[Offer] Asus ROG Strix B760-I BIOS Mod - Unlocked Hidden Settings

[denisuu]

ASUS ROG STRIX B760-I Guide

Intro and warning

Warning: Flashing this modified UEFI firmware may permanently brick your motherboard. Proceed only if you fully understand the risks! I am not responsible for any damage, bricked hardware, or other issues caused by this firmware. Flash at your own risk.

This is a modified UEFI firmware for the ASUS ROG STRIX B760-I mini-ITX motherboard (firmware version 1805 with Intel’s 0x12B microcode) to enable undervolting and overclocking. This modification unlocks the ability to set the Global Core SVID Voltage to adaptive or offset mode.

All settings remain at their defaults, so you’ll need to manually toggle the necessary locks before making any changes. The main reason I modified this firmware was to unhide CFG Lock, which improves power management in macOS with OpenCore for Hackintosh setups.

Important Notes

• Use only on ASUS ROG STRIX B760-I running firmware version 1805 or lower.

• This motherboard was not designed for overclocking, and some of these hidden features may have been disabled by ASUS for good reason. While this firmware unlocks these features, their functionality and stability are not guaranteed. So far I haven’t noticed any issues though.

• Advanced features present on higher-end ASUS Z-series motherboards are still missing from this modification. Features such as Extreme Tweaker, AI Features, and Silicon Prediction (SP Score) were not present at all in the firmware for the B760-I motherboard, so of course they can’t be unhidden.

• Using UEFI-Editor, I modified the access level of hidden features from 9 to 1, which unlocked several menus and additional options dependent on the ones listed below. These changes also revealed many advanced settings, including options that may not have been designed for end-user access.

Unhidden Features

Unlocked Drop-Down Menu Options

Global Core SVID Voltage

• New Options: Adaptive and Offset

SVID Behavior

• New Option: Trained

Intel Default Setting

• New Option: Extreme

New Menus

CPU Lock Configuration
Advanced → CPU Configuration → Power Management Control → View/Configure CPU Lock Options

• Includes options to enable or disable CFG Lock and Overclocking Lock

OverClocking Feature
Advanced → OverClocking Performance Menu

• Adds extensive overclocking capabilities, including frequency and voltage tweaking.

RC ACPI Settings
Advanced → RC ACPI Settings

• Unlocks power state-related options, including “Low Power S0 Idle Capability.”

Security Configuration
Advanced → PCH Configuration → Security Configuration

• Unlocks additional security-related settings tied to platform controllers.

Instructions

Requirements

• Windows 10 or Windows 11
• Intel Management Engine: Drivers, Firmware and Tools for ME 16+
• AMISCE/WINSCE (SCEHUB)
• Visual Studio Code (Optional)

Introduction

To flash the firmware, we first need to unlock the BIOS lock. Since this is hidden in the stock firmware, we cannot simply toggle the setting through the BIOS interface. Instead, we’ll need to modify the values via NVRAM. There are several guides on WinRaid that use modified grub, setup_var, and RU.EFI tools to achieve this. However, all three of these applications encountered errors due to write protection.

The only tool that worked for me was AMI SCE / WinSCE. The others produced the following errors:

RU.EFI 5.34.0426-BETA:

Error: Write variable failed (0x0000001A)

Setup_var.efi (0.3.0):

Error: Failed to write variable  
Error: Failed to set content of variable CpuSetup (SECURITY_VIOLATION)

grub-mod-setup_var.efi (2.06):

Error: Unable to set variable using EFI (Error: 0x000000000000008a)

Preparation

1. Boot into BIOS by pressing F2 at boot, press F5 to restore factory defaults, then press F10 to save and reset.

2. Boot into BIOS again with F2. Set the following two options (Use F9 to Search):

   • Setup → Tool → Publish HII Resources = Enabled
   • Setup → Advanced → UEFI Variables Protection → Password protection of Runtime Variables = Disabled

3. Press F10 to save and boot into Windows 10 or 11.

Downloading AMI SCE / SCE WIN

1. Navigate to AMISCE/WINSCE (SCEHUB) and download the latest release. Launch DL_SCEWIN.exe, which will open a command prompt window. SCEWIN should begin downloading automatically. Be aware that it might take some time for any activity to appear; in my case, the prompt remained black for an extended period before progressing.

