Sorry I missed you on IRC.

I have not tried his script. However, the error message you pasted shows that block protection is the reason you encountered difficulty. There are basically two copies of the Cr-48 firmware. One is the write-protected recovery copy, and the other is the normal firmware image. The embedded controller has a similar mechanism, and also has its recovery copy write-protected.

Some code in the bootblock (which is write-protected) determines whether to run the recovery mode firmware or the writeable firmware. So the good news is that you can replace the writeable copy pretty easily with Flashrom (That's how we deliver firmware updates). You can find out which regions of the ROM are write-protected using the "--wp-status" command.

If you need to clobber the write-protected stuff as well, then you've got to take the machine apart and make a small mod to prevent /WP from being grounded. You're on your own after that, for obvious reasons ;-)

P.S. I recommend using "-p internal:bus=spi" as an argument to Flashrom to ensure you target the correct firmware chip. Otherwise you might accidentally clobber your embedded controller firmware, which would not be fun at all...