Lets enable overclocking on all 6 and 7 series laptops

[Khenglish]

Update: Moral Hazard used MESET.EXE on his clevo to force a dump and flash, but did not gain BCLK control.

Update 2: SUCCESS by kasar on a Dell xps 15 (L502X) here! Unfortunately he needed to disable the ME region lock by desoldering and flashing the BIOS chip though.

Update 3: SUCCESS by me on Clevo P150EM here! Mod relied on Clevo-only program to unlock ME region.

Update 4: SUCCESS by Rhadamanthis on MSI gt780 dxr

Update 5: SUCCESS by Akimox on HP 2570p here!

 

At the hardware level, all 6 and likely 7 series laptops support overclocking. The problem is OEMs disable this ability except on laptops like the m18x.

Clock configuration is NOT controlled by the BIOS. It is controlled by the Intel ME FW (management engine firmware), a BIOS extension. Only a few bits must be changed from a overclocking disabled ME FW to make it an overclocking enabled ME FW. Gigabyte accidentally leaked an intel utility that can read the ME FW, edit it, and write the new version back to the flash ROM, along with all the necessary documentation to make the correct changes. This flash ROM contains not only the ME FW, but the BIOS, flash descriptor, and 2 other regions called the GbE and PDR.

 

There is one problem, which is that all laptop manufacturers (except ASUS) disable read/write access to the flash ROM. The read/write locks are contained in the flash descriptor. The security settings in the flash descriptor can be ignored by setting a special flag on BIOS startup known as the flash descriptor override, which enables read/write access to all regions. This override is used when you run a BIOS update. At this time there are methods to enable the flash descriptor override for HP and Clevo systems only.

 

After setting the override and rebooting you can dump your whole flash image, edit the ME FW, rebuild the image, and flash. It is possible to flash either the ME FW region only, or the whole image. Obviously flashing the whole image is risky since you will also be flashing your BIOS, so I suggest just flashing the ME region. 6 series are more tolerable of corrupting the ME FW than 7 series. 7 series cannot run without a functional ME FW. 6 series can run without one as long as the BIOS detects that the ME FW is corrupt, and thus refuses to run its settings, however, the laptop can sill be bricked anyway if the BIOS thinks the ME FW is functional while it really is not, and attempts to run the inoperable clocking settings.

Some of you may be aware of fwupdlcl.exe which can update the ME FW without enabling the flash descriptor override. This does not work for our purposes since it does not perform a full flash. It does not overwrite the hardware config portion of the ME FW, which is where clock configuration is done. However, if someone could figure out what this program does to write its partial image, it may be possible to use that knowledge to flash a full image.

 

So here's the Intel Utilities and docs:

6 series chipset

Link removed since the leaked FITC builds invalid images. Use the ME8 FPT and documentation for now.

7 series chipset:

http://www.mediafire.com/?iwscmnadf5icnxq (thanks to kasar)

MESET.exe to unlock Clevos:

http://www.mediafire.com/?465pknsgc2z83s8

ME_Port by svet to unlock MSIs:

https://www.dropbox.com/s/spmvxmz9pal1j6l/ME_Port.com

 

BE CAREFUL WHEN USING FPTW64!

It will happily overwrite your BIOS without any warning if you enter the wrong command. Even if you do things properly, still be prepared to have a dead ME FW and whatever the consequences of that may be.

Although it is unlikely, trying to enable overclocking through my suggestions can kill your motherboard. There are a few combinations of mistakes that can be made which will most certainly do so. You have been warned, so don't blame me if you do. Also if you do, do NOT go RMA your laptop and make your manufacturer pay for what you caused. You took the risk, so you pay for the necessary repairs even if under warranty.

If things go wrong I will do everything I can to help you recover, but please accept responsibility for trying this.

 

Ok now that all that is out of the way so people can't justifiably yell at me. Back to how to try this.

 

1.

Enable your flash descriptor override. Clevo users can use MESET.exe. MSI users can use ME_Port. HP users can use the keyboard sequence "WIN+left_arrow+right_arrow" during POST (got this info from Tech Inferno Fan). ASUS users don't have to do anything since they don't have the lock engaged. The rest of you guys are at this time out of luck.