2. Optional: Once the process is complete, copy the contents from .\SCEWIN\5.05.01.0002 to C:\TOOLS.

Download Flash Programming Tool (FPTW64)

1. Download FPTW64 from Intel Management Engine: Drivers, Firmware and Tools for ME 16+ and extract the archive.

2. Optional: Copy the FPTW64.exe from CSME System Tools v16.1 r0\Flash Programming Tool\WIN64 to C:\Tools.

Create a backup

Right click start, open PowerShell as Administrator and navigate to the folder where FPTW64.exe is located.

Run the following command to check if FPTW64 is working: .\FPTW64.exe -I

If this is was successful you can now create a backup by dumping the BIOS, I recommend doing this at least two to four times and comparing the resulting file hashes to verify the integrity of the dump.

Run the following command to create the first backup:

.\FPTW64.exe -BIOS -D B760-I_1805_DUMP1.BIN

After the first dump is complete, repeat the process with a new file name for the second dump:

.\FPTW64.exe -BIOS -D B760-I_1805_DUMP2.BIN

Next, compare the two hashes to ensure the files are identical and verify that both are 32,768 KB (32 MB) in size. If the files meet these conditions, store them in a secure location. This will allow you to recover the firmware using a hardware flasher if anything goes wrong.

To compare the hashes, use the following command:

Get-FileHash .\Filename.bin

We can try to flash them back but you will see the BIOS lock prevents this. Try:

.\FPTW64.exe -BIOS -F B760-I_1805_DUMP1.BIN

Extract the NVRAM variables

Next, open PowerShell with administrative privileges and navigate to the folder where SCEWIN_x64.exe is located (in my case, it’s the same folder: C:\Tools).

Then, run the command:

.\Export.bat

A new file named nvram.txt should appear in the folder. Open it in a text editor, then open a new, empty file.

Copy the first few lines from nvram.txt into the new file.

Next, use CTRL + F to search for BIOS lock. Once located, copy the block of code containing the BIOS lock to the new file and move the asterisk from [Enabled] to [Disabled]

Run .\Import.bat through PowerShell.

Reboot your PC, then open PowerShell as Administrator once more.

Navigate back to the folder containing FPTWIN64, and copy the modified firmware (downloaded from the bottom of this page) into the folder.

Flash the modified firmware using the following command (it should succeed now):

.\FPTW64.exe -BIOS -F B760-I_1805_MOD.BIN

Reboot your PC again, and you should see a screen prompting you to press F1 to enter BIOS and F5 to reset to factory defaults.

Don’t worry if the first boot takes longer than usual. This is normal after flashing new firmware. Once the process is complete, the GMAN should appear, and the hidden features will be accessible when you enter the UEFI BIOS.

Recovery: Flashing the SPI Chip

If flashing went wrong, your device is unresponsive, or you’re working with a motherboard where the BIOS Lock can’t be disabled through software, you’ll need a hardware flasher like the CH341A. These programmers are very inexpensive, but you’ll need to do the 3.3v voltage mod to avoid damaging the board.

On my board, the chip was a GigaDevice 25B256EYIG, but I’ve also seen images online of this specific board using a Winbond chip. While the specific chip on your board may vary, there should be a 32MB WSON-8 chip there. Unlike traditional chips, WSON-8 chips don’t have exposed pins, their solder pads are underneath. Fortunately, on this board, the pads extend slightly beyond the chip’s edge, making it possible to use an 8x6 Pogo Pin adapter for a non-invasive connection.

The chip is located between the screw for securing the NVMe drive and the Intel B760 chipset.

Hardware Setup

I bought all of these for very cheap on AliExpress.

• CH341A programmer: ~€3
• WSON 8x6 Pogo-pin adapter: ~€12
• Soldering arm: ~€6

Initially, I held the pogo-pin adapter manually while flashing the chip. However, since the process takes 15 minutes in AsProgrammer and 20 minutes in NeoProgrammer, my hand got tired, and slight movements caused errors. To stabilize it, I used a €6 soldering arm and placed a weight on top to keep it steady.

Using AsProgrammer

For this chip, I recommend using AsProgrammer 2.1.2 since it already includes support for the GD25B256E and writes slightly faster than NeoProgrammer.

Here’s the flashing process:

1. Click Read ID and select GD25B256E.
2. Click the arrow next to Program IC, then choose: Unprotect → Erase → Program → Verify
3. After flashing, do an extra Verify IC step to confirm the write was successful.

