ASRock Z370/Z390 Taichi (and some others, actively modding!) Firmware with Intel Management Engine Disabled

[Anomander43]

@R-T-B , no worries man, even if you don't manage to reply at all, it's still cool!

However I have some more findings to report. So I've tried going from R-T-B's 3.20 to again his 1.80, but it said "Instant Flash - Secure Flash check failed". So I downloaded the official 1.60 and managed to downgrade to it and then managed to successfully install R-T-B's 1.80. However my game fps performance didn't change since 3.20. I have a recording of the game when I was on the original 1.80 and the fps at that time so it's not something I've imagined.
Just for the sake of testing I also installed the unmodded 1.80 and still no change. So I'm guessing it's either another factor that affected the game fps or a combination of factors in which the bios might or might not be included, but it looks like it's not the sole purpose on it's own.
Another thing that I can confirm from my tests is that 3.20 is more stable at least in RAM overclocking potential. I managed to up the clock a bit more and when I reverted to 1.80, the same setup did crash. So I guess I'm staying with R-T-B's 3.20 for now.
I'll let you know if I find anything else, but I don't plan on uninstalling windows updates just to try and figure out what caused it. More like, if I find it by chance

 

[R-T-B]

Thanks for the report. I'll get around to looking at your settings someday... honest, heh.

 

[SomeRandomPerson]

R-T-B, thank you very much for the trailblazing work you're doing here!
Any chance you could make the ME-less version for the Asrock Z370 K6? If you're short on time please just explain what I need to do to the BIOS besides running me_cleaner -S.

Can you tell me what the part number of your BIOS chip is? I'd like to do external flashing and I'd prefer to do my research before buying the board if possible.

Thanks!

 

[Anomander43]

@R-T-B , no pressure, just checking if you plan to do the 3.30 version as well? Not that I know if we need the changes:
1.Update vBIOS and GOP
2.Update Intel RAID driver

 

[R-T-B]

@R-T-B , no pressure, just checking if you plan to do the 3.30 version as well? Not that I know if we need the changes:
1.Update vBIOS and GOP
2.Update Intel RAID driver

Unfortunately my current job requires a TPM for some odd-duck thing so I stopped making these for myself as the Management Engine provides one.

I can still produce a build but it will be 100% untested. Coming right up if willing to play guinea pig. SHOULD be safe but no guarantees you know?

R-T-B, thank you very much for the trailblazing work you're doing here!
Any chance you could make the ME-less version for the Asrock Z370 K6? If you're short on time please just explain what I need to do to the BIOS besides running me_cleaner -S.

The only other step is tricking the sig check... which won't apply to a hardware flash.

Some advice though, you will likely lose your mac if you don't transfer the ethernet firmware beforehand or patch your real image dump.

What I'd personally do is update to the target firmware... Then hardware dump that image and patch/flash that via hardware.

Can you tell me what the part number of your BIOS chip is? I'd like to do external flashing and I'd prefer to do my research before buying the board if possible.

Thanks!

I don't have time to extend support at the moment (employment does that) but it is really just me_cleaner -S plus disabled sig checks. The second part is harder but not needed for a hardware flash...

Don't know about the chip. Next time I dissect my rig I will try and check. I do remember it being supported by flashrom and a ch341a though. That is a great cheap flash board...

EDIT: Just posted an experimental build... try it please (if willing to accept the risks!).

EDIT EDIT: Tested myself, because I had to... Unfortunately does not work if you already updated to official 3.30. Will work from a 1.80 flash I think if you have NOT updated to 3.30 yet. There are technical reasons for this that are too boring to explain, but the bottom line is there is no work around yet. If you have 3.30 on your machine ever, you will need to hardware flash it. By the way, the chip is a winbond W25Q128.V

EDIT EDIT EDIT: Just did a hardware flash and it turns out ASRock does not store the mac in the bios. So hardware flash freely with no concerns, it works fine.

