The interesting and weird thing is that Throttlestop undervolting is completely locked as shown in the screenshot, BUT there is an HP Omen Gaming Hub Utility that has an undervolt feature which allows me to undervolt the CPU Core only.
Although Throttlestop shows voltage controls as locked, it shows that the undervolt which is applied through the HP Omen Utility is real and functional in the FIVR page.
I have had experiences with locked undervolting before, so far I was able to unlock it in every case, except my current HP Victus 16-r1057nt Laptop with an i7-14700HX on the latest BIOS version from HP (version f.12).
Simple fixes:
- Disabling Core Isolation
- Disabling VBS (Virtualization-Based Security)
- Disabling Virtualization from BIOS
Advanced fixes:
Modding BIOS using setup_var or RU.efi, to change both CFG Lock and Overclocking Lock variables, done it successfully 5 times so far on different machines from different manufacturers. (Lenovo, Dell, and Asus)
But when it comes to this HP BIOS (Insyde f.12), I am unable to.
I was not able to backup my current BIOS using the Universal BIOS Backup Toolkit, I get the error “Driver install failed!” which as far as I understand means that there is some kind of protection on the BIOS.
I was able to bypass the backup issue by using the UEFITool on the official BIOS from HP’s website (since it is the BIOS that I currently have installed) then using IFRExtractor to turn it into a readable text file, it is attached.
From the text file I was able to learn the Offset Values of CFG Lock (0x43) and Overclocking Lock (0x10E), but I couldn’t make sure in which EFI variable they are stored, usually it is CpuSetup or Setup
Nevertheless, I still booted into RU.efi and tried changing the Offset Value 0x43 inside CpuSetup from 1 to 0. When I try to save the new value (ctrl+w) I get WRITE ERROR 0x00000008 EFI_WRITE_PROTECTED.
As far as I understood from other guides and threads, if there is EFI write protection then the only thing which only has a low chance of working is flashing an already modded BIOS with an external programmer.
If anyone reading this with some experience or knowledge could answer some of my questions I would appreciate it a lot.
Questions:
- In which EFI Variable are the CFG Lock and Overclocking Lock actually located? If you know how to read BIOS dumps please check the attached text file.
- Do you think that both of these Lock variables are currently set to 1, if not, which variable is responsible for what? The fact that the Omen Utility is able to undervolt CPU Core makes me think that only one of the variables is actually locked not both.
- Why can’t Throttlestop change voltages but the Omen Utility can? What special permissions or drivers does the Omen Utility have that makes it able to somehow bypass the undervolting lock that Throttlestop is experiencing?
Possible Solutions?
- Do you think it is possible to locally modify the HP Omen Gaming Hub Utility to add “sliders” just like the CPU Core one but for CPU Cache as well? This solution might be very difficult since the utility is not open-source
- What about modifying Throttlestop in such a way to make it “pipeline through” the HP Omen Utility? Maybe if we somehow connect it to one of the HP drivers we could at least obtain control over CPU Core (which is definitely adjustable) from Throttlestop as well rather than only from the utility.
Anyways, I love this forum, and I love Throttlestop and the freedom it gives you to control everything. Thank you for spending the time and reading. Any help is appreciated.