Using NeoProgrammer

If AsProgrammer doesn’t work or you prefer NeoProgrammer, you can use it as well, but you’ll need to manually import the chip. Save the following content as Import.xml:

<?xml version="1.0" encoding="utf-8"?>
<chiplist>
  <SPI_NAND>
    <GIGADEVICE>
      <GD25B256E id="EF4019" page="256" size="33554432"/>
    </GIGADEVICE>
  </SPI_NAND>
</chiplist>

Download

B760-I_1805_MOD_v2.1.BIN

SHA256: 0A19F92BD6480B115F67E6B74A45256D6977047F95A7AA6325793A49CCAF6AC9

MD5: E4B0788BDDB4B08138860C78DC1B97D

[denisuu]

Other ways to flash the firmware

IMPORTANT! Before you flash anything to your board make sure Intel Boot Guard isn’t enabled, if it is and you flash a customized firmware your device won’t boot!

Refer to this guide: Determining whether the Intel Boot Guard is enabled

Luckily Intel Boot Guard is not enabled on the ASUS B760-I ROG STRIX firmware 1805, .

For most ASUS motherboards, the steps in the first post should work. However, if your motherboard doesn’t have the options Publish HII Resources and Password Protection of Runtime Variables, or if you’re following this guide to modify the firmware for a different brand or model, you could try turning the BIOS lock off with setup_var or RU.efi first.

You can find additional guides online, such as: [Guide] HowTo Fix Intel FPT Error 280 or 368

If that doesn’t work you’ll need to tinker with the hardware to disable the lock. The simplest method is to back up the full chip using FPTwin64 (as described earlier), modify the BIOS Lock in the dump, and flash it back using a hardware flasher.

Another way is to unlock the full SPI, this is by using the pin-mod method, a technique officially described in Intel’s chipset documentation. This method is intended for motherboard service and requires connecting specific pins on your board’s audio chip.

ASUS ROG STRIX B760-I "Pinmod"

If your motherboard has a different audio chip, you’ll need to look up its datasheet online, as the pin locations can vary. Locate the pins named DVDD and SDATA_OUT on your audio chip. Refer to the chip’s datasheet or pinout table for this information. As the ASUS ROG STRIX B760-I uses the ALC1220P chip you can refer to the ALC1220 spec sheet.

Use a small wire, clip, or another conductive tool to temporarily connect (or “short”) the DVDD and SDATA_OUT pins. You’ll need to do this during system startup, specifically when the system reaches the PWROK state (right after pressing the power button).

Flash Your BIOS

Once the pins are successfully shorted, the motherboard’s full flash memory address range will be unlocked until the next reboot. This allows you to flash a modified BIOS with certain locks, like the BIOS Lock, disabled. The short needs to be removed after unlocking, before proceeding with the flash

Be extremely careful when shorting the pins. These chips are very small and delicate. Too much pressure from a needle or clip could damage the pins or cause an accidental short circuit elsewhere. Double-check the pin locations and your setup before powering on the system.

Creating a modified firmware

To modify the BIOS file, we’ll use @Brainlet’s incredible UEFI-Editor tool, which handles most of the heavy lifting. This tool has significantly simplified the process of unhiding settings compared to the past when everything had to be done manually using a hex editor or AMIBCP.

However, there are still a few tasks that require a hex editor, such as setting BIOS defaults by editing NVRAM variables (as discovered by @Tad91) and unhiding options in dropdown menus. I won’t be covering AMIBCP in this guide.

Acquiring the necessary files

#ToDo For now refer to the instructions on the UEFI-Editor GitHub page.

Unhiding Menus and Settings

When using UEFI-Editor, the main goal is to change the Access Level of hidden settings so they become visible in the BIOS menu. To do this, we change the Access Level from 09 to 01 for any option we want to unhide.

Some settings have an Access Level of 29, which means they only appear if another option is enabled. Since these are conditional, we won’t modify them to avoid potential issues.

Other Access Level modifications

Some settings also have a SuppressIf condition, meaning they remain hidden unless a specific requirement is met. In some cases, this condition is clear like in the example below UnderVolt Protection option being hidden if the value of OverClocking Feature (question-ID 0x2830,) is equal to 0x0 (Disabled).

To unhide a setting, start by booting into the BIOS and checking the graphical interface to see if the condition it evaluates is visible. If it’s not, try searching for the QuestionId in UEFI-Editor.

If you still can’t find it, open the IRF file and manually compare the values, using the example above or those in the next chapter as references.

