ThinkPad T480s (and probably others) flashing guide
This guide will cover instructions for flashing a T480s
with broken Intel ME Firmware.
Prerequisites
- A Python install
- A ThinkPad with a disabled Battery (BIOS, Power, Disable internal battery)
- A second PC with (at least for this guide) Windows
- A BIOS-Programmer
Table of content
SymptomsSymptoms:
No ME Firmware Version visible in BIOS
No Intel AMT Option in F12 Boot Menu
Very slow boot time (1min+) - could also be Thunderbolt issue.
Fix
BIOS Programmer
To fix this issue, a BIOS Programmer is needed.
Thankfully, they can be found for really cheap on AliExpress etc.
In this Guide, i used this programmer.
Be sure to select something that includes CH341 under "Color" otherwise you might end up with only a test clip.
The shipping of this went suprisingly fast, it took only 6 business days to ship to Germany.
Dumping the BIOS
Software
In this guide, i will use Windows as my OS of choice.
Doing this is certainly possible in Linux too, but i haven't had any experience with it yet.
For Chip Operations, you can choose between NeoProgrammer or AsProgrammer.
They are basically the same, but AsProgrammer is open-source.
I used NeoProgrammer. It comes with drivers already, which is pretty handy.
To install needed Drivers with NeoProgrammer, simply navigate into NeoProgrammer's Folder
and then into the Folder called 'Drivers'
There, you will find another Folder called CH341A and an Image.
The Programmer comes with its jumpers set as needed, but just to make sure,
take a look at the image and confirm your Jumper is set exactly like in the Image.
Then, navigate into 'CH341' and run SETUP.exe. This requires Admin access.
Installation is pretty simple, just press 'INSTALL'
After installing the Drivers, you should be all set. Navigate into NeoProgrammer's Folder and run NeoProgrammer.exe.
In NeoProgrammer, go to 'Hardware' and select 'CH341 Black'. back to identifying
Plug in your Programmer without anything connected to it.
In NeoProgrammer, click on the Icon with the green question mark.
Now check in the Log below. It should output:
Current programmer: CH341 Black
IC not responding
If it outputs that, everything worked well until here.
If it outputs something like
Connecting Error CH341(Not found)
Connecting Error CH341(Not found)
Connecting Error CH341(Not found)
IC not responding
check if you have plugged the Programmer in firmly (also avoid USB-Hubs or similar) and if that doesnt fix it, reinstall the Drivers.
Hardware / actually dumping
Remove the programmer from your computer.
Locate your Connector that has a black plastic plug on it.
Plug your test clip into the plastic plug. It's only possible in one way, so you cant mess it up.
If not already done, raise the insertion lever on your Programmer.
Make sure your programmer's USB-port is facing to the LEFT.
Locate your right wire from your test clips cable.
Plug the connector in with the red wire facing to the TOP RIGHT and the connector to the most left position possible.
Then, press the insertion lever down.
It should look like this now.
Now, open up your ThinkPad. On the T480s, just remove the bottom cover.
Locate your BIOS Chip. For the T480s, it is right next to the DIMM slot. It should read either WinBond or MXIC.
For future reference, take a picture of it.
The chip has a small hole on one pin. This is the first pin.
Locate your red wire on your Test Clip.
Now, attach your test clip in a way the red wire aligns with the Pin with the hole above it. back to re-writing
Attaching can be a bit tricky. Try to see if your Clamp is clamped on the chip properly and no Test Clip Pin is bent.
Succesfully attached clip (from u/ibrakestuff) - check out his guide!
Now, connect your Programmer to your PC. Be careful not to rip off the test clip.
If not already opened, open NeoProgrammer.
Be sure you have still selected CH341 Black. (see here)
In NeoProgrammer, once again press the Icon with the green question mark. back to re-writing
A menu should pop up, asking about your Chip type.
Depending on what your chip read earlier, select the exact model of your chip.
After selecting your Chip, select the icon with the green arrow.
Congrats, you are now dumping your BIOS. Wait for the dump to finish.
After finishing the dump (NeoProgrammer will log 'success!'), click on the save icon.
Save the bios file to a directory of your liking. Be sure to change the file ending to .bin.
After saving, first (!) disconnect your programmer from your PC, then remove the test clip.
Then, head to your saved .bin file folder.
If you have found the .bin file, back it up. Back it up, really. This is important.
Fixing the Intel ME
After backuping it, copy it one more time to a directory of your liking. We will work with it now.
MEA(nalyzer)
Download MEAnalyzer.
After downloading, extract the .zip file and copy your dump into it.
In Windows Explorer, click on your current directory and just type 'cmd'
A command prompt will open. Type in: 'MEA.py (yourdumpfilename).bin
C:\Users\xyz\xyz\MEAnalyzer-r365>MEA.py xyz.bin
A window will open, asking for options. Just press enter to skip, you dont need any.
Then, a window like this will open.
What is important here is the Version, SKU, Chipset and Power Down Mitigation. Take a Screenshot or note these down.
With your screenshot taken, you can close MEA again.
Flash Image Tool (FIT)
Head to this folder.
Select your matching CSME Version.
11.xx = first numbers of your Version.
CON/COR = First word of your SKU (CONsumer or CORporate)
LP C / H A = last Letters of your Chipset.
NPDM/YPDM = Power Down Mitigation (yes = Y, no = N)
For my BIOS, CSME 11.8 COR LP C NPDM was the right one.
Download and extract the folder.
Navigate to this folder.
Select your matching System Tools version.
e.g. for CSME Version 11 in MEA.py, select CSME System Tools v11.
Download and extract this folder again.
With everything downloaded and extraced, head into your CSME System Tools Folder.
Head into the 'Flash Image Tool' Folder.
Run fit.exe
Click on file, then open. Open your bios dump (any copy of your liking)
Under 'Flash Layout' On the left, scroll down until you find 'Intel ME Region'
Find the Parameter 'Intel ME Binary File' and click on its Value (a file path)
A window will open, asking if you are sure. Click yes.
Click the three dots under value and select your Intel ME .bin file from your extraced CSME folder.
After selecting your new ME file, go to Build -> Build Image.
When building has finished, exit Firmare Image Tool again, but open its Folder.
There should be a file called outimage.bin now.
If you have found the file, congrats again. Your Intel ME is now most likely fixed.
Writing the fixed BIOS back to the Chip
Open NeoProgrammer again.
Without plugging the programmer in (!), Connect your Clip to your Chip again (as here).
Plug in the programmer and identify the chip to test (as here)
Now, press Ctrl+O and open your outimage.bin from the Flash Image Tool folder.
After opening it, press the icon with the red X on top of a chip.
It should now erase the Chip. This can take a while, for me, it took about a minute.
If it outputs 'success', your chip is now erased.
Now, press the button with the blue arrow to write your fixed BIOS to the chip.
This also takes its time. For me it took about 3 minutes.
If it finishes, you can optionally verify that your flash went well. To verify, press the icon with the equal sign.
After all of this, your ThinkPad should be fixed now.
Disconnect the Programmer from your PC, disconnect the Clip and screw your bottom cover back on.
Connect your ThinkPad to its AC, enter BIOS, and see if ME Firmware Version is present now.
I hope i could help you with this guide. Cheers ^^