SLIC 2.1 UEFI BIOS Mod Flash & "Capsule Header" Issue on HP P7-1446s MSI MS-7778

Discussion in 'BIOS Mods' started by 02836659, Sep 17, 2014.

  1. 02836659

    02836659 MDL Novice

    Aug 23, 2012
    12
    1
    0
    First I want to say a quick thank you to all who contribute here as their work has been infinitely helpful to me over the years.

    I have not previously had an issue after many BIOS mods and flashes but am now very much stuck. The system in question is a friend's HP Pavillion P7-1446s. Using HP's latest BIOS download [h10025.www1.hp-DOT-com/ewfrf/wc/softwareDownloadIndex?cc=us&lc=en&softwareitem=cp-134631-1] which is SP67068 and contains JAS_819.rom (UEFI BIOS v8.19) and SAFUWIN.exe, AndyP's Phoenix Tool v2.57 identifies and successfully mods the ROM file, but HP's included SAFUWIN and several other AFU versions I've tried will not flash the modified ROM. The SLIC 2.1 info per the SLIC Toolkit is incomplete/incorrect on HP's BIOS and thus Win7 is not activating.

    When I use the /D command to check the modded ROM file (ex: SAFUWIN.exe BIOS.rom /D) it reports "ROM File Capsule Header checking... fail."
    When I use the /CAPSULE option to attempt to flash the ROM and override the capsule header (ex: SAFUWIN.exe BIOS.rom /CAPSULE /B /P /N /K) it reports "System BIOS image invalid or corrupt."
    When I use the /GAN option, which is undocumented and is something I saw in a few threads regarding this issue (ex: SAFUWIN.exe BIOS.rom /GAN), it will "complete" the flash but the next boot into Win7 shows that the SLIC info remains incorrect/incomplete when checked with the SLIC Toolkit.

    I've got a bunch of pages open and I've read lots of people talking about various methods, from using MMTool to simply extract/insert info from the original/modified ROMs, to using the undocumented /GAN command to force a flash of all blocks, to using UEFITool to do something with the capsule header (extract/insert, delete completely, etc), and lots more.

    I had never heard of or encountered anything to do with the "capsule header" before now. After some searching and a reply from BDMaster on here, I have a basic idea of what it is as far as security/verification and why it is problematic. I'm hoping to get more info on this as I've been at this for several days now and he needs the computer back ASAP. I need to decide whether I should abandon the Win7 install and revert him back to an HP Win8.1 install and do the OEM activation for that, or if there is some hope for this BIOS and activating Win7.

    What's confusing me the most is that there are so many varied reports where some people use multiple different methods to successfully fix or bypass this issue, while there are also explanations of this signature/verification/etc that sound essentially impossible to solve. I'm also not knowledgeable enough to fully grasp why/how I'm modding an Insyde/EFI BIOS from HP for an MSI MS-7778 (Jasmine) board with the Phoenix Tool and flashing with an AMI utility... but that's for another time.

    Is there a cut-and-dry answer/solution for this? Does it just vary for every BIOS version? At first I was hopeful that there must be some combination of tweaks through the Phoenix Tool, UEFITool, etc, that would work, but of course I know nothing about how any of this stuff really works. Thanks in advance for any additional help, insight, etc.
     
  2. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    17,374
    15,027
    340
    Like HP laptops, the SLIC in HP desktops is externally controlled by some flags in DMI area which can be manipulated by standard AMI tools. See the example here; but I can't figure out how to calculate the appropriate FBYTE value.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. 02836659

    02836659 MDL Novice

    Aug 23, 2012
    12
    1
    0
    Thanks Tito. Since this is a genuine HP desktop, it does have the FeatureByte located on the sticker on the bottom of the case. I've had to enter the FeatureByte, Build ID, etc, in the past when replacing HP boards, but I didn't realize they had a purpose other than hardware identification. In that post it looks like the FeatureByte might provide some SLIC info, maybe it equates to a version like 2.0 or 2.1? I will get that tool and use this Pavilion's FeatureByte and see what happens and report back.
     
