Corrupted Management Engine Firmware on Lenovo Ideapad 720s-13IKB

Hello! I bought a month ago a Lenovo Ideapad 720s-13IKB model 81A8, with the BIOS version 5SCN38WW , and it’s been a pretty good machine so far. I had some problems with the preloaded version of Windows 10 Home and I decided to reinstall the operating system using a .iso file from Microsoft. Then, I had to reinstall the drivers and here starts my problem. I found in the chipset tab on the official Lenovo website a program called “Intel Management Engine Firmware update version 11.6”, and I gave it a shot. It was a command prompt program and it worked just fine until about 90 to 95% percent progress, when the prompt closed and on my screen appeared a pop up saying that “your computer will shut down in less than a minute”. I let it shut down and then I pressed the power button. At this point, something strange happened: the screen powered on and the keyboard backlit turned on for a few seconds, then both turned back off for more than 3 minutes, although the computer was still on and the fans were running. I was really scared that I damaged my laptop. However, the Lenovo splash screen came on the screen and, then, the laptop booted just fine. Now, here are the problems: when I press the power button, it behaves like I mentioned earlier, the only difference being the fact that it takes between 30 to 40 seconds to get to the actual Lenovo boot screen, which is way more than 2.5 seconds, the way it was before. I don’t have the Intel Management Engine Interface installed on my system, and now it won’t install, because the installer says that “This platform is not supported”. I can neither run the firmware update utility, because it reports in the error log that there is an error with the Intel Management Engine Interface, which I can’t install. Moreover, I discovered that, in Device Manager, only 3 firmware devices show off, less than 5 or 6, as there used to be before the failed update. So, I think that I have a corrupted ME Region, about which I read several posts on this forum. The only inconveniences are:
1. The fact that I don’t have a .bin file of my BIOS, only the .exe from the Lenovo. Also, I don’t know how to dump my BIOS without any special device. I really need to get a 5SCN38WW.bin file;
2. When I will eventually get the .bin file, I don’t know what to do with it. I read that I need to use programs like UEFITool or Intel Easy Clean Me, but I don’t know how to use either of those. If I get to use one of them, I suppose I have to flash my BIOS again, which I don’t know how to do it without the utilitarian tool from Lenovo.
In conclusion, would you be kind enough to help my solve this issue? I am not a noob in the computers world, but I really don’t know how to fix this corrupted ME region problem, since I never had any problems with my BIOS. Thank you very much for any help, and please excuse my bad English!

Hello Marian, you need to buy SPI programmer in order to repair corrupted MEI firmware or any broken bios where the system is non-bootable, there is plenty of information of how you can recover it just use the search menu or google. [Guide] Using CH341A-based programmer to flash SPI EEPROM

Thanks for the input! Well, that’s some kind of bad news to me. I thought I could fix this problem without any hardware, since my device is working fine, it’s only the problem with the very long boot time. Anyway, I found such a device on a website in a country. It says it is a “Memory Programmer CH341a with USB for use to Flash and EEPROM from 24xx and 25xx series” (sorry for this pretty bad translation, but the description isn’t extremely clear), and it look like the one in the picture. Is this what I need? It is not very expensive, it costs about 7$, and people say it works with writing BIOS files and EEPROMs. I have one question though: if I buy this device and use the CH341a software, won’t I still need the original BIOS .bin software? Thank you for help!
The complete specs of the device:
USB port
Chip CH341A
5V-3.3V Power Supply
Supports Windows XP, Vista, Win7 and Win8 (32 / 64bit)
Conversion chip SOP8 SOP16 to DIP8 (I have no ideea what this is, so my translation may not be accurate)
Supports 24EEPROM and 25 SPI flash chip 8pins / 16pins

CL853_1[1].jpg

Hello,

Your CSME firmware is corrupted. Something happened during the update probably and now it’s in recovery mode. Totally not your fault.

