Lets enable overclocking on all 6 and 7 series laptops

[blowntaha]

Here it is unlocked.

blowntahaOC

How do I flash under EFI using the fpt.efi? Would that maybe make a difference? Btw, renamed BlowntahaOc -> ocme in case you're wondering if I flashed the correct image; I just tried again in Windows as well with no success. I think there might be a setting in the FW image that makes or breaks my flash because sometimes I am able to flash and other times I am not able. Do you think you could upload the full image for me to try? Or could it be that my 3920XM version is somehow interfering?

[Khenglish]

Here's the full image:

blowntahaOC

[Klem]

As we can see, now in your bios, in descriptor region, access to ME region is locked. No read, no write. Now you have only two way, one flash mod bios with programmer device, other one flash mod bios with pinmode on audio chip.

[blowntaha]

EDIT:

As we can see, now in your bios, in descriptor region, access to ME region is locked. No read, no write. Now you have only two way, one flash mod bios with programmer device, other one flash mod bios with pinmode on audio chip.

So, you're saying I can't do what this guide does? The brief tldr; version, he finds ME bios in hex editor (which has main bios open) highlights the ME FW portion and saves it as dump.bin. Opens it FITC, mods it, open in hex, copy and pastes over old. I actually did all of this and have it ready to flash, only I wanted to come here first and make sure I'm not missing something that I shouldn't do this. Problem is when I copy and paste ME from bios in hex and save, it is 1532 KB, then after modifying it and rebuilding it, and reopening it to get the smaller parts, I get no file which is 1532 KB. Closest sized file is 1396 KB which is not the same length in hex editor meaning some random text will be before or after the me fw data so.... could that cause problems?

[Klem]

Modifing ME and flash ME it is different things. I told you that in your case access to read/write region ME is locked. Locked in descriptor region. In this case does not matter correct or not you insert ME in bios, because lock dont get you access to flash this region.

[timohour]

This is my original (full) BIOS extract with fpt, and this is the one I tried modding. What am I missing?

6470b is an Ivy Bridge laptop with HM76 chipset.

Thanks

@Khenglish

Could you please help me modify my bios to unlock BCLK OC. This is the original extract with fpt. I can't understand what I am doing wrong.

Thanks!

[blowntaha]

Modifing ME and flash ME it is different things. I told you that in your case access to read/write region ME is locked. Locked in descriptor region. In this case does not matter correct or not you insert ME in bios, because lock dont get you access to flash this region.

lenovo sucks, everything so locked down and difficult to mod..

How do i add a pinmode on audio chip to a bios?

[Klem]

http://forum.techinferno.com/general-notebook-discussions/2091-lets-enable-overclocking-all-6-7-series-laptops-24.html#post84052

[blowntaha]

I successfully overclocked my notebook. Thank you all!!

Notebook: Dell Inspiron N5110 (same to Dell Vostro 3550)

PCH: HM67

ME: 7.1.60.1193

ME RW access: HDA_SDO pin

Instructions:

1. Dump ME firmware with fptw64.exe -ME -D dump.bin
   
2. Open dump.bin file with ftic.exe and set Number of Flash Components to 0
   
   
3. Build Image – outimage.bin will be generated.
   
4. Rename outimage.bin to outimage0.bin
   
5. Make required modifications and Build Image again.
   Gallery
   
6. Compare outimage0.bin and outimage.bin with Beyond Compare or any another tool.
   
   
7. Open dump.bin with a hex editor, search for outimage0.bin values and replace them with outimage.bin values. Eg: If you changed SRC Source Select from 0x00033733 to 0x00133734 you'll need to change 33 37 03 00 to 34 37 13 00 a single time. All values changed are placed at close offsets.
   
8. Flash ME firmware with fptw64.exe -ME -F dump.bin
   

XTU:

http://forum.techinferno.com/general-notebook-discussions/2091-lets-enable-overclocking-all-6-7-series-laptops-24.html#post84052

EDIT: So you just short the pins circled from the first pic? & would someone mind telling/showing the best way to do that (best = easiest)?

-Thanks

[Tech Inferno Fan]

lenovo sucks, everything so locked down and difficult to mod..

How do i add a pinmode on audio chip to a bios?

Can see an example of how it's done at http://forum.techinferno.com/dell-latitude-vostro-precision/6980-14-dell-latitude-e6440-owners-lounge.html#post99289

[Khenglish]

Hello all!

I am trying to enable BCLK OC on my HP Probook 6470b but no matter which version of XTU I use Reference Clocks are greyed and no slider.