  4. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    17,374
    15,027
    340
    The idea is, you need to take the FBYTE value from a PC which comes with Windows 7 & place it on the one that comes with 8.x. Remember to back up the OEM DM key from the MSDM table.

    :)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. 02836659

    02836659 MDL Novice

    Aug 23, 2012
    12
    1
    0
    Yeah that makes sense, so the FBYTE from this Pavilion wouldn't have proper/complete SLIC 2.1 info for Win7. By some miracle I think I have a FBYTE value written down that I saved from a motherboard swap in an OEM Win7 HP, so if I can find that I will use it, or see what I can locate online. I wouldn't think there would be anything wrong with having a FBYTE repository of some kind for users to add to and have them sorted by SLIC type or something. Anyway thanks again, oh and as for Win8 the HDD has already been wiped and formatted so I'd be starting from scratch if I had to install that. I may have saved an image of the recovery partition but that's probably the only thing. I'll give the AMIDEWIN tool a try shortly.
     
  6. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    17,374
    15,027
    340
    #6 Tito, Sep 17, 2014
    Last edited: Sep 17, 2014
    Read my guide carefully; the OEM DM key is stored in the ACPI table of the UEFI.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. 02836659

    02836659 MDL Novice

    Aug 23, 2012
    12
    1
    0
    I will certainly have to read your guide at some point as I haven't done any clean installs of 8.1 yet but the time will no doubt arrive.

    As for the SLIC issue, I had a moment earlier to make a bit of progress. I think during one of my flashes, probably using /GAN where every BIOS block was wiped and flashed, most of the info under System IDs was cleared. UUID and one or two other fields were the only things left. I used HP's normal method to access those IDs and set them all as I wanted:

    This is supposedly a "version 7" BIOS and the directions to follow for it --
    1. Power on computer and press ESC key to get options menu
    2. Press F10 for "Computer Setup"
    3. Press "CTRL" + "A"
    4. Go to "Security" tab, then down to "System IDs" and press enter
    5. Fill out whichever fields you want.

    I used all the info on the case for Build ID, Serial #, etc. The only change I made was to try a different FeatureByte which will hopefully be associated with Win7 x64 rather than the original FByte which is for Win8.

    I entered 2U2V 2e3E 3H3Q 3V3X 3m3u 464k 5T5c 5u5x 676J 6S6b 7B7j .A3 for my FeatureByte.

    I found this info posted on another site, and it seems reasonable and matches the FeatureByte that I used:

    "On the bottom of your case, you will have a label with something called Feaeture Byte containing a string such as
    xx?? xxxx 67xx xx6b xxxx xxxx xxxx xxxx .xx
    where 67=ATF_OS.7 (windows 7) and 6b=AFT_HAL.64 (64bit) while one of the other word bytes (i think ??) indicates what level of OS. You should also see BuildID on the same label with a string like 11WWTROW6**#SABG#DABG
    where the 6 indicated 64bit (3=32bit)"

    I will see if I can find any differences with the SLIC Toolkit or other utilities. I can't get that AMIDEWIN file in that post as the link seems to be for a Lenovo BIOS file instead. I will keep looking around for it.
     
  8. 02836659

    02836659 MDL Novice

    Aug 23, 2012
    12
    1
    0
    #8 02836659, Sep 17, 2014
    Last edited: Sep 17, 2014
    (OP)
    The 2U2V 2e3E 3H3Q 3V3X 3m3u 464k 5T5c 5u5x 676J 6S6b 7B7j .A3 FeatureByte has greatly improved the SLIC Toolkit report.

    - SLIC Dump at bottom shows
    Status: Dump OK! (HPQOEMSLIC-CPC_V2.1) and "20 01" appears correctly in Basic tab

    - Advanced tab shows Cert and PKey as valid and says
    Cert OK, of course

    - SLIC Diagnosis shows PubKey and Marker both as
    HPQOEMSLIC-CPC, Version: 2.1, Digital Signature: OK

    - The only issue now is the OEMID/TableID shows X&RSDT
    != PubKey == Marker because XSDT & RSDT are incorrectly HPQOEMSLIC-MPC

    Therefore the SLIC Status is
    Invalidated. What's strange is that I'm almost positive that before I did any flashing the only fields filled out were XSDT & RSDT, and they were the correct values of HPQOEMSLIC-CPC which is what I need again now. I'm going to reflash the untouched HP BIOS once more to see if it changes/fixes anything here.

