EVGA

Restore original BIOS of EVGA Z87, with downgrade Intel ME 9.1.x to 9.0.x, do a ME pinmod?

Author
Post
Essentials Only Full Version
SidusSomnium
New Member
  • Total Posts : 3
  • Reward points : 0
  • Joined: 2015/12/20 05:44:15
  • Status: offline
  • Ribbons : 0
2015/12/24 13:34:28 (permalink)
I have a EVGA Z87 Classified (E878) Motherboard but recently I make a big mistake: I click on the false item in the drop down menu in the BIOS download section and download the EVGA Z97 Classified (E979) BIOS and flash it. Flashing of the Z97 firmware terminates without any problems, but flashing back the correct Z87 BIOS is problematic. I think Intel Management Engine (ME) causes the problems because it is a downgrade.
 

The BIOS files



The correct BIOS I want to have is v1.09 for EVGA Z87 Classified (E878):
It can be found here: and I call this package further "E878_109.zip"

ME Analyser v1.4.0 output of the included 1E878109.bin:

--------- ME Analyzer v1.4.0 ---------

File:     1E878109.bin

Firmware: Intel ME
Version:  9.0.31.1487
Release:  Production
Type:     Region, Extracted
FD:       Unlocked
SKU:      1.5MB
VCN:      3
PV:       Yes
Date:     12/12/2013
FITC Ver: 9.0.22.1467
Latest:   Yes


The script to update the BIOS in E878_109.zip just run:
FPT -F 1E878109.bin -SAVEMAC


where FPT is:
Intel (R) Flash Programming Tool. Version:  9.0.22.1467


So this is the EVGA official method to update the BIOS.



The actual installed BIOS is v1.08 for EVGA Z97 Classified (E979):
It can be found here: and I call this package further "E979_108.zip"

ME Analyser v1.4.0 output of the included 1E979108.bin:

--------- ME Analyzer v1.4.0 ---------

File:     1E979108.bin

Firmware: Intel ME
Version:  9.1.0.1120
Release:  Production
Type:     Region, Extracted
FD:       Unlocked
SKU:      1.5MB
VCN:      10
PV:       Yes
Date:     14/02/2014
FITC Ver: 9.1.0.1120
Platform: Desktop
Latest:   No


The script to update the BIOS in E979_108.zip just run:
FPT -F 1E979108.bin -SAVEMAC


where FPT is:
Intel (R) Flash Programming Tool. Version:  9.1.0.1035


What I have tried so far



1. Just run update.bat in E878_109.zip from a DOS-USB-stick, e.g. run the command:
FPT -F 1E878109.bin -SAVEMAC


This will result in the error 25:

Error 25: The host CPU does not have write access to the target flash area. To enable write access for this operation you must modify the descriptor settings to give host access to this region.
Screenshot:
 



This error occurs when the Flash Descriptor is locked, or? But the analysing/info tolls say the it is unlocked.

2. Run the same command with FPT 9.1.0.1035 (the version shipped with E979_108.zip):
FPT -F 1E878109.bin -SAVEMAC

This will result in a C programming error:

Assertion Failed: 0, function SpiCheckAccess, file ..\..\Common\SpiFlashUtils.c, line 1394
Screenshot:



3. Run the same command with FPT 9.1.10.1000 (a newer version as in E979_108.zip):
FPT -F 1E878109.bin -SAVEMAC

same error as in 2.

Screenshot:



4. Try to first downgrade only the ME region with "Intel (R) Firmware Update Utility Version: 9.0.22.1467":
FWUPDLCL -F ME9015m.bin -ALLOWSV


where ME9015m.bin is "Intel ME Firmware v9.0.31.1487 (1.5MB)" from

will result in the error:
Error 8704: Firmware update operation not initiated due to a SKU mismatch

Screenshot:



5. Try to first downgrade only the ME region with "Intel (R) Firmware Update Utility Version: 9.1.2.1000":
FWUPDLCL -F ME9015m.bin -ALLOWSV

same error again as in 4.

Screenshot:


6. Mention that flashing any Z97 (E979) BIOS version with the following command (so the default update command from the E979_xxx.zip" packages) still works fine:
FPT -F 1E979xxx.bin -SAVEMAC


Actually I don't have any further idea what to try and the EVGA support actually respond only (in PR language of course) with a "F*** you customer you already paid for the product". Have someone maybe a Idea?


Additional Information


MEInfo (from Intel ME System Tools v9.1 r7 - (Updated: 18/11/2015) in 
MEINFO


Intel(R) MEInfo Version: 9.1.20.1020
Copyright(C) 2005 - 2014, Intel Corporation. All rights reserved.

