plutomaniac

Updates:

• W25xHNx BIOS Mod v1.2 was released
• Removed Renesas USB 3.0 driver (use Windows 10 stock)
• Improved text

New Clevo W2xxHNx/W2xxHPx series BIOS Mods

v1.2

• Intel Sandy Bridge 206A7 CPU microcode 29 --> 2D

Updates:

• W25xHNx BIOS Mod v1.1 was released
• Added Windows 10 drivers and instructions
• TouchPad: ELAN SmartPad v15.10.5.2
• Camera: ChiconyCam v1.0.56.614
• ME Firmware and Driver: Links to ME thread
• Fixed broken links and improved text

New Clevo W2xxHNx/W2xxHPx series BIOS Mods

v1.1

• Intel Management Engine firmware from v7.1.60.1193 (31/08/2012) --> v7.1.80.1214 (23/07/2013)
• Intel HD Graphics 3000 vBios from v2170 (07/08/2013) --> v2171 (08/12/2014)
• Updated flashers to AFUDOS v3.07.01 and FWUpdate v7.1.50.1166

Interesting, may I ask which version?

If you talking about an FPT version that doesn't require a locked descriptor: it does not exist. As people said above, if you cannot do the HDA_SDO method then an SPI Programmer is your only choice.

UEFI shouldn't have to do with that method. I'm not sure about resistor. I guess just shorting should work. For example this comes from a ME8 Manufacturing Guide:

It's definitely a valid way of unlocking the descriptor according to numerous Intel documentation. Noone said it's easy though... FPT will detect whether it's locked, it's not playing any games.

Yes it is indeed very hard, today's HDA chips are way too small to perform that thing. The OEMs probably have some super-thin strong wire or something to do it. It's impossible with a paperclip. Another way would be to use a flash programmer which won't care for any flash descriptors and such.

1. Download ME System Tools v8.x from my ME Thread

2. Shut Down the computer

3. At your motherboard, find the Realtek Audio chip

4. Use tweezers or a paper clip to short together pins 1 and 5

5. Power the PC on and wait for POST screen to show up

6. You can now stop shorting the two pins

7. Boot at Windows (you are now running the system with an unlocked descriptor)

8. Go to Flash Programming Tool, open a command line as administrator and type FPTw64 -d BIOS.bin and then FPTw64 -d ME.bin -ME

9. Two files should appear if the descriptor is unlocked. One 1.5MB ME.bin file which the dumped ME region and one 8MB BIOS.bin file which is the whole SPI dump (it's god to keep a full image dump in case of problems).

10. Attach us here the ME.bin file and someone will modify it.

The VIA chipset could also be for USB or other functionality. Not audio necessarily. There is a better post by me here:

RE: Intel Management Engine: Drivers, Firmware & System Tools - 48

Don't follow it though since it's for another system with ME 9. The procedure is pretty much the same though. What audio chip does your laptop have? It's not mentioned at the Asus website specifications.

Damn, that's too bad

Weird enough I don't find that G75VW users have the same problem...

Thanks anyway!

To unlock the descriptor you need to use the HDA_SDO method which requires you to have physical access to the audio chip of the motherboard. So you would need to open the laptop for that.

Yeap, this is what I said above. Your flash descriptor is locked. It doesn't matter if the BIOS update has an unlocked 4KB Flash Descriptor region. If your current BIOS has a locked descriptor you would need to unlock it in order to a) Modify the ME and Unlock the descriptor via BIOS update for good.

Also, you are using an old FPT version. You can find the latest firmware & tools at my ME thread HERE. Not that it matters for the current problem you are having. You need an unlocked descriptor first.

Send me your ME FW and I'll mod it. Asus does not lock the ME FW in the flash descriptor so it's easy.

Usually the flash descriptor is locked at the production line. The BIOS updates have an unlocked descriptor but it doesn't matter if it's already locked. I have verified this for desktop Asus motherbords and I suspect it's the same for mobile.

News:

W25xHNx BIOS v1.01.07 Mod released! Download and changelog.

