HP ProDesk 600 G6 Mini BIOS unlocked - now EC can't find valid firmware

[slavetothesound]

I Used a T48 and RCUnlocker to remove password from the BIOS on a previously fully functional HP ProDesk 600 G6 Mini. Everything went very smoothly and I was able to boot the machine and install an OS. I then unplugged the machine and put it on the shelf for a week.

Now when I boot the machine, it does not POST. It plays 5.2 beep codes which are interpreted as:

The embedded firmware controller cannot find valid firmware

I read the firmware with the T48 and it is different than what I flashed to it, so I flashed the unlocked firmware that I had saved. No change. I could use some advice on next steps to take.

I can only speculate from inexperience, but this machine has vPro on it and perhaps that chip needed some flashing as well?

[slavetothesound]

Thought about it a little bit... I have the original password protected BIOS saved. I will try to flash that back and see if the situation improves.

[slavetothesound]

1. Flashed the original working BIOS back.
2. Machine boots with "There is a problem with the HP Endpoint Security Controller on the unit. The Endpoint Security Controller settings havebeen recovered to their default state."
3. Flashed the unlocked BIOS again.
4. Machine Boots, BIOS are unlocked.
5. Updated BIOS to latest version (ME and USBC also updated).
6. The Management Engine section of the BIOS is still locked.. Any ideas how to go about unlocking this? BIOS current state attached.
7. I also had a look at the BIOS files in ME Analyzer and there are some errors about corruption both on the current version and the locked version before I changed anything.

╔═══════════════════════════════════════════╗
║ ME Analyzer v1.307.0 r345 ║
╚═══════════════════════════════════════════╝

╔═══════════════════════════════════════════════╗
║ updated-unlocked.BIN (1/1) ║
╟───────────────────────────────┬───────────────╢
║ Family │ CSE ME ║
╟───────────────────────────────┼───────────────╢
║ Version │ 14.1.65.1969 ║
╟───────────────────────────────┼───────────────╢
║ Release │ Production ║
╟───────────────────────────────┼───────────────╢
║ Type │ Extracted ║
╟───────────────────────────────┼───────────────╢
║ SKU │ Corporate H ║
╟───────────────────────────────┼───────────────╢
║ Chipset Stepping │ A ║
╟───────────────────────────────┼───────────────╢
║ TCB Security Version Number │ 1 ║
╟───────────────────────────────┼───────────────╢
║ ARB Security Version Number │ 11 ║
╟───────────────────────────────┼───────────────╢
║ Version Control Number │ 31 ║
╟───────────────────────────────┼───────────────╢
║ Production Ready │ Yes ║
╟───────────────────────────────┼───────────────╢
║ OEM Configuration │ No ║
╟───────────────────────────────┼───────────────╢
║ FWUpdate Support │ Impossible ║
╟───────────────────────────────┼───────────────╢
║ Date │ 2022-03-24 ║
╟───────────────────────────────┼───────────────╢
║ File System State │ Error ║
╟───────────────────────────────┼───────────────╢
║ Size │ 0x148000 ║
╟───────────────────────────────┼───────────────╢
║ Flash Image Tool │ 14.0.53.1649 ║
╟───────────────────────────────┼───────────────╢
║ Chipset Support │ CMP-H/LP ║
╚═══════════════════════════════╧═══════════════╝
╔═════════════════════════════════════════════╗
║ Power Management Controller ║
╟─────────────────────────────┬───────────────╢
║ Family │ PMC ║
╟─────────────────────────────┼───────────────╢
║ Version │ 140.2.01.1018 ║
╟─────────────────────────────┼───────────────╢
║ Release │ Production ║
╟─────────────────────────────┼───────────────╢
║ Type │ Independent ║
╟─────────────────────────────┼───────────────╢
║ Chipset SKU │ H ║
╟─────────────────────────────┼───────────────╢
║ Chipset Stepping │ A ║
╟─────────────────────────────┼───────────────╢
║ TCB Security Version Number │ 3 ║
╟─────────────────────────────┼───────────────╢
║ ARB Security Version Number │ 3 ║
╟─────────────────────────────┼───────────────╢
║ Version Control Number │ 0 ║
╟─────────────────────────────┼───────────────╢
║ Production Ready │ Yes ║
╟─────────────────────────────┼───────────────╢
║ Date │ 2021-02-22 ║
╟─────────────────────────────┼───────────────╢
║ Size │ 0x14000 ║
╟─────────────────────────────┼───────────────╢
║ Chipset Support │ CMP ║
╚═════════════════════════════╧═══════════════╝
╔═══════════════════════════════════════════════════════╗
║ Platform Controller Hub Configuration ║
╟─────────────────────────────┬─────────────────────────╢
║ Family │ PCHC ║
╟─────────────────────────────┼─────────────────────────╢
║ Version │ 14.0.0.7002 ║
╟─────────────────────────────┼─────────────────────────╢
║ Release │ Production, Engineering ║
╟─────────────────────────────┼─────────────────────────╢
║ Type │ Independent ║
╟─────────────────────────────┼─────────────────────────╢
║ TCB Security Version Number │ 0 ║
╟─────────────────────────────┼─────────────────────────╢
║ ARB Security Version Number │ 0 ║
╟─────────────────────────────┼─────────────────────────╢
║ Version Control Number │ 0 ║
╟─────────────────────────────┼─────────────────────────╢
║ Production Ready │ Yes ║
╟─────────────────────────────┼─────────────────────────╢
║ Date │ 2020-06-12 ║
╟─────────────────────────────┼─────────────────────────╢
║ Size │ 0x1000 ║
╟─────────────────────────────┼─────────────────────────╢
║ Chipset Support │ CMP ║
╚═════════════════════════════╧═════════════════════════╝

