Acer One 10 S1002

BIOS/UEFI Modding BIOS Modding Guides and Problems
1

Hi,

I bought this tablet - http://www.acer.com/ac/en/US/content/series/acerone10 (S1002) and i would like to unlock the bios.

It s an AMI V UEFI 2013
Advanced and Chipset tabs are locked, also almost every option in the only visible tab is locked.

AMIBCP 4.55 is not able to save the rom (Runtime error)
I m unable to find the setup module in eufi tool

I updated the bios to 1.10 and then extracted the rom with afu ([Guide] Flashing modified AMI Aptio UEFI using AFU)

These informations are displayed:
Signed bios update: enabled ( Can i flash my modded bios with afu? )
BIOS flash method: runtime,capsule,recovery
flash write-protection: disabled

Noob question: the cpu does support 64bit but i m unable to boot any x64 Windows version and any 32/64 Linux distro. Does this means that it has a 32bit UEFI? Is this a bios lock? Any way to bypass this?

Thanks

extracted.zip (1.99 MB)

2

i found latest? AMIBCP v5.01 and it s able to save my bios.

can i add a link to this tool, so everyone can edit newer bioses?

Edit:
The bios is now unsigned. Can i safely flash it?

3

Noob question: the cpu does support 64bit but i m unable to boot any x64 Windows version and any 32/64 Linux distro. Does this means that it has a 32bit UEFI? Is this a bios lock? Any way to bypass this?

Secure boot : Disabled ?

OR

http://www.howtogeek.com/175641/how-to-b…th-secure-boot/


setup module in MMTOOL :

|018|Setup |899407D7-99FE-43D8-9A21-79EC328CAC21|00020CD0|00E50C|DRVR|

Don’t break your brain to modify it into hex code, Use AMIBCP and change “ACCESS/USE” to USER in replacement of DEFAULT.

4

Yes, you can give us a link to this newer AMIBCP version.

Probably yes (if you have done the modification correctly).


That is strange. Which error message do you get? How much RAM has your system?

5

5.01 32 and 64 bit version
http://www72.zippyshare.com/v/CohjmKrh/file.html

There s no error, it boots the internal os.
I booted Clover EFI and my EFI version is 2.31 32bit
it has 2gb of ram.

@DoZe How can i unlock hidden tabs without hex editor? is there a new way?
secure boot is disabled

i just changed 1 option permission to user and this is afu output:

secure flash enabled, recalculate ROM size with signature… Enabled
ffs checksum…ok
12 - Error: No non-critical blocks found in ROM file.

6

Maybe the installation of anyother OS is blocked by the vendor of your system.
Have you tried to delete all existing partitions of your SSD/HDD (after having saved your important data on an external disk drive or USB Flash drive)?

This is not a good basis for a 64bit OS.

7

i already wiped everything and i installed a clean win 10 32bit, the only one that actually boot with no problems
i cannot boot older win oses because the legacy boot option is locked >.<

yea i know, but my main os is arch+openBox and it only uses 150mb of ram. the 64bit version should give me a performance boost (this cpu is not a beast)

8

i just open your bios with AMIBCP v4.55.0070

See the scrrenshot :

setuphowto.jpg




Oupppss yes runtime error too F…

9

yes, you can open it but you cannot save

i also have an asus laptop (non uefi) and to unlock hidden tabs i had to hex edit the bios.

10

Arf…

Use UEFITOOL to extract setup module (I give you the setup module in the above post) and modify in hex code.
To simplify you work, you can use IFR extractor tool to see where you need to mod the hex code easier :

http://donovan6000.blogspot.fr/2014/02/u…-extractor.html

1) Open your setup module you have extracted before with IFR (in uncompressed form of course, with UEFITOOL or MMTOOL, but i prefer UEFITOOL).
2) Click on “Extract” and IFR generate a .txt.

if you know to mod in hex code it can help you to visualize what to mod.

11

that s what i did and i though that module was not setup.

in the old bios i had all the menus in the ifr, while here you can only see "setup"
and form setup ref main, advanced etc…

seem a bit different,mmm…not sure what i should do with this

12

If You want to learn, see here :

http://forums.mydigitallife.info/threads…nus-MSR-unlock!

13

https://www.acer.com/ac/en/US/content/support-product/6142

14

@HowDoI - I can unlock this BIOS possibly, but I have no idea about “64bit bootloader/module insertion”, unless there is sister model of this exact model that allows x64, or you have info/thread where someone discusses that kind of edit for this exact system. It may just be a BIOS setting, seems like no one mentioned or looked about that previously?

On BIOS menu, by default you can only see Main, Security, Boot, and Save & Exit, correct? I can only add one more, or swap out something for something else, unless AMIBCP access level User/Super edit by itself would enable visibility (not likely)

