Is there a possibility that replace the Bios Region with other C612 board?
I found the supermicro have the two cpus board...But it's bios region is 12M larger than 8M.
zip it to 8M or change the desp to use the entire 16M chip
which it easy?

There is several ways to remove microcode generally, for that kind of mod. Remove only microcode itself, or remove the entire microcode module, or remove only the microcode entries and leave the header of the module, which are you doing?
And, what tool are you using to do the actual edit? To fix checksum you mentioned is easy, but if you remove microcode there would not be any checksum shown by UEFITool 57, since that long microcode checksum like you showed above is part of the actual microcode.
In this BIOS, microcodes (x2) are located in 8C8CE578-8A3D-4F1C-9935-896185C32DD3 >> 197DB236-F856-4924-90F8-CDF12FB875F3 as you mentioned, there is two of these volumes in the BIOS so you need to edit both same/same

And yes, FIT always needs corrected after you edit microcodes for sure, and often any other BIOS edit too. FIT was broken by default in this BIOS, and incorrectly setup too if the offsets were even correct to begin with (which they are not)
FIT needs entry count increased to 2 microcodes by default not one, and then correct microcode offsets added. If you are removing microcodes, then you need to decrease total entry count by one (so remove original single microcode entry value)
And then fix offsets of all other items in the FIT table via straight hex edit on entire BIOS as a whole.

So you want BIOS with 306F2 removed and FIT fixed? If yes, I can make for you from the dump you sent me. Don't use UEFITool 28, it breaks this BIOS, and removes padding at PEI volumes on rebuild

Sorry, didn't see your other reply until I posted the above. No, you can't replace BIOS region from one board to another, too many things differ between boards for stuff like that usually (rare occasions maybe)

* Edit @carson512 - here is BIOS including mods I already did for you + 306F2 removed and FIT table fixed for microcode entry (so you will see fixed entry for microcode now, but only 406F1 is there)
Additionally included is BIOS with fixed FIT table on BIOS that includes both original microcodes, so you can see how FIT Table should have been initially from HP
http://s000.tinyupload.com/index.php?fil...215321482320073

here is the test result:
MRBSUTestUEFI25306F2REMFITFix.bin can't boot with tha same error that i remove the microcode...
SYSTEM-25Q128FVSGMRBSUTest-FITFixed.bin can boot normal.Check the debug log with the backup bios.Look like the same.


here is the end part of debug log with first one MRBSUTestUEFI25306F2REMFITFix.bin

Zitat

---

Loading PEIM at 0x000FFFBDC40 EntryPoint=0x000FFFBF870 HpSecPhaseErrorReportingPei.efi
PROGRESS CODE: V03020002 I0
HpNvramRead PPI distributor
275-Unsupported Processor Detected - Processor stepping not supported.
Action: If available, update the System ROM to a version supporting this
stepping through iLO's out-of-band FW update interface.
- System Halted!

ERROR: C80000002:V801000A1 I0 85CC8B8F-F2B6-11E1-B12E-3C4A92B21913 FE1FF3E0
CricSend
HpNvramRead PPI distributor
HpNvramWrite PPI distributor
CricSend: GPO handshake set. Waiting for iLO FW
CricSend: iLO FW cleared the GPO handshake. Success!

