Modify AMI Aptio4 BIOS for HP Pavilion 500-549ng

[treysis]

Hey everyone,

I have a probably rather complicated problem. I have a HP Pavilion 500-549ng Desktop PC, which is affected by the newest Spectre security vulnerability. Though HP did supply an updated BIOS, I cannot install it! I suspect the reason is that HP changed the version number scheme, and therefor the update routine refuses to install the newer version number, because it actually thinks that this number is lower.

But let me explain more: I downloaded the BIOS update from here: http://ftp.hp.com/pub/softpaq/sp84001-84500/sp84453.exe
The description for the update is found here: https://support.hp.com/de-de/drivers/selfservice/swdetails/hp-pavilion-500-500-desktop-pc-series/7477729/model/8902926/swItemId/cp-202533-1
After I installed the update, my BIOS actually did some update. But as it turned out, it just got updated to 80.08, not A0.15, as shown in the release notes. I noticed in past BIOS updates that the version information was not correct, but I didn't think of any. Only now with the Meltdown&Spectre situation did I also investigate the CPU microcode. As the Microsoft checktool for Meltdown&Spectre showed me my PC was still vulnerable, I investigated more, and I found out that the microcode is still at a much older revision.

So, I looked at the update package, and strangely it comes with two different updates! If I extract the update file, I get two update-EXEs, one ME2_8008.exe, and one ME2_A015. But if I try to install the ME2_A015, the PC will reboot into BIOS and everything, but then complains that the image file did not pass validation. First of, if I download any other firmware update for HP computers, they only contain one BIOS update. Second, HP did change the versioning scheme from 80.0x to A0.xx. I therefor assume that the update program doesn't recognize that A0-versions are newer, and downgrades are not allowed, due to SMI(?) security checks.

Also, if I open the .bin-files for the update in AMIBCP, the board version and revision are identical. So both versions do seem to be correct for my board. If I go to "DMI tables"->"BIOS information", I see the following in the right pane:
1 AMI
2 80.08
3 04/17/2017
and for the newer BIOS I see the following:
1 AMI
2 4.6.5
3 12/19/2017
Here, the BIOS versions with 80.0x numbering all show the corresponding number under (2). But all A0 versions show the same 4.6.5 under (2).

If I go to tab "BIOS Features", major and minor version all show the corresponding (with major being 80, or A0, and minor being 06, 07, 08, or 11, 12, 14, 15...).

So, what to do now? Is there a way to remove the SMI security check? I was thinking about "patching" a newer BIOS to have the same versioning scheme as the old ones, and increase it a little bit. But I assume there will be a signature check as well (which would fail).

Or is that a feasible approach?

I would even go in there with an SPI programmer of some sort (I have a TL866CS). But I'd rather do it without.

Ah, it's a Memphis2-S board by Pegatron, IH87 chipset: https://support.hp.com/my-en/document/c04648625

Thank you and sorry if I posted in the wrong forum.

[treysis]

So I've made some progress on this issue:

after changing the FDO jumper (flash descriptor override) I am now able to read and write the BIOS with Intel's Flash Programming Tool from the ME System Tools (v9.5 r6).

So I've played around a little. I could flash a newer version than 80.08 (e.g. A0.14) and then use the normal update routine to update to the newest A0.17. However, since the newer versions are just flashed 1:1 they don't contain my system data like serial number of mainboard, service tag, Windows 8 serial, probably also missing the MAC address.

Now if I flash back the dumped 80.08 I get all those data back, but I'm again not able to update. At least I was able to integrate the Haswell microcode update against Spectre/Meltdown. But I'd still like to update the bios in general.

My theory is still that the update mechanism checks for the bios version and thinks that 80.08 is newer than A0.17, and therefor refuses to accept the update. I wonder if it is maybe possible to change the version number of my current 80.08 to something like let's say A0.08 so that I can then use the normal update routine to get to the newest BIOS version while retaining all system specific data.

So far, I've tried editing it with UEFITool oder AMIBCP 4.53, but it seems I am always missing some parts. That is, I wasn't able to change the version number. I changed some strings, but when I flashed that bios and rebooted it would still show the original 80.08. Maybe I am overlooking something? Please, could somebody with better knowledge have a look at the attached dump?

BIOS 80.08 with microcode v.24 for Haswell
https://www.sendspace.com/file/xpc6gq

PS: I x-ed out part of the Windows 8 serial since I didn't want it to appear on the net forever.