In regards to OS, I see the following BIOS settings

BOM Seletion Switch, VarStoreInfo (VarOffset/VarName): 0x120, VarStore: 0x1, QuestionId: 0xCA, Size: 1, Min: 0x0, Max 0x9, Step: 0x0 {05 91 E4 03 E5 03 CA 00 01 00 20 01 10 10 00 09 00}
0xDF7D Default: DefaultId: 0x0, Value (8 bit): 0x3 {5B 06 00 00 00 03}
0xDF83 One Of Option: Force Windows/BOM3.0, Value (8 bit): 0x3 {09 07 EC 03 00 00 03}
0xDF8A One Of Option: Force Windows/BOM3.1, Value (8 bit): 0x2 {09 07 ED 03 00 00 02}
0xDF91 One Of Option: Force Windows/BOM3.2, Value (8 bit): 0x1 {09 07 EE 03 00 00 01}
0xDF98 One Of Option: Force Windows/BOM3.3, Value (8 bit): 0x8 {09 07 EF 03 00 00 08}
0xDF9F One Of Option: Force Android/BOM2.0, Value (8 bit): 0x7 {09 07 E7 03 00 00 07}
0xDFA6 One Of Option: Force Android/BOM2.1, Value (8 bit): 0x6 {09 07 E8 03 00 00 06}
0xDFAD One Of Option: Force Android/BOM2.2, Value (8 bit): 0x5 {09 07 E9 03 00 00 05}
0xDFB4 One Of Option: Force Android/BOM2.3, Value (8 bit): 0x4 {09 07 EA 03 00 00 04}
0xDFBB One Of Option: Force Android/BOM2.4, Value (8 bit): 0x9 {09 07 EB 03 00 00 09}
0xDFC2 One Of Option: Development Mode, Value (8 bit): 0x0 {09 07 E6 03 00 00 00} <<< May be ideal choice to try and see if x64 can be loaded
0xDFC9 End One Of {29 02}
0xDFCB One Of: Pre-OS/BOM Selection, VarStoreInfo (VarOffset/VarName): 0x127, VarStore: 0x1, QuestionId: 0xCB, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {05 91 D2 03 D3 03 CB 00 01 00 27 01 10 10 00 FF 00}
0xDFDC One Of Option: Windows 8.X/BOM3.0, Value (8 bit): 0x0 {09 07 D4 03 00 00 00}
0xDFE3 One Of Option: Windows 8.X/BOM3.1, Value (8 bit): 0x1 {09 07 D5 03 00 00 01}
0xDFEA One Of Option: Windows 8.X/BOM3.2, Value (8 bit): 0x2 {09 07 D6 03 00 00 02}
0xDFF1 One Of Option: Windows 8.X/BOM3.3, Value (8 bit): 0x3 {09 07 D7 03 00 00 03}
0xDFF8 One Of Option: Android/BOM2.0, Value (8 bit): 0x80 (default) {09 07 D8 03 10 00 80}
0xDFFF One Of Option: Android/BOM2.1, Value (8 bit): 0x81 {09 07 D9 03 00 00 81}
0xE006 One Of Option: Android/BOM2.2, Value (8 bit): 0x82 {09 07 DA 03 00 00 82}
0xE00D One Of Option: Android/BOM2.3, Value (8 bit): 0x83 {09 07 DB 03 00 00 83}
0xE014 One Of Option: Android/BOM2.4, Value (8 bit): 0x84 {09 07 DC 03 00 00 84}
0xE01B One Of Option: Unkown, Value (8 bit): 0xFF {09 07 DD 03 00 00 FF}
0xE022 End One Of {29 02}
0xE024 One Of: BOM Select Valid, VarStoreInfo (VarOffset/VarName): 0x11E, VarStore: 0x1, QuestionId: 0xCC, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 E0 03 E1 03 CC 00 01 00 1E 01 10 10 00 01 00}
0xE035 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 D2 01 00 00 01}
0xE03C One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 B9 01 10 00 00}
0xE043 End One Of {29 02}
0xE045 One Of: BOM Select End, VarStoreInfo (VarOffset/VarName): 0x138, VarStore: 0x1, QuestionId: 0xCD, Size: 1, Min: 0x0, Max 0xFE, Step: 0x0 {05 91 E2 03 E3 03 CD 00 01 00 38 01 10 10 00 FE 00}
0xE056 One Of Option: Enabled, Value (8 bit): 0xFE (default) {09 07 D2 01 10 00 FE}
0xE05D One Of Option: Disabled, Value (8 bit): 0x0 {09 07 B9 01 00 00 00}
0xE064 End One Of {29 02}
0xE066 One Of: OS/BOM Selection, VarStoreInfo (VarOffset/VarName): 0x11F, VarStore: 0x1, QuestionId: 0xCE, Size: 1, Min: 0x0, Max 0x84, Step: 0x0 {05 91 D0 03 D1 03 CE 00 01 00 1F 01 10 10 00 84 00}
0xE077 Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
0xE07D One Of Option: Windows 8.X/BOM3.0, Value (8 bit): 0x0 {09 07 D4 03 00 00 00}
0xE084 One Of Option: Windows 8.X/BOM3.1, Value (8 bit): 0x1 {09 07 D5 03 00 00 01}
0xE08B One Of Option: Windows 8.X/BOM3.2, Value (8 bit): 0x2 {09 07 D6 03 00 00 02}
0xE092 One Of Option: Windows 8.X/BOM3.3, Value (8 bit): 0x3 {09 07 D7 03 00 00 03}
0xE099 One Of Option: Android/BOM2.0, Value (8 bit): 0x80 {09 07 D8 03 00 00 80}
0xE0A0 One Of Option: Android/BOM2.1, Value (8 bit): 0x81 {09 07 D9 03 00 00 81}
0xE0A7 One Of Option: Android/BOM2.2, Value (8 bit): 0x82 {09 07 DA 03 00 00 82}
0xE0AE One Of Option: Android/BOM2.3, Value (8 bit): 0x83 {09 07 DB 03 00 00 83}
0xE0B5 One Of Option: Android/BOM2.4, Value (8 bit): 0x84 {09 07 DC 03 00 00 84}


And, that’s all I have for now…

15

"Main, Security, Boot, and Save & Exit"

16

Bump.