Activation of Management Engine after exchange Z590 chipset - ASUS PRIME Z590M-PLUS

[DynaxSC]

Hi, i have an ASUS PRIME Z590M-PLUS board, which had an shorted Z590 chipset. I have succesfully exchanged the chipset to a factory new one, however there is a serious problem with the Intel Management Engine (later on: ME) not beeing activated after the chipset device replacement.

For lower chipset families (on ASUS boards) it worked to program the oldest bios version into the SPI rom, and the bios had activated the Management Engine itself by default - there was a message on the screen prior booting - "BIOS is updating Management Engine ..... . Do not shut down to prevent ....." or something similar.

For the ASUS Z590M-PLUS board this method deos not work, and the ME does not activate automatically. The ME binary is included in the oldest bios image available (0404). I have made some investigation what can be done with the Intel System Tools described on the WinRaid forum (https://winraid.level1techs.com/t/in...ols-2-15/30719), especially with the fptw64.exe module, and the only thing I could discover is that the ME is in a "deactivated status". It is also possible to do some status inquiries, dump the bios image or bios modules, even program the bios/modules again, but still all this does not activate the ME. Entering into BIOS shows version 0.0.0.0 of the ME, and under Windows the device "Intel Management Engine Interface #1" is missing.

Trying to update the ME with the respective ASUS ME Update Tool ends up after 7% progress, with no effect (normally the progress reaches 50% or so).

The board actually boots into Windows, but only on SATA disks, as NVME support is not working w/o the ME running, so the board has a limited functionality. Before I have made a try with another oldest bios image coming from ASUS PRIME Z590-P motherboard, and surprisingly this bios works on the Z590M-PLUS board, and it was even able to activate the ME. After reverting back to the correct bios for Z590M-PLUS the ME was still activated with visible version in bios, and even NVME disks started to work again, however the Audio chip (Realtek ALC897) was not working at all (I suspect due to the fact, that the Z590-P board has a different audio chip). Also the ASUS ME Update Tools worked again, but updating the ME did not solve the problem with the non-working audio chip.

To go sure I exchanged the audio chip, but with no effect, so the audio chip is not the problem. Then I exchanged the chipset again to a factory new one, and I got back to the situation with inactive ME and non-working NVME functionality, however the audio chip is working again w/o the activated ME.

I know there are some people out there knowing much more about the ME, so any help with how to activate this stubborn ME is appreciated. Possibly it is only one bit or byte in the bios image necessary to change to trigger the ASUS ME activation function, so a great respect to the one who knows how to do this !

To solve this issue will probably help many people trying to repair motherboards with broken chipsets, and there are a lot of them, I would guess 20% of all broken motherboards is a result of chipset failure (shorted chipset).

So thanks in advance for any good ideas.

[stj]

Re: Activation of Management Engine after exchange Z590 chipset - ASUS PRIME Z590M-PL

amazing,
i try so hard to disable/destroy the ME spyware and your trying to boot it up!
the bios firmware is usually only related to usb3
have you tried booting Linux to see if it changes anything?

[DynaxSC]

Re: Activation of Management Engine after exchange Z590 chipset - ASUS PRIME Z590M-PL

Hi, yes tried linuxmint but also no audio and no cable LAN was working under linuxmint. The problem is that bios does not load the ME operating system into the chipset before boot process, so it doesn't matter which OS you load later, chipset does not run the ME at all, so no access by any OS possible.

But after now sitting 3 days non-stop 16h a day I finally - EUREKA - got it working, here the receipe:

1. Start Flash Image Tool (FIT)
2. Load into FIT a stock bios from ASUS site
3. Under Flash Settings, in the subsections:
-> Flash Components -> set "Software Re-Binding Enabled" to -> YES
-> FPF Configuration-> set "Hardware Binding" to -> Enabled
4. Here should be: Set any individual BIOS parameters (eg. MAC address, Serial, UUID) - didn't find out how to do this in FIT so far - I have done it after point 5 next (building image) traditionally with FD44 tool (only for ASUS)
5. Build image (Ctrl-B) -> the image will be placed in the FIT directory - and here the FIT tool is really intelligent, as it knows from the stock image, there are 2 bios chips (8k+16k - in this order), and does generate also two additional bin images of the sizes of the two SPI roms !
6. Burn the images with a HW programmer (eg CH-341) into the SPI rom (it should be also posible to program it with fptw64 - but didn't work for me due to the protection settings in the descriptor region (I was not able to change the write permissions to YES toghether with the parameters in point 3 - FIT generated an error massage saying this parameter set is not allowed)
7. Boot the board - it should work out of the box
8. On the running board run the command "ftpw64 -closemnf" - this is a command which sets a bit informing about manufacturing end status (not sure if this is necessary, but I have done it, in order to get out of the "production" state initiated in point 3 - this is my guess but its highly likely to be necessary to do so)
9. Update BIOS version if necessary (I have done all this on the oldest stock version 0404, so needed to upgrade bios to newest)
10. Boot into Windows and update ME with ASUS ME Update Tool - if necessary

That's it - quite simple, but to get it working without any support from ASUS/INTEL is an achievment - I must say, I'm a little bit proud of myself

BTW, I'm not sure if it is necessary to enable both options unders point no 3 above - havent checked this again, as I do not want to brick my chipset trying around. I suspect it is enough to enable the first option only, but I'm sure poeple out there will try it out - pls anybody update the instruction if necessary.


Coming back to disabling the ME totally, there is an option to disable the ME in the fptw64 tool ("fptw64 -disableme"), haven't tried, but you may do it. However it might have consequences, like in my case NVME functionality and LAN chip (forgot to write about it before) were not working at all. Another observation I had some time ago, is that a missing ME leads in some cases to timeouts and quite long boot process - 1-2 minutes lags, so this is quite annoying for daily use.

BTW, all the Intel CSME tools you can run with -h option for help on the available command line options, "/?" works too.


I've read also there are some tools out there to disable/limit functionality of the ME - see eg: https://github.com/corna/me_cleaner

Maybe you can use this to get ME disabled/limited in functionality. However the risk for ME abuse is mainly in the commercial versions of the ME used for company laptops/servers, etc. Normal consumer ME versions for private builds do not have the remote access/management functionality enabled by default, so in my opinion here the risk is negligible.

Good luck and hope people will make use of this info to save a lot of boards before throwing them away.

[stj]

Re: Activation of Management Engine after exchange Z590 chipset - ASUS PRIME Z590M-PL

i have used ME-Cleaner - it works well

[DynaxSC]

Hi stj,

Could you describe in a few words how you do this with ME_Cleaner ?