corna / me_cleaner

Tool for partial deblobbing of Intel ME/TXE firmware images
GNU General Public License v3.0
4.42k stars 275 forks source link

Not working well on Gigabyte GA-H55M-S2H through internal flashing, help #387

Open c-fst opened 1 year ago

c-fst commented 1 year ago

Hi, I have motherboard Gigabyte GA-H55M-S2H, H55 chipset (Ibex Peak), with processor family Nehalem (Lynnfield). I've downloaded BIOS from Gigabyte's website here: https://download.gigabyte.com/FileList/BIOS/mb_bios_ga-h55m-s2h_f7.exe?v=81bbbe13998d689201ddae260eea27c6 , it's a full SPI ROM with also ME in it (it's 8MB). The ME/TXE firmware version is 6.0.30.1203. To extract and to flash images I used mainly "flashspi.exe" (present in the download from Gigabyte), because it never makes me problems before in extracting and flashing. Specifically I used the command flashspi.exe with /C /D /E to flash and with /S to extract.

I tried to clean ME (and flash) in a stock SPI image (from site) and in an extracted one. I used (in addition to Gigabyte tool FLASHSPI.exe (freeDOS)) also Qflash (a tool in the BIOS) later. I use internal flashing because the motherboard has Dual BIOS and because the flashing seems to write the entire chip.

Following _mecleaner guide I've checked all images with ifdtool -d (and also with unhuffme) commands and all image files have (in ifdtool output) the same FLREGn Section, not as expected (the BIOS Region):

PCH Revision: 5 series Ibex Peak
FLMAP0:    0x02040002
  NR:      2
  FRBA:    0x40
  NC:      1
  FCBA:    0x20
FLMAP1:    0x10100206
  ISL:     0x10
  FPSBA:   0x100
  NM:      2
  FMBA:    0x60
FLMAP2:    0x00000020
  PSL:     0x0000
  FMSBA:   0x200
FLUMAP1:   0x00000eec
  Intel ME VSCC Table Length (VTL):        14
  Intel ME VSCC Table Base Address (VTBA): 0x000ec0

ME VSCC table:
  JID0:  0x0000471f
    SPI Component Vendor ID:            0x1f
    SPI Component Device ID 0:          0x47
    SPI Component Device ID 1:          0x00
  VSCC0: 0x20152015
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x06
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID1:  0x004a25bf
    SPI Component Vendor ID:            0xbf
    SPI Component Device ID 0:          0x25
    SPI Component Device ID 1:          0x4a
  VSCC1: 0x20092009
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        Yes
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        Yes
    Upper Write Granularity:            1 bytes
    Upper Block / Sector Erase Size:    4KB
  JID2:  0x001620c2
    SPI Component Vendor ID:            0xc2
    SPI Component Device ID 0:          0x20
    SPI Component Device ID 1:          0x16
  VSCC2: 0x20052005
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID3:  0x001630ef
    SPI Component Vendor ID:            0xef
    SPI Component Device ID 0:          0x30
    SPI Component Device ID 1:          0x16
  VSCC3: 0x20052005
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID4:  0x001720c2
    SPI Component Vendor ID:            0xc2
    SPI Component Device ID 0:          0x20
    SPI Component Device ID 1:          0x17
  VSCC4: 0x20052005
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID5:  0x001740ef
    SPI Component Vendor ID:            0xef
    SPI Component Device ID 0:          0x40
    SPI Component Device ID 1:          0x17
  VSCC5: 0x20052005
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID6:  0x004b25bf
    SPI Component Vendor ID:            0xbf
    SPI Component Device ID 0:          0x25
    SPI Component Device ID 1:          0x4b
  VSCC6: 0x20092009
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        Yes
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        Yes
    Upper Write Granularity:            1 bytes
    Upper Block / Sector Erase Size:    4KB

OEM Section:
00: 21 27 2d 6c 68 35 2d b5 35 01 00 00 00 02 00 00
10: 00 00 50 20 01 08 74 65 73 74 2e 42 49 4e 13 64
20: 20 00 00 2d 80 86 e1 f7 46 93 7d a6 7f bb bb a7
30: 48 40 0e 8a a2 b5 ae 08 d4 62 b5 b4 c3 22 c5 ab

Found Region Section
FLREG0:    0x00000000
  Flash Region 0 (Flash Descriptor): 00000000 - 00000fff 
FLREG1:    0x07ff0000
  Flash Region 1 (BIOS): 00000000 - 007fffff 
FLREG2:    0x04f20001
  Flash Region 2 (Intel ME): 00001000 - 004f2fff 
FLREG3:    0x00000fff
  Flash Region 3 (GbE): 00fff000 - 00000fff (unused)
FLREG4:    0x00000fff
  Flash Region 4 (Platform Data): 00fff000 - 00000fff (unused)

