But, before you go any further, double check the contents of your backup at address 0x00001000 (like with a Hex Editor). If that byte contains 0xFF, then your backup is invalid and will brick your C7 again, so STOP! I will address this situation in another post soon.
OK now, first of all, you'll need the following gear:
1. A Bus Pirate
2. A Bus Pirate Probe cable
3. A Pomona 5250 SOIC Clip
Do not substitute the 3M part for the Pomona, as it won't work. The Bus Pirate is an inexpensive hacker's tool that can serve as an external chip programmer. It's supported by flashrom and although painfully slow, it does the job quite well. It all cost me ~$60 including shipping.
This presentation will provide a good step-by-step guide to disassembling your C7 to get access to the EEPROM which is on the top side of the motherboard (MB), under the keyboard. It looks like a horrible nightmare, but thanks to these guys, it really isn't too difficult. However, I do recommend disconnecting both the keyboard and the trackpad, their cables and connectors are too fragile to risk leaving connected, IMHO. I will admit that reconnecting them is a royal PITA, though.
https://docs.google.com/file/d/0Bzig09VSdjW1azRKaEtqZk5MZW8/edit?usp=sharing
Here's an ASCII diagram detailing how to connect the Bus Pirate (BP) to the C7's EEPROM.
PNG
On my MB, the chip is a Macronix MX25L6406E, but yours might differ. You should also be aware that there's more than one probe cable design and the color schemes vary. I'm using the Seeed Studio probe cable design. For more info on the BP, consult:
http://dangerousprototypes.com/docs/Bus_Pirate
For instructions on programming the EEPROM, consult this authority:
http://johnlewis.ie/unbricking-a-samsung-series-5-550-chromebook/
He's using a Samsung 550 Chromebook, but the procedure is the same. The C7's battery pack is, of course, removable. So, as long as the battery is disconnected, it's already "cut."
This comment has been removed by the author.
ReplyDeleteHi, Barry S. Schultz, Can you provide the original firmware for Acer C7? I want to flash the firmware to the original in fedora linux by flashrom tool, but it turn to a brick.I think my original firmware backup is bad, just like your says. Now, i need the original firmware and flash it by a hardware programmer, can you help me? Thank you!
ReplyDeleteOf course, I can & will help! But, the firmware contains the serial number of your C7 which is used by Google in some manner. I don't know exactly how. All I could provide is a ROM with a blank serial number that might not work correctly in some respects.
ReplyDeleteThe best solution is to reconstruct your firmware by replacing the first 2 MB of code in your backup ROM image with the first 2 MB of code from bios.bin in the shellball, which I can provide. This replaces the Intel Management Engine, which is trashed in the backup, but keeps the rest of your original ROM intact.
Do you understand all of this and are you comfortable doing it? Can you use a Hex Editor with ease?
Thank you for reply. Yeah, my work about the software design, so i think i can understand and can do it. I want to try the second method, please provide the related file to me.
ReplyDeleteOK. Here's the Intel Management Engine: https://docs.google.com/file/d/0Bzig09VSdjW1ZVVOVWlheUxWY0k/edit?usp=sharing
DeleteThis file un-zipped should be exactly 2048 kb or 2 MB. You need to replace the first 2 million bytes of your ROM backup with these 2 million bytes. So, the resulting COMBINED.ROM file will still be 8 MB in size. Then you can flash the COMBINED.ROM into the chip labeled U17 on the motherboard and you should be de-bricked! Let me know if anything isn't clear or you have any questions.
Just in case, here's the default C7 firmware, extracted from the shellball:
Deletehttps://docs.google.com/file/d/0Bzig09VSdjW1V29QSHBfQU9zVm8/edit?usp=sharing
This file un-zipped should be exactly 8 MB. You can flash this to de-brick, but you won't have a serial number and you'll know it's not standard firmware.
And finally, here's the complete shellball extracted from the C710 Chrome OS Recovery Image:
https://docs.google.com/file/d/0Bzig09VSdjW1MnlPdDFfYjVqdmM/edit?usp=sharing
This contains the default firmware plus the Chrome OS utilities to support flashing it.
All you should need is the Intel ME (first download) but I like to be thorough and provide the complete solution, which wasn't easy to obtain.
Thank you very much! I have fixed it by the second method(replace the IME of my backup rom). And i try flash A0756 bios to C7, but failed.
DeleteExcellent! And you're very welcome! I've been considering trying the AO756 BIOS myself but haven't found the courage. How did you attempt it?
Delete"You have to bridge pins 3 & 7 to pin 8 on the clip since you only have one +3.3v line. I put a standard jumper on pins 7 & 8 and ran a wire from pin 3 to the jumper."
ReplyDeleteI just want to make sure I am understanding this. Do I need to make sure those pins are all connected somehow (I've figured out HOW, so that's not the problem)? Over at the johnlewis.ie site the procedure on the Samsung does NOT appear to be connecting these pins together, but you say "the procedure is the same." I'd like to make sure I'm clear on this since pin 8 gets 3.3v to it.
Yes, you're correct on all points. I have speculated that the Samsung's non-removable battery might account for the difference but IDK for sure.
ReplyDeleteThank you. Flashing right now.
DeleteI found it easier to run his command to investigate the content of backedup bios, from the same shell (no need to hex editor):
ReplyDeletehexdump -s 0x1000 -n 4 orig_bios.bin
Also another way to read bios is this:
chromeos-firmwareupdate --sb-extract .
it makes sense to also take a backup with it