[flashrom] Flash Access on Shuttle XH170V failed

[Nico Huber]

On 23.03.2017 20:26, Michael Fuckner wrote:
> Hi,
> 
> I got a file, 8MB in size and it contains data. md5sum is not identical
> to original file and binwalk looks different on the beginning.

Not sure, what an "original" file would be. The flash contains data that
is specific to your device like serial numbers, the MAC address etc.
Also, at least two of the firmwares in your flash are self-modifying
(ME, UEFI).

> The original file starts with 0x258988, so this is the area for ME and
> Ethernet Config?

What is 0x258988 supposed to mean? an offset? I doubt that binwalk can
give any thorough report of the flash image though.

Let's have a look at your log:

> === Region Section ===
> FLREG0   0x00000000
> FLREG1   0x07ff0200
> FLREG2   0x005a0000
> FLREG3   0x5a000000
> FLREG4   0x00000000
> 
> --- Details ---
> Region 0 (Descr.) 0x00000000 - 0x00000fff
> Region 1 (BIOS  ) 0x00200000 - 0x007fffff
> Region 2 (ME    ) 0x00000000 - 0x0005afff
> Region 3 (GbE   ) 0x00000000 - 0x01a00fff
> Region 4 (Platf.) 0x00000000 - 0x00000fff

This is part of the Firmware Descriptor, the first part of any modern
Intel flash image. Beside many other things it contains this partition
table. It looks very odd, with overlapping regions. I haven't looked
into changes in the descriptor for Skylake yet, maybe it's not decoded
correctly.

However if you want to verify your image you can try to decode the read
descriptor:

  $ make -Cutil/ich_descriptors_tool/
  $ util/ich_descriptors_tool/ich_descriptors_tool -f flash.bin

It should give you the same output that you can find in your log.

Thanks again for testing and your log, it's nice to see things working!
;)

Nico