SLIC 2.1 UEFI BIOS Mod Flash & "Capsule Header" Issue on HP P7-1446s MSI MS-7778

First I want to say a quick thank you to all who contribute here as their work has been infinitely helpful to me over the years.

I have not previously had an issue after many BIOS mods and flashes but am now very much stuck. The system in question is a friend's HP Pavillion P7-1446s. Using HP's latest BIOS download [h10025.www1.hp-DOT-com/ewfrf/wc/softwareDownloadIndex?cc=us&lc=en&softwareitem=cp-134631-1] which is SP67068 and contains JAS_819.rom (UEFI BIOS v8.19) and SAFUWIN.exe, AndyP's Phoenix Tool v2.57 identifies and successfully mods the ROM file, but HP's included SAFUWIN and several other AFU versions I've tried will not flash the modified ROM. The SLIC 2.1 info per the SLIC Toolkit is incomplete/incorrect on HP's BIOS and thus Win7 is not activating.

When I use the /D command to check the modded ROM file (ex: SAFUWIN.exe BIOS.rom /D) it reports "ROM File Capsule Header checking... fail."
When I use the /CAPSULE option to attempt to flash the ROM and override the capsule header (ex: SAFUWIN.exe BIOS.rom /CAPSULE /B /P /N /K) it reports "System BIOS image invalid or corrupt."
When I use the /GAN option, which is undocumented and is something I saw in a few threads regarding this issue (ex: SAFUWIN.exe BIOS.rom /GAN), it will "complete" the flash but the next boot into Win7 shows that the SLIC info remains incorrect/incomplete when checked with the SLIC Toolkit.

I've got a bunch of pages open and I've read lots of people talking about various methods, from using MMTool to simply extract/insert info from the original/modified ROMs, to using the undocumented /GAN command to force a flash of all blocks, to using UEFITool to do something with the capsule header (extract/insert, delete completely, etc), and lots more.

I had never heard of or encountered anything to do with the "capsule header" before now. After some searching and a reply from BDMaster on here, I have a basic idea of what it is as far as security/verification and why it is problematic. I'm hoping to get more info on this as I've been at this for several days now and he needs the computer back ASAP. I need to decide whether I should abandon the Win7 install and revert him back to an HP Win8.1 install and do the OEM activation for that, or if there is some hope for this BIOS and activating Win7.

What's confusing me the most is that there are so many varied reports where some people use multiple different methods to successfully fix or bypass this issue, while there are also explanations of this signature/verification/etc that sound essentially impossible to solve. I'm also not knowledgeable enough to fully grasp why/how I'm modding an Insyde/EFI BIOS from HP for an MSI MS-7778 (Jasmine) board with the Phoenix Tool and flashing with an AMI utility... but that's for another time.

Is there a cut-and-dry answer/solution for this? Does it just vary for every BIOS version? At first I was hopeful that there must be some combination of tweaks through the Phoenix Tool, UEFITool, etc, that would work, but of course I know nothing about how any of this stuff really works. Thanks in advance for any additional help, insight, etc.

 

Thanks Tito. Since this is a genuine HP desktop, it does have the FeatureByte located on the sticker on the bottom of the case. I've had to enter the FeatureByte, Build ID, etc, in the past when replacing HP boards, but I didn't realize they had a purpose other than hardware identification. In that post it looks like the FeatureByte might provide some SLIC info, maybe it equates to a version like 2.0 or 2.1? I will get that tool and use this Pavilion's FeatureByte and see what happens and report back.

 

Yeah that makes sense, so the FBYTE from this Pavilion wouldn't have proper/complete SLIC 2.1 info for Win7. By some miracle I think I have a FBYTE value written down that I saved from a motherboard swap in an OEM Win7 HP, so if I can find that I will use it, or see what I can locate online. I wouldn't think there would be anything wrong with having a FBYTE repository of some kind for users to add to and have them sorted by SLIC type or something. Anyway thanks again, oh and as for Win8 the HDD has already been wiped and formatted so I'd be starting from scratch if I had to install that. I may have saved an image of the recovery partition but that's probably the only thing. I'll give the AMIDEWIN tool a try shortly.

 

I will certainly have to read your guide at some point as I haven't done any clean installs of 8.1 yet but the time will no doubt arrive.

As for the SLIC issue, I had a moment earlier to make a bit of progress. I think during one of my flashes, probably using /GAN where every BIOS block was wiped and flashed, most of the info under System IDs was cleared. UUID and one or two other fields were the only things left. I used HP's normal method to access those IDs and set them all as I wanted:

This is supposedly a "version 7" BIOS and the directions to follow for it --
1. Power on computer and press ESC key to get options menu
2. Press F10 for "Computer Setup"
3. Press "CTRL" + "A"
4. Go to "Security" tab, then down to "System IDs" and press enter
5. Fill out whichever fields you want.

I used all the info on the case for Build ID, Serial #, etc. The only change I made was to try a different FeatureByte which will hopefully be associated with Win7 x64 rather than the original FByte which is for Win8.

I entered 2U2V 2e3E 3H3Q 3V3X 3m3u 464k 5T5c 5u5x 676J 6S6b 7B7j .A3 for my FeatureByte.

