@boombastik

See the mCodeFIT version, it should be 0.2.5, аlso use the UBU version 1.69.15. These versions show the actual position of the microcodes.
Use UEFITool NE for additional verification _FIT_

Hello

To update the microcode (UBU 1.70)
What is the difference between option C and M ?
What is the best ?



Thanks

Zitat von tistou77 im Beitrag #3662

---

To update the microcode (UBU 1.70)
What is the difference between option C and M ?

---

@SoniX Thank you for your excellent work on this tool. May I request that you include updates for the SATA / RAIDDRIVERS to the ones that Fernando found to be the best? For example:

Recommended for Intel X99 systems, usable with all Windows Operating Systems from Win7 (32/64bit) up.
Best matching Intel RAID ROM resp. EFI "RaidDriver" BIOS modules: v14.8.2.2397

According to my benchmark tests (look >here<) these drivers are the best choice for Intel 100-/200-Series Chipset systems running Win10 on a RAID0 array. They are usable with all Windows Operating Systems from Win7 (32/64bit) up.
Best matching Intel RAID ROM/EFI "RaidDriver": v15.5.1.3017

These RaidDrivers aren't options in your tool currently.

If I want to recover the microcode 2B, I used the bios 1004 (Rampage VI Extreme) which contains it, extract the microcode, to integrate it in UBU 1.70
The CPUID is the same, but not the "plateform", is it good ?

cpu50654_plat97_ver0200002B_2017-08-09_PRD_5FFAAE55
cpu50654_platB7_ver02000043_2018-01-26_PRD_4840163E

Thanks

Hi, I have already used UBU, back in the 1.49 version and it worked just fine.

Today I decided to try and run it on my MSI GT72 BIOS, and I ended with a 6MB file when I started with a 3MB one.
Downloaded the latest UBU and crutch from the .ru site, extract it, Windows complains about it having this trojans and virustotal also reports 6 hits...
I know that given that its oROM's and what not maybe its false positives, but the old 1.49 didn't had this..

So, now using the 1.69 version I get this when I try to update any oROM:
The MMTool window shows this:
Saving secure rom as unsigned
And then the UBU:
* Generate FFS Intel RAID Driver GUID 91B4D9C1-141C-4824-8D02-3C298E36EB3F ...Ok!
* Update EFI Intel RAID Driver GUID 91B4D9C1-141C-4824-8D02-3C298E36EB3F ...Error!
* Update OROM Intel RST Device ID 282a ...Error!

But if I run the scan again it reports that it updated the oROM, given that this all smells fishy I wont try to flash this resulting bios file.

Any ideas what can be causing this?

Latest microcode revision guidance February 26 2018 released!

https://newsroom.intel.com/wp-content/up...te-guidance.pdf

Zitat von boktai1000 im Beitrag #3641

---

MCE.exe is detected as Trojan:Win32/Tiggre!plock by Windows Defender after extracting both UBU_v1_69_15.7z and UBU_v1_70_a12_Dev.rar.

---

@Fernando:
As of right now - per the Microsoft re-submission this is the status

mce.exe
Submission ID: 77196593-f714-461d-918b-3bf8293c16e8
Status: In progress
Submitted by: Anonymous
Submitted: Feb 28, 2018 12:00:07 PM

Thank you! For the Microsoft re-analysis it's currently in progress, and status can be checked at the submission link in my post above. I don't know how long it takes them to evaluate or re-test though, or what the process looks and consists of on their end.

Regarding not happening to you though with Defender, I can confirm that it did indeed happen to me again as of the writing of my post a couple hours ago on Win10 v1709 with latest Defender Definitions.

EDIT by Fernando: Unneeded fully quoted post replaced by directly addressing to the author (to save space within this already very voluminous thread)

Latest version of 1.69.15 checks out clean with Eset Antivirus on my end.

I downloaded from the supposed dev link that ends in .ru and it gets more hits than the ones form Mega.

Besides this, it might be false positives, I'm not pointing fingers, at all!

Any ideas why its dying trying to patch an Aptio 4 BIOS?

Today I extracted "UBU_v1.69.15.1_without-MMTool.rar" and the Windows Defender doesn't detect anymore the "Trojan:Win32/Tiggre!plock".
"UBU_v1.69.14-fixed_without-MMTool.rar" is also not detected anymore.

I have virus definition v1.261.1717.0 updated 19h09 pm (europe time) on a Windows 7 x64 bit, which was not the case yesterday and before yesterday and was still detecting the trojan in MCE.exe at extraction with 7-Zip.

Not sure if it's still safe to use for flashing bios, i suggest to wait some more feedbacks if you're not in a hurry.

The status and final determination on the Microsoft Analysis is still "Pending / In progress" at least as far as their link goes, so any results you see right now from it I would say are inconclusive until this finishes. Resubmitting for analysis may do something to the definition, I have no clue - but I do know that it's being re-evaluated, and still is. Hybrid Analysis flags it as "Malware" as well, which my expectations of a false positive would be "Suspicious" since some of the behavior may be interpreted as such with modifying and inject microcode into a BIOS file. The Hybrid Analysis website also gives some details on how the executable works with python files, sqlite databases, etc and how it executable itself runs and processes these changes, the behavior and coding of such is heuristically similar to that of malware. Anyways as I mentioned, I would wait to see what Microsoft comes back with in regards to their re-evaluation at least. In addition to this, I am trying to familiarize myself a bit with what has been going on with the UBU tool and it sounds like part of it or maybe the entire thing was due for a rewrite because of the MMTool module, I am wondering if this portion (MCE) is another thing that would be modified as well. I don't know if this is a reasonable ask, but I can see the benefits of open source code review being beneficial for a project like this, but with dealing with proprietary tools and what not currently I'm sure that makes it difficult.