Added link to the W2xxHNx/W2xxHPx BIOS Mods thread

Updated Renesas uPD720200a v4.0.2.1-0.3 file with newer flasher & .bat file to check version

Updated Intel ME 1.5MB v7.1.60.1193 file with tools and .bat files

Intel Management Engine Interface v10.0.20.1258 --> v10.0.28.1000

Fixed broken Realtek Audio proof image

Added W25xHNx Concise User Guide (Greek)

Added FAQ about Realtek RTL8188CE & Motorola Bluetooth

Added Note about actively-updated drivers and removed links

Multiple text/font adjustments for a simpler look

Clevo W2xxHNx/W2xxHPx series Modded & Stock BIOS

Note: This thread is no longer updated. You can find the latest info HERE.

Notice: Make sure you have downloaded the correct Mod for your specific model and that the laptop's or a UPS battery backup is present during the update process.

Disclaimer: I do not hold any responsibility for any problems that may occur by using the mods in a wrong way. Remember that you flash these at your own risk. I have personally tested the W25xHNx mod. Since the laptops mentioned here are of the same series and thus almost identical, you shouldn't face any problems with the rest of them. The same changes were made to all models after ensuring that their stock counterparts are identical to the tested W25xHNx laptop.

Note: All mods contain both the Modded and Stock BIOS image files so that you can go back in case you want to. Use Mod.bat or Stock.bat at a DOS environment respectively. Check the Flashing Guide below for detailed instructions.

W2xxHNx/W2xxHPx Mod Changelog:

v1.2

Intel Sandy Bridge 206A7 CPU microcode 29 --> 2D

v1.1

Intel Management Engine 1.5MB firmware 7.1.60.1193 --> 7.1.80.1214
Intel HD Graphics 3000 vBios 2170 --> 2171
Updated flashers to AFUDOS v3.07.01 and FWUpdate v7.1.50.1166

v1.0

Intel Management Engine 1.5MB firmware 7.0.4.1197 --> 7.1.60.1193
Intel HD Graphics 3000 vBios 2117 --> 2170
JMicron JMC25x Gigabit Ethernet Controller 1.0.9.0 --> 1.0.10.0
Intel Sandy Bridge 206A7 CPU microcode 12 --> 29
Removed redundant Intel Sandy Bridge 206A7 CPU microcode 14
Added support for Intel Core i7-2820QM ES/QS processor (W25xHPW)
Fixed grammar mistake at Resuming from Hibernation image
Fixed spelling mistakes at Advanced tab (Alart --> Alarm)
Merged BIOS & EC firmware into a single image file
Correct BIOS version & date reported in Windows

Clevo W25xHNx series BIOS v1.01.07 & EC v1.00.06 [Mod v1.2]

Supported Models (*): W251HNQ, W251HNQ-C, W255HN, W253HNQ1, W253HNQ, W258HNQ etc...

Clevo W25xHPx series BIOS v1.01.07 & EC v1.00.08 [Mod v1.2]

Supported Models (*): W251HPQ, W251HPQ-C, W255HP, W253HPQ1, W253HPQ, W258HPQ etc...

Clevo W27xHNx series BIOS v1.01.05 & EC v1.00.04 [Mod v1.2]

Supported Models (*): W270HNQ etc...

Clevo W27xHPx series BIOS v1.01.05 & EC v1.00.05 [Mod v1.2]

Supported Models (*): W270HPQ etc...

Clevo W25xHPW series BIOS v1.01.05 & EC v1.00.04 [Mod v1.2]

Supported Models (*): W251HPW, W255HPW, W258HPW, W253HPW1, W253HPW etc...