 

[SomeRandomPerson]

Thanks for testing!

Did you do the hardware flash with the ch341a board?
Any issues with insufficient power/did you need to apply another power source to the motherboard?

 

[Anomander43]

Will it work from your v3.20?

 

[R-T-B]

Will it work from your v3.20?

Yes, sorta.

You'll likely need to downgrade briefly to some old version to actually flash due to new restrictions( I reccomend the 1.80 official release) but as long as you've never ran 3.30 official you'll be fine.

Thanks for testing!

Did you do the hardware flash with the ch341a board?
Any issues with insufficient power/did you need to apply another power source to the motherboard?

Re power: yes there are power issues on the bios chip if it's set to active. Just use the backup bios jumper to disable the chip you want to flash though, then it works fine.

 

[SomeRandomPerson]

Unfortunately my board doesn't seem to have that jumper, it seems to be only on the Taichi.

 

[R-T-B]

Unfortunately my board doesn't seem to have that jumper, it seems to be only on the Taichi.

It may work anyways, not certain though. Sorry I can't be more help.

 

[SomeRandomPerson]

I really appreciate all the help you've been giving us.

I received the board and it does have the bios jumper, even though it's undocumented on the manual. Unfortunately it uses a Macronix 25L12873F chip, which isn't supported by flashrom.

I'm almost giving up on external flashing.

Any chance you could edit the Asrock Z370 K6 v3.20 bios for me? Did some googling but couldn't find out how to disable the signature checks. If you don't have time a link that explains how to do it is enough (I can use UEFITool and AMIBCP if needed).

 

[R-T-B]

Any chance you could edit the Asrock Z370 K6 v3.20 bios for me? Did some googling but couldn't find out how to disable the signature checks. If you don't have time a link that explains how to do it is enough (I can use UEFITool and AMIBCP if needed).

The easiest way to remove the sig checks is still pretty invovled. It's also beyond my ability to fully explain, as even I don't understand parts (hence me having issues with their latest attempts to update the sig protection, and requiring most to just flash from a version like 1.80).

I will patch a bios for you though. No issue with doing that, as long as you understand it has a smallish brick risk since I can't test. Weird it's an oddball Macronix like that. It seems they are trying to make everything hard lately. Flashrom will probably add it soon but that doesn't help us now.

PS: Sorry for the late reply, my monitor died and that makes a lot harder for bios work. I need at least 1440p to be productive now.

EDIT: There is a version in the main http://glacialsoftware.net/FIRMWARE/ directory that should flash from a stock 1.80 bios just fine and apply 3.20 as well as remove the management engine. Let me know your results if you can. Unzip and use the built in flash utility from a full stock 1.80 bios.

It should be here.

 

[Shou Miko]

@R-T-B I am still happy to see you keep updating the bios for the Z370 Taichi

 

[R-T-B]

@R-T-B I am still happy to see you keep updating the bios for the Z370 Taichi

I try... unfortunately ASRock seems to have taken an objection and are making things harder every update!

 

[SomeRandomPerson]

Thanks but before you posted I'd already flashed my BIOS.

What I did was run me_cleaner -S on the K6 bios and swap the ME region for the one on your Taichi 3.2 modded bios using a hex editor.

It flashed fine and seems to have worked. ME doesn't show up in any of the usual Linux commands.

I see that you also FF'd section 5A88641B-BBB9-4AA6-80F7-498AE407C31F of the BIOS region (addresses 534D1C to 535D1B). Should I worry that I didn't do that? What does that do?

Thanks again!

 

[R-T-B]

I see that you also FF'd section 5A88641B-BBB9-4AA6-80F7-498AE407C31F of the BIOS region (addresses 534D1C to 535D1B). Should I worry that I didn't do that? What does that do?

That's usually sigchecking code. If it works without it, no worries then! Intriguing.

 

[SomeRandomPerson]

Did you or anyone else here test if NVMe drives work properly with these mods?