Found Component Section
FLCOMP     0x0930001c
  Dual Output Fast Read Support:       not supported
  Read ID/Read Status Clock Frequency: 33MHz
  Write/Erase Clock Frequency:         33MHz
  Fast Read Clock Frequency:           33MHz
  Fast Read Support:                   supported
  Read Clock Frequency:                20MHz
  Component 2 Density:                 4MB
  Component 1 Density:                 8MB
FLILL      0x00000000
  Invalid Instruction 3: 0x00
  Invalid Instruction 2: 0x00
  Invalid Instruction 1: 0x00
  Invalid Instruction 0: 0x00
FLPB       0x00000000
  Flash Partition Boundary Address: 0x000000

Found PCH Strap Section
PCHSTRP0  : 0x00205782
PCHSTRP1  : 0x0000000f
PCHSTRP2  : 0x00000000
PCHSTRP3  : 0x00000000
PCHSTRP4  : 0x00c8e002
PCHSTRP5  : 0x00000000
PCHSTRP6  : 0x00000000
PCHSTRP7  : 0x00000000
PCHSTRP8  : 0x00000000
PCHSTRP9  : 0x00000503
PCHSTRP10 : 0x00010044
PCHSTRP11 : 0x99000097
PCHSTRP12 : 0x00000000
PCHSTRP13 : 0x00000000
PCHSTRP14 : 0x00000000
PCHSTRP15 : 0x00000318
AltMeDisable bit is not set

Found Master Section
FLMSTR1:   0xffff0000 (Host CPU/BIOS)
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
  Requester ID:                      0x0000

FLMSTR2:   0xffff0000 (Intel ME)
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
  Requester ID:                      0x0000

FLMSTR3:   0xffff0118 (GbE)
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
  Requester ID:                      0x0118

Found Processor Strap Section
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff

Specifically here the BIOS Region seems to start in a wrong place (its end seems good); while seems that ME starts in right address and end in a 0xff zone (but this area includes ME anyway so it's not bad, I suppose).

At first I ignored this and cleaned both images (the stock one and the extracted with flashspi.exe one) with me_cleaner.py -S -O (same output)

Full image detected
The ME/TXE region goes from 0x1000 to 0x4f3000
Found FPT header at 0x1010
Found 14 partition(s)
Found FTPR header: FTPR partition spans from 0xf2000 to 0x1b2000
ME/TXE firmware version 6.0.30.1203
Public key match: Intel ME, firmware versions 6.x.x.x
The AltMeDisable bit is NOT SET
Reading partitions list...
 FOVD (0x00000400 - 0x000002000, 0x00001c00 total bytes): removed
 EFFS (0x00002000 - 0x0000e2000, 0x000e0000 total bytes): removed
 NVKR (NVRAM partition, no data, 0x00010000 total bytes): nothing to remove
 BIEL (      no data here      , 0x00003000 total bytes): nothing to remove
 BIIS (      no data here      , 0x00036000 total bytes): nothing to remove
 NVTD (NVRAM partition, no data, 0x00002000 total bytes): nothing to remove
 NVCM (NVRAM partition, no data, 0x00004000 total bytes): nothing to remove
 NVOS (NVRAM partition, no data, 0x00011000 total bytes): nothing to remove
 NVSH (NVRAM partition, no data, 0x00007000 total bytes): nothing to remove
 BIAL (      no data here      , 0x00009000 total bytes): nothing to remove
 NVVE (NVRAM partition, no data, 0x00000c00 total bytes): nothing to remove
 GLUT (0x000e2000 - 0x0000f2000, 0x00010000 total bytes): removed
 FTPR (0x000f2000 - 0x0001b2000, 0x000c0000 total bytes): NOT removed
 NFTP (0x001b2000 - 0x0004f2000, 0x00340000 total bytes): removed
Removing partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0xe7)...
Reading FTPR modules list...
 BUP              (Huffman, fragmented data, ~30 KiB  ): NOT removed, essential
 VE_FW_NAND       (Huffman, fragmented data, ~152 KiB ): removed
 KERNEL           (Huffman, fragmented data, ~100 KiB ): removed
 POLICY           (Huffman, fragmented data, ~90 KiB  ): removed
 VENOM            (LZMA   , 0x1507f3 - 0x152648       ): removed
 HOSTCOMM         (LZMA   , 0x152648 - 0x1570dd       ): removed
 RSA              (LZMA   , 0x1570dd - 0x15d05d       ): removed
 CLS              (LZMA   , 0x15d05d - 0x160a6e       ): removed
 TDT              (LZMA   , 0x160a6e - 0x163c4a       ): removed
The ME minimum size should be 1056768 bytes (0x102000 bytes)
The ME region can be reduced up to:
 00001000:00102fff me
Setting the AltMeDisable bit in PCHSTRP10 to disable Intel ME...
Checking the FTPR RSA signature... VALID
Done! Good luck!

and flashed them (through flashspi.exe). But the result for both was a BIOS blocked in initial phase of POST, that displays the first screen just with the name of CPU (with a different frequency) in detected devices area; and I can't do anything neither enter to settings. So I restored main with backup BIOS, through a method found in another issue for Gigabyte mb.

