Acer Aspire TC-895 unlock hidden menu

Hi,

I try to enable onboard graphics controller when using discrete graphic card.
The BIOS will disable onboard graphics controller (Intel UHD 630) when I put in a discrete graphic card. (AMD Radeon RX 5000 series)
However, I want to use both onboard and discrete graphic card together because hackintosh will need it.

I was able to dump the BIOS by using Intel ME tools. But when I try to flash it back, (even without modification) I got:


The command I am using:

1
2
 
FPTw.exe -bios -d biosreg.bin
FPTw.exe -bios -f biosreg.bin
 

I changed the BIOS Lock to 0x0 by using RUEXE, (modGRUB's setup_var doesn't work) but when I reboot back to Windows, I am still getting the same error.
Then I go back to RUEXE saw that BIOS Lock value reverse back to 0x1. (locked)

Another problem is I followed @Lost_N_BIOS 's General Aptio V Mod Guide try to unlock BISO hidden menu so I can change onboard graphics controller settings. But at step 9, I couldn't find hidden short list. I attached my File_DXE_driver_Setup_Setup.ffs and Section_PE32_image_AMITSE_AMITSE.sct files.

Any help is greatly appreciated.

uefi.zip (534 KB)

@Black-Xstar - You usually cannot use both onboard and PCIE Card, unless in crossfire with AMD CPU/GPU etc. But, I’m not 100% sure about leaving internal graphics enabled, while also using PCIE Card, that may be possible and I just never noticed or tried etc.
But, I do doubt this is possible, it’s generally always disabled automatically when PCIE Card is used, unsure outcome if you try to force it enabled. Why would Hackintosh require both?? I’ve never seen this mentioned, and I’ve setup hackintosh myself a few times and never had to mess with this or use onboard graphics etc

For FPT, you need to first disable secure boot, UEFI mode change to Legacy, remove any BIOS password, disable any TPM or encryption, then try again FPT BIOS region dump, then reflash.
You need to disable FPRR, this is what that 167 error is (usually), not BIOS Lock (but disable both)
Flash Protection Range Registers (FPRR), VarStoreInfo (VarOffset/VarName): 0x615
BIOS Lock, VarStoreInfo (VarOffset/VarName): 0x14, VarStore: 0x17

If you cannot change both with grub/setup_var, or RU method, then you may need to use H2OUVE and dump vars, edit there (in two locations usually, but I can’t check since you did not attach BIOS), then flash back

BTW, you can also just change that setting to enabled with RU >> Onboard Graphics Controller, VarStoreInfo (VarOffset/VarName): 0x12D
Edit 0x12D in SaSetup @ GUID 72C5E28C-7783-43A1-8767-FAD73FCCAFA4 << This what I’m talking about below, just change the actual setting you want to change in the hidden menu, change it directly, then no need for mod BIOS
^^ This requires RU method, and you need to have all I mentioned above disabled too (secure boot, UEFI mod >> Legacy instead, no TPM, no BIOS password etc)

The guide you mention is about unlocking menus, editing menus etc, not about changing a setting. And, as mentioned in that guide, that is only a general example, some BIOS may have more “lists” or less "lists"
If you simply want to change one BIOS setting, you do not need to unlock any menu, and you do not even need to make or flash mod BIOS.
Is that your only real concern here, to change one setting? If yes, let me know and I will show you how to do that without having to work around being able to flash in mod BIOS.

@Lost_N_BIOS thanks for quick reply.

macOS will use onboard graphics controller to accelerate video decoding/encoding, more important, Apple’s DRM requires Intel graphics. Without it, Safari will not able play any DRM video like netflix/primevideo and Apple TV+ won’t work at all.
Most retail motherboards (desktop) and laptops can use 2 graphics cards together. For example, the laptop will auto switch to onboard card when using battery to save power.

