Panasonic CF-31 BIOS update

Why can not I update the BIOS?
CF-31SBL141M current BIOS Ver. V3.00L12 M32
new BIOS ver. V3.00L14
After starting BiosUpdate_31_V300L14 message
"This model is not supported Code=209"

Thank you.

 

CF-31SBL141M - Customer Specific Ford, Win7, Intel Core I5-3320m 2.60ghz, Vpro, 13.1 Xga Touch

Because the BIOS is a customer specific, custom BIOS.
BIOS Ver. V3.00L12 M32
The M32 indicates that it is a custom BIOS.
I have a usb programmer and I still failed at trying to update custom BIOS's in CF19's and CF31's.
Short answer is that you can't update that BIOS.
You will want to verify what works and what doesn't. Many of the custom BIOS's have WIFI,WWAN,Bluetooth, and/or even USB ports permanently disabled.

I have seen on CF19's the custom BIOS models use a totally different motherboard and different physical BIOS chip.

 

Thanks Shawn, now everything is clear. If the laptop is attached to Ford, perhaps Ford's programs on him are licensed?

 

I am sure the Ford programs are licensed by Ford.

 

What ford programs are on your 31 ?

 

I was curious about that myself.

 

Sounds to me like someone slipped up and forgot to wipe the harddrive.

 

Well there are several other possibilities.
How and where was this laptop acquired?

Most of those diagnostic programs need a specific dongle to work anyway. So odds are the programs are not really useful without the hardware.

 

Some manufacturers retain windows activation key in the BIOS. Maybe Ford for its diagnostic programs so doing.

 

That is an interesting thought.

I do know for a fact that many Toughbooks with custom BIOS's have permanently disabled hardware. Nissan CF19's have usb ports disabled. Military and gov't have all wireless disabled. Gas and water utilities models in the UK boot as soon as power is applied.

 

Info like this would be a nice addition to ohlip's "How to buy......." thread.

 

By model number, you can know the history?
CF-31SBL141M - Customer Specific Ford

 

All we know is this is how is left the factory

CF-31SBL141M - Customer Specific Ford, Win7, Intel Core I5-3320m 2.60ghz, Vpro, 13.1 Xga Touch

 

yep ...
in this case (as with virtually all panasonic models) that string of numbers and letters "tells the story" ...
it is akin to the VIN that is visible through the windshield of a car on the driver's side .
it left the assembly line and dealer with a set of *options* ... specific to requirements of the purchaser (in this case ford) .
you won't know exactly where the comp went to but you will know the original purchaser .

 

Its information in sicret?

 

We know who it was made for and what hardware it had.

We don't know where it was sold exactly. However the M as a ending character indicates it was for USA.
We don't know which Ford dealer it went to.

Do you want LaptopFax like CarFax?
I can make a history up
Sold to a dealer in Arizona on July14, 2013
Transferred from receiving to the service dept.
Issued to a tech named Dave. (Dave has 2 kids and an Ex wife)
Oct26,2015 Daves co worker John spilled coffee on it. Dave punched John in the nose for this. (John is a drunk and was hungover)
Oct27,2015 Dave got fired and the CF 31 got sent in for a keyboard replacement.
Nov1,2015 Laptop is returned from local service company.
Nov,2,2015 John gets back to work and is issued Daves former CF31.
Mar,10,2016 Phoenix Ford decides that it is time to replace Service dept's CF31's
Mar11,2016 Phoenix Ford discovers one of the service dept's CF31's has been stolen
Mar30,2016 Ford takes delivery of new CF31's and "yours" is sold to disposal company.
April1,2016 Disposal company sells used CF31 on Ebay and you purchase it.

April 1 Ha Ha Ha

 

good humor!

 

That's because I am an ice cream man.....

 

I feel sorry for Dave.

 

"dave's not here , man" .

 

Just to steer things back
I did receive my Revelprog programmer yesterday.
This is on my list to try once more to replace a custom BIOS(unlocked) with a standard BIOS.
I have a parts unit CF31 to experiment with. Along with 6 blank chips.
I soldered a socket on the motherboard to make things easier.

 

What type of chips? If all that hard, can use cryptography?

 

SPI 25 series BIOS chip.
It is beyond hard. It is next to, if not, impossible.

cryptography?
I really have no idea what you mean. Unless you mean cryptography as in, it is encrypted, that is not the problem.
Toughbooks are hardware locked down to insure durability and prevent modification of gov't and corporate equipment.
The Toughbooks with a custom BIOS are really locked down via hardware.
I have seen CF19's with custom BIOS's that used a BIOS chip that has a bit setting to prevent the BIOS chip from being flashed again EVER.
I have seen those chips on a motherboard that is a different part number from the standard version. Swapping to a standard BIOS chip and the motherboard will not boot.

