Can i get general instructions for modifying AMI bios ?

[Lost_N_BIOS]

Not sure what you are trying to do there? But I've never suggested those FPT commands. What is it you're trying to do with FPT?
And, what is your ME FW version, and which ME System tools package version are you using FPT from? You need matching ME System tools package, to get FPT from, that matches your ME FW version.

Then, once you have that, here is the correct command to dump the BIOS region >> FPTw.exe -bios -d biosreg.bin (Remove w from fpt if using DOS)

ME System Tools packages are here in section "C"
https://www.win-raid.com/t596f39-Intel-M...Tools.html

If you corrupted the BIOS you might not be able to dump it with FPT, nor would you want to except for to try and preserve/copy your board specific details out to another BIOS (Serial, UUID etc)

[chaus]

In an earlier message, you wrote "Is this an Intel based system, that has Intel ME? If yes, you should use Intel FPT to dump BIOS region, modify, then reflash the BIOS region"

So i found FPT, and was trying to dump the BIOS contents.

I'm not sure what my ME version is, or even if i have ME at all. As for the system tools package, iirc i found it in an attachment to a message somewhere on this forum, i'm not sure what the version is.

Sorry for not being very clear!

[Lost_N_BIOS]

I know I said that, but I never gave you directions, was waiting for you to check your ME FW version then I could give you proper directions.

Did you recover the board now? If yes, find ME FW version then you can get correct FPT in above link, then use command I gave above to backup the BIOS region to modify. To check ME FW version, check on BIOS main page, it may be shown there. If not, download HWINFO64 and on the large window, expand motherboard section, then go to ME section and find the ME Firmware version. Once you know the ME FW version (Just the first digit (or two if 10-12) is needed, then download the correct matching ME System Tools Package at the link I gave you above.

Inside that will be Flash Programming Tool folder, then a Windows/Win or DOS folder if you are wanting to do from DOS, inside those will be correct FPT for your system.

[chaus]

Thanks again for your suggestions!
So according to intel's tool here: https://superuser.com/a/1283343/5296
My ME details are:

Code:

*** Intel(R) ME Information ***
   Engine: Intel(R) Management Engine
   Version: 9.1.0.1120

I'll try finding the correct tools package next, cheers

[Lost_N_BIOS]

You need this package from link above >> •Intel ME System Tools v9.1 r7

Inside you will find Flash Programming Tool folder, and inside that a windows or win/win43 folder. Select that win folder, hold shift and press right click, choose open command window here (not power shell).

Then run this command to make backup of BIOS region >> FPTw.exe -bios -d biosreg.bin

To flash back >> FPTw.exe -BIOS -d modfilename.bin

You may need to unlock "BIOS Lock" first before you can flash back, this is done by changing the default variable in the setup module (For the BIOS mod part) To unlock it on the BIOS in the board now you need to use grub and setup_var, here is a guide I wrote on doing that
https://www.win-raid.com/t3908f16-GUIDE-...-BIOS.html

[chaus]

Long story short: It works now!!! SUCCESS

Sorry for long time with no replies, as i was waiting for my CH341A programmer to arrive from china.

Unplugged my lenovo PC, and clipped it to the chip i mentioned in an earlier post (yellow arrow). The chip has a dot on pin 1, which i matched to the red stripe on the clip's cable.

On my mac, i installed flashrom: brew install flashrom

Tried to extract with: flashrom -p ch341a_spi -r read.bin
But it wanted to know the exact chip type, so tried again with: flashrom -p ch341a_spi -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" -r read.bin
Success!
Verified it was reading reliably with: flashrom -p ch341a_spi -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" -v read.bin
More success!

I opened the bin file in UEFItool, found the correct GUID as described in an earlier post, patched it with Hopper / Hex fiend as also described earlier.

Re-flashed the BIOS with: flashrom -p ch341a_spi -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" -w modified.bin

Unclipped everything, enabled wifi in the bios, rebooted, and it just works now! Fantastic.

I apologise for not trying with the ME System tools you recommended, it's difficult for me to get to a non-mac PC to create bootable DOS USBs. Plus i figured hacking it with a hardware flasher would be interesting, which it was! For anyone else who wants to do this in future, to be honest, you could buy the CH341A flasher, or for about the same money, just buy a lenovo-approved wifi card. Certainly an interesting exercise however

[Lost_N_BIOS]

Great you got it sorted out with CH341A.
Sorry I didn't know you were having a hard time to make DOS Bootable USB on MAC, if I knew I could maybe try and help you find a way.

[chaus]

All's well that ends well! Pretty happy with it all, and thanks a million for your help

Hopefully this can be helpful to someone in future.

[Lost_N_BIOS]

You're welcome, and yes it's always good to see happy ending

I'm sure others will run into this thread in the future as you mentioned

[Capissen38]

You're welcome, and yes it's always good to see happy ending

I'm sure others will run into this thread in the future as you mentioned

Perhaps sooner than you think! I got an M73 to use as a pfSense box, and wanted a second mPCIe GbE interface. Got one on eBay, but quickly discovered the dreaded whitelist. I got the black CH341A and a clip, and have been hopping around online for the past couple days learning waaay more about UEFI than I'd ever expected to. I was making progress but hitting roadblocks since the structure of the AMI BIOS is apparently different than the Phoenix BIOS commonly used in laptops. But you and chaus in this thread got me pointed in the right direction, and I'm happily running a whitelist-free M73 TFF now! I can't thank you folks enough.

For future people, here's what I used:

- This article got me started: https://medium.com/@p0358/removing-wlan-...033a5a5e5a
- CH341A programmer (the "black" one) with SOIC8 clip to gain access to the ROM (note that you might have to really futz with the clip to get it to work)
- AsProgrammer to dump the ROM and then erase/reprogram it
- UEFITool for searching through the EFI modules, and the older version of UEFITool to commit changes back to the ROM file
- HxD for making the actual edit

In the end, all I did was change '74' at 0x41C4 to 'EB'. That's it, folks!