Hello!
I have a bricked system, I am attempting to modify the "boot menu" disabled by default, so that doing fn+esc procedure I can regain access with USB drive pressing F12. This computer has eMMC storage so no way to swap drives.
I am attempting to modify an .fd file downloaded from Acer website. isflash.bin file, FN+ESC looks for file SapporoGL.fd so I renamed it to this name.
I need to set default option "boot menu" to enabled and regain control of the machine.
I downloaded Insyde H2OUVE (UEFI Variable Editor) v200.00.01.00 to another machine. I can see all the settings in the GUI, however the SAVE button stays grayed out after changes. Also if I do "Save as" it creates another file without the changes. Can you point me what I am missing?
@mdq10 - Upload a copy of the BIOS you want modified and I will change the setting for you. There is only a few versions of H20UVE that are leaked to public that function, and that version is not one I’ve ever heard of, so it may be some disabled leaked version that doesn’t function for editing (only inspecting)?
Please upload a copy of the file you need edited, and also upload a copy of that H20UVE too so I can check it out, thanks.
As for the actual issue, the only way an edited BIOS is going to help you be able to invoke the boot menu to be able to flash BIOS, is if you edit the on-board BIOS. Changing this in a BIOS “To flash” isn’t going to enable it in the BIOS in there now, hope you get what I mean.
You may need flash programmer like CH341A and SOIC8 test clip, then dump the current BIOS contents, edit those, then program back, then do the recovery. Do not program in stock BIOS if you get these tools, you will loose serial, UUID and LAN MAC ID.
Also, do not erase or write to the chip with programmer until you’ve made a backup and had someone look at it for you to confirm it’s good, so you don’t loose those details mentioned previously.
Also, “Boot Menu” is not normally some selectable/set-able option, however maybe you mean it’s disabled as a possible useable item and you are trying to enable it? Normally this is invoked one of two ways, via hotkey at bootup, or by there being no drives or bootable devices installed.
You may however, be able to set USB to be the first bootable device, instead of HDD/EMMC etc.
Thank you, here you go:
http://s000.tinyupload.com/?file_id=32009737613553229859
I downloaded from the SPI chip using raspberry pi and flashrom. I did a month ago, although I am pretty sure this is the file. Perhaps you can see in there if the serial, mac id and such are in there. The spi chip is 1.8V so I’ve added a little voltage level shifter in between.
I’ve read other users with same computer having problems accessing the UEFI menu after modifying eMMC partitions. This is quite odd since the UEFI code runs on SPI chip, but it seems to be the case. I was not able to access the UEFI menu because I erased Windows completely and repartition the eMMC drive.I had the same experience.
However, before doing that, I had disabled secure boot and enabled the boot menu so I was able to boot usb drives and my linux system.
At the time it failed I was tinkering with kernel efistub configuration in ‘efibootmgr’. then it didn’t boot anymore , boot menu was gone and UEFI menu of course not.
It may be the case that boot menu is in fact enabled and the problem resides perhaps in UEFI binary doing POST and failing because of some content on eMMC. I am curious about your input.
As far as H20UVE , I’ve downloaded from this same website, this link http://en.inspur.com/eportal/fileDir/en_…04_20190424.zip
a thread: Unlocking advanced options in Insyde H2O BIOS for Clevo NH70RCQ (Hyperbook)
I only attempted to modify an FD file downloaded from Acer website, I didn’t try to edit my own bricked bios file
@mdq10 - Thanks
I think the non-access issues have to do with Fast Boot (and or Super/Ultra Fast Boot enabled). With those enabled by default you cannot enter BIOS except from within the OS troubleshoot exit to BIOS method, when system is Win8-10.
Unless you remove the hard drive or other bootable media, then BIOS access is available as normal since there is nothing to boot from. It’s not possible to remove that drive with EMMC, so then you are stuck if you edit/clear out the original UEFI partitions, and it tries to boot there anyway and goes no where.
Yes, it sounds like it’s a failed edit, and is probably still booting to the failed EMMC UEFI file you edited.
Your software link is broken, but luckily you posted the thread link too. Thanks for this file, not sure how I missed it here, I’ll check it out.
I originally thought you said H20EZE, this is what you edit/save BIOS files with, UVE is for editing/changing current onboard BIOS only (At least used to be this way)
And yes, reading the included PDF, and checking out the app, this is just GUI method of editing BIOS settings via a dumped file (CVS, or txt etc, like a vars.txt dump edit/reflash).