This is military level security. Not Dell, Hp, or Apple "security"

 

I find it difficult to translate their thoughts correctly. I just wanted to say. Use protection.

 

Hello Shawn,

Why you would want to solder a new BIOS? There is a risk to damage the motherboard or affect some small SMD components on the motherboard near the BIOS chip. You can use an 8 pin SOIC clip and reflash the factory chip with another version. If the BIOS chip is not locked for reflashing no need to replace it. Replace the custom BIOS with a standard one should work without any issue but you need to do some small adjustments to the file you want flash.
1. Get the old model number from the old chip
2. Get the serial number from the old chip
3. Get the MAC address for the ethernet card from the old chip

Hex edit the new file otherwise you will have 2 laptops with the same specs/serials. All those details are in the NVRAM section of the BIOS and much more also.

Regards!

 

Where to find the contents of NVRAM. At the manufacturer's BIOS is in exe file. Before recording, the program seems to modify it, and then recording starts.

 

I have a SOIC clip and tried many times with 2 different programmers. In circuit flashing fails every time. I tried on 3 or 4 different Toughbooks also. Different models and mks.

 

Manufacturer's BIOS upgrade file doesn't contain the full BIOS and on top is certificate signed on most vendors now. So you have to forget about it for any recovery purposes. That can be used only on a fully working machine.NVRAM part is not contained in there anyway.

Discussion was based on the dump made with a SPI programmer. When you dump the whole chip you can read the contents of NVRAM after you decompress the modules. Usually NVRAM area is 128KB or 256KB. I saw that some BIOS versions have 2 NVRAM areas probably for backup purposes in case one gets corrupted.

 

Sometimes it fails that's true but depends on your programmer and software used, you can fine tune some parameters and it will work.
One parameter you can try if software supports is the speed during writing. I usually select some middle speed or if fails go to the lowest one. Second parameter is "Double Write". This will write every sector twice. After write if the verify task fails, disconnect the programmer, close the programming software and reboot the PC. Start again only the verify task and you will see that it is fine. I guess it makes some kind of disconnect or some buffers get in a bad state and the verify task fails but in reality the chip was written fine. I was successful with in-circuit programming with the MCUmall GQ-4X and GQ-5X SPI.

 

I have a SP8-B
and a Revelprog

 

Looking at the specs for your programmers looks good but I didn't work with them so I don't know how the software is like.
It seems they push it for speed and fast programming but that is not always good. I suggest to lower the speed if you have any software option and see how it works.

For the Revelprog are you using the in-circuit serial programming (ICSP) connector or the ZIF one with the wires to your SOIC clip? the ICSP connector is with buffered I/O. Not sure how is that implemented or how good it works.

 

Can you give a type of memory used to store the BIOS? It is not clear recorded / not recorded, the verification is done, if not passed, we write again after the recording. Or I millet is not in the topic?

 

The zif socket adapter to the SOIC clip
Similar to this. I shortened the wires and soldered them on to the clip and the socket adapter.

 

link to Revelprog software
http://www.reveltronics.com/downloads/software/english/REVELPROG-IS_v1-5_Setup-EN.exe

Link to SP8-B software (FlyPro)
http://www.sofi-tech.com/upload/product/FlyPRO_Setup.ZIP

 

I found a write speed adjustment on the Revelprog.

 

Tried reading the chip in circuit and got nothing..Tried slow speed, still nothing.
Both programmers could not read the chip.
Should I start the computer and try reading then?

 

Never had much luck with in-system programming when it comes to bioses. Most eeproms are simply wired incompatibly on the motherboard for this to work. Grounding the correct pin or putting a small ~3.3V current to another can help, but think it is much easier to simply desolder, program and resolder. No need to measure anything and it works every time, plus it is a good opportunity to solder in an eeprom socket:

Spoiler: SOIC8 200 mil eeprom sockets, various eeproms and a DIP8 adapter

Spoiler: Samsung NP900X4C - socketed bios eeprom

With Secure Flash becoming ever more rampant and manufacturers rarely supplying plain binaries for new models anymore it is also a good idea to do this right after receiving a new laptop. This way you have a 1:1 binary that can be flashed on a bricked, non-booting system. More so since downflashing and even same-version flashing are often prohibited nowadays, which is especially annoying when you're already on the last-available version and it becomes corrupted (like the Series 9 in the picture is prone to do). The only alternative then would be to buy a $25 pre-programmed chip (and wait for a week or two) or pull one from a working system and write its content to the chip.

