BIOS Update via EFI Shell

Schenker Technologies GmbH, Version 1.2 (March 2024)

This document will help you to get familiar with updating your EC, ME and BIOS Firmware via EFI Shell.

Essential instructions
This paragraph will represent the most concise, yet complete, version of our instructions.
The rest of this document will explain each step in more detail with screenshots.

1. Prepare USB thumb drive, formatted with FAT32. If drive is larger than 32GB, you need to partition it.
Unzip content of EFI Shell into the root of the thumb drive.
Unzip content of EC and/or BIOS updates into your thumb drive (creating subfolders is OK).
Make sure system is ‘plugged in’ with external power.
2. Reboot and disable ‘Secure Boot’ in BIOS Setup (press F2 to enter BIOS Setup).
3. Boot from USB thumb drive (press F7 to select boot media during reboot).
4. Navigate folder structure in EFI shell and run .NSH files to execute the update.
5. Wait for the update to complete. Do not manually shutdown or reboot the system during the update!
If your update consists of multiple parts (multiple ZIP files or subfolders), run the updates one after another.
6. If you get a “Secure Boot Violation” error after updating, this is normal. Remove USB stick and reboot.
7. When update is complete, reboot and enter BIOS Setup.
In the “Exit” menu, select “Load Defaults” (or “Optimized Defaults” or similar).
Finally, finish by selecting “Save & Exit” (or “Save & Reset” or similar).

More detailed instructions / Step 1: Prepare the USB thumb drive

1. Make sure that your USB thumb drive is formatted in FAT32.

2. If the drive is larger than 32GB, you need to partition it with the Windows Disk Management.
3. Download the ZIP file EFI Shell for USB.
4. Unpack it into the root directory (not a subdirectory) of your USB thumb drive.
5. Unpack the content of the EC/BIOS Update ZIP files onto your USB thumb drive (creating subfolders is OK).

Figure 1: USB thumb drive formatted in FAT32 Figure 2: Typical directory layout of USB thumb drive with EFI Shell

BIOS Update via EFI Shell, Page 1 of 6

See the following screenshots for reference:

Introduction: Aptio BIOS vs. Insyde BIOS

When entering BIOS Setup (F2), you will see either one of these two systems:

Aptio BIOS Aptio BIOS with ESA Insyde BIOS

(American Megatrends, AMI) (American Megatrends, AMI)

Figure 3: Aptio BIOS (classic) Figure 4: Aptio BIOS (graphical) Figure 5: Insyde BIOS (graphical)

Both systems are equally up to date and fully compliant with BIOS/UEFI standards. While the UI appear different on
first look, the organisation and operation is identical. Aptio Setup will go directly to the setup pages. Insyde BIOS will
greet you with a ‘Welcome’ screen first in which you’ll have to select ‘Setup Utility’ to go deeper into BIOS Setup.

Please remember these hotkeys:

F2 BIOS Setup Utility Gives you access to all UEFI/BIOS settings.

F7 Boot Select Manager Enables you to select your boot device, including USB media.

To enable F2 (BIOS Setup) and F7 (Boot Select), hold down the respective hotkey during early boot-up time.

Step 2: Disable Secure Boot

On most laptops, a feature called ‘Secure Boot’ is enabled in the BIOS. However, ‘Secure Boot’ needs to be disabled
in order to boot EFI Shell from USB thumb drive.

1. Reboot and enter BIOS Setup Utility (F2).

2. Find and disable ‘Secure Boot’, if it is not disabled already.
3. You may find it in menu items such as ‘Security’, ‘Boot’ or ‘Administer Secure Boot’.
4. After you have disabled ‘Secure Boot’, go to ‘Exit’ and select and comfirm ‘Save Changes and Reboot’ (or similar).

Step 3: Boot your USB thumb drive

1. Make sure system is ‘plugged in’ with external power.
2. Attach your USB thumb drive to one of the USB Ports.
3. Boot your system and hold down F7 to enter Boot Manager.
4. Select and confirm ‘EFI USB Device’ or ‘Generic Flash Disk’.

Figure 6: Boot Manager (F7) will look different, depending on your

system. The function is the same on both systems.

BIOS Update via EFI Shell, Page 2 of 6

 Attention: EC and BIOS Updates might automatically reboot the system multiple
times. The screen might even stay dark for a certain amount of time.
This is normal. Please be patient and let the update proceed without interruptions.