     
  9. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    17,374
    15,027
    340
    Thanks for the feedback. You're going to the right direction, but the invalidated SLIC is there as you have modded the bios previously with wrong SLIC. Just reflash the original bios & change the FBYTE as necessary.

    BTW, download the Lenovo bios update package, open it & extract it to the default directory. Inside it, you can find the required AMI tool.

    :drinks2:
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. 02836659

    02836659 MDL Novice

    Aug 23, 2012
    12
    1
    0
    Massive success! At some point in my many misguided flashing attempts I screwed up the XSDT & RSDT SLIC values. One final run of "SAFUWIN.exe JAS_819.rom /sp /b /p /n /k" (option /sp was to keep my BIOS settings instead of wiping them too) was all it needed and now the incorrect -MPC values are changed back to -CPC as they were by default in the 8.19 ROM. SLIC Diagnosis in the Advanced tab of SLIC Toolkit now shows SLIC Status: Validated and Windows 7 Ultimate x64 is activated and genuine at startup, as it should be.

    I believe that I also unlocked the MPM when the System IDs were cleared. Interestingly, SAFUWIN reports "System ROM Secure Flash = Disable" and "MPM Status... UNLOCK." I suppose once I'm certain everything will stay correct I will lock the MPM again.

    In conclusion, it seems that I could have done this quickly and easily by:

    1. Erasing the FeatureByte from the BIOS (and any other desired System IDs)
    2. Using the method to then add/edit the System ID values and entering an appropriate Win7 FByte instead of the Win8 one from the factory
    3. Check SLIC Toolkit and System > Windows Activation to make sure the new FeatureByte worked

    I wasted a lot of time barking up the wrong tree with the "capsule header" stuff. Hopefully this will be useful to someone and, as always, I probably wouldn't have figured this out if not for people like Tito and the many others who make this forum so great.

    If anyone is looking to do the opposite and wants to try a Win8 FByte, here are a few that I have:

    Win8 (unverified)
    OEM String: FBYTE
    2V33 3E3K 3N3Q 3R4C 4h5W 5c6J
    6S6Z 6b7B 7K7M 7Q7S 7W7s 9Sa3 akap aqar
    [auaz -OR- axaz] .df
    OEM String: BUILDID
    12LA3RR8609**#SABM#DABM


    Win8 (verified)
    OEM String: FBYTE
    2U2V 333E 3K3N 3Q3R 4k5W 5c6J
    6S6Z 6b7B 7C7K 7M7Q 7T7W 8K9S a3ap aqas
    auaz .nt
    OEM String: BUILDID
    12NA3AR86**#SABA#DABA


     
  11. 02836659

    02836659 MDL Novice

    Aug 23, 2012
    12
    1
    0
    Excellent, that's what I was thinking! Great info!

    Gotcha, I'll have to do that and save it for future use. I was lucky to have the "version 7" BIOS I think, as it allowed me to do that editing without needing a program outside of the BIOS environment. At least I got a break somewhere! Thanks a million for your help and explanations here, Tito. I was making this way more complicated than it was with the right info.
     
  12. odiyan

    odiyan MDL Novice

    Jul 29, 2009
    23
    2
    0
    Hi,

    I got a problem with HP ProDesk 400 MT while i try to update the FBYTE using AMIDEWINx64 Utility (Aptio) v2.10 , i get the following error

    Error: Fail to initialize SMBIOS.

    can any one guilde me to update the FBYTE on this

    Thanks
     
  13. 02836659

    02836659 MDL Novice

    Aug 23, 2012
    12
    1
    0
    Can you use this guide to verify which HP BIOS version (5, 6, 7, etc) your board has and post back:

    [h10025.www1.hp -DOT- com/ewfrf/wc/document?cc=us&lc=en&docname=bph07110]
     
  14. odiyan

    odiyan MDL Novice

    Jul 29, 2009
    23
    2
    0
    The Bios Version is L02 v2.18
     
  15. 02836659

    02836659 MDL Novice

    Aug 23, 2012
    12
    1
    0
    Sorry, I may not have been clear on what I was asking you to do.