Flashing Guide (Text & Video):

1. Create a bootable MSDOS/FreeDOS USB flash-drive using Rufus

2. Copy all files relevant to your model at the USB flash-drive's root directory

3. Plug the USB flash drive at your laptop's USB 2.0 port

4. Restart and press F2 to enter BIOS to make sure that you do not have any BIOS or HDD password protection

5. Restart and press F7 to enter the Boot Order menu at which select your USB flash drive

6a. To update your BIOS & EC to the latest modded version, type Mod

6b. To update your BIOS & EC to the latest stock version, type Stock

7. Follow the easy on-screen prompts to finish the update process

8. The first time after the update, the laptop will boot and automatically restart quickly

9. Press F2 to enter BIOS and Load Setup Defaults followed by Save Changes and Reset

10. You have successfully updated your BIOS & EC to the latest modded/stock versions

(*) As shown at Clevo Bios Mirror and laptop Service Manuals

Special thanks to Lordkag for the help and advice.

Ha, ha. Oh Clevo... I can't imagine how many systems you must have bricked and brought back to life in order to know all these.

I guess I could transform this thread slightly into a small guide for older systems up until Ex series on how to do the BIOS/EC merger. Could be useful for someone, who is feeling dangerous, later on.

Yes, I am aware that 6-series can survive with a "broken/bricked" ME so I was not worried too much while testing this. That's not the case with 7-series and up though. Unfortunately the only 6 series FITC is buggy so on such systems embedding the ME inside the bios will never be doable. It's ok though, the DOS version of FWUpdLcl + ME update 1.3MB file is a lot safer + keeps settings + does not require MESET nor the dangerous & scary () FPT flasher. I'll stick to that.

For more ME experiments I can go to my Z77 Dual Bios desktop which should be ok no matter what I do while learning. Thanks for the reply Prema, my mod is pretty much ready now.

I suppose you don't happen to have a v7 DOS FWUpdLcl tool after 7.1.20, do you?

EDIT: Oh, can you please also fix the title from Wndows to Windows? Apparently only a mod can do that.

I actually tested a W3xxST before and the EC block was there. That's the rom that I said I tested for reference.

Thank you for verifing that Prema, I'll base my mod on the "EC" file. That's what I thought. Btw, UEFITool can also be used for doing the extraction quickly without a hex editor and copy-pasting (I know you know that, just for helping others who might be looking into that). To insert it back though, a hex editor is needed since you cannot import and replace "padding".

I checked one or two newer models for reference and saw that again the EC is signified by 02 00 2E 02 00 0E 22 22 22 22 22 02 06 with a size of 64KB or 10000 length. However, this is probably for systems with one EC firmware using one BIOS/EC ITE chip. The position, size etc might differ otherwise. Just pointing that out. And yes, I'm not going to mess with the actual EC. I can't afford bricks nor do I have a programmer!

It's weird that Clevo has decided to have one BIOS and one EC image when they could easily release one file with both updated. And their batch files shut down the system after the EC making it more dangerous to actually cause a brick. Who knows, they probably have a reason...

So, I am looking into embedding an updated ME into the bios but I'm facing a weird "glitch". Normally this is done by taking the Intel production 1.5MB image, opening it with FITC, changing OEM settings, clocks etc and then replacing the original using a hex editor. However, I am trying to find a way to bypass using FITC v7.1.20.1197 to rebuild the ME since I've read that it rebuilds broken images resulting in bricks. That only leaked version is flawed when it comes to 6-series systems unfortunately. So I followed another procedure that I thought and should in theory work (two times using different methods to make sure):

1. Updated ME to 7.1.60.1193 with FWUpdLcl (it updates version while keeping OEM settings)

2. Run MESET to overwrite the flash descriptor and reboot (constant full fan speed -> this way I know it's overwritten)

3. Run ftp -D DUMP_BIOS.bin

4. Shutdown to reset flash descriptor

HEX Editor Method:

5. Open DUMP_BIOS.bin with HxD hex editor

6. Find the beginning of ME which is 20 20 80 0F 40 (near KRID text) and click before 20 (for me that's at offset 1000)

7. Edit > Select block and change Length to 17D000

8. Right click > Copy , New file , Right click > Paste Write (ignore the file-size warning)

9. Save as ME_EXTRACTED_HEX.bin

10. Open STOCK_BIOS.bin and ME_EXTRACTED_HEX.bin with HxD hex editor

11. Select ME_EXTRACTED_HEX.bin, Right click > Select all

12. Select STOCK_BIOS.bin , find the beginning of ME (20 20 80 0F 40) and click before 20

13. Edit > Select block and change Length to 17D000

14. Right click > Paste Write (the changed ME region is now in red color)

15. Save as STOCK_BIOS_ME_71601193_HEX.bin (stock bios + updated ME + OEM settings *)

UEFITool Method:

5. Open DUMP_BIOS.bin with UEFITool

6. Go to ME Region (make sure size is 17F000 and version 7.1.60.1193)

7. Right click > Extract as is and save as ME_EXTRACTED_UEFITool.bin

8. Open STOCK_BIOS.bin with UEFITool

9. Go to ME Region (it should report a size of 17F000 and an older ME version)

10. Right click > Replace as is and select ME_EXTRACTED_UEFITool.bin

11. At Action tab the old ME is set to Remove whereas the new ME is set to Replace (both sizes must be 17F000)

12. Save image file as STOCK_BIOS_ME_71601193_UEFITool.bin (stock bios + updated ME + OEM settings *)

* In my case I don't have to manually set the OEM settings (using the broken FITC) since I used a DUMP of my own bios (which already includes the appropriate settings) for the purpose of using it at same series models from Clevo. Otherwise more steps are needed when you don't have access to a dump of the system to be updated.

Note: UEFITool extracts the whole ME Region (length 17F000 or 1.532KB) and not just ME (length 17D000 or 1.524KB)!

I did it with both methods and these are the results:

STOCK_BIOS_ME_71601193_HEX.bin (SHA-1: 620D1BB96683C23DE3098E4F569709AD83EC780B)

STOCK_BIOS_ME_71601193_UEFITool.bin (SHA-1: 620D1BB96683C23DE3098E4F569709AD83EC780B)

The files are identical so in theory I did everything properly. However, after the flash when I restore default bios settings this happens:

It happens on the fly. If I save the settings after that, it gets stuck like this which means you cannot boot from anything except CD/DVD's. To fix it, I have to restore the default ME and reflash the EC & BIOS with three consecutive commands. It has to be ME/FPT related since I never had problems with the modified BIOS itself. After some tests I concluded that it has nothing to do with my modded BIOS but entirely with the updated ME inside it. I tested both StockME+StockBIOS & StockME+ModdedBIOS. As long as the ME was not updated the weird problem was never appearing.

For the record, I have found a way more elegant solution which does not require FPT or MESET. I can use the DOS version of FWUpdLcl with the v7.1.60.1193 ME Update (1.3MB file). It works like a charm. But, I still don't understand what it is I did wrong when manually inserting the dumped ME, causing the boot order issue. I'm thinking it has something to do with the ME coming from a dump.

Hello,

I was interested in merging my laptop's BIOS & EC together into one image and came to an interesting conclusion. My laptop is Clevo W25xHNx from 2011 (EOL). The latest BIOS is 1.01.07 and was released alongside EC 1.00.05. After some time EC 1.00.06 was released and no more updates after that. I opened BIOS 1.01.07 and EC 1.00.05 with AMIBCP and saw that both of them are based on the 1.01.07 BIOS which makes sense since they were released together.

Next I opened EC 1.00.06 with AMIBCP and saw that it is also based on the 1.01.07 BIOS which again makes sense since it had to be based on the latest released BIOS.

So I wondered whether I had to do anything to merge the 1.01.07 BIOS and 1.00.06 EC. I could just flash the 1.00.06 EC image (/E & /P /B /N) to update both EC and then BIOS. Obviously I had to make sure first that there were no other differences apart from an updated EC. Maybe the bare EC image didn't include parts of the main BIOS block. I opened both 07 BIOS and 06 EC with Beyond Compare and saw that only a small block was different on both of them. That block should contain the EC.

However, since I don't know from where exactly I should copy-paste I decided to use UEFIExtract.