Intel(R) ME code versions:

BIOS Version:                           4.6.5
MEBx Version:                           0.0.0.0000
Gbe Version:                            1.3
VendorID:                               8086
PCH Version:                            5
FW Version:                             9.1.0.1120 H

FW Capabilities:                        0x41101960

    Intel(R) Anti-Theft Technology - PRESENT/ENABLED
    Intel(R) Capability Licensing Service - PRESENT/ENABLED
    Protect Audio Video Path - PRESENT/ENABLED
    Intel(R) Dynamic Application Loader - PRESENT/ENABLED
    Service Advertisement & Discovery - PRESENT/ENABLED

TLS:                                    Disabled
Last ME reset reason:                   Power up
Local FWUpdate:                         Enabled
BIOS Config Lock:                       Enabled
GbE Config Lock:                        Enabled
Host Read Access to ME:                 Enabled
Host Write Access to ME:                Enabled
SPI Flash ID #1:                        C22018
SPI Flash ID VSCC #1:                   20452045
SPI Flash BIOS VSCC:                    20452045
BIOS boot State:                        Pre Boot
OEM Id:                                 00000000-0000-0000-0000-000000000000
Capability Licensing Service:           Enabled
OEM Tag:                                0x00000000
Localized Language:                     Unknown
Independent Firmware Recovery:          Enabled


MEINFO -VERBOSE


Intel(R) MEInfo Version: 9.1.20.1020
Copyright(C) 2005 - 2014, Intel Corporation. All rights reserved.


FW Status Register1: 0x1E000255
FW Status Register2: 0x66002306
FW Status Register3: 0x00000200
FW Status Register4: 0x00004000
FW Status Register5: 0x00000000
FW Status Register6: 0x30000020

  CurrentState:                         Normal
  ManufacturingMode:                    Enabled
  FlashPartition:                       Valid
  OperationalState:                     M0 with UMA
  InitComplete:                         Complete
  BUPLoadState:                         Success
  ErrorCode:                            No Error
  ModeOfOperation:                      Normal
  Phase:                                HOSTCOMM Module
  ICC:                                  Valid OEM data, ICC programmed
  ME File System Corrupted:             No

Get ME FWU version command...done

SMBIOS Table Data 
    SM BIOS Spec Version :    2.8 
    Starting address:         0x ED100 
    Table Size in Bytes:        3026   ( 0xBD2 ) 
    Number of Table Entries:   the    78   ( 0x4E ) 

    Table Type   0 ( 0x 00 ) found, size of  24 (0x 18 ) bytes 

SMBIOS Table Data 
    SM BIOS Spec Version :    2.8 
    Starting address:         0x ED100 
    Table Size in Bytes:        3026   ( 0xBD2 ) 
    Number of Table Entries:   the    78   ( 0x4E ) 