This will and does however, edit NVRAM variables, which is similar to editing a BIOS, only it doesn’t change the visible current default (unsure if all system rely on the NVRAM setting or what is in BIOS default). I made some changes and compared, it makes the changes and saves them (Along with tons of other changes)
But, this is not an actual BIOS editor though, for that you want EZE, if you want to edit it via some Intel GUI Application. I checked though, and all versions publically available crash when opening the setup menu to edit (or some wont offer the option) so no luck there either.
I checked your dumped bricked BIOS with this tool, I see F12 boot menu disabled. Is that way you want enabled?
You could also switch boot mode to legacy instead of UEFI, that would allow you to enter BIOS and probably also install windows etc on the EMMC
Fast Boot is enabled too, suggested to be disabled until this is sorted out, so it’s not stopping you from entering BIOS.
Suggested changes below, please confirm and I will make them
One Of: F12 Boot Menu:, VarStoreInfo (VarOffset/VarName): 0x4CF, VarStore: 0x1234, QuestionId: 0x4, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 1F 01 20 01 04 00 34 12 CF 04 00 10 00 01 00}
One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 1F 00 10 00 00}
One Of Option: Enabled, Value (8 bit): 0x1 {09 07 20 00 00 00 01} << Change to default
One Of: Fast Boot, VarStoreInfo (VarOffset/VarName): 0x4EA, VarStore: 0x1234, QuestionId: 0xA019, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 B3 01 B4 01 19 A0 34 12 EA 04 04 10 00 01 00}
One Of Option: Disabled, Value (8 bit): 0x0 {09 07 1F 00 00 00 00} << Change to default
One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 20 00 10 00 01}
Optional - will make secondary BIOS with all the above + this - if you want a copy like this too
Boot Mode:, VarStoreInfo (VarOffset/VarName): 0x79, VarStore: 0x1234, QuestionId: 0xA015, Size: 1, Min: 0x1, Max 0x2, Step: 0x0 {05 91 25 00 26 00 15 A0 34 12 79 00 04 10 01 02 00}
One Of Option: UEFI, Value (8 bit): 0x2 (default) {09 07 87 01 10 00 02}
One Of Option: Legacy, Value (8 bit): 0x1 {09 07 88 01 00 00 01} << Change to default
The above, automatically disables this, but this can also optionally be disabled by itself and that will break secure/UEFI mode, and would disable Fast Boot too
One Of: Secure Boot:, VarStoreInfo (VarOffset/VarName): 0x4E4, VarStore: 0x1234, QuestionId: 0xAE20, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 6E 01 6F 01 20 AE 34 12 E4 04 04 10 00 01 00}
One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 20 00 10 00 01}
One Of Option: Disabled, Value (8 bit): 0x0 {09 07 1F 00 00 00 00} << Change to default
Please link me to the stock BIOS for this, I want to check it out to compare, your BIOS does look odd in UEFITool, so it is possible that it’s actually corrupted some. Once I see the stock BIOS I’ll be able to tell.
Also, if you know of someone elses dump to compare with too, that would be great, if not don’t worry about looking
Don’t program in BIOS from Acer, you will loose your serial, UUID and probably LAN MAC ID too. As for can I see those, yes, maybe, if I know what they were (I can’t find blindly in this BIOS at least not at a quick glance I didn’t see)
Hdi ! well , thanks for the valuable input. Would be great if you can make the suggested changes. By the way , can you give a link to the tool you use? or is it a plain binary editor?
Here is a link to the stock BIOS from Acer website: (I don’t have other users dump to compare)
http://s000.tinyupload.com/index.php?fil…777517596647464
The sequence as I remember was like this: I bought the machine and before removing windows I checked for a BIOS update on the website. I believe it came with v1.03. I’ve executed the v1.07 update on the host machine and it updated succesfully. After that I’ve removed Windows and installed Linux, machine was still booting. My audacity didn’t stop there and went further with the kernel EFI stub adventure bypassing the bootloader. After an update and efibootmgr edit, the adventure ended hhaha
It would be great if the menu didn’t show because of fast boot, then once disabled I can continue accessing uefi menu even without Windows installed.
Anyway, I believe the link above is stock bios for same version as “bricked.bin” on previous post. Only the file is 9MB instead of 8MB, I guess it contains some extra code to run the update on the machine itself.
It may be that my file is corrupted some as you said, the spi chip being 1.8v I had to make a voltage level shifter with a transistor. My way to verify integrity was to download 2 or 3 times and do a binary compare. They’ve matched, but maybe the file is corrupted as you said.
I send you the serial numbers on private message.