All SupressIf modifications

Unhiding drop-down menu options

Modifying SuppressIf and QuestionId conditions in your BIOS involves hex editing, which can lead to system instability if done incorrectly. Blindly altering suppress conditions without understanding their dependencies may cause unexpected behavior, including boot failures or inaccessible settings. To minimize risks, make incremental changes and test thoroughly after each modification. Avoid modifying multiple suppress conditions at once, and always maintain a backup of your original firmware.

Proceed with caution and at your own risk!

Some settings will appear in the BIOS menu after being unhidden with UEFI-Editor, but their drop-down options may still be missing. For example, the Global Core SVID Voltage setting becomes visible when we change its Access Level to 01, but the choices Offset Mode and Adaptive Mode will not show up in the drop-down menu.

On the ASUS ROG STRIX B760-I, all question IDs from 0x13DF to 0x15AB (a total of 461 settings) don’t have any description and are not visible in UEFI-Editor, only in the IRF file. Since we don’t know what these toggles control it’s safer to remove the SupressIf pointing to QuestionId instead of changing anything to the questions since we don’t know what they do.

When we extract the WinSCE NVRAM file (as shown in the previous post), we can also see that some options are missing in NVRAM.

// File Name : nvram.txt
// Created on 08/02/25 at 19:06:48    
// AMISCE Utility. Ver 5.05.01.0002
// Copyright (c) 2021 AMI. All rights reserved.

HIICrc32= 7B139387

Setup Question	= Global Core SVID Voltage
Help String	= Configure the global Core Voltage requested by the cores.
Result may be influenced by ActualVRM Core Voltage.
Token	=2CD9
Offset	=16B
Width	=01
BIOS Default	=[00]Auto 
Options	=*[00]Auto
         [01]Manual Mode

By looking at the IRF file we can see why these options don’t appear. Offset Mode only appears if Switch Microcode (Question ID: 0x2DAD) is set to 0x1.

0x6DC0F: 			OneOf Prompt: "Switch Microcode", Help: "Switch Microcode for 0xB0671 CPU. Changing the microcode to a version other than the current one may present security risks. Do it at your own risk.", QuestionFlags: 0x14, QuestionId: 0x2DAD, VarStoreId: 0x30, VarOffset: 0x12F, Flags: 0x10, Size: 8, Min: 0x0, Max: 0x2, Step: 0x0 { 05 91 2D 27 2E 27 AD 2D 30 00 2F 01 14 10 00 02 00 }
0x6DC20: 				OneOfOption Option: "Current Microcode" Value: 0, Default { 09 07 2F 27 10 00 00 }
0x6DC27: 				OneOfOption Option: "0x104 Microcode" Value: 2 { 09 07 30 27 00 00 02 }

Adaptive Mode only appears if Question ID: 0x1574 is set to 0x1. The issue is that 0x1574 is one of these 461 settings (ranging from 0x13DF to 0x15AB, as discussed earlier) that have no descriptions, so we don’t know what they control.

0xAE3BD: 			Numeric Prompt: "", Help: "", QuestionFlags: 0x0, QuestionId: 0x1574, VarStoreId: 0x30, VarOffset: 0x25, Flags: 0x10, Size: 8, Min: 0x0, Max: 0xFF, Step: 0x0 { 07 91 00 00 00 00 74 15 30 00 25 00 00 10 00 FF 00 }

Because of this, it’s safer to modify the Suppression Conditions rather than changing the actual question value. To make these missing options visible, we need to edit the following code:

0x69FE1: 		OneOf Prompt: "Global Core SVID Voltage", Help: "Configure the global Core Voltage requested by the cores. Result may be influenced by Actual VRM Core Voltage.", QuestionFlags: 0x10, QuestionId: 0x2CD9, VarStoreId: 0x30, VarOffset: 0x16B, Flags: 0x10, Size: 8, Min: 0x0, Max: 0x3, Step: 0x0 { 05 91 F0 27 F1 27 D9 2C 30 00 6B 01 10 10 00 03 00 }
0x69FF2: 			OneOfOption Option: "Auto" Value: 0, Default { 09 07 FC 26 10 00 00 }
0x69FF9: 			OneOfOption Option: "Manual Mode" Value: 1 { 09 07 87 27 00 00 01 }
0x6A000: 			SuppressIf  { 0A 82 }
0x6A002: 				Uint64 Value: 0x0 { 45 8A 00 00 00 00 00 00 00 00 }
- 0x6A00C: 					Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
+ 0x6A00C: 					Uint64 Value: 0x1 { 45 0A FF 00 00 00 00 00 00 00 }
0x6A016: 					Equal  { 2F 02 }
0x6A018: 				End  { 29 02 }
0x6A01A: 				SuppressIf  { 0A 82 }
- 0x6A01C: 					EqIdValList QuestionId: 0x2DAD, Values: [0] { 14 08 AD 2D 01 00 00 00 }
+ 0x6A01C: 					EqIdValList QuestionId: 0x2DAD, Values: [0] { 14 08 AD 2D FF 00 00 00 }
0x6A024: 					OneOfOption Option: "Offset Mode" Value: 2 { 09 07 88 27 00 00 02 }
0x6A02B: 				End  { 29 02 }
0x6A02D: 			End  { 29 02 }
0x6A02F: 			SuppressIf  { 0A 82 }
0x6A031: 				Uint64 Value: 0x0 { 45 8A 00 00 00 00 00 00 00 00 }
- 0x6A03B: 					Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
+ 0x6A03B: 					Uint64 Value: 0x0 { 45 0A FF 00 00 00 00 00 00 00 }
0x6A045: 					Equal  { 2F 02 }
0x6A047: 				End  { 29 02 }
0x6A049: 				SuppressIf  { 0A 82 }
0x6A04B: 					EqIdVal QuestionId: 0x1574, Value: 0x7 { 12 86 74 15 07 00 }
0x6A051: 						Not  { 17 02 }
0x6A053: 					End  { 29 02 }
0x6A055: 					SuppressIf  { 0A 82 }
- 0x6A057: 						EqIdVal QuestionId: 0x1594, Value: 0x1 { 12 06 94 15 01 00 }
+ 0x6A057: 						EqIdVal QuestionId: 0x1594, Value: 0x1 { 12 06 94 15 FF 00 }
0x6A05D: 						OneOfOption Option: "Adaptive Mode" Value: 3 { 09 07 89 27 00 00 03 }
0x6A064: 					End  { 29 02 }
0x6A066: 				End  { 29 02 }
0x6A068: 			End  { 29 02 }
0x6A06A: 		End  { 29 02 }
0x6A06C: 		SuppressIf  { 0A 82 }
0x6A06E: 			EqIdValList QuestionId: 0x2CD9, Values: [0, 2, 3] { 14 0C D9 2C 03 00 00 00 02 00 03 00 }
0x6A07A: 			String Prompt: "  - CPU Core Voltage Override", Help: "Configure the voltage for the CPU Core.

I opened Visual Studio Code on the left side and Free Hex Editor Neo on the right to modify the values so the SupressIf values never evaluate to true. I replaced everything by FF which is hexadecimal for 255, which will never be true, since those are not options that can be set for those questionID’s.

Other options

Unhide ‘Extreme’ under Intel Default Settings

0x683DA: 		OneOf Prompt: "Performance Preferences", Help: "Performance Preferences offer options allowing you to adjust processor performance and power limit related settings based on your preferences.", QuestionFlags: 0x14, QuestionId: 0x2CB5, VarStoreId: 0x30, VarOffset: 0x15C, Flags: 0x10, Size: 8, Min: 0x0, Max: 0x2, Step: 0x0 { 05 91 B0 2B B1 2B B5 2C 30 00 5C 01 14 10 00 02 00 }
0x683EB: 			OneOfOption Option: "Intel Default Settings" Value: 0, Default { 09 07 B2 2B 10 00 00 }
0x683F2: 			OneOfOption Option: "ASUS Advanced OC Profile" Value: 2 { 09 07 B4 2B 00 00 02 }
0x683F9: 		End  { 29 02 }
0x683FB: 		SuppressIf  { 0A 82 }
0x683FD: 			EqIdVal QuestionId: 0x15A1, Value: 0x0 { 12 06 A1 15 00 00 }
0x68403: 			OneOf Prompt: "Intel Default Settings", Help: "Load the Intel Default Settings and operate within Intel's recommended parameters.", QuestionFlags: 0x14, QuestionId: 0x2CB6, VarStoreId: 0x30, VarOffset: 0x160, Flags: 0x10, Size: 8, Min: 0x1, Max: 0x2, Step: 0x0 { 05 91 B5 2B B6 2B B6 2C 30 00 60 01 14 10 01 02 00 }
0x68414: 				OneOfOption Option: "Performance" Value: 1, Default { 09 07 B8 2B 10 00 01 }
0x6841B: 				SuppressIf  { 0A 82 }
- 0x6841D: 					EqIdVal QuestionId: 0x15A0, Value: 0x1 { 12 06 A0 15 01 00 }
+ 0x6841D: 					EqIdVal QuestionId: 0x15A0, Value: 0x1 { 12 06 A0 15 FF 00 }
0x68423: 					OneOfOption Option: "Extreme" Value: 2 { 09 07 B9 2B 00 00 02 }
0x6842A: 				End  { 29 02 }
0x6842C: 			End  { 29 02 }
0x6842E: 		End  { 29 02 }