There's also another, really neat benefit to the socket; at POST the bios, ec and me are copied (shadowed) in RAM and this is what the system is running from. XTU and ThrottleStop write their settings to this copy, rather than directly to the eeprom. Now, that also means you can hot-pull the eeprom and put in a blank or, here it gets interesting, an eeprom with a bios from an altogether different system. When you then run a flash program meant for this other system it will verify by comparing the values in the eeprom, rather than the shadowed version, receiving an ' Ok, all signals are go!'. After a reboot it would obviously brick, but there's no need to since you can simply swap the eeprom again on the live system, netting a working, 1:1 binary of a different system's bios and, usually, the combined ec and me (since these are often flashed during the same process and to the same chip). Doesn't work all the time, though; some reboot first and flash upon boot, but you can let it proceed to write the eeprom and swap again after a forced shutdown.

It's only too bad MXM vbioses use smaller, 150 mil eeproms, so these sockets will not work. Hence the 200 mil 4Mbit eeproms in the photo; they're cheaper and it wouldn't waste a 64Mbit chip for a situation where even a 1 or 2Mbit would do. It is, however, tricky to modify the socket's bottom and solder it to the 150 mil footprint, but it is doable:

Spoiler: HD 8970M, socketed vbios

 

More to the story.

I am attempting to repair a motherboard that I did solder a bios chip socket on to.
My issue is trying to READ the bios from the working system. I am hesitant to remove the chip from the fully working laptop.

 

There's no risk in removing and reading the chip, provided you're setting the correct chip or flashing parameters in the programmer (whichever is applicable). Once gambled a bit with a chip that had unreadable, scratched markings and this scrambled a few bit of data, bricking the firmware. But then again, with ISP it is the same risk and, come to think of it, that data corruption actually happened with an ISP setup, so ...

The chip may also be wired to have the write-protect pin active. Whether that setting means the pin is powered or not can be checked for using the eeprom's specification sheet. The knowledgeable programmer wouldn't care since it knows what the specific eeprom expects, but when it is still on the mb you may first have to tinker with that WP pin accordingly.

 

No risk as long as my solder skills and equipment are good enough.

I have several new blank replacement chips, so I know the part numbers are correct.
Chip is N25Q128A13
I choose the proper chip from the software list. The Revelprog does not verify the chip ID. The SOFI can verify ID if I enable it.

I recently purchased a 48watt soldering tweezer with 5mm and 10mm tips.
This tool is the hands down winner for working with SOIC chips. My hot air station is a royal PITA to remove chips with. Even with the proper nozzle.

I may want to practice with the tweezers a bit more before I attack the perfectly good CF31 motherboard.

 

According to forum rules,
We are not allowed to have any discussion of password removal on this website....Sorry

 

Just like Shawn said "No talk" means no talk at all...sorry. I don't want to lock this thread so let's stay on track .

 

reviving a thread.

Currently working on CF 31's at the moment.
Experimenting with stock BIOS's that have Intel ME and versions that don't. (what I am doing doesn't really matter anyway)

Using a Revelprog programmer.
Simple question..Are these chips interchangeable in a basic BIOS application?
What are the differences in these chips?

Winbond W25Q128FV
Micron N25Q128A
Cypress S25FL127S
ISSI IS25LP128

 

The bios itself couldn't care less; storage = storage and it's the 'SPI/type 25' protocol that makes them interchangeable. However, it depends on the flashing program (the official, software-based one) as to which eeproms are supported. The Winbond is a very common model, so that should have the least risk of being incompatible.

Second thing to check is whether the hardware write-protect pin is default-off or default-on on the original eeprom; the system will have its pin (#3) either powered to 3.3V or grounded (sometimes it's even floating) and you want its replacement to operate similarly. Google ' chip + pdf' and their specification sheets should be clickable promptly.

Those are rather behemoth-like chips, btw. Do they duplicate everything or is it a lot of empty space?

 

Fascinating info.
This is all just a learning experiment for me. I am working on an i3 unit of mine.

From the rom file loaded into the programmer, it looks like a lot of empty space.
On the CF19's and CF31's the standard chip seems to be the N25Q128.
However on some oddball and customer specific units I have seen W25Q128 chips.
So far, it appears to me that software flashing of the Winbond models is more picky and difficult.
The programmer doesn't care.