I found this info posted on another site, and it seems reasonable and matches the FeatureByte that I used:

"On the bottom of your case, you will have a label with something called Feaeture Byte containing a string such as
xx?? xxxx 67xx xx6b xxxx xxxx xxxx xxxx .xx
where 67=ATF_OS.7 (windows 7) and 6b=AFT_HAL.64 (64bit) while one of the other word bytes (i think ??) indicates what level of OS. You should also see BuildID on the same label with a string like 11WWTROW6**#SABG#DABG
where the 6 indicated 64bit (3=32bit)"

I will see if I can find any differences with the SLIC Toolkit or other utilities. I can't get that AMIDEWIN file in that post as the link seems to be for a Lenovo BIOS file instead. I will keep looking around for it.

 

The 2U2V 2e3E 3H3Q 3V3X 3m3u 464k 5T5c 5u5x 676J 6S6b 7B7j .A3 FeatureByte has greatly improved the SLIC Toolkit report.

- SLIC Dump at bottom shows Status: Dump OK! (HPQOEMSLIC-CPC_V2.1) and "20 01" appears correctly in Basic tab

- Advanced tab shows Cert and PKey as valid and says Cert OK, of course

- SLIC Diagnosis shows PubKey and Marker both as HPQOEMSLIC-CPC, Version: 2.1, Digital Signature: OK

- The only issue now is the OEMID/TableID shows X&RSDT != PubKey == Marker because XSDT & RSDT are incorrectly HPQOEMSLIC-MPC

Therefore the SLIC Status is Invalidated. What's strange is that I'm almost positive that before I did any flashing the only fields filled out were XSDT & RSDT, and they were the correct values of HPQOEMSLIC-CPC which is what I need again now. I'm going to reflash the untouched HP BIOS once more to see if it changes/fixes anything here.

 

Massive success! At some point in my many misguided flashing attempts I screwed up the XSDT & RSDT SLIC values. One final run of "SAFUWIN.exe JAS_819.rom /sp /b /p /n /k" (option /sp was to keep my BIOS settings instead of wiping them too) was all it needed and now the incorrect -MPC values are changed back to -CPC as they were by default in the 8.19 ROM. SLIC Diagnosis in the Advanced tab of SLIC Toolkit now shows SLIC Status: Validated and Windows 7 Ultimate x64 is activated and genuine at startup, as it should be.

I believe that I also unlocked the MPM when the System IDs were cleared. Interestingly, SAFUWIN reports "System ROM Secure Flash = Disable" and "MPM Status... UNLOCK." I suppose once I'm certain everything will stay correct I will lock the MPM again.

In conclusion, it seems that I could have done this quickly and easily by:

1. Erasing the FeatureByte from the BIOS (and any other desired System IDs)
2. Using the method to then add/edit the System ID values and entering an appropriate Win7 FByte instead of the Win8 one from the factory
3. Check SLIC Toolkit and System > Windows Activation to make sure the new FeatureByte worked

I wasted a lot of time barking up the wrong tree with the "capsule header" stuff. Hopefully this will be useful to someone and, as always, I probably wouldn't have figured this out if not for people like Tito and the many others who make this forum so great.

If anyone is looking to do the opposite and wants to try a Win8 FByte, here are a few that I have:

Win8 (unverified)
OEM String: FBYTE
2V33 3E3K 3N3Q 3R4C 4h5W 5c6J
6S6Z 6b7B 7K7M 7Q7S 7W7s 9Sa3 akap aqar
[auaz -OR- axaz] .df
OEM String: BUILDID
12LA3RR8609**#SABM#DABM


Win8 (verified)
OEM String: FBYTE
2U2V 333E 3K3N 3Q3R 4k5W 5c6J
6S6Z 6b7B 7C7K 7M7Q 7T7W 8K9S a3ap aqas
auaz .nt
OEM String: BUILDID
12NA3AR86**#SABA#DABA

 

Excellent, that's what I was thinking! Great info!

Gotcha, I'll have to do that and save it for future use. I was lucky to have the "version 7" BIOS I think, as it allowed me to do that editing without needing a program outside of the BIOS environment. At least I got a break somewhere! Thanks a million for your help and explanations here, Tito. I was making this way more complicated than it was with the right info.

 

Can you use this guide to verify which HP BIOS version (5, 6, 7, etc) your board has and post back:

[h10025.www1.hp -DOT- com/ewfrf/wc/document?cc=us&lc=en&docname=bph07110]

 

Sorry, I may not have been clear on what I was asking you to do.

The link that I posted has "-DOT-" in it. Delete that bit and replace it with a "." so that the link will work and bring you to the HP website.

Read that guide and follow its directions. What you're looking for is not the L02 v2.18 part, it will be a 5, 6, 7, etc. When you read that guide you will see that there are two ways to tell which version you have -- One is for HP BIOS versions of 6 and earlier, and the other is for 7 and later. The part that will identify the HP BIOS version for either method is highlighted in a square box in that HP guide.

The reason I'm asking for this specific info is that there are various ways to edit the FeatureByte depending on which HP BIOS version your board has. Like I posted earlier (post 7), the board I was working on when I started this thread had a "version 7" BIOS, and one of HP's methods to edit the FeatureByte was directly in the BIOS setup and did not require any additional programs.

Remember, you are looking for a version number like 5, 6, 7, etc.

 

Again, I'm not looking for the L02 part, but a version like 5, 6, 7, etc. You need to follow the directions in that guide to find out. It's not info that gets posted on the HP site with the BIOS file as far as I know. You have to boot into the BIOS like that guide describes. Hope that helps.