I couldnt upload the bios dump text file so here the top of the file and the relevant part of it:
Details: (open/hide by a click)
Blockquote
UEFI Protocol Detected
String Packages
Offset: Language:
0x53ED8 en-US (0x0)
0xA8EDE fr-FR (0x1)
0xAB493 zh-TW (0x2)
0xAC925 es-ES (0x3)
0xAED5A zh-CN (0x4)
0xD4F38 en-US (0x5)
0xDFAED fr-FR (0x6)
0xEAACF zh-TW (0x7)
0xEF4BF es-ES (0x8)
0xF9DCD zh-CN (0x9)
Form Sets
Offset: Title:
0xB0CB8 Advanced (0x1645 from string package 0x0)
0xD3568 Power (0x16CD from string package 0x0)
0xFF0E8 Security (0x19B from string package 0x5)
0x100778 Boot (0x1BB from string package 0x5)
0x102238 Main (0x8 from string package 0x5)
0x103758 Security (0x5A from string package 0x5)
0x104C28 Exit (0x1F5 from string package 0x5)
0x105D78 System Configuration (0x83 from string package 0x5)
0x107C78 Boot Options (0x97 from string package 0x5)
Internal Forms Representation
Offset: Instruction:
0xB0CBC Form Set: Advanced [C6D4769E-7F48-4D2A-98E9-87ADCCF35CCC], ClassGuid0 [9F85453E-2F03-4989-AD3B-4A840791AF3A] {0E A7 9E 76 D4 C6 48 7F 2A 4D 98 E9 87 AD CC F3 5C CC 45 16 30 16 01 3E 45 85 9F 03 2F 89 49 AD 3B 4A 84 07 91 AF 3A}
0xB0CE3 Guid: [0F0B1735-87A0-4193-B266-538C38AF48CE] {5F 15 35 17 0B 0F A0 87 93 41 B2 66 53 8C 38 AF 48 CE 03 01 00}
0xB0CF8 Guid: [0F0B1735-87A0-4193-B266-538C38AF48CE] {5F 15 35 17 0B 0F A0 87 93 41 B2 66 53 8C 38 AF 48 CE 04 05 00}
0xB0D0D Default Store: Standard Default, DefaultId: 0x0 {5C 06 CC 16 00 00}
0xB0D13 Default Store: , DefaultId: 0x1 {5C 06 00 00 01 00}
0xB0D19 VarStore: VarStoreId: 0x1234 [A04A27F4-DF00-4D42-B552-39511302113D], Size: 0x4B0, Name: SystemConfig {24 23 F4 27 4A A0 00 DF 42 4D B5 52 39 51 13 02 11 3D 34 12 B0 04 53 79 73 74 65 6D 43 6F 6E 66 69 67 00}
0xB0D3C VarStore: VarStoreId: 0x1233 [A04A27F4-DF00-4D42-B552-39511302113D], Size: 0x8, Name: AdvanceConfig {24 24 F4 27 4A A0 00 DF 42 4D B5 52 39 51 13 02 11 3D 33 12 08 00 41 64 76 61 6E 63 65 43 6F 6E 66 69 67 00}
0xB0D60 VarStore: VarStoreId: 0x2 [72C5E28C-7783-43A1-8767-FAD73FCCAFA4], Size: 0x22A, Name: SaSetup {24 1E 8C E2 C5 72 83 77 A1 43 87 67 FA D7 3F CC AF A4 02 00 2A 02 53 61 53 65 74 75 70 00}
0xB0D7E VarStore: VarStoreId: 0x4 [5432122D-D034-49D2-A6DE-65A829EB4C74], Size: 0x2B, Name: MeSetup {24 1E 2D 12 32 54 34 D0 D2 49 A6 DE 65 A8 29 EB 4C 74 04 00 2B 00 4D 65 53 65 74 75 70 00}
0xB0D9C VarStore: VarStoreId: 0x3 [B08F97FF-E6E8-4193-A997-5E9E9B0ADB32], Size: 0x23A, Name: CpuSetup {24 1F FF 97 8F B0 E8 E6 93 41 A9 97 5E 9E 9B 0A DB 32 03 00 3A 02 43 70 75 53 65 74 75 70 00}
0xB0DBB VarStore: VarStoreId: 0x5 [4570B7F1-ADE8-4943-8DC3-406472842384], Size: 0x6DB, Name: PchSetup {24 1F F1 B7 70 45 E8 AD 43 49 8D C3 40 64 72 84 23 84 05 00 DB 06 50 63 68 53 65 74 75 70 00}
0xB0DDA VarStore: VarStoreId: 0x6 [AAF8E719-48F8-4099-A6F7-645FBD694C3D], Size: 0x2, Name: SiSetup {24 1E 19 E7 F8 AA F8 48 99 40 A6 F7 64 5F BD 69 4C 3D 06 00 02 00 53 69 53 65 74 75 70 00}
0xB0DF8 VarStore: VarStoreId: 0x1 [EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9], Size: 0x597, Name: Setup {24 1C 43 D6 87 EC A4 EB B5 4B A1 E5 3F 3E 36 B2 0D A9 01 00 97 05 53 65 74 75 70 00}
0xB0E14 VarStoreEFI: VarStoreId: 0x7 [EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9], Attrubutes: 3, Size: 1, Name: PciBusSetup {26 26 07 00 43 D6 87 EC A4 EB B5 4B A1 E5 3F 3E 36 B2 0D A9 03 00 00 00 01 00 50 63 69 42 75 73 53 65 74 75 70 00}
0xB0E3A VarStore: VarStoreId: 0x100B [EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9], Size: 0x99, Name: SetupVolatileData {24 28 43 D6 87 EC A4 EB B5 4B A1 E5 3F 3E 36 B2 0D A9 0B 10 99 00 53 65 74 75 70 56 6F 6C 61 74 69 6C 65 44 61 74 61 00}