The Flash Protection Range Registers (FPRR) is set to 0x0 (disabled) when I am checking from RUEXE.
However, the BIOS Lock is 0x1 (enabled), and I can’t change it by using grub/setup_var and RUEXE. (it reverse back when I am reboot)

I did try to use RUEXE to change “Onboard Graphics Controller, VarStoreInfo (VarOffset/VarName): 0x12D” at SaSetup to 0x1, but it is the same issue, the value reverse back when I am reboot. (I tested in Windows the onboard gfx is still disabled)

202009050x12D.png



I want to unlock the hidden menu so I can easily change the settings like CFG Lock. I was able to disable CFG Lock at RUEXE, but the onboard gfx change doesn’t work as expected.
But if I can just change the settings to make both onboard and discrete gfx card work together, I don’t need do a BIOS mod.

My bios dump:

1
 
https://mega.nz/file/SIIDXajB#BiCAtVaViZeWnpEM8qakw-pkNVzmNpcc_yLfpp4C_sE
 

Ahh, OK, I see! I never used any of that, nor did anything like you mentioned, when I’ve tested hackintosh, so I never had to have this concern about onboard graphics enabled or not.
So your concern here is about functionality of the OS for what you want to do, needs onboard graphics enabled too, not the install of hackintosh in general.

Most/all desktops disable onboard once you connect PCIE card. Laptops, 95% have onboard enabled always, otherwise no display out. In rare/expensive laptops, sometimes you can switch or use both etc, but that’s not common.

Make the onboard graphics change in RU with PCIE card removed and ONLY booting with onboard graphics, I bet it stays then. Default is enabled anyway, so it should be 01 always, this is what you want
However, as mentioned, it may not be possible, and is abnormal to have it enabled + use a PCIE graphics card, this usually only possible in certain systems or certain AMD/Crossfire situations.

Did you did notice FPRR AND BIOS Lock is in PCHSetup, not Setup or SaSetup correct? PCHSetup >> VarStoreId: 0x17 [4570B7F1-ADE8-4943-8DC3-406472842384] << This is where you change BIOS Lock and FPRR while using RU, due to this, you cannot change with setup_var, since they are not in setup.
Sorry, I forgot to mention above!

Here, dump vars for me, I will edit to disable BIOS lock and FPRR (these both, or at least one, may still be enabled in “custom” NVRAM too, outside of their normal varstores)
Download the following package, and run the command below from each versions folder that directly contains it’s exe.
Once done, copy the entire folder somewhere, delete everything but any created vars.txt and then repackage this and send to me, this way all created vars.txt remain in place in the folders of the version that created them.
http://s000.tinyupload.com/index.php?fil…212104496994806

H2OUVE.exe -gv vars.txt

I’ll check the BIOS about menu mod for you now too, thanks for the dump

* Edit, we may be able to force enabled only, by editing setup and replace the disabled option, so the min/max is 01 only
Or similarly, make both options enabled only, so no matter what it switches to it would then = enabled.

like so >>
Onboard Graphics Controller, VarStoreInfo (VarOffset/VarName): 0x12D, VarStore: 0x16, QuestionId: 0xCE0, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 72 1C 73 1C E0 0C 16 00 2D 01 10 10 00 01 00}
One Of Option: Enabled, Value (8 bit): 0x0 {09 07 03 00 00 00 00}
One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 10 00 01}

Or this may also work
Onboard Graphics Controller, VarStoreInfo (VarOffset/VarName): 0x12D, VarStore: 0x16, QuestionId: 0xCE0, Size: 1, Min: 0x1, Max 0x1, Step: 0x0 {05 91 72 1C 73 1C E0 0C 16 00 2D 01 10 10 01 01 00}
One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 10 00 01}

* Edit 2 -
After looking at your AMITSE, you do not need AMITSE edit here, probably only AMITSE/SetupData edit to change Access Level to User or Super at ROOT of setup, which you can do with AMIBCP

@Lost_N_BIOS
Thanks god! I have the Acer Aspire TC-895 too!

I was trying to unlock the hidden menus as OP did but also failed.