---

here is the normal boot log near

Zitat

---

Loading PEIM at 0x000FFFBDC40 EntryPoint=0x000FFFBF870 HpSecPhaseErrorReportingPei.efi
PROGRESS CODE: V03020002 I0
HpNvramRead PPI distributor
PROGRESS CODE: V03020003 I0
Evaluate PEI DEPEX for FFS(01359D99-9446-456D-ADA4-50A711C03ADA)
RESULT = TRUE (Apriori)
Loading PEIM at 0x000FFF79820 EntryPoint=0x000FFF7A460 CpuPei.efi
PROGRESS CODE: V03020002 I0
Install PPI: C153205A-E898-4C24-8689-A4B4BCC5C8A2
Register PPI Notify: 7408D748-FC8C-4EE6-9288-C4BEC092A410
PROGRESS CODE: V03020003 I0
Evaluate PEI DEPEX for FFS(4F1F379F-2A62-48BB-AC34-D3F135C6E2B7)
RESULT = TRUE (Apriori)
Loading PEIM at 0x000FFF670A0 EntryPoint=0x000FFF67AA8 PcatSingleSegmentPciCfg2Pei.efi
PROGRESS CODE: V03020002 I0
Install PPI: 057A449A-1FDC-4C06-BFC9-F53F6A99BB92
PROGRESS CODE: V03020003 I0
Evaluate PEI DEPEX for FFS(1988A1D8-04FC-4D68-B58D-636F36F30D82)
RESULT = TRUE (Apriori)
Loading PEIM at 0x000FFF402A0 EntryPoint=0x000FFF40E3C SoftStrapsPeim.efi
PROGRESS CODE: V03020002 I0
Install PPI: 7F19E716-419C-4E79-8E37-C2BD84EB6528
Flash Map PEIM Loaded
PROGRESS CODE: V03020003 I0
Evaluate PEI DEPEX for FFS(34CC6167-7AE7-403E-8AB2-23837F398A30)
RESULT = TRUE (Apriori)
Loading PEIM at 0x000FFF77780 EntryPoint=0x000FFF782A0 PlatformInfo.efi
PROGRESS CODE: V03020002 I0
:: CPU Type Socket ModelId# 3F
:: CPU stepping # 2
Install PPI: 1E2ACC41-E26A-483D-AFC7-A056C34E087B
PROGRESS CODE: V03020003 I0
Evaluate PEI DEPEX for FFS(B1F7AF2F-2807-478C-A893-2BF4DDD1F62B)
RESULT = TRUE (Apriori)
Loading PEIM at 0x000FFF7C1C0 EntryPoint=0x000FFF7D210 PeiVariableAuth.efi
PROGRESS CODE: V03020002 I0
PeimInitializeVariableServices
Install PPI: 2AB86EF5-ECB5-4134-B556-3854CA1FE1B4
PROGRESS CODE: V03020003 I0

---

that may the key is ‘Loading PEIM at 0x000FFFBDC40 EntryPoint=0x000FFFBF870 HpSecPhaseErrorReportingPei.efi’
and try to use IDA with this efi file

change that ‘jz’ to ‘jnz’
than make other error.
Maybe the HpSecPhaseErrorReportingPei just a error handler module? The code 275 was pass to the HpSecPhaseErrorReportingPei?

@carson512 - SYSTEM-25Q128FVSGMRBSUTest-FITFixed.bin is same BIOS I sent you already at post #12, but with FIT Fixed for both microcodes, so you can see how it should look in UEFITool NE
Other BIOS = fail, this means your system cannot boot without microcode for the CPU, not all can and this must be one of those. Does the board have a service or management jumper? If yes, try that BIOS again with jumper in place and see if that matters or not.

Not sure on the assembly, if that would help or not I mean, if you want to bypass all that, I'd change that JZ to JMP >> hex >> 74 37 >> EB 37, so flow them becomes as you see below


There is two modules "HpSecPhaseErrorReportingPei", Edit both and make the edit via direct hex editing on entire BIOS as a whole, that way PEI volume does not get rebased.
Check post-edit file in UEFITool NE and make sure you don't then need to correct checksum for those two modules, if so re-edit via direct hex on BIOS as a whole.

there is a System maintenance switch On board. I try MRBSUTestUEFI25306F2REMFITFix.bin with change Reserved SW(S3,S4,S8,S9,S10,S11,S12) to ON.Nothing changed...still show the ‘unsupported' error.
in the debug log :
S3、S4、S12 add one log 'Maintenance Switch** is set.'
S4 may change the debug log level. add some like 'Loading PEIM at 0x000FFF97FC0 EntryPoint=0x000FFF98B78 HpStatusCodeHandlerPei.efi ' in the log
at this phase can't find nothing different.

there is 4 jumpers with pins. two of them is the COM pin(RX TX GND VCD),One is NMI functionality jumper(An NMI crash dump creates a crash dump log before resetting a system which is not responding.).One is just 3 pins near ME rom One GND and two 3.3V,and not mention in the guide.

