[flashrom] reading the flash image of my Celsius H265

[Nico Huber]

Hello Elmar,

On 09.05.2018 22:12, Elmar Stellnberger wrote:
> However if I execute this twice I get two different images:
> wget https://www.elstel.org/uploads/celsius.rom
> wget https://www.elstel.org/uploads/celsius2.rom

actually, I don't see a BIOS in there at all. And the firmware descrip-
tor (first 4KiB of a SPI flash in Intel systems) says there is no BIOS
region (output of ich_descriptor_tool):

  === Region Section ===
  FLREG0   0x00000000
  FLREG1   0x00000fff
  FLREG2   0x03ff0005
  FLREG3   0x00020001

  --- Details ---
  Region 0 (Descr. ) 0x00000000 - 0x00000fff
  Region 1 (BIOS   ) is unused.
  Region 2 (ME     ) 0x00005000 - 0x003fffff
  Region 3 (GbE    ) 0x00001000 - 0x00002fff

So it seems *this* SPI flash is only used for chipset configuration and
ME firmware.

As David pointed out, your BIOS may share the flash chip with an Embed-
ded Controller (its unlikely that flashrom wouldn't see the chip other-
wise). And I can't advice you to use further try using flashrom. This
situation (EC shared flash) is exactly why we have that "I_want_a_brick"
option.

If you want to hunt more clues nevertheless, you can send us the output
of `flashrom -p internal:laptop=force_I_want_a_brick -V`. IIRC, it
also tells from which bus the BIOS was loaded.

> Using vbindiff I can see that quite a lot is different between both
> images. - which would be difficult to achieve if the firmware was
> changed while I am running my computer. The image may be somehow
> corrupted as me_cleaner (BIOS offers Intel AMT) can not process the image:

I think the ME has some logging enabled and simply writes to the flash.

Nico