Unbrick Acer TravelMate P253-E (Q5WV1 LA-7912P Rev 2.0)

[SOLVED] Unbrick Acer TravelMate P253-E (Q5WV1 LA-7912P Rev 2.0)

hi,

in the past i successfully slic-modded the bios of like 5 desktops and notebooks, including "self-mods" (amitool, etc), so i tried to mod the bios of the p253 but bricked it in the process. i need help to unbrick...

what i did:

1) get version number of installed bios: insyde 2.15
2) google for "acer p253-e slic 2.1 mod 2.15" - no satisfying results
3) go to acer homepage, select model, but the latest bios version available for download is 2.14.. strange... download anyway, maybe i dont need the latest microcodes in the 2.15 release...
4) modded the 2.14 bios: phoenixtool 2.14 (dynamic), rw-everything 1.6.4, acer slic table with matching certificate
5) tried to flash the modded bios with insydeflash, but "bios version compare error", ok find a way to downgrade
6) tried to make insydeflash flash the 2.14 bios (modded and original): platforms.ini: add RESSEN to SwitchString, [Bios_Version_Check] Flag=0, nope, always "bios version compare error"
7) get recovery filename: Q5WV1X64.fd
8) tried to flash the bios (modded and original) with fn+esc recovery boot mode: notebook starts to recovery mode (different fan behaviour, no image on screen), access usb-drive for 15 seconds, 3 loud beeps, reboot, still 2.15 bios installed

9) tried to dump the installed bios with universal bios backup toolkit 2.0: bios not recognized
10) dump the installed bios with insydeflash shell parameter /b: filesize is 5mb, strange, downloaded bios (extracted Q5WV1X64.fd) has 6.44mb... maybe additional platform data??
11) mod the dumped bios
12) recovery-flash the modded 2.15 bios: recovery-mode, 2 min usb-access, no beeps, reboot. so something has been flashed
13) notebook is bricked: fan spinning, black screen. recovery-mode broken (does still start but there is not a single usb-access; tried every port)

14) disassemble the thing, on the way remove cmos battery, retry, still bricked as expected
15) look all over the pcb to find flash memory chips: cFeon 1mb spi (EN25Q80A 100HIP) and winbond 4mb spi (W25Q32BV SIG). i guess the 1mb chip holds the ec-bios and the 4mb chip the main bios...

questions:
why is the recovery-mode broken? i thought it is there to recover from defect bios flash...
how does the recovery-mode work? does the embedded controller (ene KB9012QF) control the recovery mode?
if yes then maybe flashed the ec-rom....
does the dumped bios file (5mb) contain both the main bios and the ec-bios? if yes how to split the file?
does the dumped bios file (5mb) contain cmos-data? while looking through the file with winhex found multiple occurences of "W.D.C. .W.D.5.0.0.0.B.P.V.T.-.2.2.H.X.Z.T.3" (model of hdd); would expect this data in cmos, not in bios....
does somebody have the raw-dump of the 2 flash-chips or can give me an howto to dump these?

found a way to flash the 2 chips externally: h**p://rayer.g6.cz/elektro/spipgm.htm
just need the data, that has been in the chips originally.
i do have a second notebook here (exact same version, still unbricked), but its not my property, so i'd rather avoid to disassemble it and unsolder the flash-chips to read them externally... but if there is a way to read the raw-data of the 2 chips with software, let me know.

trial and error is rather tedious when i have to unsolder the chips, solder them to the flashing device (which i have to build first), flash them externally, resolder them to the pcb, reassemble the thing and test.... so i'd like to make sure i got the right data and have to do this only once...
uploaded the dumped 5mb bios file from 10), so you can have a look at it: h**p://netload.in/dateiCmghdpSUnf/insyde2.15biosdump.7z.htm

questions? answers? tips? information? ideas? thanks....

 

fixed it, here is how:

as i had a second p253 (exact same model) the strategy was to raw-dump the contents of the working notebooks flash chips and writing this unmodified dump back to the flash chips of the bricked device.
i needed to unsolder the flash chips from the working notebook too, because i didn't find a software to dump the chips individually and completely. just fixing the 1mb-chip didn't help, i had to fix both chips (i hoped the 1mb chip would hold the ec-software, which i thought might control the recovery mode. but nope, fixing that one didn't repair the recovery mode).
so i built the programming device from here (h**p://rayer.g6.cz/elektro/spipgm.htm) and got the software, then unsoldered the good chips. soldered it to the programming device and tried to read the data. first i didn't get an identification of the chip, let alone a sensible dump of the content. i had to tweak the programmer and the connection, including attaching my oscilloscope to the cs#-pin and ground to get the communication going (i wanted to look at the signals to debug and when connected to the scope it worked; i guess the 15pF input capacitance did the trick). maybe this is helpful: h**p://write-code.blogspot.de/2012/08/parallel-port-spi-flash-programmer-and-unbrick-wm8650.html
i read each chip 5 times and compared the hashes of the dumps to be sure the communication is stable and the dump correct.
then soldered the chips back to the working notebook (thankfully it was still working afterwards...) and unsoldered the bricked chips. programmed the chips with the dumps and verified each one 2 times against its dump to be sure it was programmed correct. soldered the chips back, reassembled the notebook, attached the power, prayed and hit the power-button: tada! working bios, booted like a charm.

this method worked great to get a totally bricked notebook working again, but if i had not had a second notebook to read the dumps from, they would have been quite difficult to get. i would have needed the help from the community either to get their dumps or to extract the dumps from the official flash-file.

ps: version 2.15 of the insyde bios is online now on the acer homepage.