with the debug log is loaded 13 modules before the unsupported error

Zitat

---

Loading PEIM at 0x000FFF97FC0 EntryPoint=0x000FFF98B78 HpStatusCodeHandlerPei.efi
Loading PEIM at 0x000FFF5B560 EntryPoint=0x000FFF5C518 PcdPeim.efi
Loading PEIM at 0x000FFFC65A0 EntryPoint=0x000FFFC74A8 HpOemPei.efi
Loading PEIM at 0x000FFFCA8E0 EntryPoint=0x000FFFD3A1C PlatformTopologyPei.efi
Loading PEIM at 0x000FFF80820 EntryPoint=0x000FFF814EC PciDeviceTablePeim.efi
Loading PEIM at 0x000FFF7ED80 EntryPoint=0x000FFF7F7B0 PeiSio.efi
Loading PEIM at 0x000FFF846A0 EntryPoint=0x000FFF897A0 GromitInitPeim.efi
Loading PEIM at 0x000FFF82960 EntryPoint=0x000FFF83450 RiserConfigPeim.efi
Loading PEIM at 0x000FFF99FE0 EntryPoint=0x000FFF9AB20 HpPostCodeWorkerPei.efi
Loading PEIM at 0x000FFF9BEC0 EntryPoint=0x000FFF9DB90 EVideoEventWorkerPei.efi
Loading PEIM at 0x000FFFA0680 EntryPoint=0x000FFFA1E90 LogIMlEventPei.efi
Loading PEIM at 0x000FFFA5380 EntryPoint=0x000FFFB1FE0 ImlEventWorkerPei.efi
Loading PEIM at 0x000FFFBD5C0 EntryPoint=0x000FFFBF1F0 HpSecPhaseErrorReportingPei.efi

---

The microcode check must in this module.
Is that possible use IDA to chek which module call the HpSecPhaseErrorReportingPei.efi to show the unsupported error or just HpSecPhaseErrorReportingPei.efi itself.


use winhex to edit the bios file directly 74 >> EB
the system boot without the ‘unsupported' error and continue the progress.
until the red screen show 'PiSmmCore+00BA8Eh RIP address out of range' error same as jnz or remove the HpSecPhaseErrorReportingPei module.
but i realize that jmp is much better than jnz when the cpu change ..
The PiSmmCore is the modulethat load all SMM module?
And searching the rom just PiSmmCpuDxeSmm module with the 'RIP address out of range' string and a SMM module.

here is the part debug log with ‘EB’bios

Zitat

---

PcdCpuSmmMsrSaveStateEnable = 0
PcdCpuSmmProtectedModeEnable = 0
PcdCpuSmmUseDelayIndication = 0
PcdCpuSmmUseBlockIndication = 0
PcdCpuSmmUseSmmEnableIndication = 0
SmmInitiFeatures: CPU 1
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 2
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 3
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 4
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 5
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 6
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 7
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 8
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 9
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU A
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU B
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU C
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU D
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU E
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU F
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 10
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 11
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 12
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 13
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 14
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 15
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 16
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 17
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 0
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
InitializeHpMpSyncData
InstallProtocolInterface: 26EEB3DE-B689-492E-80F0-BE8BD7DA4BA7 7FA84518
SmmIplSmmConfigurationEventNotify: gEfiSmmConfigurationProtocolGuid found
SMM IPL registered SMM Entry Point address 7FBF6098
SmmInstallProtocolInterface: EB346B97-975F-4A9F-8B22-F8E92BB3D569 7FA84480
SmmInstallProtocolInterface: D5950985-8BE3-4B1C-B63F-95D15AB3B65F 7FA843F0
SmmInstallProtocolInterface: 9DB72E22-9262-4A18-8FE0-85E03DFA9673 7FA84408
SmmInstallProtocolInterface: 1D202CAB-C8AB-4D5C-94F7-3CFCC0D3D335 7FA84710
SMM S3 SMRAM Structure = 76CA6BB0
SMM S3 Structure = 7C000F92
SMM CPU Module exit from SMRAM with EFI_SUCCESS
SMM IPL closed SMRAM window