0xB0E62 VarStore: VarStoreId: 0x8 [E59376D7-2DD9-42A3-9EC8-1D71D5E3C1EC], Size: 0x2, Name: OsProfile {24 20 D7 76 93 E5 D9 2D A3 42 9E C8 1D 71 D5 E3 C1 EC 08 00 02 00 4F 73 50 72 6F 66 69 6C 65 00}
0xB0E82 VarStore: VarStoreId: 0x100C [EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9], Size: 0x30, Name: SetupCpuFeatures {24 27 43 D6 87 EC A4 EB B5 4B A1 E5 3F 3E 36 B2 0D A9 0C 10 30 00 53 65 74 75 70 43 70 75 46 65 61 74 75 72 65 73 00}
0xB0EA9 VarStore: VarStoreId: 0x13BD [B08F97FF-E6E8-4193-A997-5E9E9B0ADB32], Size: 0xC, Name: CpuSetupVolatileData {24 2B FF 97 8F B0 E8 E6 93 41 A9 97 5E 9E 9B 0A DB 32 BD 13 0C 00 43 70 75 53 65 74 75 70 56 6F 6C 61 74 69 6C 65 44 61 74 61 00}
0xB0ED4 VarStoreEFI: VarStoreId: 0x9 [B08F97FF-E6E8-4193-A997-5E9E9B0ADB32], Attrubutes: 3, Size: 10, Name: CpuSetupSgxEp ochData {26 2F 09 00 FF 97 8F B0 E8 E6 93 41 A9 97 5E 9E 9B 0A DB 32 03 00 00 00 10 00 43 70 75 53 65 74 75 70 53 67 78 45 70 6F 63 68 44 61 74 61 00}
0xB0F03 VarStore: VarStoreId: 0x13DC [EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9], Size: 0x1, Name: TbtSetupVolatileData {24 2B 43 D6 87 EC A4 EB B5 4B A1 E5 3F 3E 36 B2 0D A9 DC 13 01 00 54 62 74 53 65 74 75 70 56 6F 6C 61 74 69 6C 65 44 61 74 61 00}
0xB0F2E VarStore: VarStoreId: 0x1108 [5432122D-D034-49D2-A6DE-65A829EB4C74], Size: 0xD, Name: MeSetupStorage {24 25 2D 12 32 54 34 D0 D2 49 A6 DE 65 A8 29 EB 4C 74 08 11 0D 00 4D 65 53 65 74 75 70 53 74 6F 72 61 67 65 00}
0xB0F53 VarStore: VarStoreId: 0xA [64192DCA-D034-49D2-A6DE-65A829EB4C74], Size: 0x8, Name: IccAdvancedSetupDataVar {24 2E CA 2D 19 64 34 D0 D2 49 A6 DE 65 A8 29 EB 4C 74 0A 00 08 00 49 63 63 41 64 76 61 6E 63 65 64 53 65 74 75 70 44 61 74 61 56 61 72 00}
0xB0F81 Form: Advanced, FormId: 0x1 {01 86 01 00 45 16}
0xB0F87 Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 30 16 00 00 00}
0xB0F8E End {29 02}
0xB0F90 Ref: Boot Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x1, FormId: 0x21 {0F 0F 47 16 48 16 01 00 00 00 FF FF 00 21 00}
0xB0F9F Ref: Peripheral Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x2, FormId: 0x22 {0F 0F 49 16 4A 16 02 00 00 00 FF FF 00 22 00}
0xB0FAE Ref: SATA Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x3, FormId: 0x23 {0F 0F 4B 16 4C 16 03 00 00 00 FF FF 00 23 00}
0xB0FBD Ref: USB Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4, FormId: 0x26 {0F 0F 4D 16 4E 16 04 00 00 00 FF FF 00 26 00}
0xB0FCC Ref: Chipset Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x5, FormId: 0x27 {0F 0F 4F 16 50 16 05 00 00 00 FF FF 00 27 00}
0xB0FDB Ref: Debug Settings, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x6, FormId: 0x1006 {0F 0F FE 03 FE 03 06 00 00 00 FF FF 00 06 10}
0xB0FEA One Of: Type C Support, VarStoreInfo (VarOffset/VarName): 0x58E, VarStore: 0x1, QuestionId: 0x7, Size: 1, Min: 0x0, Max 0x2, Step: 0x0 {05 91 3A 0F 3B 0F 07 00 01 00 8E 05 10 10 00 02 00}
0xB0FFB One Of Option: Platform-POR, Value (8 bit): 0x0 {09 07 56 0D 00 00 00}
0xB1002 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0xB1009 One Of Option: Disabled, Value (8 bit): 0x2 (default) {09 07 04 00 30 00 02}
0xB1010 End One Of {29 02}
0xB1012 Ref: ACPI Table/Features Control, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x8, FormId: 0x28 {0F 0F 51 16 52 16 08 00 00 00 FF FF 00 28 00}
0xB1021 Ref: CPU Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x9, FormId: 0x100D {0F 0F 64 01 64 01 09 00 00 00 FF FF 00 0D 10}