Although having a programmer around is always a good thing, I’m not sure you should go to such lengths on a brand new system with (I assume) active warranty. Technically, the issue happened from an official Lenovo firmware update so it should cover it. We can try to fix it via software (if possible) but I advise against opening the machine so that warranty can be claimed even if we fail. For the record, if it comes down to that, Lenovo does include a full SPI/BIOS image at that executable, which I have attached below (5scn38ww.bin).

In order to repair the CSME corruption, you need to unlock read/write access to the Engine/CSME region of the SPI/BIOS chip, as explained in [Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing. To check if the Flash Descriptor is unlocked, download CSME System Tools v11 from Section C of Intel Management Engine: Drivers, Firmware & System Tools and run Flash Programming Tool via “fptw -d spi.bin”. If it completes successfully, it is likely that you have read/write access. Otherwise, you’ll need to follow any steps possible to unlock it first. However, in your case, there might be a Lenovo tool which can unlock access easily (section E4). I don’t know if it’s going to work for your system, but it might. Download it from here, open a command prompt as administrator at the BootMode folder and run “BootModeX64.exe /UnlockTXE”. The system will probably shutdown immediately and theoretically you should have an unlocked Flash Descriptor at the next boot. Test “fptw -d spi.bin” again. If it completes successfully, download the attachment and run “fptw.exe -me -f 5scn38ww_CSME.bin” followed by “fptw -greset”. After the restart, the firmware should be healthy which you can verify by running MEInfo tool via “MEInfoWin64.exe -fwsts”.

5scn38ww.rar (5.08 MB)

Thank you very much for your informations! I ran the “fptw -d spi.bin” command and it didn’t give any error, so I preceded to the “fptw.exe -me -f 5scn38ww_CSME.bin” command which, sadly, threw this error:


"Copyright (c) 2007 - 2018, Intel Corporation. All rights reserved.

Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
W25Q64FV ID:0xEF4017 Size: 8192KB (65536Kb)

Unable to detect ME disabled.
Do you wish to proceed with the flash write operation? Y/<N> or q to quit : Y

GbE Region does not exist.

Error 451: The host CPU does not have write access to the target flash area. To enable write access for this operation you must modify the descriptor settings to give host access to this region.
FPT Operation Failed. "
Well, at least I have read/write acces to the CSME region, but I will try to find out what exactly causes the error 451. Thank you for all your help!

The fpt result and the error you got indicates that you have read but not write access. You’ll need to test BootMode, as I explained above. If it works, you should be able to run “fptw.exe -me -f 5scn38ww_CSME.bin” afterwards.

So, I downloaded BootMode v2.2 from your link, opened a command prompt as administrator, ran the “BootModeX64.exe /UnlockTXE” command and the result was a message saying :“Operation successful!!!”. However, my system didn’t shutdown or restart, and the “fptw.exe -me -f 5scn38ww_CSME.bin” still doesn’t work. I think I followed the steps correctly, but my laptop doesn’t seem to cooperate . Thanks for your aid!

It definitely needs a restart for the command to apply so if it doesn’t do it automatically, it has to be done manually. After you get the “successful” message, restart the system and test the command again.

Hello! Sadly, I still get the same error 451. Running the “unlockTXE” command does not have any impact whatsoever. Isn’t there any other way to flash this .bin file? Or a tool to be able to write the Management Engine firmware? I feel like I am very close to fix this issue but, at the same time, I am very far away. Thank you for supporting me!

"Close", not really. Unlocking the FD is always the hardest part when it comes to firmware servicing. I think that command should work at the very similar 720-12IKB. Did you attempt to re-flash exactly at the next reboot?

Yes, I did. I tried both the 32 and 64 bit version of BootMode, and both showed "Operation succesful", but none of them worked. Thanks for you input!