Error: Firmware is incomplete/corrupted, expected 0x2000000 not 0xFFE000!

Error: Skipped MFS partition at 0x81FF0, unrecognizable format!

Warning: Firmware size exceeds Engine/Graphics region, possible data loss!

Note: Adjusted buffer to Flash Descriptor 0x2000 - 0x2002000!

[hoaca388]

[QUOTE=slavetothesound;n3251907]

1. Flashed the original working BIOS back.
2. Machine boots with "There is a problem with the HP Endpoint Security Controller on the unit. The Endpoint Security Controller settings havebeen recovered to their default state."
3. Flashed the unlocked BIOS again.
4. Machine Boots, BIOS are unlocked.
5. Updated BIOS to latest version (ME and USBC also updated).
6. The Management Engine section of the BIOS is still locked.. Any ideas how to go about unlocking this? BIOS current state attached.

Serial number ?

[slavetothesound]

Serial number ?

MXL1515LDX

[rex98]

1. Flashed the original working BIOS back.
2. Machine boots with "There is a problem with the HP Endpoint Security Controller on the unit. The Endpoint Security Controller settings havebeen recovered to their default state."
3. Flashed the unlocked BIOS again.
4. Machine Boots, BIOS are unlocked.
5. Updated BIOS to latest version (ME and USBC also updated).
6. The Management Engine section of the BIOS is still locked.. Any ideas how to go about unlocking this? BIOS current state attached.
7. I also had a look at the BIOS files in ME Analyzer and there are some errors about corruption both on the current version and the locked version before I changed anything.

╔═══════════════════════════════════════════╗
║ ME Analyzer v1.307.0 r345 ║
╚═══════════════════════════════════════════╝