Cheers, Jose
--------------
This was taken from self-extracted exe file temp folder. "isflash.bin"
From the following site:
https://www.acer.com/ac/en/US/content/su…roduct/7564?b=1
I extracted the Setup PE32 module with UEFITool NE, then created IFR output from that using Universal IFR Extractor (This is what that text is from above).
To make these changes I would change at this module via hex, and then additionally find and change in NVRAM too (by way of UEFITool NE Alpha 55 and Regular version 25 + Hex editing).
UEFITool is here, downloads are in "releases tab - https://github.com/LongSoft/UEFITool
Universal IFR extractors (I use 0.7 most often, but sometimes other works when 0.7 wont) - http://s000.tinyupload.com/index.php?fil…560912505939999
Please link me to the stock BIOS package from Acer, I want the exe/zip etc link.
I know nothing about Linux, so my advice and thoughts have to stop where you removed windows. Yes, Fast boot enabled and UEFI Boot mode being used always disables BIOS access usually, unless you exit from OS to BIOS.
Bricked.bin is BIOS 1.07. Voltage shouldn’t cause this kind of corruption, so I don’t think that has anything to do with it, and since you compared 2-3 dumps and all matched it’s probably exact chip contents.
You never programmed a stock BIOS to the chip using a programmer did you? I need to see stock BIOS before I can do anything else, I know you linked something you uploaded above, but I want link to Acer to download this package
* Edit - I see your second post after writing the above, please use edit if you need to add more info, thanks. And thanks for the Link to Acer, this is only one I wanted.
So this system is “Acer SF114-32”?
* Edit - I compared with stock, it looks just as bad/wrong, so this is either how they do this particular BIOS, or you programmed in stock BIOS to this chip without meaning to or without mentioning it to me.
Looking it over, seems like they do it this way on purpose, terrible BIOS structure/design 
I’m heading out now, but I will make you BIOS as mentioned above tonight when I get back, hang tight 
* Edit - @mdq10 - Here is two BIOS, this is built with your bricked BIOS as source. If neither of these get you anywhere, these changes may need made in NVRAM, which I cannot find in this BIOS as of now…
So, we may need to do interim test and program in the stock BIOS to see what happens, if that also fails to boot, I will edit it same way as this one, then we’ll know if these edits work or not, or if your bricked BIOS is bricked or not. If it comes to this, I will send you 8MB cut from stock BIOS package
http://s000.tinyupload.com/index.php?fil…959378799633178
Hi Lost_N_Bios,
I finally got time to come back to this. Thanks for the files.
I’ve tested both BIOS1.bin and BIOS2.bin you generated and they didn’t work. Still getting same result: A cursor on the upper left corner. If I press F2 the cursor is bigger size, is if it gets to the point to initialize the screen for text mode, and stays there.
Regarding the bios structure, I also read in a forum that making changes to the solid state drive EFI partition corrupted the UEFI somehow to the point you could not access the BIOS menu anymore. As if some files in the EFI partition are needed by the BIOS. You said NVRAM could not be found in the chip, perhaps it is stored in EFI partition?
I kept the original image from the on-board eMMC, 64GB. I considered taking out the eMMC and programming it with original image again but it is not easy. I would need to use a rework station to take the BGA chip out and soldered it afterwards. Anyway, any ideas welcome. Cheers
Hi,
I downloaded UEFItool and ifrextractor. I was able to extract from PE file all the setup settings and I see in BIOS1.bin the F12 Boot Option is set as “default” and “Fast Boot” off as default, like you said.
Reading again at your post, you mention that you could not find the NVRAM section and that may need to be changed as well.
I think I may have found the NVRAM section in the BIOS1.bin file. Screen capture of UEFITool:
http://s000.tinyupload.com/index.php?fil…481919884634927
I will attempt next to find where the settings as stored in NVRAM, I guess the extracted IFR give addresses to where this is stored in NVRAM.
Cheers
Bummer - we’ll proceed as I mentioned then. Did you dump BIOS after you wrote, and then compare that in hex to what you programmed in, to be sure the write was 100% accurate? If you didn’t do that, do it now, that way you know it’s not failing due to a bad write/bad verification
No, NVRAM is not stored in UEFI hard drive partition, and HDD/SSD has nothing to do with BIOS being able to work or not, it will boot to BIOS/work properly with no HHD/SSD once BIOS is proper.
EFI partitions only needed on HDD/SSD to boot to OS. However, I’ve never dealt with eMMC system, if that image wasn’t 64GB I’d say send to me so I can see if anything BIOS is on there, but I doubt it, never heard of such a thing and BIOS should not be on disk ever anyway.