X64 Exception Type 0D - General Protection Exception

RCX=0000000000000058 DX=0000000000000000 R8=0000000000000001 R9=000000007FA8450F
RSP=000000007F78ECD8 BP=0000000000000017 AX=0000000000000001 BX=000000007FA844E8
R10=0000000000000001 11=000000006B542C20 12=000000006B544A70 13=0000000000000044
R14=0000000000000000 15=000000000000FFFF SI=0000000000000000 DI=0000000000000000
CR2=0000000000000000 CR3=000000007F761000 CR0=80000033 CR4=00000668 CR8=00000000
CS=0038 DS=0020 SS=0020 ES=0020 RFLAGS=00010046 MSR1D9=0001 345=32C4 1C9=000D

LBRs From To From To From To From To
01h 790E1A25->790E18F7 790E19F2->790E1A15 790E18F2->790E19E0 790E1988->790E18EB
05h 790E195C->790E197F 790E18E6->790E1950 790E14F0->790E18CC 790E1722->790E14E4
09h 790E1A25->790E171B 790E19F2->790E1A15 790E1716->790E19E0 790E1988->790E170F
0Dh 790E195C->790E197F 790E170A->790E1950 790E1A25->790E16FD 790E18FF->790E1A28

CALL ImageBase ImageName+Offset
00h 000000007FBF3000 PiSmmCore+00BA8Eh
RIP address out of range

---

here is the part debug log with normal bios

Zitat

---

PcdCpuSmmMsrSaveStateEnable = 0
PcdCpuSmmProtectedModeEnable = 0
PcdCpuSmmUseDelayIndication = 0
PcdCpuSmmUseBlockIndication = 0
PcdCpuSmmUseSmmEnableIndication = 0
SmmInitiFeatures: CPU 1
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 2
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 3
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 4
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 5
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 6
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 7
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 8
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 9
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU A
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU B
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU C
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU D
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU E
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU F
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 10
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 11
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 12
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 13
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 14
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 15
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 16
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 17
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
SmmInitiFeatures: CPU 0
SmmInitiFeatures: Haswell family CPU
SmmInitiFeatures: SMRR supported
InitializeHpMpSyncData
InstallProtocolInterface: 26EEB3DE-B689-492E-80F0-BE8BD7DA4BA7 7FA84518
SmmIplSmmConfigurationEventNotify: gEfiSmmConfigurationProtocolGuid found
SMM IPL registered SMM Entry Point address 7FBF6098
SmmInstallProtocolInterface: EB346B97-975F-4A9F-8B22-F8E92BB3D569 7FA84480
SmmInstallProtocolInterface: D5950985-8BE3-4B1C-B63F-95D15AB3B65F 7FA843F0
SmmInstallProtocolInterface: 9DB72E22-9262-4A18-8FE0-85E03DFA9673 7FA84408
SmmInstallProtocolInterface: 1D202CAB-C8AB-4D5C-94F7-3CFCC0D3D335 7FA84710
SMM S3 SMRAM Structure = 76CA6BB0
SMM S3 Structure = 7C000F92
SMM CPU Module exit from SMRAM with EFI_SUCCESS
SMM IPL closed SMRAM window
Evaluate SMM DEPEX for FFS(EF827D89-960E-485B-9D0F-2850E6CB2BB0)
PUSH GUID(F4CCBFB7-F6E0-47FD-9DD4-10A8F150C191) = TRUE
PUSH GUID(456D2859-A84B-4E47-A2EE-3276D886997D) = FALSE
PUSH GUID(2FF29FA7-5E80-4ED9-B380-017D3C554FF4) = TRUE
PUSH GUID(13A3F0F6-264A-3EF0-F2E0-DEC512342F34) = TRUE
PUSH GUID(6AFD2B77-98C1-4ACD-A6F9-8A9439DE0FB1) = TRUE
PUSH GUID(C2702B74-800C-4131-8746-8FB5B89CE4AC) = TRUE
AND
AND
AND
AND
AND
END
RESULT = FALSE
Evaluate SMM DEPEX for FFS(B398EA1B-2CFA-43B4-BE88-8B063348FAA4)
PUSH GUID(FB71B8EE-7486-11E2-B770-10604B6831C2) = FALSE
PUSH GUID(13A3F0F6-264A-3EF0-F2E0-DEC512342F34) = TRUE
PUSH GUID(6AFD2B77-98C1-4ACD-A6F9-8A9439DE0FB1) = TRUE
PUSH GUID(F4CCBFB7-F6E0-47FD-9DD4-10A8F150C191) = TRUE
PUSH GUID(C2702B74-800C-4131-8746-8FB5B89CE4AC) = TRUE
AND
AND
AND
AND
END
RESULT = FALSE
Evaluate SMM DEPEX for FFS(F3B38282-B951-4E2A-8DF5-DE01FC527AE4)
PUSH GUID(F4CCBFB7-F6E0-47FD-9DD4-10A8F150C191) = TRUE
PUSH GUID(456D2859-A84B-4E47-A2EE-3276D886997D) = FALSE
PUSH GUID(4B0165A9-61D6-4E23-A0B5-3EC79C2E30D5) = TRUE
PUSH GUID(13A3F0F6-264A-3EF0-F2E0-DEC512342F34) = TRUE
PUSH GUID(C2702B74-800C-4131-8746-8FB5B89CE4AC) = TRUE
AND
AND
AND
AND
END
RESULT = FALSE

