a base BIOS to edit before flashing.
Or, you can simply edit the FD each time, and the two bytes needed to unlock the FPRR lock. When either of those in place (on board), then BIOS needs programmed in to get them unlocked, flashes after that can be done via FPT as described above (using unlocked BIOS as base, or apply edits to new BIOS)
Hey Lost_N_BIOS
My goal is to get my original board back to info from dumpO2.bin and dumpO8.bin.
I have UEFITool and HxD ( I have noticed it complains about “parse: invalid data checksum 5Ah, should be AAh” in UEFITool with any file from these machines, even when I open the bios file download from Lenovo.
I mentioned before I have a ME_DIS jumper which allows a full FPT dump of chips, would this also allow writes to chips…??
What info is stored in the 2MB chips as they are not the same when compaired…?
I need a little info at a time, I know I can read/write files, I want to learn about the files themselves…
Again thank you for all your help.
Bob
You can ignore the checksum error, since it’s present in stock BIOS, or you can click rebuild on that GUID (Double click to get there) and UEFITool will fix the checksum. Jumper would likely allow full rewrite via FPT.
The BIOS as a whole is split onto the 8MB-2MB chips, 2MB chip contains the a padding file (unsure contents right now) and last three BIOS volumes, 8MB BIOS contains the FD, ME, GbE, NVRAM volume and the main BIOS region volume from within the BIOS region (first two volumes inside FPT dumped BIOS region)
I can show you that with images if it would better explain, but I’ll have to do it later tonight I don’t have time right now. I checked, and it’s just a direct split from the FPT dump (8MB = first 800000h and 2MB = remaining 200000h)
Hey Lost_N_BIOS,
I believe the MAC is at 00001000 & 00002000 in the 8MB dumps, what is the trick for finding the UUID location…
Thank you
Bob
@boooooob - I already said in post #11, I have all data/locations for you, but wasn’t sure what you wanted me to do, give you the info or do it myself?
Here’s all the info locations, sorry about that, I assumed you were not wasting your time still digging around or I would have posted this yesterday 
This is info from Working system dump >>
Machine type model: 3209A84 >> 33323039413834 (Hex)
System brand id.: Thinkcentre M92p
System serial number: MJ637LA >> 4D4A3633374C41 (Hex)
System UUID: 35ECC93C-B741-11E2-818F-7888BDE192300 >> “In-BIOS” format - 3CC9EC3541B7E211818F788BDE192300 (windows pulled info has one extra digit (8 near end), unsure why, maybe normal?)
Mac: 44-37-E6-BE-5D-5C >> 4437E6BE5D5C
---------------------
Finds/locations -
SMBIOSFlashData >> RAW - FD44820B-F1AB-41C0-AE4E-0C55556EB9BD
Contains Model, Serial x2, UUID <<< All this also in ME region @21780-21AD0
GbE region >> MAC @ 0h + 1000h + at ME x10
These x10 at ME may self-correct, after you replace in GbE region - and GbE region is all that’s needed to mac MAC function)
1 0x00027243 0x6 (6)
2 0x000300b6 0x6 (6)
3 0x00030ea6 0x6 (6)
4 0x00032d23 0x6 (6)
5 0x00035a53 0x6 (6)
6 0x00039d73 0x6 (6)
7 0x0003d996 0x6 (6)
8 0x00048303 0x6 (6)
9 0x0004e9c6 0x6 (6)
10 0x0007d986 0x6 (6)
Extract GbE region with UEFITool, edit both locations in hex editor, save as fixedgbe.bin. Then you can replace this back into BIOS via UEFITool, or flash directly with FPT >> FPTw.exe -gbe -f fixedgbe.bin
For the UUID, open BIOS in UEFITool, search, enter GUID I gave above, expand to RAW, extract the RAW file, edit via hex at the locations above
For the non-working machine, you’ll find the SMBIOSFlashData module by opening the Dump02 file in UEFITool. For the non-working MAC ID, drop Dump08 in hexeditor and go to 1000h to get MAC ID (also at 2000h, but of course same)
If you want to work on the non-working BIOS as a whole in UEFITool for some reason, append 02 to end of 08 in hex editor (Copy 02 entirely, paste directly at end of 08, save)
Non-Working Info >>
MAC: FC 4D D4 3B 50 18
Model - 3209E4U
Serial - MJ15G9K
UUID - (in BIOS format, windows/software will pull this in different format, but it goes into BIOS this way) >> 883E5C25B6E0E2118E1EA86A3AD52700
Hey Lost_N_BIOS,
Sorry if it seems that I don’t respond for a while, my current time here is 06:24A 3-15-19. I should have been a little better prepared before I started messing with my board, could have avoided this.
