No, changing all at once makes things worse, then we never know the cause of the issue. One edit at a time, that way we know what causes failure when it happens, like now, microcode update/FIT Table!
If I did all mods at once, there would be 4-5 edits and we would not know which caused the failure, now this way we know.

I will try again, but this BIOS was made with only a single microcode, so to add I have to edit and fix the FIT table no matter what, maybe that is wrong but I don't think so.
I will make new, without update 506E3, leave it same version it is now, and add 906E9+Fix FIT

Then if that fails, yes, maybe only way to test would be all edits at once, with only Kaby CPU microcode and test with that CPU.
But, before doing that all at once test, I would like to try vBIOS/GOP + ME with older CPU, that way we rule out vBIOS/GOP first, before again making final update change to the microcode/FIT

Will edit in new file test soon! You did verify after write correct? Write then verify all in one step?
OK, here, this has original 506E3 microcode + 906E9 & FIT correction (same as before, but with original 506E3 microcode left in place)
https://www.sendspace.com/file/i1r7lr

If that fails, then thee is some issue with the FIT change, but that has to be done, even if leaving only a single microcode I will have to fix location for the new 906E9 only microcode.
I guess we can test/confirm if FIT change breaks with single code but leaving 506E3 only in there, updated so I have to change it's location (With test first, before next to rule out updated microcode by itself fails), and then second file same single 506E3 microcde + blank entry for second microcode.

Hello

Sorry for late reply. I was absent all the day yestreday.
Today I used your new Bios file for my Dell and I got same problem as last Bios File. SAME ERROR.
Cannot Start at ALL.
When I put back your BIOS with only ME file modified it is working perfectly.
We are missing something I think.

Thank you
Salim

No problem, no hurry here it's OK
I'm sorry about this still same problem, seems there is some issue with the FIT table fix, or having a second microcode.
This shouldn't happen, let me look into this further and I'll let you know if I can find anything, maybe some pointer gets broken with the file size change and I'm missing it or something.
I'll let you know, if not we'll have to move forward like I mentioned and do the microcode last.

In the meantime, please test this BIOS, with only single 506E3 microcode, but updated version, this will confirm for me size change is causing some pointer or something somewhere to break.
OR!!! Maybe I need to use older UEFITool instead for this particular BIOS, sometimes newer version causes issue with some BIOS and old one does not, I'll make two of these BIOS so we can test that theory right now too.
Will update this post with new BIOS x2 to test.

Pre-post edit! OK, I think I see the issue now, which we may not be able to get around? I'll have to PM plutomaniac about this later if we find no matter what this is the issue (If 22.4 fails too, then I'll have to ask him if we can get around). Please test 25.1 first, then if it fails try 22.4
BootGuard is not active on this system, we've already confirmed via MEInfo, so I am not sure how this can cause a non-boot, but maybe we'll test and find only the 25.1 causes it, since it has an additional error that the 22.4 does not.
Both methods post edit have AMI protected range error, but only the 25.1 has the BG hash error too.


This did not happen previously with the ME only because ME is outside of the protected ranges. Hopefully one of these will work, possibly both if the non-boot is due to what I mentioned previously and nothing to do with these errors.
Please test both in order I mentioned so we can rule out or confirm the above, aside from this issue possibly.

Both of these have latest 506E3 microcode only, microcode size is 3KB larger, but no FIT table corrections or microcode overall file size changes made this time.
However, I think maybe the error is simply due to the ACM/BG errors caused in 25.1, we'll know more after you test both of these. Please check 25.1 first (I expect no boot), then the 22.4 (I hope will be OK), let me know outcome of each test, thanks!
https://www.sendspace.com/file/g9j9u5

HELLO MY FRIEND

I TESTED YOUR NEW BIOS.

FIRST 25.1 BIOS NOT WORKING AND GENERATIONG SAME ERROR AS BEFORE.
BIOS 24.2 SYSTEM IS BOOTING SHOWING DELL LOGO THEN A NEW MESSAGE IS COMMING ON SCREEN AFTER DELL LOGO.

HERE IS THE MESSAGE/

BOOT GUARD VERIFIED FAILED
SYSTEM WILL SHUTDOWN
PRESS ANY KEY

THANK YOU
SALIM

Thanks for testing, and report info! So we need to use 24.2 for now moving forward. I will PM plutomaniac and see if he can advise on this.




Bootguard is not active at the chipset level correct plutomaniac? Measured boot/verified boot not set, how can this be causing bootguard error if edited
Editing image previously, outside of yellow (ME region) edit was OK and bootable. This round was only microcode change, inside yellow and into cyan

This system is in Manufacturing Mode level.