This is my original (full) BIOS extract with fpt, and this is the one I tried modding. What am I missing?

6470b is an Ivy Bridge laptop with HM76 chipset and mine is equipped with an i5-3230m.

I tried XTU 3.1, 4.0, 4.1, 4.2, 4.3 and 5.1 but no change.

What else info to provide to check if this is a bad ME flash or bad XTU?

Thanks

@Khenglish

Could you please help me modify my bios to unlock BCLK OC. This is the original extract with fpt. I can't understand what I am doing wrong.

Thanks!

Sorry, I forgot you asked this a while back. Here it is:

timohourOC

The size mismatch is fine when flashing.

[timohour]

Sorry, I forgot you asked this a while back. Here it is:

timohourOC

The size mismatch is fine when flashing.

Thanks a lot for your reply.

I flashed the file you made using fpt with DOS. Unfortunately I have the same result as with my try.

Grey sliders on Reference clock and locked @ 100MHz. I tried XTU 3.1, 4.0, 4.1, 4.2, 4.3. Any ideas?

Should I reformat my laptop? Would it help? Thanks again.

[Khenglish]

Thanks a lot for your reply.

I flashed the file you made using fpt with DOS. Unfortunately I have the same result as with my try.

Grey sliders on Reference clock and locked @ 100MHz. I tried XTU 3.1, 4.0, 4.1, 4.2, 4.3. Any ideas?

Should I reformat my laptop? Would it help? Thanks again.

I just checked the file I linked you and everything looks in order. Are you sure you flashed the right file? Did you do a full power off and cold boot after flashing?

[jacobsson]

Hi guys!

Sorry for my absence, haven't got my thumbs out to dump my full BIOS+ME yet.

I do have all the components needed for it but I lack the knowledge to do it atm.

What I planned to use is a Rasbberry pi model B and a SOIC 8 clip.

@Khenglish

Is there a good guide you know of that you would recommend to me?

I did confirm that the BIOS chip (MX25L6406E if remember correctly) is confirmed in the romflash wiki list.

Thanks!

[Khenglish]

Hi guys!

Sorry for my absence, haven't got my thumbs out to dump my full BIOS+ME yet.

I do have all the components needed for it but I lack the knowledge to do it atm.

What I planned to use is a Rasbberry pi model B and a SOIC 8 clip.

@Khenglish

Is there a good guide you know of that you would recommend to me?

I did confirm that the BIOS chip (MX25L6406E if remember correctly) is confirmed in the romflash wiki list.

Thanks!

While a soldering iron can work, a heat gun is the safest way to remove the chips. It is difficult to heat the entire chip at the same time with an iron, which makes it likely that you will rip a pad off the motherboard, or overheat the chip. Most laptops need to have the motherboard pulled to get plastic casing far enough away from the firmware chips to avoid damaging the casing when using a heatgun. Using an aluminum foil shield around the area does help block heat from reaching other components, but usually is not necessary unless you have radial electrolytic caps nearby, as those have a poor heat tolerance. Some plastic connectors on motherboards will be a bit sensitive as well, so those should be protected too.

You probably have 2 firmware chips. On some systems one is BIOS only, and other other is ME FW only, but some will split the firmware files. On my latitude for example the BIOS is split between 2 chips, but the ME FW is all on one. Make sure you pull the right chip. Intel's fpt tool will state which chip the ME FW is on.

SInce this is so much work you should allow read/write access in the flash descriptor. That's easy to do in FITC. Just make all access 0xFF.

Putting chips back on is much like taking them off. You may need to add a bit of extra solder with an iron, but since we are putting the same chip back in exactly how it was, this should be unnecessary. Just be sure to put some solder flux down on the board first.

[jacobsson]

@Khenglish

Thanks for the rapid answer!

Excuse me if this sounds ignorant but my plan is to dump/flash BIOS directly from the MOBO, not de-solder the BIOS chip at all. Is that out the question? :S

[Khenglish]

@Khenglish

Thanks for the rapid answer!

Excuse me if this sounds ignorant but my plan is to dump/flash BIOS directly from the MOBO, not de-solder the BIOS chip at all. Is that out the question? :S

That may or may not work. There's an added complexity in that there are multiple chips on the SPI bus, so your programmer needs to know how to just select one.

[timohour]

I just checked the file I linked you and everything looks in order. Are you sure you flashed the right file? Did you do a full power off and cold boot after flashing?

I put the file you uploaded in my Setup 1.x disk image and flashed so there is no way I flashed a wrong image.