I am not talented enough to modify the flash ROM itself very much.
I have tried the AMIDMI editor, but it refuses to actually save the changes.
The oddball deal that is challenging me at the moment is this..
It's a model that came stock without the ME package. I software force flashed it with a bios from a different unit (same exact model without ME) all went fine.
I then software force flashed it to a model with ME. ME now shows in BIOS.
It will not allow me to update ME. Nor can I remove ME by flashing back.
Also, The model number changes with each flash. I have software to correct that, but it refuses to work on this machine.

So I am guessing that Panasonic prevents crossflashing by using different brand BIOS chips.
Each software BIOS package only runs on one brand chip. This prevents crossflashing without a programmer.

I wonder if a generic ME update would run on it? hmm

These Toughbooks sure ain't Dell or Hp's...Very challenging they are.

 

Ah, so you want either the ME erased or upgraded? The programmer can easily accomplish that. But yes, might try a vanilla ME update first, bypassing the official, laptop-specific route. It's Intel's 'FWUpdate' or 'FPT' tool you want for that:

Spoiler: FWUpdate

Code:

Intel (R) Firmware Update Utility Version: 9.1.2.1000
Copyright (C) 2007 - 2014, Intel Corporation.  All rights reserved.

FWUPDLCL.EXE [-H|?] [-VER] [-EXP] [-VERBOSE] [-F] [-Y] [-SAVE]
             [-FWVER] [-PARTID] [-ALLOWSV] [-FORCERESET] [-OEMID] [-PASS]
             [-HALTRCFG]

-H|?                  Displays help screen.
-VER                  Displays version information.
-EXP                  Displays example usage of this tool.
-VERBOSE<file>        Display the debug information of the tool.
-F<file>              File used for updating the FW.
-Y                    Automatically answer Yes to prompts.
-SAVE<file>           Save the current FW to an update image.
-FWVER<file>          Display the FW Version of current FW or update image.
-PARTID<Partition ID> Provide specific Partition ID to perform partial update.
-ALLOWSV              Allows same version firmware updates.
-FORCERESET           Automatically Reboots system after update (if needed).
-OEMID<UUID>          OEM ID needed to perform firmware update.
-PASS<pass>           MeBX password. Optional with the '-f' option.
-HALTRCFG             Halts remote configuration. 

Spoiler: FPT

Code:

+---------------------------------------------------------------------------+
Intel (R) Flash Programming Tool. Version:  8.1.10.1286
Copyright (c) 2007 - 2012, Intel Corporation. All rights reserved.
+---------------------------------------------------------------------------+
FPT.exe [-H|?] [-VER] [-EXP] [-VERBOSE] [-Y] [-P] [-LIST] [-I] [-F]
        [-ERASE] [-VERIFY] [-D] [-DESC] [-BIOS] [-ME] [-GBE] [-PDR] [-SAVEMAC]
        [-SAVESXID] [-C] [-B] [-E] [-REWRITE] [-ADDRESS|A] [-LENGTH|L] [-FOVS]
        [-CFGGEN] [-U] [-O] [-IN] [-N] [-ID] [-V] [-LOCK] [-DUMPLOCK] [-PSKFILE]
        [-CLOSEMNF] [-GRESET] [-PAGE] [-SPIBAR] [-R] [-VARS] [-COMMIT] [-COMPARE]
        [-HASHED]
+---------------------------------------------------------------------------+
fpt.exe -d BiosBackup.bin -bios
+---------------------------------------------------------------------------+
-H|?                Displays help screen.
-VER                Displays version information.
-EXP                Displays example usage of this tool.
-VERBOSE<file>      Display the debug information of the tool.
-Y                  Do NOT prompt when a warning occurs.
-P<file>            Specifies a flash part definition file to use.
-LIST               List all SPI devices supported.
-I                  Displays information about the flash image.
-F<f>[NoVerify]     Load binary file into flash.  "NoVerify" skips verify.
-ERASE              Erase the contents of flash.
-VERIFY<file>       Compare binary file to flash.
-D<file>            Dump flash contents to file or "STDOUT".
-DESC               Load/verify/dump Descriptor region.
-BIOS               Load/verify/dump BIOS region.
-ME                 Load/verify/dump ME region.
-GBE                Load/verify/dump GbE region.
-PDR                Load/verify/dump PDR region.
-SAVEMAC            Saves the GbE MAC when GbE is being reflashed.
-SAVESXID           Saves the GbE SSID and SVID when GbE is being reflashed.
-C                  Erase entire flash part.
-B                  Check to see if the flash part is erased.
-E                  Do NOT erase area before writing to flash.
-REWRITE            Rewrite the SPI with file data even if flash is identical.
-ADDRESS|A<address> Flash address to load/verify/dump file.
-LENGTH|L<length>   Number of bytes to load/verify/dump.
-FOVS               Displays list of FOVs supported.
-CFGGEN             Generates an FOV Input File.
-U                  Update Variable.
-O<file>            Sets an output file name.
-IN<file>           Input param file.
-N<name>            Name of variable.
-ID<id>             Id of the FOV to be updated.
-V<value>           Value for variable.
-LOCK[PDR]          Sets SPI flash region access to Intel recommended values
-DUMPLOCK           Dumps the current lock settings to screen.
-PSKFILE<file>      PSK key file name.
-CLOSEMNF[NO] [PDR] End of Manufacturing. Details on NO & PDR use -exp option
-GRESET[NO]         Global reset drives GPIO30 low unless "NO" is provided.
-PAGE               Pauses the screen when a page of text is reached.
-SPIBAR             Display the SPI BAR.
-R<name>            Read a variable.
-VARS               Display supported variables.
-COMMIT             Commit updates to FOVs requiring a FW reset.
-COMPARE<file>      Compare variable with expected value filled in a text file
-HASHED             Display a variable (from read command) in hashed format.
+---------------------------------------------------------------------------+
 Below are examples of common command-line input:

  fpt.exe -f image.bin
  This usage will write the data in the bin file to the SPI flash part
  starting at address zero.

  fpt.exe -f image.bin -bios
  This usage will write the data in the bin file to Bios region of the SPI
  flash part.

  fpt.exe -u -id 1 -v P@ssword3
  This usage will update the MEBx Password FOV with the password provided.
  Refer to the fptcfg.ini file for the ids associated to a specific FOV.

  fpt.exe -closemnf NO PDR
  This usage should be performed at close of manufacturing.  It will set
  End of Manufacturing and also sets SPI flash region access to Intel
  recommended values.  The "NO" addition will prevent the system from
  doing a global reset following a successful update of the ME
  Manufacturing Mode Done, the Region Access permissions, or both.
  The "PDR" addition will allow CPU\BIOS Read & Write access to the
  PDR region of flash.

  fpt.exe -lock PDR
  This usage will set SPI flash region access to Intel recommended
  values.  The "PDR" addition will allow CPU\BIOS Read & Write
  access to the PDR region of flash.

  fpt.exe -greset NO
  This usage should be used in order to perform a global reset.
  The "NO" afterwards will disable the driving of GPIO30 for mobile SKUs.
+---------------------------------------------------------------------------+

Iirc, FWUpdate will not allow downgrades. Fpt is generic and can flash pretty much anything, also quite a bit more dangerous because of that.

Reading the full chip with the programmer and simply wiping the entire ME block is certain to work though. Look for the '$FPT' bit and simply delete the ~2MB or ~6MB after that, depending on the original ME's size.

Not sure about the ' chip-specific security measures'; all chips are readily available in a blank state, so it wouldn't be much of a hurdle. Perhaps the issue is more with an internal number that is kept in tact or even modified after each flash. Would hope that number wouldn't be the model number ... that's just crazy, so perhaps it has just gotten confused after the first forced flash.

Regardless, I'd just take the bios version you want, hex-add the desired ME (if any, really) and write the result directly to the eeprom via the programmer.

 

It would not surprise me if Panasonic made the security with the model number.
Panasonic does extreme measures with fully rugged Toughbooks.

The ME is not a real big deal either way. I kind of liked not having it, but once I started messing around I got curious about it all. Then I went off trying to correct the model number and could not. So I got even more curious.

If I have ME on it, I want it updated so I will try the 2 generic versions.

Can they lock specific portions of the bios from software changes or is it all or none?

From what I understand, The model, serial, hours, etc are all dmi/smbios items.

 

Specific, which is pretty much the default when flashing anyway. The programmer couldn't care less.

And yes, but that itself is merely a structured package inside the bios. Something like an embedded specification sheet for the system which any OS can read out.

The Panasonic firmware division sounds like a very ... 'interesting' place to work. They could merge with Lenovo and invent all new degrees of annoying their customers (à la Help Desk).

 

Tried fpt several ways. Last attempt was pure DOS to be sure.
Throws an error that fpt can not be run on this platform.
Ran the ME verification tool and it said that ME is not installed. The BIOS reports that it is.

Panasonic does very odd stuff..

Here's a question.
Anyway to get a software "read" of a chip to flash via a programmer? Will the software gather ALL of the needed information for the programmer?