 

2.

So you'll first need to dump your ME FW image. This is done by running fptw64 in windows or fpt in DOS. It needs to be run in a cmd window with admin rights. The command to do so is "fptw64 -d imagename", where imagename is whatever name you want for your flash image dump. Prema found out that at least on Clevos, attempting to dump only the ME FW leaves out the clock control segment, so you need to dump the whole flash image. Note that you're also getting the flash descriptor when you dump everything, so you can edit it to not require the flash descriptor override to do any flash image reads and writes.

 

3.

Now you need to change some bits to enable overclocking. By some, I mean you probably have to change quite a lot. The good news is that the settings on 6 and 7 series systems seem to be identical. When I edited my image, I followed the intel docs in the ME8 download. I've linked my original overclocked MW FW for comparison. You only need to make changes in the "ICC" section and subsections in FTIC. You can edit the ME FW as part of an entire flash image, or by itself. I edited it by itself, but have since then done several BIOS mods and flashing the whole image worked out fine.

 

My modded P150/170EM ME FW:

meoc.bin

 

This image is just for reference to make sure you didn't miss anything. Don't just flash this ME FW. It might work, but there has been issues with flashing someone else's ME FW on HP and Dell systems and others may be affected. Dump and edit your own, or ask me to and I will if I have the time. Some manufacturers have additional changes. When it doubt read the manual or ask me if something should be changed or not.

The Utility for editing the images is FTIC. This program has a GUI so it does not have to be run from cmd. Open your image and open the overclocking enabled image. Settings that are different from FTIC's generic 6 and 7 series file will be highlighted in yellow. What you need to edit is the ICC profiles under ICC Data. You can have up to 8 profiles. I think active profile changes depending on if you are say plugged in, on battery, on standby, temps are too high, etc. I don't really know how you identify which profile(s) much be changed, so I think you should just change all of them to make sure that if the flash works and you don't get overclocking, that you know you didn't miss something and that overclocking is impossible, so you don't waste time thinking about it and trying things.

 

The number 1 thing to check that I found to make sure things don't go bad is your "clock source select" under "FCIM/BTM specific ICC registers". If it is 0x00011A33, then your laptop uses the PLL built into the PCH and you can keep going through trying this mod. It will be 0x00011A34 for enabling overclocking. If it is something else besides these 2, STOP NOW. This means that your PCH's PLL is not being used, and that instead an external PLL is feeding the PCH clocks to distribute. If you set your laptop to use the PCH's PLL, I think the PCH will get both clocks and you'll get a laptop with unintelligible clock signals. That would be bad.

After making the changes you need to rebuild the ME FW image. You will then have a full image, and if you reopen this new image in FITC, FITC will create a new folder with the MW FW all by itself. You can use the full image or the MW FW image to flash.

 

4.

Now the fun exciting part where we do the flash. I recommend doing it in DOS. The command to flash the ME FW only is "fpt -me -f filename", where filename is the name of your flash image. Don't forget the .bin extension. If you are flashing the entire ROM then you do need to leave out the "-me". If flashing the ME FW only and used the "build compact image" option in FITC, you should get a warning that the flash image is smaller than the total ME Region area that the flash descriptor says you can use, so the area after the file length will not be changed. This is OK and flash anyway. The image FTIC creates is not padded at the end, which causes the warning to occur. If you built a full image it is padded, so you don't get this warning.

 

5.

You can now use Intel XTU to overclock. If you already installed it, you may have to reinstall it. BCLK can be changed in windows and takes effect immediately.

Remember guys, this is risky stuff, especially if you have a 7 series laptop. If you're careful though everything should turn out fine.

Edited January 20, 2017 by Khenglish

[mw86]

Great job and cool concept it will be great to see someone unlocked through your steps. Excellent write up! Welcome to Tech Inferno Khenglish.

[Xonar]

Wait, how have I not done this yet? I have a 2920XM w/o XTU on my MSI and I crave more OC'ing! I'll let you know when I have more time to try this out. Thanks for the guide buddy.

