Assuming this is an Ideapad Gaming 3-15IMH05, the tool must be 14.1 based version, all others will always fail as it needs ONLY the correct and unique version.
Can you provide me the link to the specific version of the tool?
Would you help me out of this?
Hey @Sweet_Kitten ,
I have the same revision as the OP (5.0). Ive been working on modifying my bios for the past week now to unlock stuff such as XTUInterface and memory overclocking (you can check my post if you have some extra time). I got the insydeH2O easy bios editing tools and also succesfully disabled bios guard and FPRR, but I am at a weird spot where I am not exactly sure how to continue? I tried changing the byte 16EA to “EB” as you suggested but that just ended up in failure to booting into windows, where I just get stuck with a black screen. I can get into the bios but the advanced tab isnt there anyways. I tried such things as enabling the stuff through InsydeH2O easy bios editior but I belive theres some kind of secondary check for overcloccking related stuff, because even though it appears as enebled when i extract the bios again i do not have XTUInterface or the memory overclock when i boot into the BIOS though the logo change is infact in place. Im kind of in a place where I am not sure what else i can try, the IFR files dont seem to tell a lot or I am too new to all of this.
I have a CH341A so bricking the bios isnt really a issue i can just externally flash back.
Do you think you can lend me a hand and point me in the right direction?
Hello.
Revision means very little. In fact, all modern Insyde uefis has rev. 5. Also, patch offset may differ depeneding on the device model (Lenovo compared to Acer) and bios version.
I suggest trying to edit IFR. You may follow the method described in post 1624. Add a new entry anywhere you like.
Or you can use the runtime patcher to edit and run driver [3935B0A1-…]. So more tabs appear on the top bar. But this isn’t a permanent way.
Thanks for the quick reply,
By “runtime pathcer” do you mean SREP? if yes, could you give me a quick explenation on how it works, because the github repo is 404 and the post about SREP is really limited with information.
Or you can use the runtime patcher to edit and run driver [3935B0A1-…]. So more tabs appear on the top bar. But this isn’t a permanent way.
As long as the settings stick, its not a problem.
I also wanted to watch this video of yours to see if i can learn anything more from it, just to see that you privated it. Do you think I could still watch it? I am aware of you saying that you dont think you filmed anything useful but I would still be interested in seeing it because of the limited information and tutorials about bios modding.
Sorry if I look like a stalker, I want to learn as much as I can and you just appear everywhere like UMAF, SREP and InsydeH2O bios unlock requests 
It seems to me like the whole BIOS modding community exploded around 2022-2024 with UMAF and SREP and then it had kind of died about now with the developer of those applications disappearing for seemingly no reason, so I am kind of struggling to get proper help.
Yes, I mean this. There are as many as 38 repo-copies of the original SREP source on github, including mine. Just google for it and you’ll find the basic info.
I remember deleting it completely. But now can’t recall what the video was about.
Yes, the dev’s long offline period and account deletion was kind of loss. Don’t know why they decided to do so.
I can only guess that was due to the major health issues or due to commercial hiring by other community members. I remember SmokelessCPU having a patreon account or something, where he shared more of their utilities. Could be that. Not sure, really.
Hey @Sweet_Kitten, its me again.
I’ve been watching this video from here to get me a lead on how to correctly edit the SetupUtility to show what i want, I pretty much replicated what this person did in their video. However there is a problem, after flashing when i boot into the bios the only thing I can see is a simple “_” at the left top of the screen, and bios not opening.
There are some unexplained actions and swiftly cut segments of the video so I wasnt able to follow it properly.
Could you diagnose what I’ve done wrong and if you have some time to kill could you send me a properly edited version of the SetupUtility? I hope I am not asking for too much.
Thanks for your help so far
Ok, this shouldn’t be too difficult. An entry to what menu would you want me to add? And in what place?
Thanks for volunteering, would it be possible to replace all of the advanced settings with the IPv6 or IPv4 settings? If asking for all of the advanced settings is too much then XTUInterface and ram overclocking is what I am interested in. I am 100% sure i will never touch the IPv6 or the v4 settings, i actually saw them for the first time today and they are completely useless for me. If you need something thats within SetupUtility then making those options appear within the “information” tab would also work.
maybe.zip (6.2 MB) Here is the BIOS im using right now that has a custom Logo which was a piece of cake to do with the InsydeH2O tools.
IFR.zip (233.5 KB) Here are the SetupUtility and FrontPage in .txt form
I think you overcomplicating the task. Let me sum everything up: you want Advanced in Information tab. If this is correct, I’ll post a bios mod in your separate thread Lenovo L340 soon.
Yeah sure this is what I want. Thanks
hi nybody can help me
Hello, I am trying to disable the BIOS Lock so that H2OUVE can read/write to the BIOS.
The steps I followed are the same as in the guide, and my CSME version is also the same as in the guide.
To disable the “Bios Lock” and “Flash Protection Range Registers” features, go to the H2OUVE folder, click on the “GET VARS.bat” file, which will give you your BIOS variables. Open the “vars.txt” file and search for the ‘PchSetup’ statement. Now look at the variables that enable Bios Lock and Flash Protection Range Registers. In my case, they are 1C and 683, respectively. You can identify them by looking at the value next to the “VarStoreInfo (VarOffset/VarName):” statement. Now go to 1C and 683 and replace 01 with 00, but we’re not done yet. Just in case, copy the GUID under “PchSetup,” which in my case is “4570B7F1-ADE8-4943-8DC3-406472842384,” and change the values of 1C and 683 from 01 to 00 as we did earlier. Save the changes, go to the Command Prompt as an administrator, and type “cd + H2OUVE folder location” once more, then type “H2OUVE.exe -sv vars.txt.” This should save the changes we made in the vars section.