On what you showed in image, yes I already knew that, but it’s not what I meant. It’s hard to explain, but this is not easy to find and start an edit with this module, due to the way NVRAM is stored there, and not 100% sure that is only storage location
Varstore ID per each section is how you find and edit this. For example, “UEFI OS Fast Boot” is stored in >> VarStore: 0x1234 ([A04A27F4-DF00-4D42-B552-39511302113D] - SystemConfig) @ VarStoreInfo (VarOffset/VarName): 0xEE << location of settings byte
I can find it like that, and do the edits, but it’s far from ideal/usual/easy and will take a long time to do. Plus, there is “Custom” NVRAM too, that is stored not in the same GUID/Varstore manner, a few of those, which also need edited at same time too.
So, it’s not really that I could not find NVRAM, it’s that I could not find NVRAM properly parsed into proper sections, to where it’s easily edited in a productive manner (as opposed to taking days to edit and then still not being 100% sure)
First we should test outcome of stock BIOS cut programmed in. Or yes, I could do the NVRAM edits too, send you three BIOS next.
Hi,
I did as you said. I programmed BIOS2.bin again and after read back the contents into another file. Did a diff on both and came out exact. A few days ago I got a proper voltage level translator 3.3V → 1.8V adapter . Furthermore I use flashrom tool from Raspberry Pi and it seems to do a verification after writing, so many checks involved… I feel confident now about reading/writing flash. The waveforms look clean on the oscilloscope.
If you can send the BIOS to test, would be greatly appreciated.
Sounds like a good write then, at least now you know for sure. Verify after read or write cannot be trusted, because if it verifies it’s read or write error then it’s an invalid verification, this is why I said to dump then compare.
Sometimes if programmer is not compatible with chip ID used, this can happen, and other things can cause it too.
oscilloscope not needed for any of this, only actual verification by dumping written contents and then compare to source used and once you know that is OK for your setup then all good, you don’t need to check it like that every time.
Send what BIOS to test? If you mean the 8MB cut from stock, here is that, you will loose your serial, UUID, and LAN MAC ID, but we can fix all that later provided you have some original backup with those contents (Mainly UUID cannot be recreated exactly as original, others are usually on stickers)
If this does not boot to BIOS, there is some other issue (not BIOS related) - http://s000.tinyupload.com/index.php?fil…572997270875215
* Edit - I was just helping with another user with same type of BIOS ME/TXE FW and I see in Intel FITc tool, some ME/TXE FW can optionally be targeted to be loaded into eMMC, so this could be part of the issue, not starting due to missing ME FW on the eMMC (yours says target SPI as expected, so probably not this now that I checked)
BUT!!! I now also see the current TXE FW is messed up in both BIOS I sent you (probably from what I carried over from bricked BIOS and didn’t notice until now). This issue is not in the 8MBCut linked above.
So, if ME FW is only stored in BIOS (as is normally done), then this 8MB cut should start, and the reason the others fail is due to the corrupted TXE FW
Hello,
Ok, I uploaded the 8MBcut file from above, doing the read and compare after to verify contents. It still did not work.
First boot, it turn on the power led for a couple of seconds and then went off for another second. When it came back it displayed the Acer logo but giving same results as before. No access to F2 menu or Boot Menu.
I kept a backup of the eMMC on a USB drive, perhaps I can go dig around and see if part of the firmware there. What do you suggest?
edit: Here is EFI partition from the eMMC backup, if you are curious to see:
http://s000.tinyupload.com/index.php?fil…592802056140906
There is a directory called “Insyde” but it is empty.
edit: another forum read:
https://community.acer.com/en/discussion…e-to-enter-uefi
So, was Acer logo shown before too?
I checked that EFI, all standard stuff there for EFI Boot, nothing BIOS related.
I suggest putting the eMMC drive back as it was, then you will know if BIOS access requires something that was originally on the eMMC or not. Or, while doing this, and with 8MBCut BIOS on there as it is now, try to boot to BIOS without eMMC in place at all (Thus no HDD/USB or eMMC)
OK, Finally some progress!!
BTW, yes Acer logo was always showing.
So… I read on some forum, an Acer user installed Linux on an SSD and could not enter UEFI bios menu anymore, was left with a cursors like me. When he removed the SSD and left only eMMC he gained access to uefi menu again.
So it seemed like UEFI was looking for whatever it needed on SSD if it was present. Before butchering the motherboard to rewrite eMMC with wires I thought I would try the opposite situation (to copy the eMMC backup I had into an M2 SSD) and put into my SF114-32 again.
This time I pressed F2 and to my delight the menu showed up!! The SPI chip had the last image you sent 8MBcut.bin so it did not show any serial number. But I was able to save settings which I could see upon next reboot.