Lol, Chrome thinks the .zip is malicious.

[svl7]

Wow. Excellent!!!

I really need to look into this. And I might really need to get rid of my 5 series chipset notebook...

[moral hazard]

I wouldn't mind trying this, but I can't enable the flash descriptor override on my P150HM.

I hope someone does know and can share that info.

Although it looks like I could do a hardware mod to enable the override, I think I see it on page 78 here:

http://myeurocom.ru/u/service/4/file.pdf

I think if I remove R194 and connect M E _ W E # to GND, it might enable the override.

I would prefer an easier option.

[Virale]

I wouldn't mind trying this, but I can't enable the flash descriptor override on my P150HM.

I hope someone does know and can share that info.

Although it looks like I could do a hardware mod to enable the override, I think I see it on page 78 here:

http://myeurocom.ru/u/service/4/file.pdf

I think if I remove R194 and connect M E _ W E # to GND, it might enable the override.

I would prefer an easier option.

Bump! Got a P150HM and have been looking for something like this since I got it back in March '11. Fingers crossed for an easier option.

[moral hazard]

Well I figure that with the P150HM, all we need to do is enable the flash descriptor and then flash the me firmware from the P170HM.

As some may know, the P170HM bios and EC can be flashed onto the P150HM, that's what I am running right now.

But the ME firmware will not flash, nothing I can do to flash it yet unless I go for the hardware mod.

Still hoping someone will know a workaround using a simple key combo or something along those lines.

[svl7]

What about just patching it into the bios and then flashing the bios? After all you are able to update the bios with the tools provided by Clevo...

[moral hazard]

Clevo provided AFUDOS to flash with, or am I missing something?

I can flash the P170HM bios, but does that really give me the ME firmware from the P170HM?

Because I can't change the Bclk with XTU (I can change other things like enable XMP profiles).

[svl7]

I guess it depends on whether you flash the whole bios or only parts, guess that depends on the options, but the ME firmware is part of the bios, or rather part of the bios rom file.

[moral hazard]

When I try to flash the ME firmware part, it fails.

Some error telling me that flashing the ME firmware is not supported by this bios.

I don't know how to overcome this.

[svl7]

@Khenglish or anyone else, have you managed to run the fptw64 tool on a 7 series board? I always get a 'Error 201' when trying to do so on my Asus UX21A (HM76 chipset). It says 'Cannot be run on the current platform.'

This tool would be enormously helpful...

[Khenglish]

@Khenglish or anyone else, have you managed to run the fptw64 tool on a 7 series board? I always get a 'Error 201' when trying to do so on my Asus UX21A (HM76 chipset). It says 'Cannot be run on the current platform.'

This tool would be enormously helpful...

Thanks for the info. I was hoping that the tool would run for 7 series too, but I guess not. This leaked version is from before 7 series was released. There likely is an updated version for 7 series but it hasn't found its way onto the internet.

When I try to flash the ME firmware part, it fails.

Some error telling me that flashing the ME firmware is not supported by this bios.

I don't know how to overcome this.

Could you provide more info? Did you do the security override hard mod that you mentioned before, or are you just trying the commands without permission to see if they would work? Can you read off the MW FW or is only writing a problem?

It is possible that FPTW64 does not recognize your flash ROM. I think you can work around this but you'll need to look up your flash ROM and add its datasheet info to FPTW64's flash ROM file (fparts64).

[moral hazard]

Could you provide more info? Did you do the security override hard mod that you mentioned before,

Nope I haven't tried the hardware mod yet, I was hoping that I could find a key combo to get by without needing the hardware mod.

Can you read off the MW FW or is only writing a problem?

Looks like fptw64 can't read my FW because it wont dump it:

Microsoft Windows [Version 6.1.7601]

Copyright © 2009 Microsoft Corporation. All rights reserved.

C:\Windows64>dir

Volume in drive C has no label.

Volume Serial Number is A8EC-7DC6

Directory of C:\Windows64

02/10/2012 08:07 PM <DIR> .

02/10/2012 08:07 PM <DIR> ..