Do not manually shut down or reboot the system during the Update!
Do not remove the external power supply!

If the update asks you to confirm to continue the process, please read the instructions
on the screen carefully and, if you want to proceed, confirm.

If you see any Error messages, please take a picture of the message and send it to
support. A few common messages are explained at the end of this document.

Step 4: Navigate EFI Shell

1. Your system should now boot into the EFI Shell.
2. There will be a countdown for startup.nsh - press ANY KEY to proceed. Do not press ESC (Escape).
3. You will see the following instruction on screen. Please read them carefully.

Welcome to EC/BIOS Update via EFI Shell.

You are already in the correct file system.

Please use commands 'dir' and 'cd' to navigate.

The command 'dir' will list the content of your current directory.
The command 'cd' (change directory) will navigate down to the next directory.
To navigate up to the parent folder again, use the command 'cd ..'

Use tabulator [Tab] key on your keyboard for auto-completion.

Example: 'cd Bios' and then press [Tab] a few times.

After entering the appropriate folder, run the correct NSH file to Update.
NSH files in EFI Shell are the same as BAT files (Batch files) in MS-DOS.
To run an NSH file, simply type its name into the shell and hit [Return].
You can use [Tab] again to auto-complete the name of the NSH file.
Update files are named F.NSH, FLASH.NSH, FLASHME.NSH, ECFLASH.NSH or similar.

If your BIOS update contains an ME Update, please run MESET first.

You can use PageUp and PageDown keys on your keyboard to scroll up and down.

Step 5: Run .NSH file from USB thumb drive in EFI Shell

Please navigate with EFI Shell into the subfolder that contains the .NSH file that you want to run. If you have a
system where EC and BIOS are updated seperately from one another, it is generally advised to run EC update first.
This is explained in more detail in the FAQ at the end of this document.

Some BIOS updates come with an update for Intel Management Engine (Intel ME). In some of those cases, the ME
area of the firmware needs to be unlocked first by running a special ‘MESET’ command. In such cases, the MESET
step will be contained in a separate, numbered subfolder of the BIOS update archive.

Step 6: "Secure Boot Violation" after automatic reboot (– this is normal)

After a successful BIOS update, most BIOS settings will be reset, which usually results in Secure Boot being
reactivated. During the next boot process, a Secure Boot error message will appear because the laptop automatically
tries to boot from the USB stick again. Solution: If further flash processes are planned after the BIOS update, first
deactivate Secure Boot again (reboot, F2). If no more updates are pending, you can remove the stick and proceed to
the next step. Please make sure to not remove the stick in the middle of an update.

BIOS Update via EFI Shell, Page 3 of 6

Examples and Screenshots

The exact output on the screen will depend on your system and on each individual update. Please use the following
screenshots for guidance.

Figure 7: Navigating EFI Shell and starting NSH file for EC Update. The names of files and folder might appear different, depending on your update.

Figure 8: Typical example of screen output during EC Update.

Figure 9: This error message is harmless. It occurs when an attempt is made

to boot from the USB stick again after a successful BIOS update.

BIOS Update via EFI Shell, Page 4 of 6

Step 7: Reset and Finish
After all updates are completed successfully, it is strongly recommended to go back to the BIOS to restore all settings
to factory default. This is usually described as “BIOS Reset” or “CMOS Reset”.

1. You can now remove the USB Stick from your system.
2. Enter BIOS Setup Utility (F2), go to “Exit” category.
3. Select and confirm “Load Optimized Defaults” / “Load Setup Defaults” (or similar).
4. If you have disabled “Secure Boot” earlier, please enable it again.
5. Press F10 and confirm for “Save and Exit”. Reboot and enjoy your updated system.

Thank you for updating EC/BIOS via EFI Shell.

If you have any question, please do not hesitate to contact us for support.

Troubleshooting
There might be a number of situations that might cause an error during one of these steps. This checklist will help
you to fix the most common causes:

→ Have you downloaded the correct package for your model? Please compre the Product ID of the package
with the Product ID that is printed on the product label on the bottom side of your laptop.

→ Occasionally, some USB thumb drives just don’t play well with EFI Shell. They might boot and show the
correct files, but then they might have invalid file content, checksum error or similar issues. Just try one or
two other USB thumb drives. Both USB 2.0 and USB 3.0 should be fine.