1. The BIOS Lock is 0x14 in PCHSetup(0x17)

1
2
3
4
 
0x5A9A7 		One Of: BIOS Lock, VarStoreInfo (VarOffset/VarName): 0x14, VarStore: 0x17, QuestionId: 0xBDC, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 D4 0B D5 0B DC 0B 17 00 14 00 10 10 00 01 00}
0x5A9B8 Default: DefaultId: 0x0, Value (8 bit): 0x1 {5B 06 00 00 00 01}
0x5A9BE One Of Option: Disabled, Value (8 bit): 0x0 (default MFG) {09 07 04 00 20 00 00}
0x5A9C5 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
 

0x14.png


I used RU to change 0x14 under PCHSetup to 0x0 to disable it. After reboot the value reversed back to 0x1 automatedly.

2. The FPRR is 0x615 in PCHSetup(0x17)

1
2
3
 
0x4F690 		One Of: Flash Protection Range Registers (FPRR), VarStoreInfo (VarOffset/VarName): 0x615, VarStore: 0x17, QuestionId: 0x741, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 35 12 36 12 41 07 17 00 15 06 10 10 00 01 00}
0x4F6A1 One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x4F6A8 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
 


Does this mean that the default value of FPRR is 0x0 disabled?
I used RU to check the value of 0x615 also shows 00.

0x615.png


3. I used AMIBCP5 to change all access from default to user, but I got Error 167 when I used the FPTW64 to flash it back same as OP.

Capture.PNG



I also tried to flash the original BIOS I just dumped by FPTW and I got same error 167.

1
2
 
FPTW64.exe -bios -d 1.bin
FPTW64.exe -bios -f 1.bin
 

1
2
3
4
5
6
7
 

Error 167: Protected Range Registers are currently set by BIOS, preventing flash access.
Please contact the target system BIOS vendor for an option to disable
Protected Range Registers.

Capture.PNG


FPT Operation Failed.
 
 

@Michaelsunzy - As mentioned above, often there is hidden NVRAM area that also needs these items changed, please dump vars as outlined above at post #4 and I will disable BIOS Lock and FPRR for you.
Then you will be able to FPT flash BIOS region, if you still get 167 after that, then that means flash programmer is required to flash in mod BIOS on this model. Sometiems that is only way, due to lock being inside a module not an actual setting you can change or that matters etc

Also, DO NOT change everything to USER or Super like you showed above, only change the exact items you need to change

@Lost_N_BIOS Thanks for looking the dump.

I already successful installed hackintosh without any BIOS mod, although remove CFG Lock is a bonus. (In deep, this can be emulated by OpenCore, but actual BIOS setting is more reliable)
Leaking onboard gfx in hackintosh is my main concern. Because the functions (video accelerate and DRM) I need are depending on it.

I actually tried to use AMIBCP to change access level to USER at the very beginning. However, the problem is I can not flash mod BIOS back. I am always getting Error 147 when using Intel ME tools. Besides, the afuwin flash tool doesn’t work either.
So I turned into remove the BIOS Lock and FPRR. I figured out that they are not in the SaSetup or Setup, but in the PchSetup. RU is able to change those values, but it reversed back after reboot.

I haven’t use H2OUVE.exe before but I will try and upload vars.txt, thanks!

Could you explain how to edit setup and replace the disabled option or make both options enabled only for Onboard Graphics Controller?
My goal is to use both graphics card together, so if the way works, that will be great.

@Black-Xstar - Good you have hackintosh up and running now
Please dump vars for me as mentioned above, then we will see if FPRR and or BIOS lock can be disabled by settings to bypass error 167 or not, if not you will need flash programmer.
Please also run this command with FPT and show me the report >> FPTw.exe -i
You may be able to flash volume instead of region with FPT, and not get stopped by BIOS lock of FPRR - If we can’t bypass this with vars edit.

The edits I mentioned above rely on being able to flash BIOS region, or main DXE volume with FPT first, so we need to sort that out before any edits matter.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
 
Intel (R) Flash Programming Tool Version: 14.5.12.1111
Copyright (C) 2005 - 2020, Intel Corporation. All rights reserved.
 
