Hello all,
First post…
Been lurking around here for quite a while reading, finally signed up. This site has an incredible amount of information, and knowledgeable people.

My problem, (self-inflicted) I was messing around trying to add nvme support, I got the board to the point of no post/video and 2 short beep codes (repeating). The board has a 3-pin bios header, (1-2 normal) (2-3 recovery). This board is acting exactly like it would if it had a jumper on 2-3, no matter which position it is on. In this state it is looking for a bootable CD (bios iso from Lenovo). This does work on other working units I have, but not this one.
Hardware:
Lenovo Bios update image is 4.5MB (4,612KB) AMI (APTIO 4?) *.cap format
Lenovo M92P SFF (small form factor)
Board: IS7XM, Q77 chipset
Chips: Winbond 25Q16BV (2MB), Winbond 25Q64CV (8MB)

Programmers: CH341A, black and green.
SOIC8 clip

The board I found has a ME_DIS jumper, which allows FPT -D to work on a functional board.
So with flashrom_windows:
I have a programmer dump of both chips on the messed up board (2MB, 8MB),
A programmer dump of both chips on a working board (2MB, 8MB),
A dump with FPT on a working board (10MB).

I bought a replacement motherboard (cheap on ebay) to fix my problem quickly. Now I want to figure out what I screwed up on this board.
I need some info on extraction of the GUID from the old board chip dumps, I have the old MAC/serial/model (Lenovo flash utility asks to update serial/model before each flash).

If someone could point me in the right direction, I would appreciate it.
If it aint broke, keep working on it until it is...

Thank you

Bob

@boooooob - Hey, glad you finally joined, welcome aboard! Also, very nice you have programmers in hand, hopefully you had those before the issue and didn't have to order after the issue and then wait out a long delivery

So, you want to know ho to find serial, UUID, model, MAC ID etc, in the BIOS, so you can transfer from one to the other (into a working dump, from a broken dump), correct?
Or do you just need to find this actual info in a broken dump, so you can then put in "before flash" using their software? I assume the previous, not this.

If yes, please upload a working dump and provide all it's details UUID, Serial, LAN MAC ID, and then upload a broken dump and it's details too. This way I can look at each, confirm data locations and then provide you with their locations.
EC FW (2MB) dumps are not needed, and I don't need all the other files either, only what I mentioned it's all I need to check and get this info for you.

In the interim, I would go ahead and copy one EC FW from working to non-working system, in case that's part of the current startup-up issue.

Hey Lost_N_BIOS,

Thank you for reply, will load the working 2MB dump, and see if it will bring any signs of life.

Bob

Hey Lost_N_BIOS,

I flashed the 2MB file, did not help, I thought what the hell, and flashed the 8MB file. The machine now posts/video, and I can get to bios settings. I know this is not right because it is an exact clone of my other board. But I can now access FPT dos from USB.
I got one of the cheap soic8 clips with ribbon cable, with one of my programmers, and I couldn't get it to ID chips anymore after I finished, found 2 wires broken inside the heat shrink where it is soldered to clip….This thing wouldn't stay clipped properly without holding it in place, (which is a huge PITA). I will get some Dupont jumpers and maybe a Pomona 5250 clip.
My question now, is the UUID (where is it derived from??) listed anywhere, in print on the case or motherboard, because I have no idea what the one on the messed up board is, unless it can be found in one of my dumps which were taken after I messed it up...
Also would the changes be able to be applied now with FPT, as it is much easier.

Thank you
Bob

Thank you

@boooooob - It's OK, now we know EC is not the main issue, and you've flashed in known working good copy, so once BIOS corrected it should be working.

Yes, writing in stock 8MB BIOS is not good, if that's what you meant. You can however copy working systems 8MB BIOS to the non-working system, but that wont help you recover it's serial, UUID, MAC etc, because you will overwrite all that with the working system BIOS once you program it in there.

I need dump from your working board, along with all it's details UUID, Serial, LAN MAC ID, in order to give you locations of all this.
UUID and serials may be inside the casing (usually inside the bottom/back case), or on bottom stickers etc. Also look between/under memory slots for a sticker too. Or, they may not be anywhere, what I mentioned there is just for laptops in general
Then you need to find all this sticker info for the other system too, unless you have a dumped BIOS from it?