Thank you very much for all your time and effort, I think I can get my board to “normal”, if not I know how to get it back to workable state, and try again.
I guess it is true you learn by your mistakes, because I learned a bunch in a short time.
Note, I got that Pomona 5250 soic8 clamp, it is a super clip, but expensive
.
If anyone has one of these I would advise not to use Lenovo flash from operating system, it is not very reliable. Bootable USB much better…
These boards have the restore jumper position, and you can usually get working with Lenovo bios CD iso.
These boards have ME_DIS jumper, which is very handy.
So Lost_N_BIOS , a huge THANK YOU!!, and have a nice weekend…
Bob
It’s OK about slow replies, I’m often not here until late at night once a day, sometimes I have time in afternoon but usually not enough to get through ther 20+ new replies each day.
So you like the Pomona clip too, your the second person that’s mentioned those to me. How much did it cost and why do you think it’s better than the cheap ones, aside from not being cheaply made? When you answer that, forget yours broke/cable ripped off etc.
You’re welcome, and if you need anymore help sorting this out let me know @boooooob
Hey Lost_N_BIOS,
Hope you are having a nice weekend. In the US, this was the cheapest I found, they have free overnight shipping no minimum right now, and take paypal.
If you look at the chip end of the clip, you will see they are open (you can see contacts from outside, also they have common pin spacing at top).
Once connected I think it would almost pull the chip off the board (if you pulled without releasing)
I buy lots of Low ESR, high temp. electrolytic capacitors from them to repair LCD monitor/motherboard power supply sections (they are cheaper then Mouser and Digi-key).
https://www.arrow.com/en/products/search…ona+5250&r=true
I wish I would have bought the programmers BEFORE I started my adventure.
I got the MAC/UUID, used hex editor(search hex/replace hex) and re-flashed both chips, (but on the verify of the 8MB chip with flashrom windows, it complained about something) will research it later…board posts and can access bios settings, has correct info., didn’t change serial/type/model yet.
I did some more reading, [Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing, got everything unlocked.
Lenovo still has some sort of lock on the bios section, not the desc. ( ME_DIS jumper doesn’t help) , Lenovo has a program flash2.exe which allows change of serial/type/model. I think the only way to do any modified bios, is force feeding it by a CH341A programmer, and I think I need to flash both the 2MB and 8MB chips. I thought FPT would allow me to write the 10MB file, but always get bios cannot be unlocked message.
I am also curious with the parseFile: invalid data checksum 5Ah, should be AAh , if I correct it, if it will have negative effect, IMAGE9S.CAP file (newest bios, also shows same error)
Thank you
Bob
Free overnight shipping? So, to me that says it’s half the price or more, and I’d rather pay cheapest shipping with cheapest price. But yes, $15 isn’t too bad, I’ll have to see how much that is on ebay
Looks well built, and easier to replace pins if needed.
I can unlock the lock you’re hitting, I think You will have to flash in the mod unlocked BIOS once, and then always replace this unlocked module in any/all future BIOS you flash in (Same for FD unlock), but then you will be able to FPT flash entire BIOS anytime
What error are you seeing in FPT when you run into the lock when trying to flash via FPT? Flash Protected Range Register, or other similar 2xx error?
If yes ^^ since you like to go at things yourself, here is what to edit >>
PchInitDxe >> PE32 (Extract body with UEFITool, edit via hex, replace body)
000000000000123F: 74 >> EB
000000000000142B: 74 >> EB
On checksum issue with stock BIOS, usually you can correct and it’s fine, select it in UEFITool and hit rebuild, or direct edit the entire file via hex and edit there.
Hey Lost_N_BIOS,
I just tried a fptw -f 10MB.bin on the board I have been getting working files from , and it went on without a problem… will look at the other board later to see what is going on…strange.
I really don’t now how Arrow is doing the free overnight thing, plus they (usually) have lower prices, (on things I buy anyway) must have cut a heck of a deal with FedEx, it is before 10:30A delivery next day.
I have searched eBay/Amazon/etc., going rate is about $18.50 once you add shipping.
Thanks to you, I know a lot more then when I started…
Thank you
Bob