Reading HSFSTS register... Flash Descriptor: Valid
 
--- Flash Devices Found ---
ID:0xEF4018 Size: 16384KB (131072Kb)
 
--- Flash Image Information --
Signature: VALID
Number of Flash Components: 1
Component 1 - 16384KB (131072Kb)
Regions:
DESC - Base: 0x00000000, Limit: 0x00000FFF
BIOS - Base: 0x00400000, Limit: 0x00FFFFFF
CSME - Base: 0x00001000, Limit: 0x003FFFFF
GbE - NOT PRESENT
PDR - NOT PRESENT
EC - NOT PRESENT
Master Region Access:
BIOS - ID: Read: 0x000F, Write: 0x000A
CSME - ID: Read: 0x000D, Write: 0x0004
GbE - ID: Read: 0x0009, Write: 0x0008
EC - ID: Read: 0x0101, Write: 0x0100
 
Total Accessible SPI Memory: 16384KB, Total Installed SPI Memory: 16384KB
 
FPT Operation Successful.
 

@Lost_N_BIOS Looks like I am not lucky.

I run 4 H2OUVE.exe versions, none of them is working:

1
2
3
 
Now parsing Variable Information.
Failed to get bios data!
Fail to get Variable Information.
 

I am using Win10 x64, do I need older Windows version to do that?

Here is my FPT -i dump:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
 
C:\>FPTW.exe -i
Intel (R) Flash Programming Tool Version: 14.5.12.1111
Copyright (C) 2005 - 2020, Intel Corporation. All rights reserved.
 
Reading HSFSTS register... Flash Descriptor: Valid
 
--- Flash Devices Found ---
ID:0xEF4018 Size: 16384KB (131072Kb)
 
--- Flash Image Information --
Signature: VALID
Number of Flash Components: 1
Component 1 - 16384KB (131072Kb)
Regions:
DESC - Base: 0x00000000, Limit: 0x00000FFF
BIOS - Base: 0x00400000, Limit: 0x00FFFFFF
CSME - Base: 0x00001000, Limit: 0x003FFFFF
GbE - NOT PRESENT
PDR - NOT PRESENT
EC - NOT PRESENT
Master Region Access:
BIOS - ID: Read: 0x000F, Write: 0x000A
CSME - ID: Read: 0x000D, Write: 0x0004
GbE - ID: Read: 0x0009, Write: 0x0008
EC - ID: Read: 0x0101, Write: 0x0100
 
Total Accessible SPI Memory: 16384KB, Total Installed SPI Memory: 16384KB
 


@Michaelsunzy welcome to the party!

Can H2OUVE be used on AMI chip?

I was playing with RU, an interesting found.

If I change any settings in PchSetup, the next time reboot, when I choose enter BIOS, the system will reboot automatically, I guess the BIOS found abnormal and reset itself.
Also I found another one called PchColdReset which exactly same as PchSetup. Does it from NVRAM?

Another question, I found 2 8pin chip in the motherboard:

winbond.jpg


mcix.jpg


Which one is BIOS chip if I need get a programmer to flash it?

@Lost_N_BIOS
Here is my whole dumped file Flash Image including all regions

https://mega.nz/file/fVxhjSxS#3k4LlVyOaa…VMxrCtOExQtOPDE


I tried every H2OUVE you send us, none of them works.

I don’t know what to do next:/
-----------------------

My programer should be delivered today
----------------------

@Lost_N_BIOS

My programer arrived today.

1. I use FTPW.exe -bios -d to get the bios file

2. I use AMIBCP to edit my bios file and change some menus access to user

3. I use CH341 to flash the edited file back

4. Turn on the PC.

5. The pc will restart after a few seconds and everything will be reset to default.

@Black-Xstar - You said >> If I change any settings in PchSetup, the next time reboot, when I choose enter BIOS, the system will reboot automatically << What do you mean "When you choose “enter BIOS”?
Is there some screen offering you options, if yes, what does it say, and is that always there when you try to enter BIOS, ie is that normal?