---

before 'SMM IPL closed SMRAM window' this line. the log seem the same.
in normal boot next progress is to load the EF827D89-960E-485B-9D0F-2850E6CB2BB0 which is HpstatusCodeHandlerSmm
is that possible that the HpStatusCodeHandlerPei call the HpSecPhaseErrorReportingPei than HpstatusCodeHandlerSmm couse the RIP address out of range error.
All log in the zip file below.


by the way.i just think the two bios region was stand alone. Beacuse just change the firest 8M bios part will effect.Unless in the bios menu to change the backup rom...Maybe the FIT will looks good after cut.

Maybe test that jumper and see on/off what happens, or is it maybe ME FW disable etc?

Sorry, I can't help with the logs or assembly, I know very little in this area. Maybe @Mov AX, 0xDEAD or @CodeRush could advise here, I think maybe they are only ones I know that knows this much about assembly/BIOS
Yes, sorry, I forgot only one part of the BIOS applies to your system, so only one needs edited
No, I checked, remember, you sent me partial/split BIOS, FIT is broken still there too.

test all three pins.With jumper one 2 pins the system can boot like press the power button...

i will try to update the bios from hpe web and compare the bios later.make sure the FIT is broken or hp's doing....

I just found in UEFItool File GUID: AAE07B90-4CF8-5986-AD2A-48B72CAB98A8.
there is a pad-file.What this file use for? I saw "Header checksum: E8h, valid Data checksum: AAh, valid".When i change the ‘jz’ to ‘jmp’ this checksum don't change. is that possible the error couse by the checksum?

AAE07B90-4CF8-5986-AD2A-48B72CAB98A8 should not be edited using tools, due to being in PEI Volume, only direct hex edited changes on the entire BIOS as a whole.
I did the edit with tools, and SH + Rebuild those modules, to check about the checksum for you, and that does not change on rebuilds, so that is normal/expected and would not be the cause of any error here.

About the jumper, I don't understand what you mean? position 1-2, what happens, position 2-3, same? Boot to windows or BIOS with either, and see if ME FW disabled, and test if you can dump FD with FPT and write it back or not (FPTw.exe -desc -d fd.bin >> FPTw.exe -desc -f fd.bin)
Also, I meant to test these with the mod BIOS I sent you (With microcode removed), once you find which one boots OK, or both etc.

the jumper thing.position 1-2 just like the power on pin funtion the system boot up.position 2-3 press the power button nothing change cpu fan even not run.Nothing about the ME.
Than i use this tool https://github.com/corna/me_cleaner close ME.than use MRBSUTestUEFI25306F2REMFITFix.bin and jmp one still can't boot with unsupported error or RIP error.
how to check the ME funtion been closed or not.

I try to clear the cmos and nvram than reflash the webdownloaded bios.The same with the backup one "SYSTEM-25Q128FVSG.bin".So the FIT error maybe the hp's problem.


Than I found the S3 S4 was the debug log funtion switch.
With S12 is shows

Zitat

---

281-IMPORTANT: SW12 is ON indicating physical presence. This switch should only
be ON to override certain security protections.
Action: Power down the server and put SW12 OFF if physical presence is not
required.