For Serial, UUID run each these commands from CMD Prompt and either copy all to text or take screenshot
>> wmic baseboard get serialnumber
>> wmic bios get name,serialnumber,version
>> wmic csproduct get name,identifyingnumber,uuid

Then dump BIOS region via FPT since you broke your cable >> FPTw.exe -bios -d biosreg.bin
Also dump GbE, this will be where the LAN MAC ID is stored (usually at 0h and 1000h if in there twice) >> FPTw.exe -gbe -d gbe.bin

You'll need to use FPT from ME System Tools package V8, here in section "C"
Intel Management Engine: Drivers, Firmware & System Tools

As for correcting everything with FPT, I am not sure if you can or not, we'll have to see what error is given when you try to write back BIOS region via FPT
ME region, usually no go without programmer or several BIOS edits/flashes/dancing. This due to locked in FD, but since you programmed this in already we don't need to do anything to this region anyway, only GbE and BIOS region.

On those clips, if you remove all wires or at least the broken ones, there is 5-8mm or longer metal leg that comes out of the plastic, so where the cables ripped off, you can pull off the plastic sleeve if stuck there and solder on wire directly.
It looks like this with no wires attached

Hey Lost_N_BIOS,

Working Board

Machine type model: 3209A84
System brand id.: Thinkcentre M92p
System serial number: MJ637LA
System UUID: 35ECC93C-B741-11E2-818F-7888BDE192300
Mac: 44-37-E6-BE-5D-5C
Bios rev. level: 9SKT9BAUS
Boot block rev. level: 9S9BA
Bios date: 07/17/2018

Original non-working

Machine type model: 3209E4U
System brand id.: Thinkcentre M92p
System serial number: MJ15G9K
System UUID: I think it is only listed on original packing box label...don't have, doesn't exist.
Mac: FC-4D-D4-3B-50-18

DumpW = working board
DumpO = non-working original

Really only concerned with UUID and MAC, serial and type can be changed with Lenovo flash utility.
Note, it would not allow me to upload a .zip of my FPT dump (said somthing about 6MB)
My current time and date is 08:20A 3-18-2019...

Thank you

Bob

Hey Lost_N_BIOS,

Sorry forgot to add this, other info came from bios screen.

Microsoft Windows [Version 10.0.17763.348]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>wmic baseboard get serialnumber
SerialNumber



C:\WINDOWS\system32> wmic bios get name,serialnumber,version
Name SerialNumber Version
9SKT9BAUS MJ637LA LENOVO - 1620


C:\WINDOWS\system32> wmic csproduct get name,identifyingnumber,uuid
IdentifyingNumber Name UUID
MJ637LA 3209A84 35ECC93C-B741-11E2-818F-788BDE192300


Thank you

Bob

Thanks @boooooob I will check into this tonight for you. If you want you can upload any/all files in a single zip to any free file host and I can download from there. The attached file names seem odd, are you sure I can download and extract those?

Hey Lost_N_BIOS,

I just zipped my bin files and attached, I guess attaching the files renamed them different from displayed names, but it should unzip to a folder with my *.bin file inside, (I tried it)...
If it doesn't work for you , will try plan B. I am not in any hurry whatsoever. I am trying to learn something along the way.

Thank you

Bob

Hey Lost_N_BIOS,

Plan B just incase, has FPT dump also...

Dropbox link: https://www.dropbox.com/s/u70bq7kjuk00o3y/Dumps.zip?dl=0

Thank you

Bob

@boooooob - Thanks, I just grabbed it all at dropbox. The file names w/ 02 08 confused me in the attached files, until I saw it all again at dropbox, then I realized 2MB / 8MB duh

So, you need working BIOS, but info from non-working board swapped in, so you can then flash that to the non-working board to correct it's info, correct? Or, do you just need to know the info's locations and you can do all that yourself?
I have collected all info/locations, waiting to know for sure what you want to do.

All can be corrected with UEFITool and hex editor, then reflashed via FPT or by programmer. Since you have programmer, well once you get cable fixed, first thing you should do is reprogram any BIOS with FD unlocked and then all edits after that always redo the FD unlocked if using programmer.
That way, you can use FPT in windows/DOS without having to use programmer. There may be another lock that stops FPT, FPRR/PRR Protected Range Register, but FD is main one, other I would need to see FPT error first.
I have already made an edit DIF file for the lock I expect, so if you run into it I'll be ready to tell you where to edit/how to unlock. Or, I can just send you FD unlocked, FPRR unlocked 10MB BIOS (Or split if you want), then you can use that to further edit in the system details if you want.
This would need programmed in, then any subsequent edit would be able to be flashed in via FPT without error, and that would remain unlocked provided you always use this as a base BIOS to edit before flashing.