I think if we commit it to normal mode we will find that Boot Guard is Enable.

Thx

Thanks plutomaniac! Maybe @CodeRush can advise deeper on the subject?

Do you think, since it is not committed at the PCH level, can I remove/disable in the BIOS before commit, or does not that matter at all now since OEM has put the hashes into BIOS level already?
Can these be zero'd, and then ACM/BG entry locations be removed from the FIT table? Would that possibly let us around the issue? Good thing here is he has flash programmer, so we can really test anything we want to try.


If we can't do the above, sounds like we cannot edit this BIOS then @simoutekd

Bootguard would need to be burned into the PCH at commit, I am not sure if that is something you/they manually set, and then once commit it takes place, or if we can avoid that at commit.
I guess, for this particular Dell model/sample, editing how you wanted it out, we'll have to move onto the other two models you mentioned instead.

Great, thank you for the detailed reply and info plutomaniac! So, as a test, I can remove whatever I want before he puts to commit state, within the ME settings first and then FIT table next, then we can test and see if fixes the error.
Which it should if editing and removing is that simple! And based on what you said, and since it's still in manufacturing mode, I think we can do this! We'll do a few rounds of testing, and then once we think we've got it sorted out I'll ask you to check it all out before he closes manufacturing mode.

@simoutekd - please make sure to leave this in manufacturing mode until we're 100% done and confirmed all our edits are working, and the removal of the ACM/BG stuff is all working OK. I will make you new BIOS tonight to get us started on this!

Yes Okay don't worry I will fellow all your instructions.

Also, before you order more of these Dell Systems, or the other Dell models you mentioned, see if you can ask the seller to send you only systems that are still in manufacturing mode.
That way we can always do this, otherwise if committed already and ACM/Bootguard is active then we wont be able to put the final mod BIOS on those systems.

All Dell desktops are in manufacturing mode.

Also All HP Eliteone 800G2 are in Manufacturing mode. Same like Dell

I think this is good for us because we can change what we want before we commit system and this is what I was telling you from the beginning.
This is a big chance for us that we got all those systems in uncommited mode and I think we just need to find a way how to disable security check before we commit them.

I think this link is good for you and can help.

https://embedi.com/blog/bypassing-intel-boot-guard/

Thank you
Salim

That's great for these Dell, but I think the HP we have a much bigger issue to solve with the Surestart stuff. I'm sure I can disable all the Dell Bootguard/ACM, we don't have to worry about that on the HP (at least that we've noticed).
Sorry I did not get new test BIOS made for Dell again yesterday, I will try to get that made for you tonight shortly

Thanks for link, I will read. I also planned to read all the Intel ME NDA PDF on how that is setup or not too, but I think without even reading I know and mentioned above how to easily remove and disable this.
However, after reading that link, if edits like that are required, which it seems those have been reported and fixed, making changes like that are above my skillset.
Hopefully changes like those are only needed if you're trying to work around an actively enabled machine already in committed state, which I assume that is what type of systems they were testing on.
So hopefully my intended method will work, at least for our situation.

@simoutekd - sorry for delay, here is initial 14x BIOS to test [smoking] https://www.sendspace.com/file/p9n7pk
Please test all 25 version first, in orders presented, hope you don't mind all this testing.
I'd appreciate if you could test those first, even though we think they might fail due to UEFITool 25 version giving different error than the 24, I'd like to know if this is actual "new" error or only due to newly detected stuff in 25.1 that 22.4 isn't noticing.
Then please test all 24 in orders presented. I'm hoping some of these work well before you get to 4-4 final BIOS, because at that point a new issue is presented, hopefully you don't even have to get into the V4 folders and V1-V3 from one of the 22/25 folders solves it all!

Hello
I think that file we are using for dell is already for commited system.
Why: because Service Tag is already registered on bios which mean system is committed. I don't know why.
I will send you picture for system when we power-On for first time and what we need to do.
Also I will send you MeInfo file before and after system committed. Like that you can see difference.
Also I will send you Bios file for system before it is commited and you will find that Service Tag number is not there. We can use the new file to make our MOD and tests.

Here is the Link for New Bios Backup of Dell system not committed yet and also MeInfo files before and after system is committed.

If you want me to update Bios to latest version from Dell then send you the final bios backup let me know it. Like that we can avoid that other update it after making changes.


https://fs03u.sendspace.com/upload?SPEED...TINATION_DIR=24


Sorry I don't know why this happen.

Thank you
Salim