02/10/2012 08:08 PM 27 dump.bat

03/10/2012 12:24 AM 86 error.log

08/08/2011 07:09 PM 2,019 fparts.txt

08/08/2011 07:09 PM 3,487 fptcfg.ini

08/08/2011 07:45 PM 1,277,208 fptw64.exe

08/08/2011 07:10 PM 61,952 idrvdll32e.DLL

08/08/2011 07:10 PM 114,176 pmxdll32e.DLL

7 File(s) 1,458,955 bytes

2 Dir(s) 21,653,647,360 bytes free

C:\Windows64>fptw64 -d dump

Intel ® Flash Programming Tool. Version: 7.1.20.1119

Copyright © 2007-2011, Intel Corporation. All rights reserved.

Platform: Intel® HM65 Express Chipset Revision: Unknown

Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---

MX25L3205A(D) ID:0xC22016 Size: 4096KB (32768Kb)

Error 26: The host CPU does not have read access to the target flash area. To en

able read access for this operation you must modify the descriptor settings to g

ive host access to this region.

C:\Windows64>

It is possible that FPTW64 does not recognize your flash ROM. I think you can work around this but you'll need to look up your flash ROM and add its datasheet info to FPTW64's flash ROM file (fparts64).

--- Flash Devices Found ---

MX25L3205A(D) ID:0xC22016 Size: 4096KB (32768Kb)

From the output above, it seems to recognize the flash ROM, am I correct?

[Khenglish]

Nope I haven't tried the hardware mod yet, I was hoping that I could find a key combo to get by without needing the hardware mod.

Looks like fptw64 can't read my FW because it wont dump it:

Microsoft Windows [Version 6.1.7601]

Copyright © 2009 Microsoft Corporation. All rights reserved.

C:\Windows64>dir

Volume in drive C has no label.

Volume Serial Number is A8EC-7DC6

Directory of C:\Windows64

02/10/2012 08:07 PM <DIR> .

02/10/2012 08:07 PM <DIR> ..

02/10/2012 08:08 PM 27 dump.bat

03/10/2012 12:24 AM 86 error.log

08/08/2011 07:09 PM 2,019 fparts.txt

08/08/2011 07:09 PM 3,487 fptcfg.ini

08/08/2011 07:45 PM 1,277,208 fptw64.exe

08/08/2011 07:10 PM 61,952 idrvdll32e.DLL

08/08/2011 07:10 PM 114,176 pmxdll32e.DLL

7 File(s) 1,458,955 bytes

2 Dir(s) 21,653,647,360 bytes free

C:\Windows64>fptw64 -d dump

Intel ® Flash Programming Tool. Version: 7.1.20.1119

Copyright © 2007-2011, Intel Corporation. All rights reserved.

Platform: Intel® HM65 Express Chipset Revision: Unknown

Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---

MX25L3205A(D) ID:0xC22016 Size: 4096KB (32768Kb)

Error 26: The host CPU does not have read access to the target flash area. To en

able read access for this operation you must modify the descriptor settings to g

ive host access to this region.

C:\Windows64>

--- Flash Devices Found ---

MX25L3205A(D) ID:0xC22016 Size: 4096KB (32768Kb)

From the output above, it seems to recognize the flash ROM, am I correct?

OK that's just the standard flash descriptor denying access message. I get an identical message.

[Mobius 1]

Hmm, so this can enable overclocking in a non -XM CPU?

[svl7]

I got a bit further in the meantime. I go the same message as moral hazard when I tried to access the ME firmware, but it let me dump the flash descriptor. However, when I try to flash a modified flash descriptor it comes up with error 205, unknown problem.

I need to further look into this and the documents, it must somehow be possible to flash the ME firmware, after all a lot of systems mention "ME firmware update" in their bios update change logs... e.g. bios 214 of the UX21A, also the Clevo W110ER has a ME upgrade available, separately, with the FWUpdLcl tool, so it must work somehow. I assume you already tried the FWupdLcl tool?

[moral hazard]

@svl7 using that tool in dos I think I have just dumped my current ME firmware, here it is attached.