Or, you can simply edit the FD each time, and the two bytes needed to unlock the FPRR lock. When either of those in place (on board), then BIOS needs programmed in to get them unlocked, flashes after that can be done via FPT as described above (using unlocked BIOS as base, or apply edits to new BIOS)

Hey Lost_N_BIOS
My goal is to get my original board back to info from dumpO2.bin and dumpO8.bin.
I have UEFITool and HxD ( I have noticed it complains about "parse: invalid data checksum 5Ah, should be AAh" in UEFITool with any file from these machines, even when I open the bios file download from Lenovo.
I mentioned before I have a ME_DIS jumper which allows a full FPT dump of chips, would this also allow writes to chips..??
What info is stored in the 2MB chips as they are not the same when compaired..?
I need a little info at a time, I know I can read/write files, I want to learn about the files themselves...

Again thank you for all your help.

Bob

You can ignore the checksum error, since it's present in stock BIOS, or you can click rebuild on that GUID (Double click to get there) and UEFITool will fix the checksum. Jumper would likely allow full rewrite via FPT.
The BIOS as a whole is split onto the 8MB-2MB chips, 2MB chip contains the a padding file (unsure contents right now) and last three BIOS volumes, 8MB BIOS contains the FD, ME, GbE, NVRAM volume and the main BIOS region volume from within the BIOS region (first two volumes inside FPT dumped BIOS region)
I can show you that with images if it would better explain, but I'll have to do it later tonight I don't have time right now. I checked, and it's just a direct split from the FPT dump (8MB = first 800000h and 2MB = remaining 200000h)

Hey Lost_N_BIOS,

I believe the MAC is at 00001000 & 00002000 in the 8MB dumps, what is the trick for finding the UUID location...

Thank you

Bob

@boooooob - I already said in post #11, I have all data/locations for you, but wasn't sure what you wanted me to do, give you the info or do it myself?

Here's all the info locations, sorry about that, I assumed you were not wasting your time still digging around or I would have posted this yesterday

This is info from Working system dump >>

Machine type model: 3209A84 >> 33323039413834 (Hex)
System brand id.: Thinkcentre M92p
System serial number: MJ637LA >> 4D4A3633374C41 (Hex)
System UUID: 35ECC93C-B741-11E2-818F-7888BDE192300 >> "In-BIOS" format - 3CC9EC3541B7E211818F788BDE192300 (windows pulled info has one extra digit (8 near end), unsure why, maybe normal?)
Mac: 44-37-E6-BE-5D-5C >> 4437E6BE5D5C

---------------------

Finds/locations -
SMBIOSFlashData >> RAW - FD44820B-F1AB-41C0-AE4E-0C55556EB9BD
Contains Model, Serial x2, UUID <<< All this also in ME region @21780-21AD0

GbE region >> MAC @ 0h + 1000h + at ME x10
These x10 at ME may self-correct, after you replace in GbE region - and GbE region is all that's needed to mac MAC function)
1 0x00027243 0x6 (6)
2 0x000300b6 0x6 (6)
3 0x00030ea6 0x6 (6)
4 0x00032d23 0x6 (6)
5 0x00035a53 0x6 (6)
6 0x00039d73 0x6 (6)
7 0x0003d996 0x6 (6)
8 0x00048303 0x6 (6)
9 0x0004e9c6 0x6 (6)
10 0x0007d986 0x6 (6)

Extract GbE region with UEFITool, edit both locations in hex editor, save as fixedgbe.bin. Then you can replace this back into BIOS via UEFITool, or flash directly with FPT >> FPTw.exe -gbe -f fixedgbe.bin

For the UUID, open BIOS in UEFITool, search, enter GUID I gave above, expand to RAW, extract the RAW file, edit via hex at the locations above

For the non-working machine, you'll find the SMBIOSFlashData module by opening the Dump02 file in UEFITool. For the non-working MAC ID, drop Dump08 in hexeditor and go to 1000h to get MAC ID (also at 2000h, but of course same)
If you want to work on the non-working BIOS as a whole in UEFITool for some reason, append 02 to end of 08 in hex editor (Copy 02 entirely, paste directly at end of 08, save)

Non-Working Info >>
MAC: FC 4D D4 3B 50 18
Model - 3209E4U
Serial - MJ15G9K
UUID - (in BIOS format, windows/software will pull this in different format, but it goes into BIOS this way) >> 883E5C25B6E0E2118E1EA86A3AD52700