Then, as the Wiki says that the regions section has to be reasonable, I suppose that the problem is the not regular FLREGn section. The Wiki also says that this happens because the BIOS is not in a "plain" format. So I searched in Google and in Gigabyte site if there are some conversion tools or instructions to convert BIOS in plain format but I found nothing at all, I neither found any informations about standard "plain" format for BIOS/SPI (Maybe it is the real bytes in the chip or a not proprietary format?).

Trying to resolve the issue by myself, I searched how to modify FLREG manually and it takes me a long time; after that I finally found how to do it and I fixed the BIOS region (in FD) making it to start from 0x700000 instead of 0x000000 (I suppose is right viewing the hex). And I cleaned the resulting image through me_cleaner -S (apparently with success). Here the output of ifdtool -d with the image (this time after the cleaning) with FLREGn modified as I wanted:

PCH Revision: 5 series Ibex Peak
FLMAP0:    0x02040002
  NR:      2
  FRBA:    0x40
  NC:      1
  FCBA:    0x20
FLMAP1:    0x10100206
  ISL:     0x10
  FPSBA:   0x100
  NM:      2
  FMBA:    0x60
FLMAP2:    0x00000020
  PSL:     0x0000
  FMSBA:   0x200
FLUMAP1:   0x00000eec
  Intel ME VSCC Table Length (VTL):        14
  Intel ME VSCC Table Base Address (VTBA): 0x000ec0

ME VSCC table:
  JID0:  0x0000471f
    SPI Component Vendor ID:            0x1f
    SPI Component Device ID 0:          0x47
    SPI Component Device ID 1:          0x00
  VSCC0: 0x20152015
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x06
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID1:  0x004a25bf
    SPI Component Vendor ID:            0xbf
    SPI Component Device ID 0:          0x25
    SPI Component Device ID 1:          0x4a
  VSCC1: 0x20092009
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        Yes
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        Yes
    Upper Write Granularity:            1 bytes
    Upper Block / Sector Erase Size:    4KB
  JID2:  0x001620c2
    SPI Component Vendor ID:            0xc2
    SPI Component Device ID 0:          0x20
    SPI Component Device ID 1:          0x16
  VSCC2: 0x20052005
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID3:  0x001630ef
    SPI Component Vendor ID:            0xef
    SPI Component Device ID 0:          0x30
    SPI Component Device ID 1:          0x16
  VSCC3: 0x20052005
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID4:  0x001720c2
    SPI Component Vendor ID:            0xc2
    SPI Component Device ID 0:          0x20
    SPI Component Device ID 1:          0x17
  VSCC4: 0x20052005
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID5:  0x001740ef
    SPI Component Vendor ID:            0xef
    SPI Component Device ID 0:          0x40
    SPI Component Device ID 1:          0x17
  VSCC5: 0x20052005
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID6:  0x004b25bf
    SPI Component Vendor ID:            0xbf
    SPI Component Device ID 0:          0x25
    SPI Component Device ID 1:          0x4b
  VSCC6: 0x20092009
    Lower Erase Opcode:                 0x20
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        Yes
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x20
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        Yes
    Upper Write Granularity:            1 bytes
    Upper Block / Sector Erase Size:    4KB

OEM Section:
00: 21 27 2d 6c 68 35 2d b5 35 01 00 00 00 02 00 00
10: 00 00 50 20 01 08 74 65 73 74 2e 42 49 4e 13 64
20: 20 00 00 2d 80 86 e1 f7 46 93 7d a6 7f bb bb a7
30: 48 40 0e 8a a2 b5 ae 08 d4 62 b5 b4 c3 22 c5 ab

Found Region Section
FLREG0:    0x00000000
  Flash Region 0 (Flash Descriptor): 00000000 - 00000fff 
FLREG1:    0x07ff0700
  Flash Region 1 (BIOS): 00700000 - 007fffff 
FLREG2:    0x04f20001
  Flash Region 2 (Intel ME): 00001000 - 004f2fff 
FLREG3:    0x00000fff
  Flash Region 3 (GbE): 00fff000 - 00000fff (unused)
FLREG4:    0x00000fff
  Flash Region 4 (Platform Data): 00fff000 - 00000fff (unused)