Hello! After trying for an entire day to fix this issue using Windows, I discovered that MS-DOS might do the trick. Sadly, my laptop has no settings related to legacy boot, so I can’t easily boot intro FreeDos. Is there any way I can boot into Dos without legacy support? Or any way I can unlock the Firmware Descriptor without opening the laptop? Thank you very much for your informations, and please help me out with this silly problem!

No, DOS is not needed. Since the BIOS is not BootGuard protected, @Lost_N_BIOS might be able to help you enable the hidden “Me FW Re-Flash” BIOS setup variable/option.

If his steps don’t help, you can either contact Lenovo and ask them for a way to re-flash the ME firmware after a bad flash from their own flasher (emphasize that, just in case they send some tool which can unlock the FD) or claim the warranty. Opening a new laptop is not a good idea.

Alright then! I will wait mister @Lost_N_Bios 's response, maybe he will be able to help me! Anyway, thank you very much sir for all the information and tools you provided me and, if it will be the case, I will contact Lenovo to solve my problem!

Hello again! I documented about how to enable the hidden “Me FW Re-Flash” BIOS setup using this link: [Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing. I followed all the steps, and managed to get a text file of the only PE32 Image I could find using UefiTool. I found on line 16684 a text called " Me FW Image Re-Flash", which seems very promising. The only problem is that the value after VarStoreInfo is 0x3, which doesn’t really look like a proper hex value, according to the guide I am using. I tried to change this value by booting into GRUB and writing the command “setup_var 0x3 0x01”, but I had no luck. I will attach the text file I created, maybe it will be of some use.
There is one more thing. Yesterday, I downgraded my BIOS to 5SCN18WW, because I couldn’t boot to my GRUB USB flash drive (without realizing that I didn’t format my USB as FAT32) and, interestingly, it had a feature that is not present in the 5SCN38WW BIOS version: Legacy Boot Support. This probably means nothing related to the problem I have, but would you be so kind to check if the 5SCN18WW.bin file is available to download (I will attach the .exe file of this version)? Maybe that one is better in terms of finding the hex value I’m looking for to enable the ME Firmware Re-Flash option in BIOS. Until then, I already upgraded back to 5SCN38WW, in order to test the .bin files I already have. Thank you in advance for any help!
P.S. I used IRFExtractor 0.3.6 to get the text file. Link for the 5SCN18WW.exe file: https://mega.nz/#!i80Q0IwA!Hlg3xwGtTbFbh…fgHyUEYqJde-1FQ

pe32-1.txt (1.59 MB)


Yes, this is exactly what I saw as well when looking at the IFR. Since my knowledge on IFR is very limited, I decided to ask LOST in case he can figure it out.


I have attached the extracted 5SCN18WW SPI image as well.

5scn18ww.rar (5.06 MB)

Thank you for the response! Tomorrow I will try the first two steps from this link: [GUIDE] Grub Fix Intel FPT Error 280 or 368 - BIOS Lock Asus/Other Mod BIOS Flash, since they are a bit different than the original guide I used. At the same time, I will try to apply the same procedure on the 5SCN18WW version, which will hopefully cooperate better than my actual BIOS version. Thanks for your informations and for the SPI image you sent over!

Hi! Sadly, neither the new method I tried, nor the 5SCN18WW.bin file helped me to unlock this secret BIOS option. I opened a new thread on the BIOS Modding and Problems topic and, hopefully, somebody will be able to help me for the Bios part!

I have same issue on Acer laptop, this problem probably means your laptop’s ME FW temporary disabled or in recovery mode, this state of operation perhaps occured after hard reset during an update

If you will download Intel TXEInfo and run it in CMD you will probably see same thing

IMG_20190926_172313.jpg

@marianFCBT

download FPT package with Flash Image Tool (fit.exe) and edit values which may grant write access to ME FW region for your CPU

don’t forget to Enable BIOS Guard Protection Override and change Boot Guard Profile Configuration to No_FVME or VM value (!!!), this will not turn off your pc after changes done

flash new image and see if this helps

IMG_20190926_233048.jpg