I’m stuck here because I need to change the 0x1C offset for BIOS Lock and 0x683 for FPRR, but in vars.txt, PchSetup is 00 at the 28th byte and 1667th byte, meaning both are disabled, and I haven’t changed them before.
Am I counting the bytes incorrectly? If it’s correct, why am I getting the “e0 - error: Fail to initialize SMBIOS” error even though it’s 00? Thanks in advance to anyone who can help.
Hey @amego
You think you can attach your IFR and your vars.txt here?
Ill have a look, though im not the most experienced I managed to do this before, ill see if I can help you
Hello! I am looking for help 
thank you here is my files
Can I flash modded insydeh2o bios on my dell g5 se 5505, from windows without ch341a? Because right now I cannot even enter the bios with F2, black screen with cursor top left.
Hey guys. So I spent all of 36 hours (maybe 5 were spent sleeping) working on this without actually externally flashing.
HP Envy x360 Insyde Rev.12.
7H1S7UA model with 08BE9 board. This uses an AMD chip, not Intel.
The Envy is known to have battery related issues, where plugging it in while the device is on very quickly overheats. Flashrom told me off the bat that it wasn’t gonna flash it despite using force flags. Whatever.
Messed around with SREP (Maxinator500) for a good 12 hours, and it was able to change some variables, but I believe none of them would stick when calling LoadFromFV into SetupUtilityApp or SetupUtility (can’t recall right this second). Just the main BIOS settings page, the white and light blue HDR one.
Per @Alonso’s post, I focused on a conditional jump 74 → EB in A01ODMDxeDriver (H19PlatformServiceDxe). Pattern I initially found was 75 F5 84 C0 74 0C at offset 0x11568, there’s a few matching sites in there. I tried building SREP as a driver for this and still got nowhere. What I found was ANY write to A01ODMDxeDriver/H19PlatformServiceDxe would hang. Even writing 74 → 74 was a hang. Writing to some others did not face this issue. That said, writing to others and LoadFromFV, it would take about 60 seconds, so I assume it was rebuilding. That or I was doing something wrong. I even tried HandleIndex by H19PlatformServiceDxe’s hex index eventually (BD in my case). Most of my configs were variations of this.
Op HandleIndex
BD
Op FastPatch
Pattern
75F584C0740C
75F584C0EB0C
Op End
Op LoadFromFV
SetupUtilityApp
Op Exec
Would always just hang as soon as it said “patched”.
So I assume read only maybe.
I then began using EDK 2 to modify this directly by disabling CR0 WP, and confirmed that the writes stuck by reading directly back. But I could not load into SetupUtilityApp directly without it taking over a minute. So I assume it was maybe rebuilding.
Maybe I’ve been doing something wrong this whole time and forcing it to rebuild.
After about a 30 hours I saw I believe 0x17CA5 it is checking and removing the advanced tab. I attempted to write over this. It would just rebuild every time I would load.
I’m somewhere on the verge of giving up with this.
Why am I not using a CH341A or writing my values directly? Because I don’t care. It’s my computer and I own it, it should not tell me “No”. It is a computer. I shouldn’t have to go buy something to make my computer say “OK if you say so” and other people shouldn’t either. I understand enough of USB programmers to do this, but others do not. I wanted to get somewhere with this because this is a really common issue for others with the battery problems this line carries. But no.
At this point I’ve resigned to asking Claude Opus but I’m not going to copy and paste a bunch of AI slop on here. I will post a couple potentially important or non-important takeaways in the spoiler, as it did spit out some things worth looking into. I’ve read it over and re-wrote it myself with a bit of human understanding if someone in the future smarter than myself is at a loss like I am. I’m just basically resigning now unless I really get a picture of the impossibility or what I’m doing wrong.
you Insyde and you HP. I just wanted Ubuntu.
If anyone has ideas, let me know.
Will post relevant EFI dumps also.
My Own Takeaways from Claude
0x17AC4 (just so happened to be the area I’ve been messing with) enumerates all HII formsets in the HII database and compares each title against “Advanced”/“IHV Advanced”. If it matches, it calls freepool from boot services on the handle and package to remove it from HII database completely. If this has been done it obviously won’t be rendered. Not going into IHV advanced’s checks here, but it has one around here also, for reference. Pretty much confirms I moved on to the right area and it meant fuckall.
Apparently it’s gated by one byte flag, this makes a lot of sense. Insyde’s little “Fuck You No Advanced BIOS For You vs. I Got Minez” byte at global address 0x6f120. It starts uninitialized at 0x6f120 and gets written to 1 at 0x17b8a.
Three different spots check for an 8 byte magic value, being 0x1b167, 0x1b2e7, and 0x1b423. $hpBKSEC (= 0x4345534b42706824). Offset 0x420 in “main setup variable data block”, whatever that means man. I’m pretty sure it’s right about this though. AFAIK this is probably what was making this thing hang.
I might toy around with this a little more just to see if I can get anything going at all for the sake of having done it. Not going to work at this endlessly like I have been though. I haven’t bothered downgrading BIOS as it’s just not really worth my time to verify that they’ve blocked that. If it’s worth yours, let me know how it goes.
relevantDumps.zip (12.8 KB)
Section_PE32_image_A01ODMDxeDriver_H19PlatformServiceDxe_body.zip (92.3 KB)
@kek
You can try unlocking like so, without patching A01ODMDxeDriver.
1 Like
Woah
I will be messaging you more about this tomorrow afternoon/evening. Tomorrow I have an eventful day at school. I wish I tried something more like this.