    Table Type   0 ( 0x 00 ) found, size of  24 (0x 18 ) bytes 
    Table Type   1 ( 0x 01 ) found, size of  27 (0x 1B ) bytes 
    Table Type   2 ( 0x 02 ) found, size of  15 (0x 0F ) bytes 
    Table Type   3 ( 0x 03 ) found, size of  25 (0x 19 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   8 ( 0x 08 ) found, size of   9 (0x 09 ) bytes 
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
    Table Type   9 ( 0x 09 ) found, size of  17 (0x 11 ) bytes 
    Table Type  10 ( 0x 0A ) found, size of   6 (0x 06 ) bytes 
    Table Type  11 ( 0x 0B ) found, size of   5 (0x 05 ) bytes 
    Table Type  12 ( 0x 0C ) found, size of   5 (0x 05 ) bytes 
    Table Type  24 ( 0x 18 ) found, size of   5 (0x 05 ) bytes 
    Table Type  32 ( 0x 20 ) found, size of  20 (0x 14 ) bytes 
    Table Type  34 ( 0x 22 ) found, size of  11 (0x 0B ) bytes 
    Table Type  26 ( 0x 1A ) found, size of  22 (0x 16 ) bytes 
    Table Type  36 ( 0x 24 ) found, size of  16 (0x 10 ) bytes 
    Table Type  35 ( 0x 23 ) found, size of  11 (0x 0B ) bytes 
    Table Type  28 ( 0x 1C ) found, size of  22 (0x 16 ) bytes 
    Table Type  36 ( 0x 24 ) found, size of  16 (0x 10 ) bytes 
    Table Type  35 ( 0x 23 ) found, size of  11 (0x 0B ) bytes 
    Table Type  27 ( 0x 1B ) found, size of  15 (0x 0F ) bytes 
    Table Type  36 ( 0x 24 ) found, size of  16 (0x 10 ) bytes 
    Table Type  35 ( 0x 23 ) found, size of  11 (0x 0B ) bytes 
    Table Type  27 ( 0x 1B ) found, size of  15 (0x 0F ) bytes 
    Table Type  36 ( 0x 24 ) found, size of  16 (0x 10 ) bytes 
    Table Type  35 ( 0x 23 ) found, size of  11 (0x 0B ) bytes 
    Table Type  29 ( 0x 1D ) found, size of  22 (0x 16 ) bytes 
    Table Type  36 ( 0x 24 ) found, size of  16 (0x 10 ) bytes 
    Table Type  35 ( 0x 23 ) found, size of  11 (0x 0B ) bytes 
    Table Type  26 ( 0x 1A ) found, size of  22 (0x 16 ) bytes 
    Table Type  28 ( 0x 1C ) found, size of  22 (0x 16 ) bytes 
    Table Type  27 ( 0x 1B ) found, size of  15 (0x 0F ) bytes 
    Table Type  29 ( 0x 1D ) found, size of  22 (0x 16 ) bytes 
    Table Type  39 ( 0x 27 ) found, size of  22 (0x 16 ) bytes 
    Table Type  41 ( 0x 29 ) found, size of  11 (0x 0B ) bytes 
    Table Type  41 ( 0x 29 ) found, size of  11 (0x 0B ) bytes 
    Table Type  41 ( 0x 29 ) found, size of  11 (0x 0B ) bytes 
    Table Type   4 ( 0x 04 ) found, size of  42 (0x 2A ) bytes 
    Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes 
    Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes 
    Table Type   7 ( 0x 07 ) found, size of  19 (0x 13 ) bytes 
    Table Type  16 ( 0x 10 ) found, size of  23 (0x 17 ) bytes 
    Table Type  17 ( 0x 11 ) found, size of  40 (0x 28 ) bytes 
    Table Type  17 ( 0x 11 ) found, size of  40 (0x 28 ) bytes 
    Table Type  17 ( 0x 11 ) found, size of  40 (0x 28 ) bytes 
    Table Type  17 ( 0x 11 ) found, size of  40 (0x 28 ) bytes 
    Table Type  19 ( 0x 13 ) found, size of  31 (0x 1F ) bytes 
    Table Type  20 ( 0x 14 ) found, size of  35 (0x 23 ) bytes 
    Table Type  20 ( 0x 14 ) found, size of  35 (0x 23 ) bytes 
    Table Type 136 ( 0x 88 ) found, size of   6 (0x 06 ) bytes 
    Table Type  13 ( 0x 0D ) found, size of  22 (0x 16 ) bytes 
    Table Type 131 ( 0x 83 ) found, size of  64 (0x 40 ) bytes 
        MEBx Version found is 0.0.0.0000 

Get ME FWU info command...done

Get ME FWU version command...done

Get ME FWU feature state command...done

Get ME FWU platform type command...done

Get ME FWU feature capability command...done

Get ME FWU OEM Id command...done
FW Capabilities value is 0x41101960
Feature enablement is 0x41101960
Platform type is 0x72130302
Intel(R) ME code versions:

BIOS Version:                           4.6.5
MEBx Version:                           0.0.0.0000
Gbe Version:                            1.3
VendorID:                               8086
PCH Version:                            5
FW Version:                             9.1.0.1120 H

FW Capabilities:                        0x41101960

    Intel(R) Active Management Technology - NOT PRESENT
    Intel(R) Standard Manageability - NOT PRESENT
    Intel(R) Anti-Theft Technology - PRESENT/ENABLED
    Intel(R) Capability Licensing Service - PRESENT/ENABLED
    Protect Audio Video Path - PRESENT/ENABLED
    Intel(R) Dynamic Application Loader - PRESENT/ENABLED
    Service Advertisement & Discovery - PRESENT/ENABLED
    Intel(R) NFC Capabilities - NOT PRESENT
    Intel(R) Platform Trust Technology - NOT PRESENT

TLS:                                    Disabled
Last ME reset reason:                   Power up
Local FWUpdate:                         Enabled

Get BIOS flash lockdown status...done
BIOS Config Lock:                       Enabled

Get GbE flash lockdown status...done
GbE Config Lock:                        Enabled

Get flash master region access status...done
Host Read Access to ME:                 Enabled
Host Write Access to ME:                Enabled
SPI Flash ID #1:                        C22018
SPI Flash ID VSCC #1:                   20452045
SPI Flash BIOS VSCC:                    20452045
Protected Range Register Base #0 0x0
Protected Range Register Limit #0 0x0
Protected Range Register Base #1 0x0
Protected Range Register Limit #1 0x0
Protected Range Register Base #2 0x0
Protected Range Register Limit #2 0x0
Protected Range Register Base #3 0x0
Protected Range Register Limit #3 0x0
Protected Range Register Base #4 0x0
Protected Range Register Limit #4 0x0
BIOS boot State:                        Pre Boot
OEM Id:                                 00000000-0000-0000-0000-000000000000
Capability Licensing Service:           Enabled