I extracted both BIOS 07 and EC 06 and checked both folders for file differences with WinMerge. The only difference was a single 64KB "padding" file at the top of the main BIOS block: eW251HNQ.06.dump\2 BIOS region\0 Padding\body.bin

I copied both files in a folder and after naming them appropriately I opened both of them with HxD hex editor.

At the top I can see ITE which is the BIOS/EC chip manufacturer. Scrolling down a bit reveals the file's version number witch is 1.00.05 for the BIOS 07 one and 1.00.06 for the EC 06 one. This is definitely the EC firmware.

Now, I want to test whether the latest EC_06 is a full 1.01.07 BIOS + EC 1.00.06 image. I opened both BIOS 07 and the extracted 64KB EC 06 firmware. The first line of the extracted EC file is 02 00 2E 02 00 0E 22 22 22 22 22 02 06 80 C2 AF. I search that at the BIOS 07 image and find it at offset 180000.

I go back to the EC and right click > Select all > Copy. The length is 10000 as shown by HxD.

Now I go back to BIOS 07 tab, click before the first hex number of the 180000 offset (02 in my case), Edit > Select block and enter the length of the EC file which is 10000 or 64KB.

Then right click > Paste write. The 64KB that I replaced will appear in red.

I save the result in a new file (TEST_BIOS07_EC06). In theory I have now created a 07 BIOS + 06 EC. So if I compare the stock Clevo 06 EC file with my TEST one, they should be identical. And I'm right, they both have the same SHA-1 hash.

So that proves that the EC_06 provided by Clevo can be used on it's own to update both the BIOS & EC of a machine. So, in my case I don't have to merge the 64KB EC firmware, I can use the EC image by itself. Of course, IF EC_06 was based on the 04 BIOS for example (whereas the latest BIOS is 07) I would have to extract the 64KB EC and insert it manually like I shown above. But in THIS case, that's not necessary.

Am I wrong?

Have you guys kept any older 6 series ME tools (for ME v7 series)? I'm looking for the latest "leaked" DOS counterparts of FWUpdLcl, MeManuf & MeInfo.

use a regular ME update file with FWUpdLcl same way you did it for yourself.

I finally understood what you meant all this time. I have seen at other mods (& yours of course) updated ME firmwares inside the bios file and I wanted to do the same.

EDIT:

Making an all in one file isn't required and not something you just do...every single setting has to manually ported and the ME specially designed for that system. You can't use a dump and you would waste your time learning how to use Intel Tools if all you want to do is a simple update.

Yes, I am willing to go the extra mile. In general I don't want to just request something. I like to also learn something in the process. And no I won't use the dump, that was a silly idea due to not being experienced. I know a lot of stuff about computers, just not bios modding. I'm trying to learn the basics.

If you flash a regular ME update via FPT the system will brick as it has not been designed for this system. MeSet is the software that disables the Chips protection.

After that FPT overwrites the entire chip with whatever you tell to flash. It would even write a jpeg into the ME/BIOS chip.

If you want to update the ME and preserve system specific settings use FWUpdLcl (there is also a DOS version).

Prema I have confused you apparently. I have already done that. My Clevo is already updated to the latest ME using FWUpdLcl. I know that FTP writes everything whereas FWUpdLcl just updates the ME version while keeping the settings intact. What I am trying to do is insert the regular updated ME in the stock BIOS and create a ready-to-be-flashed file by anyone with the same series without them needing to use the windows FWUpdLcl ME flasher. Basically I want to deploy this to others. Personally, I'm updated!

Sorry for the confusion

Meset is only needed if you want to alter ME settings and write an entire ME image with FPT, not for a simple ME update with FWUpdLcl.

I know that. What I meant was simply put: bios with old ME version --> update ME version to latest inside bios --> deploy to others via image file (no FWUpdLcl via Windows). If I understood correctly even at that case MESET is not needed BUT if you change ME settings (overclocking, tweaks) that change clevo default options --> MESET batch needed for end-user. Did I understand it properly?