BIOS chip is the W25Q128JV and for that only the following I know is true, software package linked below
W25Q128JV - 1.18 (read, not write) or ASProgrammer 1.40/1.41 (maybe OK read/write)
W25Q128JV - Colibri ver. 1.0.1.62 confirmed read/write OK - I suggest you use this for read and or write
http://s000.tinyupload.com/index.php?fil…213094641136166

Please do the following with FPT and send me the created files, thanks
FPTw.exe -desc -d fd.bin
FPTw.exe -me -d fd.bin << If error, OK, we’ll wait till you get programmer (I only need these two, to help fix users BIOS below)

Apologies to you both about the H2OUVE, I must have been asleep and forgot or not noticed when writing that out!
H2OUVE cannot be used on AMI BIOS, sorry

Please dump your NVRAM for me using FPT and following commands
FPTw.exe -a 0x400000 -l 0x30000 -d vol1.bin
FPTw.exe -a 0x430000 -l 0x30000 -d vol1.bin

Then, once done, try writing it back once and see if error 167 or not
FPTw.exe -a 0x400000 -l 0x30000 -f vol1.bin

Also, please test this command instead of FPT spoiler #1-2, to see if we can write the main DXE volume instead of the entire BIOS region, this may get around the 167 error too, since it does not appear to be blocked from writing to the entire BIOS region at all in your FPTw.exe -i info
FPTw.exe -a 0x476000 -l 0x44A000 -d mainDXEVol.bin

Then >>
FPTw.exe -a 0x476000 -l 0x44A000 -f mainDXEVol.bin << If this passes, we can do menu mod now! If it fails, let me edit above first, if that does not error on write back, then we’ll know for sure if FPRR and or BIOS Lock are settings causing the 167 error

Instead of H2OUVE , please download this SCEWin package, and see if any of these will work for you or not, if any NVRAM.TXT created, upload them for me as-is, in their version created folders
https://ufile.io/ylbsj1xt

Use this command from each versions folder >> SCEWIN /o /s nvram.txt /h Hii.db /v /q
If any give valid output, we can probably change the NVRAM this way as well, if the above FPT dump/write of NVRAM only fails too.

Before doing ANY of this!!! Make sure in BIOS, there is no BIOS password, that TPM is disabled, and that secure boot is disabled.


@Michaelsunzy - FPTw.exe -bios -d only gives you the BIOS region, you can’t program that back in as-is with a flash programmer.
Hopefully you made a backup of the chip FIRST with programmer, before you did anything else with programmer. AND, hopefully you used correct software/version to do your dump, or at least compatible for valid read. What is your chip ID?
If your chip is W25Q128JV as well, see above. If you did not make a backup first with programmer, then I will have to rebuild you a new complete BIOS to program back in (send me your FPT dumps BIOS region)
Also, see above bold item

Or, did you dump, and then rebuild your own BIOS, putting the edited region back into your dumped BIOS before programming back in?
Sounds like maybe you did this above, but I am not sure. Also, sounds like AMIBCP may not be able to be used on this BIOS, it may be breaking something on rebuild, not sure.
I will make similar edits for you manually, once you send me entire programmer dump of working system, with above bolded items done first.
* Edit, sorry, I missed your linked file above. Is this programmer dump? If yes, did you do the above bold items first? If not, do them now, and dump the BIOS with the program I linked above (colibri)

@Lost_N_BIOS
No, there is not screen or error messages, just reboot automatically.

FPTw.exe -desc -d fd.bin
FPTw.exe -me -d me.bin
Dumped: https://mega.nz/file/jYZziACR#6c6Bni42a_…hKAQs6CvlTcKsl0

FPTw.exe -a 0x400000 -l 0x30000 -d vol1.bin
Success.
FPTw.exe -a 0x400000 -l 0x30000 -f vol1.bin
Error 167

FPTw.exe -a 0x476000 -l 0x44A000 -d mainDXEVol.bin
Success.
FPTw.exe -a 0x476000 -l 0x44A000 -f mainDXEVol.bin
Error 167

2 of SCEWin versions are working. Here is the dump files:
https://mega.nz/file/WVBxDYKT#w8fHVjUgN7…Cczcp37nVpBn3z4

I placed order for flash programmer. Should arrive next week.

@Lost_N_BIOS

Thank you so much for your reply! :smiley:


Yes, my chip is W25Q128JV as well. I did what you said:

Please find the attached SCEWIN result, fd.bin, me.bin and mainDXEVol.bin. Only 5.03.111 works.