Get ME FWU OEM Tag command...done
OEM Tag:                                0x00000000

Get ME FWU Platform Attribute (WLAN ucode) command...done
Localized Language:                     Unknown

Get ME FWU Info command...done
Independent Firmware Recovery:          Enabled


MEManuf (from Intel ME System Tools v9.1 r7 - (Updated: 18/11/2015) and Intel ME System Tools v9.0 r2 - (Updated: 13/06/2015)) say both that everything is fine
 

How to do a Intel ME pinmod

I get the Tip that a Intel ME pinmod (HDA_SDO) could activate the Intel ME security overwrite mode, which allows writing to the ME region under any circumstances. There is no direct pin switch for that, but does anybody still knows how to activate it? Pinmod Info: [dot]bios-mods[dot]com/forum/Thread-UEFI-Dell-XPS-15z-L511z-modded-BIOS-and-HOWTO?pid=52669#pid52669
post edited by SidusSomnium - 2015/12/25 14:42:35

Attached Image(s)

#1

2 Replies Related Threads
    SidusSomnium
    New Member
    • Total Posts : 3
    • Reward points : 0
    • Joined: 2015/12/20 05:44:15
    • Status: offline
    • Ribbons : 0
    Re: Restore original BIOS of EVGA Z87, with downgrade Intel ME 9.1.x to 9.0.x, do a ME pin 2015/12/25 14:12:51 (permalink)
    Maybe the problem is not ME. I found out that the BIOS images have different sizes:

    1E878109.bin size: 16 777 216bytes (0x1 000 000 blocks)
    1E979108.bin size: 8 388 608bytes (0x800 000 blocks)

    So the actual installed BIOS is smaller than the correct one. The tools seems to not be able to detect the correct size of the flash storage (it must have at least 16 777 216bytes because of it is the original BIOS size):

    If I run the command (with FPT 9.0 or 9.1):
    FPT -ERASE -LENGTH 8388608

    it works fine, but if I run 
    FPT -ERASE -LENGTH 8388609

    it fails with
    Error 321: The address is outside the boundaries of the flash area.

    Screenshot:


    This is maybe also the reason why FPT alway prints the Warning on every operation:
    Warning: There are some addresses that are not defined in any regions. Read/Write/erase operations are not possible on those addresses.


    I tried also flashrom and it could also detect only the first 8388609bytes:

    flashrom -p internal -w 1E878109.bin


    flashrom v0.9.7-r1711 on Linux 3.14.56-std461-amd64 (x86_64)
    flashrom is free software, get the source code at http://www.flashrom.org

    Calibrating delay loop... OK.
    Found chipset "Intel Z87". 
    This chipset is marked as untested. If you are using an up-to-date version
    of flashrom *and* were (not) able to successfully update your firmware with it,
    then please email a report to flashrom@flashrom.org including a verbose (-V) log.
    Thank you!
    Enabling flash write... Enabling hardware sequencing because some important opcode is locked.
    OK.
    Found Programmer flash chip "Opaque flash chip" (8192 kB, Programmer-specific) at physical address 0x0.
    Warning: SPI Configuration Lockdown activated.
    Error: Image size (16777216 B) doesn't match the flash chip's size (8388608 B)!


    But this makes not really sense for me. Why should the flash storage suddenly shrink? And why I don't have access to the rest. Is there anywhere a max_size value which I could not erase?

    Maybe the --force option of flashrom could help; does anybody know? 

    -f, --force
        Force one or more of the following actions:

        * Force chip read and pretend the chip is there.

        * Force chip access even if the chip is bigger than the maximum supported as size for the flash bus.

        * Force erase even if erase is known bad.

        * Force write even if write is known bad.


    Or has anybody another idea for that?
    post edited by SidusSomnium - 2015/12/25 14:41:19

    Attached Image(s)

    #2
    SidusSomnium
    New Member
    • Total Posts : 3
    • Reward points : 0
    • Joined: 2015/12/20 05:44:15
    • Status: offline
    • Ribbons : 0
    Re: Restore original BIOS of EVGA Z87, with downgrade Intel ME 9.1.x to 9.0.x, do a ME pin 2015/12/27 08:29:09 (permalink)
    I solved the issue doing the following:

    1. The first 4096 bytes are the Flash Descriptor, so overwrite it with the flash descriptor which contains the correct BIOS length information
    FPT -F 1E878109.bin -REWRITE -LENGTH 4096


    2. To accept the new lengths, the computer has to be restarted. Of course now there are two different BIOS flashed, but it works enough to start again a DOS system from a USB stick.

    3. Now I have access to all 16 777 216bytes and a normal BIOS flash is working now
    FPT -F 1E878109.bin -SAVEMAC

    #3
    Jump to:
  • Back to Mobile