Unhide ‘Trained’ under SVID Behavior

0x687A2: 			OneOf Prompt: "SVID Behavior"
, Help: "Programs the CPU’s SVID behavior based on CPU’s quality.
The more optimistic the mode selected, the lower the temperature of the CPU. Intel’s Fail Safe is the default behavior of the processor oblivious to the actual Motherboard design. Trained optimizes SVID behavior to match input parameters such as VRM Loadline and Target Frequencies.", QuestionFlags: 0x10, QuestionId: 0x1E, VarStoreId: 0x30, VarOffset: 0x2E, Flags: 0x10, Size: 8, Min: 0x0, Max: 0x5, Step: 0x0 { 05 91 15 27 16 27 1E 00 30 00 2E 00 10 10 00 05 00 }
0x687B3: 				OneOfOption Option: "Auto" Value: 0 { 09 07 FC 26 00 00 00 }
0x687BA: 				OneOfOption Option: "Best-Case Scenario" Value: 1 { 09 07 17 27 00 00 01 }
0x687C1: 				OneOfOption Option: "Typical Scenario" Value: 2 { 09 07 18 27 00 00 02 }
0x687C8: 				OneOfOption Option: "Worst-Case Scenario" Value: 3 { 09 07 19 27 00 00 03 }
0x687CF: 				OneOfOption Option: "Intel’s Fail Safe" Value: 4, Default { 09 07 1A 27 10 00 04 }
0x687D6: 				SuppressIf  { 0A 82 }
0x687D8: 					Uint64 Value: 0x0 { 45 8A 00 00 00 00 00 00 00 00 }
- 0x687E2: 						Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
+ 0x687E2: 						Uint64 Value: 0x0 { 45 0A FF 00 00 00 00 00 00 00 }
0x687EC: 						Equal  { 2F 02 }
0x687EE: 					End  { 29 02 }
0x687F0: 					OneOfOption Option: "Trained" Value: 5 { 09 07 1B 27 00 00 05 }
0x687F7: 				End  { 29 02 }
0x687F9: 			End  { 29 02 }
0x687FB: 		End  { 29 02 }

Changing Default settings

#ToDo Add more instructions.

This is based on the instructions from point 4 from this post: [Guide] Enabling hidden BIOS settings on Gigabyte Z690 mainboards

VarStor PchSetup Offset (0x1792) + VarOffset BIOS Lock (0x1D) = NVRAM BIOS Lock (17AF)

To ensure we’re editing the correct value, verify that the values in NVAR_…_PchSetup_body.bin and NVRAM.bin are identical.

If the above matches change the value of 0x17AF to 00 to turn off ‘BIOS LOCK’ in NVRAM.bin

[chinobino]

@denisuu Thanks for sharing your modified BIOS and writing the very detailed guide so that others may benefit.

[keygene]

@chinobino @denisuu
HELLO. I’m struggling for unlock bios FOR rz09-0484 laptop.

BUT error occured. because of error:168 FPRR IN FPTW64.EXE.

Can you advise this problem?

[denisuu]

Thanks!

I had it all documented in my OneNote for personal reference, so I figured I might as well share how to flash it. I’ve also documented the BIOS modification process, but it still needs some rewriting before I can post it.

[denisuu]

@keygene

HELLO. I’m struggling for unlock bios FOR rz09-0484 laptop.

BUT error occured. because of error:168 FPRR IN FPTW64.EXE.

Can you advise this problem?

Before attempting to modify your firmware, it’s important to determin whether Intel Boot Guard is enabled, If Intel Boot Guard is enabled, flashing a modified firmware will brick your laptop, so proceed with caution.