→ If you are unable to boot from your USB thumb drive, please double check to see if it is formatted in FAT32.
Formatting in FAT32 is only possible if the partition on the stick is not larger than 32GB. A 64GB stick (or
larger) must be partitioned accordingly. See step 1 on the first page of this guide.

Various common warnings and error messages

GbE Region does not exist

GbE Region contains code and configuration data for Gigabit Ethernet in the ME firmware. This region is usually not
present if Booting over LAN is disabled in the BIOS. Can be ignored.

PDR Region does not exist

Platform Descriptor Region allows system manufactures to describe custom features for the platform. Usually not
present in our system. Can be ignored.

Error 25: The host CPU does not have write access to the target flash area. To enable
write access for this operation you must modify the descriptor settings to give host
access to this region.
This indicates that the ME Firmware Region is protected against overwriting – it’s not a bug, it’s a feature.
If you encounter this error, please run MESET (or similar) as described in Step 5 of this document.

BIOS Update via EFI Shell, Page 5 of 6

FAQ – Frequently Asked Questions

Q: What is EFI Shell?

A: EFI Shell is a Command-Line Interface similar to MS-DOS, PowerShell and Linux Bash. It is fully seperate from your
operating system. EFI Shell is compatible with UEFI, which has been the most common BIOS architecture since 2012.

Q: What is EC Firmware?
A: EC stands for “Embedded Controller” - it is responsible for battery and power management, fan control, keyboard
input and RGB LEDs. This Controller is a chip on the mainboard that is separate from the BIOS chip. In the system’s
hierarchy, the EC is activated before the BIOS. Among all the chips that might require firmware updates, the EC chip
is the most low-level one.

Q: What is a Capsule Update?

A: Laptop Firmware Updates are usually seperated into EC and BIOS firmware. However, some recent models
combine both EC and BIOS into one single update process, called Capsule Update. Our download portal is usually
structured in such a way that we will no offer any redudant files. If you see two separate packages (a ZIP with EC and
another ZIP with BIOS), you are usually required to install both of them after one another. However, if you only see a
single ZIP file, them the EC update might already be included with the BIOS.

Q: If I have separate EC and BIOS updates – which one should I install first?
A: There used to be the rule of thumb that EC should be updated before BIOS. This only really applies to rare
situations where a mainboard/platform has a cross-generational transition, as happened in the past when Windows
7 transitioned to Windows 8 (with UEFI support) or when a platform with a socketed Desktop CPUs is upgraded for a
new CPU generation. When we upload packages with such special requirements, we will always provide an extra
readme in the ZIP file and the EC and BIOS folders will be numbered (1, 2) accordingly.

Q: What is the purpose of MESET?

A: Some BIOS Updates might include an ME Firmware-Update. “FLASHME.NSH” will typically run the ME Update first
(if present), then automatically run the BIOS Update. However, before ME Update, you need to unlock the ME for
write-access. This is done via MESET Tool, typically named MESET.EFI, MeSet.efi, or MeSetX64.efi.
If you find this tool in your BIOS Update folder, run it in EFI Shell. After MESET is complete, the system will reboot.
During this reboot, the fans will run at high speed and it might take a few moments to finish rebooting. After reboot,
you can launch EFI Shell again in order to continue with the ME/BIOS Update.

Q: Can I update my EC/BIOS in Windows instead?

A: While most models can be updated via Windows in theory, we usually do not provide the necessary tools to do
so. We provide EC and BIOS updates via EFI shell in the interest of safety and security. EFI Shell is fully independent
from your operating system, therefor avoiding any potential risk of interference from Windows software and other
background processes.

Let’s imagine the worst case: you are running a BIOS update in Windows and the progress bar is moving from 0 to
100%. Suddenly in the middle of this update, something triggers a reboot. This could be a scheduled Windows
update, a software for a 3rd party or it could be a good old fashioned Bluescreen. Or maybe someone pressed the
power button by accident, triggering a shutdown. In such situations, there is a high risk that your system might not
be able to boot anymore. It would then be necessary to go through complicated BIOS recovery steps. We try to avoid
such situations at all cost. This is why we support EC and BIOS updates only via EFI Shell.

End of document

BIOS Update via EFI Shell, Page 6 of 6