HP 650 BIOS flashrom recovery help! :(

[DARKGuy]

Hello!

It's been years since I made a post here but I finally managed to (unfortunately?) have a motherboard to test some BIOS modding... well, not by choice, but I need to revive it and I just started to get into this world of modding...

Short story / resume:

Cause: ran setup_var to set DVMT size to 1G, write OK but after a reboot, it died.

Problem: No video/LCD backlight/POST/Beeps. Power LED turns on and fan spins but that's it. The idea is to revive it to working state... CPU, LCD, Power, etc. are good because I tried with a spare motherboard and it turned on without issues.

Who: HP 650 Motherboard Part No. 687701-501

Chips: 

• 4MB Winbond W25Q32BVSIG (r/w), let's call it LEFT
  
• 1MB Winbond W25Q80BVSIG (cannot be detected, RDID/REMS error), let's call it RIGHT
  

Tools: 

• Pomona SOIC8 Clip    
  
• Raspberry Pi 3 Model B v1.2    
  
• Spare working motherboard, so I can experiment with this one    
  
• BIOS backup prior to setup_var made with InsydeFlash, 5 MB file   
  
• BIOS dump after non-working setup_var taken with SOIC8 Clip, 4MB chip only    
  
• BIOS dump from spare motherboard, 4MB chip only
  

Resources:

• Service manual: http://h20628.www2.hp.com/km-ext/kmcsdir...0281-1.pdf    
  
• W25Q32BVSIG: https://cdn.hackaday.io/files/7758331918...100413.pdf    
  
• W25Q80BVSIG: https://cdn-shop.adafruit.com/datasheets/W25Q80BV.pdf    
  
• Raspberry Pi pinout: https://github.com/bibanon/Coreboot-Thin...spberry-Pi    
  
• Motherboard image: Attached
  

Notes:

• BIOS recovery method using EFI/USB tool DOES NOT WORK, Phoenixtool didn't give any Recovery filename either. Win+B, Fn+B, Win+Esc, etc. Nope, nada.
  
• When I connect the Clip to LEFT, an orange led nearby to the right (pic here) turns and stays on until the Pi is turned off.
  
• When I connect the Clip to RIGHT, a white led to the far bottom-left of the board (presumably HDD/Power) blinks, which according to the manual it could be Sleep state. It worked for a few times, now it doesn't blink.
  
• Somehow the same pinout in the Clip for LEFT doesn't work for RIGHT, even though the pinout in the datasheet of both chips is identical.
  
• If I invert the Clip (flip 180 degrees) and connect it, the Pi turns off.
  
• Originally, the laptop would turn on and off in a loop, unless I turned it on with Win+B pressed, but it didn't do anything. I tried to strip the first 1024Kb out of the 5MB backup file and flash that 4MB remaining part to the chip, but now it just turns on, fan spins and but it doesn't do anything.
  

I'm kinda running out of ideas here... I'm currently at work now, but I'm thinking that maybe if I flash the dump I have from the spare working motherboard, could it work? I mean, flashing it with the backup didn't make it work but it changed the power-on behavior, which makes me think that doing this could work. It would be a good idea to know what do those two LEDs mean though.

Any help is greatly welcome!

Thanks in advance!
- DARKGuy

[DeathBringer]

Did you tried to remove CMOS battery?
Can you read&write a dump from W25Q32BVSIG?

[DARKGuy]

Did you tried to remove CMOS battery?
Can you read&write a dump from W25Q32BVSIG?

About the BIOS battery, yes of course! no effect though. And yes, I can read/write to the W25Q32 (4Mb) chip.

[DeathBringer]

Give me "BIOS dump after non-working setup_var" and I'll tell what's needed to change.
Tell full "setup_var command" you entered.

[DARKGuy]

Alright, I've attached the BIOS file you have requested, and an image of the setup_var command I ran. Unfortunately that's the only one I have... somehow I had the idea to take a picture just in case . Command was: setup_var 0x198 0x11. Very appreciated! .

[DeathBringer]

Open dump file in HEX-editor.
Go to offset 0x18AE8C
Change 0x11 to 0x02
Write dump to the chip

[DARKGuy]

Open dump file in HEX-editor.
Go to offset 0x18AE8C
Change 0x11 to 0x02
Write dump to the chip

Man you are AWESOME!  !!!! I've been struggling with this for days, well at least I know I have a spare motherboard just in case xD here, it's alive again, THANKS A LOT!! ^_^

   

By the way, is it possible to unlock the Advanced menu on this one? I've been reading the dump file from Phoenixtool, but there's little info about it, and I can't find a setting like "Hidden Pages" for Acer, or which variable to set in order to enable the Advanced menu... I mean, it's there, but it's not being REFerenced anywhere, I guess? I spent this evening on it after bringing the laptop back to life thanks to you, but I'm not sure how to proceed, been wanting to do it myself, but I think I better ask here to someone with more experience than me

[DeathBringer]

By the way, is it possible to unlock the Advanced menu on this one?

I make CPU support mods only.

[DARKGuy]

By the way, is it possible to unlock the Advanced menu on this one?

I make CPU support mods only.

Oh, I see. It's okay though, I have the laptop alive and that is what had me really concerned. However, I don't know if it's a side-effect of the BIOS writing, but somehow changing the 0x198 value, even though it gets changed, after a power cycle it resets to 0x02, so there's no way I can increase the DVMT pre-allocated size? Other values do change, but this one doesn't. I know it changes because if I set it to 0x11 I'm back to the original issue, so I think that somehow it's being reset to that default value upon boot - is that a possibility? and if so, is there any way to override it?

Thanks again!