If Boot Guard is not enabled, you can try disabling the BIOS lock:

1. Using UEFI-Shell:

   • Boot into UEFI-Shell.
   • Use the tool setup_var to set the correct offset and turn the BIOS lock off.

2. If UEFI-Shell doesn’t work, try RU.EFI.

3. If neither method works, you can try using SCEWIN. Note, however, that if your laptop is not an ASUS model, you may not be able to enable certain options like Publish HII Resources or Password Protection of Runtime Variables, which could prevent this method from working. Keep an eye on the GitHub repo, maybe a solution will pop-up there.

4. As a last resort, check if your laptop has a SOP8 chip. If it does, you can:

   • Dump the firmware using a hardware flasher like the CH341A.
   • Turn off the BIOS lock in the firmware.
   • Write the modified firmware back to the chip.

5. Alternatively, you can gain temporary full read/write access by performing the pin mod, an official Debug method by Intel which unlocks access to all flash regions.

Good luck!

[keygene]

@denisuu
THANKS!

All of the errors described in the text above have occurred (RU, GRUBSHELL)
So I want to use SCEWIN but on the basic AMI APTIO bios screen I didn’t find any features
If it was similar, it was just SECUREBOOT option and key deletion.
HII RESOURCESPASSWORD was nowhere to be found, but in this case, all you have to do is use CH341A to dump it, modify it, and flash it, right?

[denisuu]

@keygene

All you have to do is use CH341A to dump it, modify it, and flash it, right?

You’re probably out of luck if you’re relying on software alone. I updated my reply above to include the pin-method. If your laptop uses a Realtek audio chip, check which one it is, then find the spec sheet for that specific chip and identify which pins to bridge. For example, on my board, it’s an ALC1220. That said, I wouldn’t recommend this approach. It involves removing the chip’s shielding, and the pins are extremely tiny.

If you’re planning to go the CH341A route, I suggest practicing with some old hardware first, like an old PC, router, or modem you don’t use.

Either way, you’ll need to do some research on your own. This topic isn’t about my specific motherboard, and it’s not even close. I don’t mean to be rude, but I can’t spend more time explaining this.

[keygene]

Thanks for your dedication.
I ll find the answer.

[denisuu]

I updated the first post to include recovery options and the second post to add more BIOS flash options for anyone referencing this guide.

A Reddit user suggested that the BIOS from an ASUS ROG STRIX Z790-I might work, so I attempted a cross-flash. However, the system didn’t POST and only displayed a red LED. Asus CrashFree BIOS 3 didn’t help in this case.

I was able to recover the board by flashing back the dump I made using FPTwin64 with a CH341a hardware flasher.

Mods: If you notice anything inaccurate or think more details are needed on a topic, let me know.

[denisuu]

I upload a second version as per request via Reddit.

Changelog

Revealed the following options

BCLK Frequency (Numeric) under Ai Tweaker by unsuppressing: 0x686CA, 0x68694, and 0x68670, and modifying QuestionId 0x2CBB to Access Level 01.

BCLK Aware Adaptive Voltage by unsuppressing: 0x69EC8 and 0x69EAE.

Advanced → BCLK Configuration by unsuppressing: 0x735D1.
This exposes the following additional settings:

• BCLK TSC HW Fixup
• Discrete CPU BCLK Frequency
• Discrete Peg/DMI CLK Frequency

Note: The option BCLK Aware Adaptive Voltage appears twice with conflicting defaults, I don’t know which one takes precedence. They reference different offsets, so their behavior might differ too?

The drop-down menu under Ai Tweaker also has a third option Auto which the one under Overclocking Performance Menu doesn’t have.

[Gre]

A huge thank you for your guide! I struggled with flashing a modified BIOS for half a year, but such a simple and, apparently, obvious solution for an experienced user—placing the files in “C:\Tools”—finally helped.

[denisuu]

Glad I could help!

I edited the second post with instructions on the BIOS editing itself.

[denisuu]

This will be the final edit on the first post.

I’ve confirmed that ASUS CrashFree BIOS 3 won’t work for recovery, so I removed it and expanded the SPI flashing section.

I also updated the link to version 2.1 since some users couldn’t see the Overclocking Performance menu. This might be due to different optimized defaults, possibly from updating from a previous firmware version or a different hardware revision? To fix this, I set it to enabled by default in NVRAM. it has no other changes over the previous version.

I will still edit the second post and add detailed instructions on NVRAM editing for enabling the overclocking menu by default.