All writing backs got error 167.

Michaelsunzy.rar (4.94 MB)

@Black-Xstar - Thanks for the info, and FD/ME dump too. Looks like programmer may be required, since error 167 still on both those FPT runs
But, maybe we can do changes with SCEWin, lets see FPRR is disabled already, so only BIOS lock needs changed, and then if 167 error remains this is due to a FPRR lock in BIOS module and not in BIOS/NVRAM settings (so programmer would need to remove it, if we can find/remove)
Here is edited NVRAM.txt for version 5.03.1111 (This was only one that worked), put this in that folder and then run the command below from Admin CMD Prompt
http://s000.tinyupload.com/index.php?fil…947925063733130

SCEWIN /i /s nvrammod.txt

Then reboot, and try FPT spoiler #1-2 again, using new biosreg name, just in case it passes #2 this time

@Michaelsunzy - Did you brick your system, or are you booting again etc? I was a bit confused with your previous post as to what was going on, what you did etc.
If you can boot now, great! Please wait, we’ll see about SCEWin, if this can get past 167 error or not. If not, programmer will be required for edits, and on 167/FPRR I may or may not be able to remove via BIOS edit, I’ll have to see if I can find the lock in modules.
Since you already have programmer. Please send me dump from working system, unedited. This means if you are booting OK now, reflash stock BIOS using stock method, so BIOS is clean without any edits.
Then load optimized, save and reboot back to BIOS, then disable secure boot, TPM, and remove any BIOS password. Then shut down, dump the BIOS using colibri and send to me.
I will then see if I can find and remove the lock causing 167, if not, I will just do the menu edit/unlock for you manually so we can see if AMIBCP is breaking something, or if there is some auto-BIOS-Recovery going on here or something. << If that, not sure we can get around, unless you can find chip containing what it’s using as backup to restore from.

@Lost_N_BIOS

I tried import back modified NVRAM.txt file, then I reboot computer. When I see Acer logo, the computer automatically reboot again. The behaviour is the same as I change NVRAM value in the RU. The FPT still reports error 167 when I use it in the Windows.
I guess this BIOS has some kind of protection? If the important value in NVRAM get changed, it will automatically restore it in next reboot.

Is there anyway to around it? Like, change the value related to the onboard graphics directly without unlock BIOS.

I am still waiting for my flash programmer.

@Black-Xstar - Sounds like some auto-recovery, not protection, otherwise it would not be able to reset the value to original.
Check the board on both sides once you programmer arrives, then dump all SOIC8 chips you see, give me their ID’s too, in case I need to tell you to use certain software/version to dump

You can try changing only the graphics option you want to change, using RU method, then reboot and see if it’s changed back.
It’s located at >> Onboard Graphics Controller, VarStoreInfo (VarOffset/VarName): 0x12D, VarStore: 0x16 << = SaSetup @ GUID - 72C5E28C-7783-43A1-8767-FAD73FCCAFA4
00 = Disabled
01 = Enabled

Or, you can also try making the change in SCEWin and see if same too. To edit this, open your original NVRAM.txt dump, find that setting and move the asterisk as it mentions, then flash it back.

// Setup Question = Onboard Graphics Controller
// Token =CE0 // Do NOT change this line
// Offset =12D
// Width =01
// BIOS Default =[00]Disabled
// Options =[00]Disabled // Move "" to the desired Option
// [01]Enabled

Change to
// Setup Question = Onboard Graphics Controller
// Token =CE0 // Do NOT change this line
// Offset =12D
// Width =01
// BIOS Default =[00]Disabled
// Options =[00]Disabled // Move “*” to the desired Option
// *[01]Enabled

Then after reboot, dump again and check to see if it’s back to original. If it is, then we may either have to use programmer to make changes, or have to find the backup it’s using to recover and make the changes there first

@Lost_N_BIOS

I already tried that, both RU and SCEWin, to modify 0x12D @ SaSetup.
It doesn’t work. System automatically restore it at next reboot.

So my last hope will be the programmer! Is it possible that programmer will not work in my case?

Thanks.