EDIT: I cant seem to open my dump with fitc.

EDIT #2: I can open my full bios image with fitc and then I can see the ME region.

EDIT #3: Well I just modded my bios using fitc to match the ME settings found in the m18x-r1 ME FW file.

I think I will flash it now. Wish me luck.

EDIT #4: Flashed my modded bios, no difference. Don't know if the ME firmware really changed or not.

MYBACKUP.zip

[svl7]

When flashing the bios did you specify to flash the whole image and not only the bios part?

You could also try cropping the modified ME part of your bios and then flash it with the FWUpdLcl tool. In that case you probably need to use the -allowsv parameter in order to flash it.

[Khenglish]

When flashing the bios did you specify to flash the whole image and not only the bios part?

You could also try cropping the modified ME part of your bios and then flash it with the FWUpdLcl tool. In that case you probably need to use the -allowsv parameter in order to flash it.

You can't use FWUpdLcl to try to get overclocking. It doesn't flash over hardware config settings like clock control. I spent many hours with a hex editor then found that out However, it may be possible though to use it to install ME8 to try to get IVB support.

@svl7 using that tool in dos I think I have just dumped my current ME firmware, here it is attached.

EDIT: I cant seem to open my dump with fitc.

EDIT #2: I can open my full bios image with fitc and then I can see the ME region.

EDIT #3: Well I just modded my bios using fitc to match the ME settings found in the m18x-r1 ME FW file.

I think I will flash it now. Wish me luck.

EDIT #4: Flashed my modded bios, no difference. Don't know if the ME firmware really changed or not.

The backup you loaded is a FWUpdLcl formatted backup. This format lacks the clock config at the beginning of the file and adds padding at the end to match the proper file size. Did you try to flash with FWUpdLcl or did you use FPTW? FPTW uses the full properly formatted image with the clock config. If you did flash a proper image with FPTW remember that no new options will open up in the BIOS, and you must use Intel XTU or something similar to make clock changes.

Hmm, so this can enable overclocking in a non -XM CPU?

Yes, although you can only get BCLK overclocking which will max out at around 5%. XM users could possibly gain higher multipliers and unlocked power limits.

[Mobius 1]

Aww man ):

[moral hazard]

Sorry it seems that I was still only flashing the bios and not the whole image.

Really there is nothing left for me to do except the hardware mod and then try FPTW.

[Khenglish]

Sorry it seems that I was still only flashing the bios and not the whole image.

Really there is nothing left for me to do except the hardware mod and then try FPTW.

How would you do that hardware mod? It seems that finding that line coming out of the PCH will be difficult. If you can come up with an idea for the mod I am willing to attempt it too.

[moral hazard]

I thought R194 would be marked on the motherboard, so I was just going to try and spot that resistor and then lift one leg and connect it to GND.

I don't know how I will find out which side of the resistor to lift, but I expect that to become more clear when I find R194.

But due to work, I wont be able to find time for this mod in the next week, so it may be a little while before I can report back.

[moral hazard]

I have a small update, first the intel ME resistor isn't on the motherboard so I can't do the test above.

http://forum.techinferno.com/clevo-sager/2095-clevo-p150hm-hm65-xtu.html#post29352

Second and more interesting news, maybe we can flash the ME firmware if we do what the clevo P170EM notebook users do:

How to flash whole ROM that include ME:

1. Plug in AC adaptor.

2. Run MeSet.EXE under pure DOS, the system will auto cold boot.

3. Run FlashMe.bat under pure DOS.

4. The system display flash complete message after flash success, if the system doesn't shut down automatically please press power button to power off.

5. Plug off AC adapter for 5 seconds then plug in AC adapter.

6. Power on system, the system will shut down automatically.

7. Power on system and enter CMOS setup to check BIOS version and load system defaults.

That is a quote taken from a text document in the latest clevo P170EM bios.

forum.notebookreview.com/sager-clevo/416916-clevo-bios-thread.html

So I wonder if I use MeSet.EXE on my P150HM before trying to flash the ME firmware, would it let me flash?

Will test this eventually when I get some time.