╔═══════════════════════════════════════════════╗
║ updated-unlocked.BIN (1/1) ║
╟───────────────────────────────┬───────────────╢
║ Family │ CSE ME ║
╟───────────────────────────────┼───────────────╢
║ Version │ 14.1.65.1969 ║
╟───────────────────────────────┼───────────────╢
║ Release │ Production ║
╟───────────────────────────────┼───────────────╢
║ Type │ Extracted ║
╟───────────────────────────────┼───────────────╢
║ SKU │ Corporate H ║
╟───────────────────────────────┼───────────────╢
║ Chipset Stepping │ A ║
╟───────────────────────────────┼───────────────╢
║ TCB Security Version Number │ 1 ║
╟───────────────────────────────┼───────────────╢
║ ARB Security Version Number │ 11 ║
╟───────────────────────────────┼───────────────╢
║ Version Control Number │ 31 ║
╟───────────────────────────────┼───────────────╢
║ Production Ready │ Yes ║
╟───────────────────────────────┼───────────────╢
║ OEM Configuration │ No ║
╟───────────────────────────────┼───────────────╢
║ FWUpdate Support │ Impossible ║
╟───────────────────────────────┼───────────────╢
║ Date │ 2022-03-24 ║
╟───────────────────────────────┼───────────────╢
║ File System State │ Error ║
╟───────────────────────────────┼───────────────╢
║ Size │ 0x148000 ║
╟───────────────────────────────┼───────────────╢
║ Flash Image Tool │ 14.0.53.1649 ║
╟───────────────────────────────┼───────────────╢
║ Chipset Support │ CMP-H/LP ║
╚═══════════════════════════════╧═══════════════╝
╔═════════════════════════════════════════════╗
║ Power Management Controller ║
╟─────────────────────────────┬───────────────╢
║ Family │ PMC ║
╟─────────────────────────────┼───────────────╢
║ Version │ 140.2.01.1018 ║
╟─────────────────────────────┼───────────────╢
║ Release │ Production ║
╟─────────────────────────────┼───────────────╢
║ Type │ Independent ║
╟─────────────────────────────┼───────────────╢
║ Chipset SKU │ H ║
╟─────────────────────────────┼───────────────╢
║ Chipset Stepping │ A ║
╟─────────────────────────────┼───────────────╢
║ TCB Security Version Number │ 3 ║
╟─────────────────────────────┼───────────────╢
║ ARB Security Version Number │ 3 ║
╟─────────────────────────────┼───────────────╢
║ Version Control Number │ 0 ║
╟─────────────────────────────┼───────────────╢
║ Production Ready │ Yes ║
╟─────────────────────────────┼───────────────╢
║ Date │ 2021-02-22 ║
╟─────────────────────────────┼───────────────╢
║ Size │ 0x14000 ║
╟─────────────────────────────┼───────────────╢
║ Chipset Support │ CMP ║
╚═════════════════════════════╧═══════════════╝
╔═══════════════════════════════════════════════════════╗
║ Platform Controller Hub Configuration ║
╟─────────────────────────────┬─────────────────────────╢
║ Family │ PCHC ║
╟─────────────────────────────┼─────────────────────────╢
║ Version │ 14.0.0.7002 ║
╟─────────────────────────────┼─────────────────────────╢
║ Release │ Production, Engineering ║
╟─────────────────────────────┼─────────────────────────╢
║ Type │ Independent ║
╟─────────────────────────────┼─────────────────────────╢
║ TCB Security Version Number │ 0 ║
╟─────────────────────────────┼─────────────────────────╢
║ ARB Security Version Number │ 0 ║
╟─────────────────────────────┼─────────────────────────╢
║ Version Control Number │ 0 ║
╟─────────────────────────────┼─────────────────────────╢
║ Production Ready │ Yes ║
╟─────────────────────────────┼─────────────────────────╢
║ Date │ 2020-06-12 ║
╟─────────────────────────────┼─────────────────────────╢
║ Size │ 0x1000 ║
╟─────────────────────────────┼─────────────────────────╢
║ Chipset Support │ CMP ║
╚═════════════════════════════╧═════════════════════════╝

Error: Firmware is incomplete/corrupted, expected 0x2000000 not 0xFFE000!

Error: Skipped MFS partition at 0x81FF0, unrecognizable format!

Warning: Firmware size exceeds Engine/Graphics region, possible data loss!

Note: Adjusted buffer to Flash Descriptor 0x2000 - 0x2002000!

you erased the wrong nvramacticeregion, upload here the untouched original main and ec.

[slavetothesound]

you erased the wrong nvramacticeregion, upload here the untouched original main and ec.

Here's the firmware I originally read from the device before unlocking. Read twice to verify. It still shows errors in ME Analyzer. I'm guessing this was modified or corrupted before I acquired the device on /r/homelabsales.

Guessing at the relevant bits of output from ME Analyzer:

║ File System State │ Error

....

Error: Firmware is incomplete/corrupted, expected 0x2000000 not 0xFFE000!

Error: Skipped MFS partition at 0x81FF0, unrecognizable format!

Warning: Firmware size exceeds Engine/Graphics region, possible data loss!

Note: Adjusted buffer to Flash Descriptor 0x2000 - 0x2002000!

[slavetothesound]

upload here the untouched original main and ec.

is there more than one chip I should read from? I’ve only read from the chip in the far bottom left. The one labeled BUOS was something like ‘70’ or ‘17’ repeating. Can’t remember exactly.

[rex98]

Here's the firmware I originally read from the device before unlocking. Read twice to verify. It still shows errors in ME Analyzer. I'm guessing this was modified or corrupted before I acquired the device on /r/homelabsales.

Guessing at the relevant bits of output from ME Analyzer:

here

[slavetothesound]

here

Thanks for this! Should have time to try this out tomorrow evening.

[slavetothesound]

here

It booted with a message like “finishing the final step of your bios update”, then reboots. It seems to be the same as before - the BIOS is still unlocked, but I can't access the MEBx configuration. I enter the default password “admin” and it prompts for a new password, but errors when it goes to save the new password.

MEBx Login Error
Error applying new password

[slavetothesound]

Ohhhhh there’s a password complexity requirement that I was not aware of. Everything works!

Thanks you all for your help. It turns out my test password just wasn’t good enough. I wish software engineers would provide more helpful error messages in their programs.