 

[Shou Miko]

Did you or anyone else here test if NVMe drives work properly with these mods?

I have tried 2 Samsung nvme's one 960 evo 250gb the other 970 evo 500gb both works flawless

 

[R-T-B]

Working on adding support for the Z370 Gigabyte Aorus Gaming 7. it's being suprisingly tough. It appears to have DXE's that implement Intel Boot Guard, which is unusual for a gigabyte board. I have already bricked it once (yes, both dual bioses) and am waiting on my hardware programmer to recover it. This may take a while... will update with my interesting findings...

 

[R-T-B]

Chip we are seeing for reference. Ch341a and AsProgrammer on github can read/write it.

 

[R-T-B]

z370 gaming 7 Board is bootlooping again. I've almost worn out my programers clip. Man, Gigabyte really went all out on protection of the ME region for some reason...

EDIT: Gigabyte somehow killed itself. As best I can figure the 9900k depends on the Intel ME in some way, at least on the gaming 7. Will investigate further... on my taichi. Will need to do some explaining to the donor and hope that's enough... I mean there are no promises here.

 

[R-T-B]

Client is ok with me failing to support the gigabyte g7. Very nice guy just hoping for the best... sorry I could not do more there!
For the Taichi: 3.40 is up at the usual place now. Should flash normally from official 1.80 (aware 9th gen users cannot run that, working on a fix, in the meantime try official 3.20)

EDIT: 3.40 temporarily pulled. Bootloops. Working on it. Thank goodness for dual bios.

 

[R-T-B]

This is a PSA that ASRock has made some significant undocumented bios changes in 3.40. At this time, I do not expect if you update to the latest official, you will be able to switch back to my mod without a hardware programmer. Please avoid for the time being.

EDIT: Tested & working 3.40 is up at the usual place now. Should flash normally from official 1.80 or earlier (aware 9th gen users cannot run that, working on a fix, in the meantime using hardware flasher is my advice).

If you have ever ran official 3.40 it may not work.

 

[R-T-B]

As my Z370 Taichi died mysteriously (no, not related to my modbios, I am sure) I have purchased a new z390 taichi to replace it. Will see if support for that board is possible. I will support the z370 taichi as usual but won't be able to test before release anymore.

 

[R-T-B]

The z390 Taichi is now supported. It was a very diffilcult board but all z390 boards will likely be the same if not harder.

Why? Intel changed the format of the management engine region of the bios in ME 12, which is used in z390 on up. This means we can't mod it using open source tools like me_cleaner anymore.

Not content to just give up with that, I used an undocumented mode intended for government targets to instruct the ME to turn itself off (credit to people much more skilled than me for finding this). Since the government trusts intel with this mode and it is pretty much certainly Intel's mode for computers they sell to government clients with data sensitive needs, I think we can assume that even though the management engine firmware is still present, it turns itself off just like it tells you. The government would be all over them if they were lying about that.

How long that mode will remain now that the public has discovered it is anyones guess... For now, here is bios 1.80 for the Z390 Taichi with ME disabled. Find it in the usual spot.

Be aware, the procedure to activate this mod is slightly different. You MUST first flash official 1.80. This is not negotiable, it must happen.

After that, unzip the archive, open an admin command prompt, and cd to the directory you unzipped the archive too.

Type "flashme" and wait for it to finish.

Reboot and go straight to bios.

You should be presented for a few moments with a menu similar to the following, the full unlocked bios. You don't want to horse around with 90% of this stuff, it's dangerous. The only thing you want is under "PCH-FW Configuration." Go there.

Under that menu you have a nice menu option that lets you turn the ME on and off at whim. NOTE: Despite the wording "ME Temporarily Disabled," it is permanent short of anything that resets your CMOS. Not often that happens and if it does, you can just turn it off again.

So, test, enjoy, and let me know if any bugs appear. Seems to work for me!