---

On screen and debug log.
But when SW12 os ON with the microcode removed bios MRBSUTestUEFI25306F2REMFITFix.bin can't boot either.still the unsupported error.

-----------------------------

Was this bios a EDK2 base UEFI ROM?

@carson512 - ME Cleaner should not be used here, please PROGRAM back some non ME Cleaner edited BIOS.
Yes, FIT error can be HP issue, some manufacturers do not care/pay attention etc.

S12 - "Certain Security Protections" that is what we want to override to use FPT I bet But you have programmer, so none of that matters really.

EDK2, I have no idea what that is or if this is that, sorry.

Best to maybe just used known supported CPU, at stock unedited specs? Unless DeathBringer has time and can help on this one

@DeathBringer - Can you help here, BIOS need to modify is SYSTEM-25Q128FVSG.bin in post #4, or last link on post #12 for menu edited BIOS we've been using
Need to make Max Turbo edit, and or make BIOS bootable for 306F2 microcode removed (or is this system not one that can boot with no microcode?)

Unlocking mods aren't interesting to me.

ok i will program back the ME bios.
there is a GUID: 1BA0062E-C779-4582-8566-336AE8F78F09 which subtype was 'SEC core' in UEFITOOL.
with the error moudle HpSecPhaseErrorReportingPei name. maybe the SEC part find a error and show by the moudle.
So use IDA to check the SEC core PE32 img.

there is a cpuid check.
change the jnz 75 to jz 74
but can't boot with blackscreen....
any idea...
--------------------

still thanks for you help.

@carson512 - Are you wanting to -
1. Make it avoid >> manufacture's diagnostic checkpoint (POST code) and end up at >> movd esi, mm3
OR
2. Make it definitely go to >> manufacture's diagnostic checkpoint (POST code)

If #1 is goal >>
At loc_FFFFEBDC >> Change JNZ >> 75 15 >> Change to >> 75 00
At loc_FFFFEBE8 >> Change JNZ >> 75 0D >> Change to >> 75 00
At loc_FFFFEBF0 >> Change JNZ >> 75 05 >> Change to >> 75 00

IF #2 is goal >>
At loc_FFFFEBDC >> Change JNZ to JMP >> 75 15 >> Change to EB 15

change as #1 goal way.
But still unsupport....maybe not the funtion we want

I check all the SecCore
there is 8 times 'cpuid' usage:

Zitat

---

Address Function Instruction
1-.text:FFFF9AE7 sub_FFFF9AD8 cpuid
2-.text:FFFF9BAC sub_FFFF9BA5 cpuid
3-STARTUP_:FFFFEBDE sub_FFFFEA38 cpuid
4-STARTUP_:FFFFEC08 cpuid
5-STARTUP_:FFFFEFC3 sub_FFFFEA38 cpuid
6-STARTUP_:FFFFF797 cpuid
7-STARTUP_:FFFFF7B0 cpuid
8-STARTUP_:FFFFF7BF cpuid

---

with the 'cpuid' info https://en.wikipedia.org/wiki/CPUID the key is eax value.
when eax=1 use 'cpuid' will return Processor Version Information in eax with 'Family ID' 'Stepping ID'an etc...
in those place
1.eax,1
2.eax,[ebp+arg_0] (can't understand what "[ebp+arg_0]" for. )
3.eax,eax (maybe eax is '0' with IDA F5 key in loc_FFFFEA38,also the last time changed zone,and than check the ebx,ecx,edx with 1970169159,1818588270,1231384169,what this str mean.... ))
4.eax,1
5.eax,1
6.eax,1
7.eax,0
8.eax,0Bh(with the wiki maybe the Intel thread/core and cache topology)


so the key may in 1,4,5,6 and 2....

Sorry, I can't help or understand any of the above, I know very little assembly

Maybe @dsanke can help - BIOS need to modify is SYSTEM-25Q128FVSG.bin in post #4, or last link on post #12 for menu edited BIOS we've been using
Need to make Max Turbo edit, and or make BIOS bootable for 306F2 microcode removed (or is this system not one that can boot with no microcode?)