0xB1030 Ref: Connectivity Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0xA, FormId: 0x13D2 {0F 0F CD 00 CE 00 0A 00 00 00 FF FF 00 D2 13}
0xB103F Ref: Power & Performance, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0xB, FormId: 0x100E {0F 0F B7 01 B7 01 0B 00 00 00 FF FF 00 0E 10}
0xB104E Suppress If {0A 82}
0xB1050 QuestionId: 0xC11 equals value 0x2 {12 06 11 0C 02 00}
0xB1056 Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0xC, FormId: 0x1013 {0F 0F D6 04 D7 04 0C 00 00 00 FF FF 00 13 10}
0xB1065 End If {29 02}
0xB1067 Ref: Memory Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0xD, FormId: 0x1028 {0F 0F E9 0F EA 0F 0D 00 00 00 FF FF 00 28 10}
0xB1076 Ref: System Agent (SA) Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0xE, FormId: 0x1029 {0F 0F E7 0F E8 0F 0E 00 00 00 FF FF 00 29 10}
0xB1085 Ref: PCH-IO Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0xF, FormId: 0x102F {0F 0F 35 06 36 06 0F 00 00 00 FF FF 00 2F 10}
0xB1094 Ref: PCH-FW Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x10, FormId: 0x103E {0F 0F 79 04 7A 04 10 00 00 00 FF FF 00 3E 10}
0xB10A3 Ref: Thermal Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x11, FormId: 0x1046 {0F 0F 0C 0E 0D 0E 11 00 00 00 FF FF 00 46 10}
0xB10B2 Suppress If {0A 82}
0xB10B4 QuestionId: 0xC1B equals value 0x1 {12 86 1B 0C 01 00}
0xB10BA Not {17 02}
0xB10BC QuestionId: 0xC1B equals value 0x5 {12 06 1B 0C 05 00}
0xB10C2 Not {17 02}
0xB10C4 And {15 02}
0xB10C6 End {29 02}
0xB10C8 Ref: Platform Settings, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x1125 {0F 0F 23 0F 24 0F 12 00 00 00 FF FF 00 25 11}
0xB10D7 End If {29 02}
0xB10D9 Ref: ACPI D3Cold settings, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x13, FormId: 0x10F3 {0F 0F 89 0F 8A 0F 13 00 00 00 FF FF 00 F3 10}
0xB10E8 Ref: Intel ICC, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x14, FormId: 0x1389 {0F 0F 5D 04 5D 04 14 00 00 00 FF FF 00 89 13}
0xB10F7 Guid: [38237648-09CC-47C4-8B5F-B09F06890DF7] {5F 94 48 76 23 38 CC 09 C4 47 8B 5F B0 9F 06 89 0D F7 07 00}
0xB110B End {29 02}
0xB110D End Form {29 02}
0xB110F Form: PCI Configuration, FormId: 0x20 {01 86 20 00 46 16}
0xB1115 Subtitle: Statement.Prompt: PCI Configuration, Flags: 0x0 {02 87 46 16 00 00 00}
0xB111C End {29 02}
0xB111E Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 30 16 00 00 00}
0xB1125 End {29 02}
0xB1127 Gray Out If {19 82}
0xB1129 QuestionId: 0xC99 equals value 0x2 {12 86 99 0C 02 00}
0xB112F QuestionId: 0xC98 equals value 0x1 {12 06 98 0C 01 00}
0xB1135 And {15 02}
0xB1137 End {29 02}
…
…
0xB576B Form: View/Configure CPU Lock Options, FormId: 0x1012 {01 86 12 10 67 01}
0xB5771 One Of: CFG Lock, VarStoreInfo (VarOffset/VarName): 0x3E, VarStore: 0x3, QuestionId: 0x16D, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 5F 03 60 03 6D 01 03 00 3E 00 10 10 00 01 00}
0xB5782 One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0xB5789 One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0xB5790 End One Of {29 02}
0xB5792 One Of: Overclocking Lock, VarStoreInfo (VarOffset/VarName): 0xDA, VarStore: 0x3, QuestionId: 0x16E, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 5B 03 5C 03 6E 01 03 00 DA 00 10 10 00 01 00}
0xB57A3 One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0xB57AA One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0xB57B1 End One Of {29 02}
0xB57B3 End Form {29 02}
…
…
Blockquote
Edit by Fernando: Thread title shortened and put the BIOS dump text file into a “spoiler” (for better readability of the post’s main content)