After flashing I shut down removed battery and power and installed XTU 3.1. I also tried 4 4.1 4.2 & 4.3... The bar is grey and there is no slider.

I will try again later today and post my results

[blowntaha]

As we can see, now in your bios, in descriptor region, access to ME region is locked. No read, no write. Now you have only two way, one flash mod bios with programmer device, other one flash mod bios with pinmode on audio chip.

Wait a second, if that is the case then how was I able to produce this dump? I took a picture after the second time flashing, thinking that something went wrong after the first time. If I was able to read the ME FW to make a dump, and able to flash it (proof below), why am I unable to now? & If I do a full bios flash, modding the bios .bin by replacing the old me fw with a modified one (in hex edit), setting MEUPdate=1 in platform.ini, might that work?

Also, I just dumped my descriptor to see whether or not I'd be able to, and I was able to. Is there something I could do with that dump to enable read/write on ME?

[Khenglish]

@blowntaha I don't get why you can dump. You flash descriptor said you had no read access.

Anyway, here's a full image with an unlocked descriptor and firmware.

blownOC2

[blowntaha]

@blowntaha I don't get why you can dump. You flash descriptor said you had no read access.

Anyway, here's a full image with an unlocked descriptor and firmware.

blownOC2

I was able to flash and dump freely when I first started meddlig in ME FW. I think I may have flashed either a bugged/corrupted FW, or one with certain settings that may have messed something up. Would it be possible for me to mod a full bios .rom, enter BIOS recovery by hitting the required keys while powering on laptop to enter recovery mode and let it flash that way? Would that flash the ME as well? FYI, the pic I posted earlier was of one after successfully flashing. But now, I can't even dump.

If I'm unable to unlock descriptor, I think I might just buy an spi programmer... How do I know which one to get and if it will be compatible?

[Khenglish]

I was able to flash and dump freely when I first started meddlig in ME FW. I think I may have flashed either a bugged/corrupted FW, or one with certain settings that may have messed something up. Would it be possible for me to mod a full bios .rom, enter BIOS recovery by hitting the required keys while powering on laptop to enter recovery mode and let it flash that way? Would that flash the ME as well? FYI, the pic I posted earlier was of one after successfully flashing. But now, I can't even dump.

If I'm unable to unlock descriptor, I think I might just buy an spi programmer... How do I know which one to get and if it will be compatible?

You could try recovery. Can't hurt.

fpt will read out your flash ROM parts. Get a programmer that supports them. The one I use is a TL866.

[blowntaha]

You could try recovery. Can't hurt.

fpt will read out your flash ROM parts. Get a programmer that supports them. The one I use is a TL866.

Woohoo! The BIOS recovery worked, at least as far as I can tell. MEINFO is showing read/write access as enabled, although my ME re-flash firmware is disabled in BIOS. It also seemed to reset all of my NVRAM vars I fiddled with which I've read in numerous places emphasizing that it does not reset NVMRAM. I ran MEINFO right after the first (me-only) flashing, it gave me an error

Error 9459: Internal error (Could not determine FW features information)

I also realized I forgot I didn't do a cold boot so I reflashed the one you uploaded (used one I modified for first one), cold booted, and will edit this to report back.

EDIT: everything still seems locked, going to try once more, but not reflash because I forgot I modified full BIOS.rom and added it in there... /facepalm

EDIT 2: Okay.... So I went into BIOS recovery, and it successfully flashed the modified ME FW, I verified this by fpt -me -d -me.bin and checking if the proper bits in hex edit were set. Also, fpt -DUMPLOCK shows

which is what they should be if they are in fact unlocked. I completed all of this error-free (rather, I didn't repeat anything that would produce errors, such as running meinfo, and reflashing unnecessary firmware).

After finally unlocking flash descriptor, XTU still does not unlock my multipliers, nor does throttlestop. Attached is my current ME FW dump. All help is appreciated (it really is).

EDIT3: Just opened dump in fitc and saw wrong settings, gonna retry

me.zip

[blowntaha]

You could try recovery. Can't hurt.

fpt will read out your flash ROM parts. Get a programmer that supports them. The one I use is a TL866.

I re-flashed a third time, and then dumping my me bios to verify in FITC. I can 100% positively say that the settings match the ones in the me fw you uploaded for me. However everything still appears locked. I noticed a 'Clock Commander Tool' inside the zip of the ME tools, could that possibly help troubleshoot?

I've attached my newest, corrected, current ME dump.

OCME3DMP.zip

[Khenglish]

Hmm this is my 2nd mod in the past 2 days that didn't work. Let me check it vs another.