    The link that I posted has "-DOT-" in it. Delete that bit and replace it with a "." so that the link will work and bring you to the HP website.

    Read that guide and follow its directions. What you're looking for is not the L02 v2.18 part, it will be a 5, 6, 7, etc. When you read that guide you will see that there are two ways to tell which version you have -- One is for HP BIOS versions of 6 and earlier, and the other is for 7 and later. The part that will identify the HP BIOS version for either method is highlighted in a square box in that HP guide.

    The reason I'm asking for this specific info is that there are various ways to edit the FeatureByte depending on which HP BIOS version your board has. Like I posted earlier (post 7), the board I was working on when I started this thread had a "version 7" BIOS, and one of HP's methods to edit the FeatureByte was directly in the BIOS setup and did not require any additional programs.

    Remember, you are looking for a version number like 5, 6, 7, etc.
     
  16. odiyan

    odiyan MDL Novice

    Jul 29, 2009
    23
    2
    0
    Sorry for the dealy, I have followed the link with "." replacing DOT

    please find the link to the original bios

    bit -DOT- ly/1mO4YhS

    OdiYaN
     
  17. 02836659

    02836659 MDL Novice

    Aug 23, 2012
    12
    1
    0
    Again, I'm not looking for the L02 part, but a version like 5, 6, 7, etc. You need to follow the directions in that guide to find out. It's not info that gets posted on the HP site with the BIOS file as far as I know. You have to boot into the BIOS like that guide describes. Hope that helps.
     
  18. Leo03Rus

    Leo03Rus MDL Novice

    Mar 19, 2012
    3
    0
    0
    #18 Leo03Rus, Feb 10, 2015
    Last edited: Feb 12, 2015
    Hi, exuce my for my language - english is not my native.

    I have HP Pro 3400. They came with DOS.
    FBYTE:
    2U2W 3E3N 3R3V 3Y4C 4k5W 6E6K 6a6y 727J 7Q7T 7W7d 8C8D 8S94 9R .2M
    and BUILDID:
    BID=11WWSNAD301#SABB#DACB
    I looking for Feature Byte for this HP Pro 3400 to unlock SLP 2.1 (to install Win7).

    I not have ability to post PMs, i may collect these parameters - Feature Byte, Build ID from a lot of HP Desktop PC, bundled with various OS (DOS/W7Pro/W8Pro).
     
  19. PicoBot

    PicoBot MDL Novice

    Jul 7, 2015
    1
    0
    0
    Hi,

    I would like to add the following information:

    Yesterday I got a HP Prodesk 400 G1 (L02) which was sold with FreeDos and I was requested to install Windows 7 Pro on this machine. The preinstalled Feature Byte of course disables the SLIC within the BIOS, which is type 7 and revision 2.40.

    Following the informations in this thread, at first I tried to enter a different Feature Byte through the BIOS setup. It was possible to enter the new Feature Byte named in this thread, but it is not stored at all. After a reboot, the old Feature Byte was still there. Then I tried the method using amidewin, but I only got the message "Error: Fail to initialize SMBIOS.". Even booting from an USB-Stick with FreeDos and amidedos does not allow to change the Feature Byte; only an error message appears.

    From other sources in the internet I learned that at least the newer BIOS versions have a write protection for the Feature Byte. The Feature Byte can only be written, if no valid ( checksum ) Feature Byte has been written before, in other words, in can only be written once in the factory and cannot be changed after the first initialization. Therefore the method of changing the Feature Byte can't be used on HP computers which have a newer BIOS version. Of couse there might exist a non public tool from HP, which can change the Feature Byte, but I found no information about that.

    If I understand the information from HP in the BIOS changelogs, it is also no longer possible to flash any modified ( SLIC added ) BIOS, because only the flash routine built into the BIOS can flash a new BIOS. And this routine will only accept a BIOS image which is signed by HP. I did not try if it is possible to flash a modified BIOS using third party tools, but I am afraid that this would either not work or damage the BIOS.

    C.U. PicoBot