I was also able to access F12 boot menu. Seems clear the UEFI firmware is looking for something on the eMMC/SSD EFI partition to even bring F2 menu. I don’t know what or why. If I find something else useful I will post here. Thanks for your help
Good to know about the Acer logo, that probably meant BIOS was mostly (or all) fine the whole time.
Great to hear you’ve found your way in now!! 
So it IS something on the eMMC the BIOS needs before it allows entry, or maybe even before it fully loads?
So, you can now also try those first BIOS I edited for you too, once you confirm those work to allow F12 boot menu and or BIOS entry etc, you can send me your original BIOS dump (if I don’t already have it?) and I can make those same edits.
That way you’ll have your serial number and stuff back in the BIOS
Hello,
Thanks. Ok, so I did the following:
With SPI clamp I re-uploaded the original ‘bricked’ firmware I originally sent you and tried to boot again.
It worked fine, entered BIOS menu and made changes. So now I was at version 1.07 with serial numbers and all other original info in there. Now even more proof firmware reacts somehow to EFI partition on eMMC/SSD.
I upgraded to latest BIOS version from Acer (V1.09) through SapporoGL.fd file on USB drive and pressing FN+ESC.
Now this is also working , i can access BIOS menu and Boot menu. Through the menu I can see it effectively updated to v1.09 and kept serial numbers. I booted to linux and all is looking ok.
Next I would like to unlock the bios so I can tweak any setting. I did the following procedure:
1- Went to UEFI bios menu, selected to disable Network boot.
2- turn off laptop, hooked SPI clamp, downloaded contents of SPI chip into a file.
3- Turned on laptop, went to bios menu, enabled Network boot again.
4- Turned off laptop, download contents of SPI chip and put in another file.
If we look at the difference between the two files we can learn exactly location where changes are stored, can’t we? There is only one setting difference in between both working images.
In one of your earlier messages you mentioned there were many locations for NVRAM and was difficult to know where to change. I uploaded both files here:
http://s000.tinyupload.com/index.php?fil…625110358593263
Do you think you can unlock the bios with this info? Or guide me to how to do it? Thanks
Great success there
Yes, that way may be able to tell us which area the default settings applied comes from (setup, NVRAM etc), at least for that one setting you changed (usually this would be same for others too, but not always)
I’ll check those files and let you know what I find. As for “unlocking BIOS” this is not same as changing BIOS settings defaults, and none of this helps with any of that.
It’s been a while since I looked at this BIOS with menu unlocking in mind, and you were never able to get into it before, so I don’t have BIOS images for this. I need images of each BIOS page you can see now, and please put them in a zip, thanks.
I checked, and setup is not changed, applied changes are set in NVRAM/VSS2 padding file, and these are what is used to apply your changes
Network Boot:, VarStoreInfo (VarOffset/VarName): 0x6F << At NVRAM, VarStore: 0x1234 (Name: SystemConfig) - Below is a small snippet of the SystemConfig/Setup NVRAM area, ending in the byte that holds the setting valyue for network boot.
03 FF 00 00 00 01 01 01 00 00 00 02 00 01 01 01 << Last byte = Enabled (in your “Enabled” BIOS x2 / NONE in your “Disabled” BIOS)
03 FF 00 00 00 01 01 01 00 00 00 02 00 01 01 00 << Last byte = Disabled (in your “Enabled” BIOS x3 / And x3 in your “Disabled” BIOS)
I cannot see where to generally unlock this BIOS menu, images may help but I doubt it.
For a full menu unlock you may need to ask at BIOS-mods forum and provide a programmer dump (let them know it’s programmer dump in advance too, so they don’t tell you that you need programmer first)
I can however, change any settings you need changed
Hi, Ok, I see. I was too optimistic I thought maybe changing a byte would bring up all the advanced settings.
Thanks again for your help.
@mdq10 - Yes, there may be 2, 4, or 6 bytes etc you can change to reveal the hidden menus, but I can’t find them “for sure” in this BIOS (I’m not too good at Insyde BIOS menu unlocks)
You’re welcome. If you want to flash through a bunch of bricked BIOS, to find the right edit, then maybe I can get them revealed for you, but that’s far from ideal with a cheap BIOS clip and programmer, better suited to a socketed BIOS or a $20 clip and really not ideal there either.
Someone at BIOS-mods can unlock it for you easily though, they are Pro Insyde BIOS modders there, someone like dudu2002 or @genius239 (he’s here, maybe he can help on this one?)
let’s say it this way… modding on newer thinkpads i can be done. 