Found Component Section
FLCOMP     0x0930001c
  Dual Output Fast Read Support:       not supported
  Read ID/Read Status Clock Frequency: 33MHz
  Write/Erase Clock Frequency:         33MHz
  Fast Read Clock Frequency:           33MHz
  Fast Read Support:                   supported
  Read Clock Frequency:                20MHz
  Component 2 Density:                 4MB
  Component 1 Density:                 8MB
FLILL      0x00000000
  Invalid Instruction 3: 0x00
  Invalid Instruction 2: 0x00
  Invalid Instruction 1: 0x00
  Invalid Instruction 0: 0x00
FLPB       0x00000000
  Flash Partition Boundary Address: 0x000000

Found PCH Strap Section
PCHSTRP0  : 0x00205782
PCHSTRP1  : 0x0000000f
PCHSTRP2  : 0x00000000
PCHSTRP3  : 0x00000000
PCHSTRP4  : 0x00c8e002
PCHSTRP5  : 0x00000000
PCHSTRP6  : 0x00000000
PCHSTRP7  : 0x00000000
PCHSTRP8  : 0x00000000
PCHSTRP9  : 0x00000503
PCHSTRP10 : 0x000100c4
PCHSTRP11 : 0x99000097
PCHSTRP12 : 0x00000000
PCHSTRP13 : 0x00000000
PCHSTRP14 : 0x00000000
PCHSTRP15 : 0x00000318
AltMeDisable bit is set

Found Master Section
FLMSTR1:   0xffff0000 (Host CPU/BIOS)
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
  Requester ID:                      0x0000

FLMSTR2:   0xffff0000 (Intel ME)
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
  Requester ID:                      0x0000

FLMSTR3:   0xffff0118 (GbE)
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
  Requester ID:                      0x0118

Found Processor Strap Section
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff

It seemed good to me for FLREG and FLMSTR sections, so I flashed it, but nothing worked again in the same way as before. I tried also this "correction" with an image extracted through BIOS Qflash, obtaining the same results. I tried also to change the region address back to the original situation (after cleaning), but didn't work the same. So my editing is not enough.

Then I tried to just disable the bit (in an image with wrong FLREG) as a temporary workaround, with -s option, and to flash again but neither this worked.

I imagine that now the (unique) thing to do is to convert BIOS into plain format (or to obtain it). But I don't know how to do it (excuse me I'm new to this things). I've read that sometimes it could be obtained through an external programmer that copies the effective BIOS. If so I could try it but before I want to know if it is an effective solution, then if the image will be more compatible with _mecleaner. So I ask here if for example the programmer procedure could change something, or if someone knows where I can find some informations about this plain format of BIOS/SPI/firmware and a way to convert mine in that if possible, or something else that could resolve my problem.

Thank you. And congratulation for the tool that you provide to us.

Updates:

I forgot to try without setting the bit... Attempts:

Update 2 I found confirmation that, in this case, the absence of BIOS' start address is an issue common in motherboards of a certain period (not a sympthom of a not-plain BIOS) as mentioned here. So it's good to fix it.

This SPI seems tricky to clean, but I hope that I'll get more improvements soon and that someone has some advices. Thanks.

c-fst commented 1 year ago

For now after many attempts what seems the best solution is this (briefly):

  1. I fix the start BIOS address in Flash Descriptor, from an extracted or stock SPI, like before.
  2. I followed the plutomaniac's guide to clean DATA in my ME (which works better with real BIOS address). So I discovered my version through MEAnalyzer. I put the mentioned resulting SPI image in the program FITC.exe of ME System Tools and did the procedure using the same version of ME (instead of an update, which I tried but the boot was done in two times, so I went back to same version).
  3. Obtained a DATA-cleaned version of my ME/SPI and after a test of how good it was, I cleaned this through me_cleaner without any option, and flashed it (this time through fpt).

I found that fitc expanded the ME region to fit the empty spaces there were before.

The result is a less slow boot as before, fast BIOS savings, but slow reboot after these. Unique bad thing is I can't turn-off through switch button, that was useful in BIOS settings. So I long press button and after shutdown I switch off from PSU to prevent rebooting. I hope that this doesn't damage my board, right? Anyone knows why this thing happens and if there is a simple fix by little BIOS mod (as the ME is not operative in BIOS setting or after POST, I suppose)?

The switch-off button from BIOS settings maybe worked one time, I don't know on what depends. The switch-off button works well when I am in DOS/freeDOS instead, so that the PC turns off immediately in this case. There is something in power and reset buttons to fix in BIOS region, I think.

P.S. After DATA-cleaning I tried with me_cleaner to disable the bit and surprisingly it booted completely, but probably because the CMOS was not resetted, in fact after clear CMOS the BIOS didn't work as before.